Skip to content

Setup for Access Management for Trino

Configure

Perform following steps to configure Trino plugin:

  1. SSH into the instance where Privacera Manager is installed.

  2. Run the following command to navigate to the /config directory and copy yml files:

    Bash
    1
2
    cd ~/privacera/privacera-manager/config
cp sample-vars/vars.trino.opensource.yml custom-vars/vars.trino.opensource.yml

  3. Modify the following properties:
    • Update the vars.trino.opensource.yml file as follows:
      YAML
      1
2
3
      TRINO_USER_HOME: "/home/trino"
TRINO_INSTALL_DIR_NAME: "/usr/lib/trino"
TRINO_CONFIG_DIR: "/etc/trino"

  4. After configuring the properties, start the connector by executing the following instructions:

    Bash
    1
2
3
    cd ~/privacera/privacera-manager
./privacera-manager.sh setup
./pm_with_helm.sh upgrade

    Run the following command to run the post install steps:

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh post-install

  5. Run the following command to copy required configuration files from the Privacera Manager output folder:

    Bash
    1
2
3
4
5
    mkdir ~/privacera-trino-plugin
cd ~/privacera-trino-plugin

cp ~/privacera/privacera-manager/output/trino-opensource/privacera_trino_setup.sh ~/privacera-trino-plugin/
cp ~/privacera/privacera-manager/output/trino-opensource/privacera_trino_plugin_conf.zip ~/privacera-trino-plugin/

Create Entrypoint.sh Script

  • Run the following command to create and edit entrypoint.sh file:

    Bash
    1
2
3
    cd ~/privacera-trino-plugin

vi entrypoint.sh

  • Add the following content in the entrypoint.sh file:

    Bash
     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
    #!/bin/bash
set -eo pipefail

set -x

TRINO_CONFIG_FILE="/etc/trino/config.properties"
# Check if the file exists
if [ ! -e "$TRINO_CONFIG_FILE" ]; then
    echo "File not found: $TRINO_CONFIG_FILE"
    exit 1
fi

# Copy the config files from the mounted volume to the trino config directory
# except jvm.config (to support trino 459 and above)
find /trino_config/ -mindepth 1 ! -name 'jvm.config' -exec cp -r {} /etc/trino/ \;
cd /home/trino/

# Check if the coordinator node and install the plugin
if grep -q "^coordinator=true$" "$TRINO_CONFIG_FILE"; then
    echo "It is a coordinator node, Installing trino plugin"
    ./privacera_trino_setup.sh
fi

# Start the trino server
/usr/lib/trino/bin/run-trino

set -- tail -f /dev/null

exec "$@"

Create Dockerfile

Create the file in the same directory as the entrypoint.sh script.

  • Run the following command to create and edit the Dockerfile:
    Bash
    1
2
3
    cd ~/privacera-trino-plugin

vi Dockerfile
  • Add the following content in the Dockerfile:
    Bash
     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
    # Define Trino version
ARG TRINO_VERSION=<trino_version>

# Use a base image to install necessary packages
FROM registry.access.redhat.com/ubi9/ubi:latest AS downloader

# Install the necessary packages
RUN dnf install -y zip findutils

# Trino base image
FROM trinodb/trino:${TRINO_VERSION}

# Set the user
USER root

## curl
RUN curl --version

## zip
COPY --from=downloader /usr/bin/zip /usr/bin/
RUN zip --version

## unzip
COPY --from=downloader /usr/bin/unzip /usr/bin/
RUN unzip

## gzip
COPY --from=downloader /usr/bin/gzip /usr/bin/
RUN gzip --version

## xargs
COPY --from=downloader /usr/bin/xargs /usr/bin/

## find
COPY --from=downloader /usr/bin/find /usr/bin/
RUN find --version

## sed
RUN sed --version

## grep
RUN grep --version

## awk
RUN awk --version

# Copy Privacera Trino Plugin configuration and setup script
COPY privacera_trino_setup.sh /home/trino
COPY privacera_trino_plugin_conf.zip /home/trino

# Set permissions and ownership
RUN chmod +x /home/trino/privacera_trino_setup.sh
RUN chown trino:trino /home/trino/privacera_trino_setup.sh
RUN chown trino:trino /home/trino/privacera_trino_plugin_conf.zip

# Create ranger directory
RUN mkdir -p /etc/ranger
RUN chown -R trino:trino /etc/ranger

# Create entrypoint directory
RUN mkdir /entrypoint

# Copy the entrypoint script
COPY entrypoint.sh /entrypoint

# Set execute permissions for the entrypoint script
RUN chmod +x /entrypoint/entrypoint.sh

# Set the entrypoint
ENTRYPOINT ["/entrypoint/entrypoint.sh"]

# Set the user
USER trino:trino

Enable Trino Application

  1. In PrivaceraCloud, navigate to Settings -> Applications.
  2. On the Applications screen, select Trino.
  3. Enter the application Name and Click Save. You can choose any name, for example, Trino.
  4. Enable the Access Management option with toggle button.
  5. Click on Save button.

Create Entrypoint.sh Script

  • Run the following command to create and edit entrypoint.sh file:

    Bash
    1
2
3
4
    mkdir ~/privacera-trino-plugin
cd ~/privacera-trino-plugin

vi entrypoint.sh

  • Add the following content in the entrypoint.sh file:

    entrypoint.sh
     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
    #!/bin/bash
set -eo pipefail

set -x

TRINO_CONFIG_FILE="/etc/trino/config.properties"
# Check if the file exists
if [ ! -e "$TRINO_CONFIG_FILE" ]; then
    echo "File not found: $TRINO_CONFIG_FILE"
    exit 1
fi

# Copy the config files from the mounted volume to the trino config directory
# except jvm.config (to support trino 459 and above)
find /trino_config/ -mindepth 1 ! -name 'jvm.config' -exec cp -r {} /etc/trino/ \;
cd /home/trino/

# Check if the coordinator node and install the plugin
if grep -q "^coordinator=true$" "$TRINO_CONFIG_FILE"; then
    echo "It is a coordinator node, Installing trino plugin"

    if [ -z "${PCLOUD_PLUGIN_SCRIPT_URL}" ]; then
        echo "ERROR: PCLOUD_PLUGIN_SCRIPT_URL is not set"
        exit 1
    fi

    curl -fSL "${PCLOUD_PLUGIN_SCRIPT_URL}" -o /home/trino/privacera_plugin.sh
    chmod +x /home/trino/privacera_plugin.sh

    ./privacera_plugin.sh
fi

# Start the trino server
/usr/lib/trino/bin/run-trino

set -- tail -f /dev/null

exec "$@"

Create Dockerfile

Create the file in the same location as the entrypoint.sh script.

  • Run the following command to create and edit Dockerfile:

    Bash
    1
2
3
    cd ~/privacera-trino-plugin

vi Dockerfile

  • Add the following content in the Dockerfile:

    Dockerfile
     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
    # Define Trino version
ARG TRINO_VERSION=<trino_version>

# Use a base image to install necessary packages
FROM registry.access.redhat.com/ubi9/ubi:latest AS downloader

# Install the necessary packages
RUN dnf install -y zip findutils

# Trino base image
FROM trinodb/trino:${TRINO_VERSION}

# Set the user
USER root

## Declare required environment variables
ENV PLUGIN_TYPE="trino"
ENV TRINO_HOME_FOLDER=/usr/lib/trino
ENV TRINO_CONFIG_DIR=/etc/trino

## curl
RUN curl --version

## zip
COPY --from=downloader /usr/bin/zip /usr/bin/
RUN zip --version

## unzip
COPY --from=downloader /usr/bin/unzip /usr/bin/
RUN unzip

## gzip
COPY --from=downloader /usr/bin/gzip /usr/bin/
RUN gzip --version

## findutils
COPY --from=downloader /usr/bin/find /usr/bin/
RUN find --version

## xargs
COPY --from=downloader /usr/bin/xargs /usr/bin/

## sed
RUN sed --version

## grep
RUN grep --version

## awk
RUN awk --version

# Create ranger directory
RUN mkdir -p /etc/ranger
RUN chown -R trino:trino /etc/ranger

# Create entrypoint directory
RUN mkdir /entrypoint

# Copy the entrypoint script
COPY entrypoint.sh /entrypoint

# Set execute permissions for the entrypoint script
RUN chmod +x /entrypoint/entrypoint.sh

# Set the entrypoint
ENTRYPOINT ["/entrypoint/entrypoint.sh"]

# Set the user
USER trino:trino

Configure the connector in Runtime and download it as a bundle. Unpack the bundle on the workstation that builds the Trino image. The image carries the setup script that installs the plugin when the coordinator starts.

Note

Runtime support for this connector is available on Self-Managed and D2P planes only.

Configure the Trino connector

  1. In the portal, open the runtime plane and go to the Connector tab. If no runtime plane exists yet, see Getting Started with Runtime Plane.

  2. Add the Trino connector and set the fields it asks for:

    Field Definition Example
    Trino distribution Engine this cluster runs. Selects the install and configuration paths below. Open Source Trino
    Trino install directory Where the engine is installed. The plugin is linked into plugin/ under this path. /usr/lib/trino
    Trino configuration directory Where the engine reads its configuration. The Ranger XML is written to ranger-conf/ under this path. /etc/trino
    Enable debug logging Off by default. Turning it on reveals the three log levels below. false

  3. Logging - only if Enable debug logging is on. For the fields and how to verify the logs afterwards, see Enable Debug Logs.

  4. Custom Properties - optional. Any key and value added here is written into the plugin's configuration, for settings this form does not expose. The key is the property name exactly as it appears there.

    For example, plugin metrics are off by default and the form does not expose them, so a deployment that scrapes them with Prometheus sets:

    Key Value Default
    TRINO_PLUGIN_METRICS_ENABLE true false
    TRINO_PLUGIN_METRICS_PROMETHEUS_LISTENER_ENABLE true false
    TRINO_PLUGIN_METRICS_PROMETHEUS_LISTENER_PORT 9090 9090

    The key must match its name in install.properties exactly. A name that is not already in that file is appended as a line nothing reads.

  5. Advanced Configuration - optional. Options this form does not carry, such as a custom service repository or deny policy dominance, are set through Custom Properties. Each page under Advanced Configuration has a Runtime tab saying which applies.

  6. Save the configuration, then download the connector bundle.

    The bundle contents depend on the plane, because certificates are shipped only where the plugin needs them:

    Plane Bundle contents
    Self-Managed trust3ai_trino_plugin_<connector>_<version>.sh and privacera_trino_plugin_conf.zip
    D2P trust3ai_trino_plugin_<connector>_<version>.sh only

Unpack the bundle

Perform these steps on the workstation where the Trino image is built.

  1. Create the build folder and unpack the bundle into a trust3ai_plugin/ sub-folder. The Dockerfile copies that whole folder, so the same file works whether or not the plane ships a configuration zip.

    Bash
    1
2
3
    mkdir -p ~/privacera-trino-plugin
cd ~/privacera-trino-plugin
unzip trust3ai_trino_plugin_*_bundle.zip -d trust3ai_plugin

  2. Confirm the contents. The Dockerfile and entrypoint.sh created below belong beside trust3ai_plugin/, not inside it.

    Bash
    1
2
    ls trust3ai_plugin
# trust3ai_trino_plugin_<connector>_<version>.sh   privacera_trino_plugin_conf.zip

    On a D2P plane the zip is absent and only the script is listed. That is expected - the Dockerfile copies whatever the folder holds.

  3. Rename the setup script to a fixed name. The downloaded name carries the connector and version, so renaming it keeps the Dockerfile and entrypoint.sh unchanged from one bundle to the next.

    Bash
    1
2
3
    cd ~/privacera-trino-plugin/trust3ai_plugin
mv trust3ai_trino_plugin_*.sh privacera_trino_setup.sh
cd ..

Create Entrypoint.sh Script

Create entrypoint.sh in the same folder, with the following content.

Bash
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
#!/bin/bash
set -eo pipefail

set -x

TRINO_CONFIG_FILE="/etc/trino/config.properties"
# Check if the file exists
if [ ! -e "$TRINO_CONFIG_FILE" ]; then
    echo "File not found: $TRINO_CONFIG_FILE"
    exit 1
fi

# Copy the config files from the mounted volume to the trino config directory
# except jvm.config (to support trino 459 and above)
find /trino_config/ -mindepth 1 ! -name 'jvm.config' -exec cp -r {} /etc/trino/ \;
cd /home/trino/

# Check if the coordinator node and install the plugin
if grep -q "^coordinator=true$" "$TRINO_CONFIG_FILE"; then
    echo "It is a coordinator node, Installing trino plugin"
    ./privacera_trino_setup.sh
fi

# Start the trino server
/usr/lib/trino/bin/run-trino

set -- tail -f /dev/null

exec "$@"

Create Dockerfile

Create the file in the same directory as the entrypoint.sh script.

Bash
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
# Define Trino version
ARG TRINO_VERSION=<trino_version>

# Use a base image to install necessary packages
FROM registry.access.redhat.com/ubi9/ubi:latest AS downloader

# Install the necessary packages
RUN dnf install -y zip findutils

# Trino base image
FROM trinodb/trino:${TRINO_VERSION}

# Set the user
USER root

## curl
RUN curl --version

## zip
COPY --from=downloader /usr/bin/zip /usr/bin/
RUN zip --version

## unzip
COPY --from=downloader /usr/bin/unzip /usr/bin/
RUN unzip

## gzip
COPY --from=downloader /usr/bin/gzip /usr/bin/
RUN gzip --version

## xargs
COPY --from=downloader /usr/bin/xargs /usr/bin/

## find
COPY --from=downloader /usr/bin/find /usr/bin/
RUN find --version

## sed
RUN sed --version

## grep
RUN grep --version

## awk
RUN awk --version

# Self-Managed: privacera_trino_setup.sh and privacera_trino_plugin_conf.zip are copied
# D2P: only privacera_trino_setup.sh is copied
COPY trust3ai_plugin/ /home/trino/

# Set permissions and ownership
RUN chmod +x /home/trino/privacera_trino_setup.sh
RUN chown -R trino:trino /home/trino

# Create ranger directory
RUN mkdir -p /etc/ranger
RUN chown -R trino:trino /etc/ranger

# Spool directory
RUN mkdir -p /var/log/trino
RUN chown -R trino:trino /var/log/trino

# Create entrypoint directory
RUN mkdir /entrypoint

# Copy the entrypoint script
COPY entrypoint.sh /entrypoint

# Set execute permissions for the entrypoint script
RUN chmod +x /entrypoint/entrypoint.sh

# Set the entrypoint
ENTRYPOINT ["/entrypoint/entrypoint.sh"]

# Set the user
USER trino:trino

Build the Docker Image

  • Run the following command to build the Docker image:
    Bash
    1
    docker build -t privacera-trino:latest .

Push the Docker Image to the Remote Hub

  • Use your internal HUB to publish the image.

Create a Namespace

  • Run the following command to create a namespace.
    Bash
    1
    kubectl create namespace <TRINO_NAMESPACE>

Create Kubernetes secret

Applicable only for PrivaceraCloud and Data Plane deployments. Not required for Runtime (Self-Managed or D2P) deployments.

  • Obtain the PCLOUD_PLUGIN_SCRIPT_URL from PrivaceraCloud → Settings → API Keys:
    1. Click the ℹ️ icon next to an existing key (or generate a new key first) to open API Key Info.
    2. Locate the Plugin Setup Script row and click COPY URL.
    3. The copied URL contains the placeholder __API_KEY__. Replace it with the actual API key value — the one shown once in the Generated API Key dialog when the key was created. If you no longer have that value, generate a new API key and use it here.
  • Create a Kubernetes secret for the Privacera plugin setup script URL. Run the following command:
    Bash
    1
2
    kubectl -n <TRINO_NAMESPACE> create secret generic privacera-api-key-secret \
--from-literal=PCLOUD_PLUGIN_SCRIPT_URL="<PCLOUD_PLUGIN_SCRIPT_URL>"

Create Docker Image Secret

  • To create an image secret, Use and run the command according to your requirements.

Add the Trino Helm Chart Repository

  • Run the following command to add the Trino Helm chart repository:
    Bash
    1
    helm repo add trino https://trinodb.github.io/charts/

Create YAML Deployment File to Override the Default Values

  • Run the following command to create and edit the values.yaml file:

    Bash
    1
2
3
    cd ~/privacera-trino-plugin

vi values.yaml

  • Add the following content to the values.yaml file based on deployment environment:

    values.yaml
     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
    image:
    repository: <TRINO_IMAGE_REPOSITORY>
    pullPolicy: Always
    # Overrides the image tag whose default is the chart version.
    # Same value as Chart.yaml#appVersion
    tag: <TRINO_IMAGE_TAG>


# Optional
imagePullSecrets:
  - name: <TRINO_IMAGE_PULL_SECRET_NAME>

server:
  workers: 1
  config:
    path: /trino_config

service:
  host: "trino"
    values.yaml
     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
    image:
    repository: <TRINO_IMAGE_REPOSITORY>
    pullPolicy: Always
    # Overrides the image tag whose default is the chart version.
    # Same value as Chart.yaml#appVersion
    tag: <TRINO_IMAGE_TAG>


# Optional
imagePullSecrets:
  - name: <TRINO_IMAGE_PULL_SECRET_NAME>

env:
  - name: PCLOUD_PLUGIN_SCRIPT_URL
    valueFrom:
      secretKeyRef:
        name: privacera-api-key-secret
        key: PCLOUD_PLUGIN_SCRIPT_URL

server:
  workers: 1
  config:
    path: /trino_config

service:
  host: "trino"
    values.yaml
     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
    image:
    repository: <TRINO_IMAGE_REPOSITORY>
    pullPolicy: Always
    # Overrides the image tag whose default is the chart version.
    # Same value as Chart.yaml#appVersion
    tag: <TRINO_IMAGE_TAG>


# Optional
imagePullSecrets:
  - name: <TRINO_IMAGE_PULL_SECRET_NAME>

server:
  workers: 1
  config:
    path: /trino_config

service:
  host: "trino"

Install Trino on Kubernetes Cluster

  • Run the following command to install Trino on the Kubernetes cluster:
    Bash
    1
    helm install -f values.yaml privacera-trino-cluster trino/trino --namespace=<TRINO_NAMESPACE>