Configure Starburst (Trino) Integration

This page details how to configure the Starburst (Trino) integration.

Overview

The plugin comes pre-installed with Starburst Enterprise, so this page provides separate sets of guidelines for configuration:

• Starburst Cluster Configuration: These instructions are specific to Starburst Enterprise clusters.
• Trino Cluster Configuration: These instructions are specific to open-source Trino clusters.

Starburst Cluster Configuration

Prerequisite

The Starburst ODBC driver must be uploaded on the App Settings page.

1 - Enable the Integration

1. Click the App Settings icon in the left sidebar.
2. Scroll to the Native Integrations section and click Add Native Integration.
3. Select Trino from the Native Integration Type dropdown menu.
4. Click Save.

2 - Configure the Immuta Connector

1. Create a configuration file immuta.properties with the following contents in the etc/catalog folder:

   connector.name=immuta
   immuta.endpoint=https://your-immuta-url.com/
   immuta.apikey=<your-api-key>
   

For more details, see Starburst's Event Listener documentation.

3 - Configure the Event Listener

1. Create an etc/event-listener.properties file in the same etc/catalog folder.

2. Copy the Event Listener Configuration items from the App Settings page and paste it in the event-listener.properties file:

   

For more details, see Starburst's Event Listener documentation.

4 - Configure Starburst to Block Access

Follow Starburst's System Access Control documentation to configure Starburst to block access to any catalog that is not Immuta so that all user access has policies enacted on it.

Trino Cluster Configuration

1 - Enable the Integration

1. Click the App Settings icon in the left sidebar.
2. Scroll to the Native Integrations section and click Add Native Integration.
3. Select Trino from the Native Integration Type dropdown menu.
4. Click Save.

The catalog configuration displayed in this section will need to be written out on all nodes (/etc/trino/config/catalog/immuta.properties).

2 - Enable Immuta on Your Cluster

1. Use the table on the Starburst (Trino) Installation Introduction page to determine the version of the plugin you should download.

2. Enable Immuta on your cluster. Select the tab below that corresponds to your installation method for instructions:

   Docker (Trino 413 and older)Docker (Trino 414 and newer)Standalone installations

   Docker installations for Trino versions 413 and older

   1. Download the plugin from Immuta's Archives site.
   2. Follow Trino's documentation to install the plugin archive on all nodes in your cluster.
   3. Extract the archive to a local directory and mount the local directory to /usr/lib/trino/plugin/immuta in the Docker container.
   4. Install the plugin on all nodes within your cluster.

   Docker installations for Trino versions 414 and newer

   For Trino versions 414 and newer, you can use the immuta-trino Docker image (which includes the Trino plugin jars) from https://registry.immuta.com instead of the trinodb/trino Docker image.

   1. Pull the image and start the container. The example below specifies the Immuta Trino plugin version 414 with the 414 tag, but any supported Trino version newer than 414 can be used:

      docker run registry.immuta.com/immuta/immuta-trino:414
      

   2. Extract the archive to a local directory and mount the local directory to /usr/lib/trino/plugin/immuta in the Docker container.

   Standalone installations

   1. Download the plugin from Immuta's Archives site.
   2. Follow Trino's documentation to install the plugin archive on all nodes in your cluster.
   3. Extract the archive to the plugin/immuta directory in the Trino installation directory.
   4. Install the plugin on all nodes within your cluster.

3 - Configure the Immuta Connector

1. Follow Trino's documentation to create this catalog directory: /etc/trino/config/catalog.

2. To configure the Immuta connector, mount the Immuta connector as the Immuta catalog: Create an immuta.properties file with the following contents, replacing the connection properties with your Trino Cluster Configuration displayed on the App Settings page:

   connector.name=immuta
   immuta.endpoint=https://your-immuta-url.com/
   immuta.apikey=<your-api-key>
   

TLS Certificates

The Starburst (Trino) integration uses the immuta.ca-file property to communicate with Immuta. Specify a path to your CA file using the immuta.ca-file property.

Optional Parameters

You can include any of these parameters in your immuta.properties file to customize your integration.

• immuta.ca-data The base64-encoded CA certificate to use when making calls to the Immuta Web Service.
• immuta.ca-file: The path to a CA file to use when making calls to the Immuta Web Service.
• immuta.cache.audit.seconds: The amount of time in seconds audit-related query metadata should be cached in the Immuta Metadata Database. If you customize this value, it should be set to a value longer than the longest running query you plan to execute against the Immuta catalog (The default is 24 hours.).
• immuta.cache.datasources.seconds: The amount of time in seconds a user's available data sources will be cached. Changing this will impact how quickly available data sources will show up when updating projects or subscriptions.
• immuta.cache.views.seconds: The amount of time in seconds that a user's view of a data source will be cached. Changing this will impact how quickly policy changes are reflected for users actively querying.
• immuta.disable-hostname-verification: Disable hostname verification when connecting to the Immuta Web Service.
• immuta.error-on-audit-failure: When set to true, error out when an Immuta audit record can not be created. Only used when the Event Listener is enabled.

4 - Configure the Event Listener

1. Create an event-listener.properties file in this directory: /etc/trino/. For more details, see Trino's Event Listener documentation.

2. Copy the Event Listener Configuration items from the App Settings page and paste it in the event-listener.properties file:

   

5 - Configure Trino to Block Access

Follow Trino's System Access Control documentation to configure Trino to block access to any catalog that is not Immuta so that all user access has policies enacted on it.