Privacera Platform

Go to the privacera-manager folder in your virtual machine. Open the config folder, copy the sample vars.dataserver.azure.yml file to the custom-vars/ folder, and edit it.

cd ~/privacera/privacera-manager
cp config/sample-vars/vars.dataserver.azure.yml config/custom-vars/
vi custom-vars/vars.dataserver.azure.yml

Edit the Azure-related information. For property details and description, click here.

1. If you want to use Azure CLI, use the following properties:

   ENABLE_AZURE_CLI: "true"
   AZURE_GEN2_SHARED_KEY_AUTH: "true"
   AZURE_ACCOUNT_NAME: "<PLEASE_CHANGE>"
   AZURE_SHARED_KEY: "<PLEASE_CHANGE>"
   

2. If you want to access multiple Azure storage accounts with shared key authentication, use the following properties:

   AZURE_GEN2_SHARED_KEY_AUTH: "true"
   AZURE_ACCT_SHARED_KEY_PAIRS: "<PLEASE_CHANGE>"
   

   Note

   Configuring AZURE_GEN2_SHARED_KEY_AUTH property allows you to access the resources in the Azure accounts only through the File Explorer in Privacera Portal.

3. If you want to access multiple azure storage accounts with OAuth application based authentication, use the following property:

   AZURE_GEN2_SHARED_KEY_AUTH: "false"
   AZURE_TENANTID: "<PLEASE_CHANGE>"
   AZURE_SUBSCRIPTION_ID: "<PLEASE_CHANGE>"
   AZURE_RESOURCE_GROUP: "<PLEASE_CHANGE>"
   DATASERVER_AZURE_APP_CLIENT_CONFIG_LIST:
    - index: 0
      clientId: "<PLEASE_CHANGE>"
      clientSecret: "<PLEASE_CHANGE>"
      storageAccName: "<PLEASE_CHANGE>"

   Note

   Configuring AZURE_GEN2_SHARED_KEY_AUTH property allows you to access the resources in the Azure accounts only through the File Explorer in Privacera Portal.

   Note

   You can also add custom properties that are not included by default. See Dataserver.

Run the following command.

cd ~/privacera/privacera-manager
./privacera-manager.sh update

Login to Privacera Portal, as a portal administrator, open Data Inventory: Data Explorer, and attempt to view the targeted ADLS files or folders. The data will be hidden and a Denied status will be registered in the Audit page.

In Privacera Portal, open Access Management: Resource Policies. Open System 'ADLS' and 'application' (data repository) 'privacera_adls'. Create or modify an access policy to allow access to some or all of your ADLS storage.

Return to Data Inventory: Data Explorer and re-attempt to view the data as allowed by your new policy or policy change. Repeat step 1.

You should be able to view files or folders in the account, and an Allowed status will be registered in the Audit page.

On the Privacera Portal page, expand Access Management and click the Auditfrom the left menu.

The Audit page will be displayed with Ranger Audit details.

Run the following command to enable Privacera UserSync:

cd ~/privacera/privacera-manager 
cp config/sample-vars/vars.privacera-usersync.yml config/custom-vars/

Enable the LDAP connector:

cd ~/privacera/privacera-manager 
cp config/sample-vars/vars.privacera-usersync.ldap.yml config/custom-vars/ 
vi config/custom-vars/vars.privacera-usersync.ldap.yml

Edit the following properties:

Run the following command:

cd ~/privacera/privacera-manager 
./privacera-manager.sh update

Run the following command to enable Privacera UserSync:

cd ~/privacera/privacera-manager 
cp config/sample-vars/vars.privacera-usersync.yml config/custom-vars/

Enable the AAD connector:

cd ~/privacera/privacera-manager 
cp config/sample-vars/vars.privacera-usersync.azuread.yml config/custom-vars/ 
vi config/custom-vars/vars.privacera-usersync.azuread.yml

Edit the following properties:

Run the following command:

cd ~/privacera/privacera-manager 
./privacera-manager.sh update

Run the following command to enable Privacera UserSync:

cd ~/privacera/privacera-manager 
cp config/sample-vars/vars.privacera-usersync.yml config/custom-vars/

Enable the SCIM connector:

cd ~/privacera/privacera-manager 
cp config/sample-vars/vars.privacera-usersync.scim.yml config/custom-vars/ 
vi config/custom-vars/vars.privacera-usersync.scim.yml

Edit the following properties:

Run the following command:

cd ~/privacera/privacera-manager ./privacera-manager.sh update

Run the following command to enable Privacera UserSync:

cd ~/privacera/privacera-manager 
cp config/sample-vars/vars.privacera-usersync.yml config/custom-vars/

Enable the SCIM Server connector:

cd ~/privacera/privacera-manager 
cp config/sample-vars/vars.privacera-usersync.scimserver.yml config/custom-vars/ 
vi config/custom-vars/vars.privacera-usersync.scimserver.yml

Edit the following properties:

If NGINX Ingress is Enabled, and NGINX controller is running on Internal LB, ensure to disable the ingress for Usersync so that it can pick a Public/Internet facing LB by adding the below variable:

vi config/custom-vars/vars.kubernetes.nginx-ingress.yml

PRIVACERA_USERSYNC_K8S_NGINX_INGRESS_ENABLE: “false”

Run the following command:

cd ~/privacera/privacera-manager 
./privacera-manager.sh update

Run the following command to enable Privacera UserSync:

cd ~/privacera/privacera-manager 
cp config/sample-vars/vars.privacera-usersync.yml config/custom-vars/

Enable the OKTA connector:

cd ~/privacera/privacera-manager 
cp config/sample-vars/vars.privacera-usersync.okta.yml config/custom-vars/ 
vi config/custom-vars/vars.privacera-usersync.okta.yml

Edit the following properties:

Run the following command:

cd ~/privacera/privacera-manager 
./privacera-manager.sh update

SSH to instance as ${USER}.

Run the following commands. See Access Manager LDAP-related properties and descriptions.

USERSYNC_SYNC_LDAP_URL: "<PLEASE_CHANGE>"
USERSYNC_SYNC_LDAP_BIND_DN: "<PLEASE_CHANGE>"
USERSYNC_SYNC_LDAP_BIND_PASSWORD: "<PLEASE_CHANGE>"
USERSYNC_SYNC_LDAP_SEARCH_BASE: "<PLEASE_CHANGE>"
USERSYNC_SYNC_LDAP_USER_SEARCH_BASE: "<PLEASE_CHANGE>"
USERSYNC_SYNC_LDAP_SSL_ENABLED: "true"
USERSYNC_SYNC_LDAP_SSL_PM_GEN_TS: "true"

Run Privacera Manager update.

cd ~/privacera/privacera-manager
./privacera-manager.sh update

SSH to the instance as ${USER}.

Run the following commands.

cd ~/privacera/privacera-manager
cp config/sample-vars/vars.usersync.azuread.yml config/custom-vars/
vi config/custom-vars/vars.usersync.azuread.yml

Edit the following properties. For property details and description, refer to the Configuration Properties below.

USERSYNC_AZUREAD_TENANT_ID: "<PLEASE_CHANGE>"
USERSYNC_AZUREAD_CLIENT_ID: "<PLEASE_CHANGE>"
USERSYNC_AZUREAD_CLIENT_SECRET: "<PLEASE_CHANGE>"
USERSYNC_AZUREAD_DOMAINS: "<PLEASE_CHANGE>"
USERSYNC_AZUREAD_GROUPS: "<PLEASE_CHANGE>"
USERSYNC_ENABLE: "true"
USERSYNC_SOURCE: "azuread"
USERSYNC_AZUREAD_USE_GROUP_LOOKUP_FIRST: "true"
USERSYNC_SYNC_AZUREAD_USERNAME_RETRIVAL_FROM: "userPrincipalName"
USERSYNC_SYNC_AZUREAD_EMAIL_RETRIVAL_FROM: "userPrincipalName"
USERSYNC_SYNC_AZUREAD_GROUP_RETRIVAL_FROM: "displayName"
SYNC_AZUREAD_USER_SERVICE_PRINCIPAL_ENABLED: "false"
SYNC_AZUREAD_USER_SERVICE_PRINCIPAL_USERNAME_RETRIVAL_FROM: "appId"

Run the following commands.

cd ~/privacera/privacera-manager
./privacera-manager.sh update

SSH to the instance as USER.

Run the following commands.

cd ~/privacera/privacera-manager
cp config/sample-vars/vars.spark-standalone.yml config/custom-vars/
vi config/custom-vars/vars.spark-standalone.yml

Edit the following properties. For property details and description, refer to the Configuration Properties below.

SPARK_STANDALONE_ENABLE:"true"
SPARK_ENV_TYPE:"<PLEASE_CHANGE>"
SPARK_HOME:"<PLEASE_CHANGE>"
SPARK_USER_HOME:"<PLEASE_CHANGE>"

Run the following commands.

cd ~/privacera/privacera-manager
./privacera-manager.sh update

After the update is complete, the setup script (privacera_setup.sh, standalone_spark_FGAC.sh, standalone_spark_OLAC.sh) and Spark custom configurations (spark_custom_conf.zip) for SSL will be generated at the path, cd ~/privacera/privacera-manager/output/spark-standalone.

You can either enable FGAC or OLAC in your Spark environment.

Enable FGAC

To enable Fine-grained access control (FGAC), do the following:

Enable OLAC

To enable Object level access control (OLAC), do the following:

Create an S3 bucket ${S3_BUCKET} for sample testing.

Download sample data using the following link and put it in the ${S3_BUCKET} at location (s3://${S3_BUCKET}/customer_data).

wget https://privacera-demo.s3.amazonaws.com/data/uploads/customer_data_clear/customer_data_without_header.csv

(Optional) Add AWS JARS in Spark. Download the JARS according to the version of Spark Hadoop in your environment.

cd  <SPARK_HOME>/jars

For Spark-3.1.1 - Hadoop 3.2 version,

wget https://repo1.maven.org/maven2/org/apache/hadoop/hadoop-aws/3.2.0/hadoop-aws-3.2.0.jar
wget https://repo1.maven.org/maven2/com/amazonaws/aws-java-sdk-bundle/1.11.375/aws-java-sdk-bundle-1.11.375.jar

Run the following command.

cd <SPARK_HOME>/bin

Run the spark-shell to execute scala commands.

./spark-shell

Run the following command.

cd <SPARK_HOME>/bin

Set the JWT_TOKEN.

JWT_TOKEN="<JWT_TOKEN>"

Run the following command to start spark-shell with parameters.

./spark-shell --conf "spark.hadoop.privacera.jwt.token.str=${JWT_TOKEN}"  --conf "spark.hadoop.privacera.jwt.oauth.enable=true"

Create a local file with the public key, if the JWT token is generated by private/public key combination.

Set the following according to the payload of JWT Token.

JWT_TOKEN="<JWT_TOKEN>"
#The following variables are optional, set it only if token has it else set it empty
JWT_TOKEN_ISSUER="<JWT_TOKEN_ISSUER>"
JWT_TOKEN_PUBLIC_KEY_FILE="<JWT_TOKEN_PUBLIC_KEY_FILE_PATH>"
JWT_TOKEN_USER_KEY="<JWT_TOKEN_USER_KEY>"
JWT_TOKEN_GROUP_KEY="<JWT_TOKEN_GROUP_KEY>"
JWT_TOKEN_PARSER_TYPE="<JWT_TOKEN_PARSER_TYPE>"

Run the following command to start spark-shell with parameters.

./spark-shell 
--conf "spark.hadoop.privacera.jwt.token.str=${JWT_TOKEN}" 
--conf "spark.hadoop.privacera.jwt.oauth.enable=true" 
--conf "spark.hadoop.privacera.jwt.token.publickey=${JWT_TOKEN_PUBLIC_KEY_FILE}" 
--conf "spark.hadoop.privacera.jwt.token.issuer=${JWT_TOKEN_ISSUER}"
--conf "spark.hadoop.privacera.jwt.token.parser.type=${JWT_TOKEN_PARSER_TYPE}" 
--conf "spark.hadoop.privacera.jwt.token.userKey=${JWT_TOKEN_USER_KEY}" 
--conf "spark.hadoop.privacera.jwt.token.groupKey=${JWT_TOKEN_GROUP_KEY}"

Add a policy in Access Manager with read permission to ${S3_BUCKET}.

val file_path = "s3a://${S3_BUCKET}/customer_data/customer_data_without_header.csv"
val df=spark.read.csv(file_path)
df.show(5)

Add a policy in Access Manager with delete and write permission to ${S3_BUCKET}.

df.write.format("csv").mode("overwrite").save("s3a://${S3_BUCKET}/csv/customer_data.csv")

SSH to the instance as USER.

Run the following commands.

cd ~/privacera/privacera-manager
cp config/sample-vars/vars.spark-standalone.yml config/custom-vars/
vi config/custom-vars/vars.spark-standalone.yml

Edit the following properties. For property details and description, refer to the Configuration Properties below.

SPARK_STANDALONE_ENABLE:"true"
SPARK_ENV_TYPE:"<PLEASE_CHANGE>"
SPARK_HOME:"<PLEASE_CHANGE>"
SPARK_USER_HOME:"<PLEASE_CHANGE>"

Run the following commands:

cd ~/privacera/privacera-manager
./privacera-manager.sh update

After the update is complete, the Spark custom configuration (spark_custom_conf.zip) for SSL will be generated at the path, cd ~/privacera/privacera-manager/output/spark-standalone.

Create the Spark Docker Image

1. Run the following commands to export PRIVACERA_BASE_DOWNLOAD_URL:

   exportPRIVACERA_BASE_DOWNLOAD_URL=<PRIVACERA_BASE_DOWNLOAD_URL>
   

2. Create a folder.

   mkdir -p ~/privacera-spark-plugin
   cd ~/privacera-spark-plugin
   

3. Download and extract package using wget.

   wget ${PRIVACERA_BASE_DOWNLOAD_URL}/spark-plugin/k8s-spark-pkg.tar.gz -O k8s-spark-pkg.tar.gz
   tar xzf k8s-spark-pkg.tar.gz
   rm -r k8s-spark-pkg.tar.gz
   

4. Copy spark_custom_conf.zip file from the Privacera Manager output folder into the files folder.

   cp ~/privacera/privacera-manager/output/spark-standalone/spark_custom_conf.zip files/spark_custom_conf.zip
   

5. You can either built OLAC Docker image or FGAC Docker image.

   OLAC

   To built the OLAC Docker image, use the following command:

   ./build_image.sh ${PRIVACERA_BASE_DOWNLOAD_URL} OLAC
   

   FGAC

   To built the FGAC Docker image, use the following command:

   ./build_image.sh ${PRIVACERA_BASE_DOWNLOAD_URL} FGAC
   

Test the Spark Docker image.

1. Create a S3 bucket ${S3_BUCKET} for sample testing.

2. Download sample data using the following link and put it in the ${S3_BUCKET} at location (s3://${S3_BUCKET}/customer_data).

   wget https://privacera-demo.s3.amazonaws.com/data/uploads/customer_data_clear/customer_data_without_header.csv
   

3. Start Docker in an interactive mode.

   IMAGE=privacera-spark-plugin:latest
   docker run  --rm -i -t ${IMAGE} bash
   

4. Start spark-shell inside the Docker container.

   JWT_TOKEN="<PLEASE_CHANGE>"
   cd /opt/privacera/spark/bin
   ./spark-shell \
   --conf "spark.hadoop.privacera.jwt.token.str=${JWT_TOKEN}"\
   --conf "spark.hadoop.privacera.jwt.oauth.enable=true"

5. Run the following command to read the S3 file:

   val df= spark.read.csv("s3a://${S3_BUCKET}/customer_data/customer_data_without_header.csv")

6. Exit the Docker shell.

   exit

Publish the Spark Docker Image into your Docker Registry.

HUB=<PLEASE_CHANGE>
HUB_USERNAME=<PLEASE_CHANGE>
HUB_PASSWORD=<PLEASE_CHANGE>
ENV_TAG=<PLEASE_CHANGE>
DEST_IMAGE=${HUB}/privacera-spark-plugin:${ENV_TAG}
SOURCE_IMAGE=privacera-spark-plugin:latest
docker login -u ${HUB_USERNAME} -p ${HUB_PASSWORD}${HUB}
docker tag ${SOURCE_IMAGE}${DEST_IMAGE}
docker push ${DEST_IMAGE}

Deploy Spark Plugin on EKS cluster.

1. SSH to EKS cluster where you want to deploy Spark on EKS cluster.

2. Run the following commands to export PRIVACERA_BASE_DOWNLOAD_URL:

   exportPRIVACERA_BASE_DOWNLOAD_URL=<PRIVACERA_BASE_DOWNLOAD_URL>
   

3. Create a folder.

   mkdir ~/privacera-spark-plugin
   cd ~/privacera-spark-plugin
   

4. Download and extract package using wget.

   wget ${PRIVACERA_DOWNLOAD_URL}/plugin/spark/k8s-spark-deploy.tar.gz -O k8s-spark-deploy.tar.gz
   tar xzf k8s-spark-deploy.tar.gz
   rm -r k8s-spark-deploy.tar.gz
   cd k8s-spark-deploy/
   

5. Open penv.sh file and substitute the values of the following properties, refer to the table below:

   Property	Description	Example
   SPARK_NAME_SPACE	Kubernetes namespace	privacera-spark-plugin-test
   SPARK_PLUGIN_ROLE_BINDING	Spark role Binding	privacera-sa-spark-plugin-role-binding
   SPARK_PLUGIN_SERVICE_ACCOUNT	Spark services account	privacera-sa-spark-plugin
   SPARK_PLUGN_ROLE	Spark services account role	privacera-sa-spark-plugin-role
   SPARK_PLUGIN_APP_NAME	Spark services account role	privacera-sa-spark-plugin-role
   SPARK_PLUGIN_IMAGE	Docker image with hub	myhub.docker.com}/privacera-spark-plugin:prod-olac
   SPARK_DOCKER_PULL_SECRET	Secret for docker-registry	spark-plugin-docker-hub

6. Run the following command to replace the properties value in the Kubernetes deployment .yml file:

   mkdir -p backup
   cp *.yml backup/
   ./replace.sh
   

7. Run the following command to create Kubernetes resources:

   kubectl apply -f namespace.yml
   kubectl apply -f service-account.yml
   kubectl apply -f role.yml
   kubectl apply -f role-binding.yml
   

8. Run the following command to create secret for docker-registry:

   kubectl create secret docker-registry spark-plugin-docker-hub --docker-server=<PLEASE_CHANGE> --docker-username=<PLEASE_CHANGE>  --docker-password='<PLEASE_CHANGE>' --namespace=<PLEASE_CHANGE>
   

9. Run the following command to deploy a sample Spark application:

   Note

   This is an sample file used for deployment. As per your use case, you can create Spark deployment file and deploy a Docker image.

   kubectl apply -f privacera-spark-examples.yml -n ${SPARK_NAME_SPACE}

   This will deploy spark application in Kubernetes pod with Privacera plugin and it will keep the pod running, so that you can use it in interactive mode.

Get all the resources.

kubectl get all -n ${SPARK_NAME_SPACE}

Copy POD ID that you will need for spark-master connection.

Get the cluster info.

kubectl cluster-info

Copy Kubernetes control plane URL from the above output that we need during spark-shell command, for example ( https://xxxxxxxxxxxxxxxxxxxxxxx.yl4.us-east-1.eks.amazonaws.com).

When using the URL for EKS_SERVER property in step 4, prefix the property value with k8s://. The following is an example of the property:

EKS_SERVER="k8s://https://xxxxxxxxxxxxxxxxxxxxxxx.yl4.us-east-1.eks.amazonaws.com"

Connect to Kubernetes master node.

kubectl -n ${SPARK_NAME_SPACE}exec -it  <POD_ID>  -- bash

Set the following properties:

SPARK_NAME_SPACE="<PLEASE_CHANGE>"
SPARK_PLUGIN_SERVICE_ACCOUNT="<PLEASE_CHANGE>"
SPARK_PLUGIN_IMAGE="<PLEASE_CHANGE>"
SPARK_DOCKER_PULL_SECRET="spark-plugin-docker-hub"
EKS_SERVER="<PLEASE_CHANGE>"
JWT_TOKEN="<PLEASE_CHANGE>"

Run the following commands to open spark-shell. The command contains all the setup which is required to open the spark-shell.

cd /opt/privacera/spark/bin
./spark-shell --master ${EKS_SERVER}\
--deploy-mode client \
--conf spark.kubernetes.authenticate.serviceAccountName=${SPARK_PLUGIN_SERVICE_ACCOUNT}\
--conf spark.kubernetes.namespace=${SPARK_NAME_SPACE}\
--conf spark.kubernetes.authenticate.submission.caCertFile=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt \
--conf spark.kubernetes.authenticate.submission.oauthTokenFile=/var/run/secrets/kubernetes.io/serviceaccount/token \
--conf spark.kubernetes.authenticate.driver.serviceAccountName=${SPARK_PLUGIN_SERVICE_ACCOUNT}\
--conf spark.kubernetes.container.image=${SPARK_PLUGIN_IMAGE}\
--conf spark.kubernetes.container.image.pullPolicy=Always \
--conf spark.kubernetes.container.image.pullSecrets=${SPARK_DOCKER_PULL_SECRET}\
--conf "spark.hadoop.privacera.jwt.token.str=${JWT_TOKEN}"\
--conf "spark.hadoop.privacera.jwt.oauth.enable=true"\
--conf spark.driver.bindAddress='0.0.0.0'\
--conf spark.driver.host=$SPARK_PLUGIN_POD_IP\
--conf spark.port.maxRetries=4\
--conf spark.kubernetes.driver.pod.name=$SPARK_PLUGIN_POD_NAME

Run the following command using spark-submit with JWT authentication.

./spark-submit \
--master ${EKS_SERVER}\
--name spark-cloud-new \
--deploy-mode cluster \
--conf spark.kubernetes.authenticate.serviceAccountName=${SPARK_PLUGIN_SERVICE_ACCOUNT}\
--conf spark.kubernetes.namespace=${SPARK_NAME_SPACE}\
--conf spark.kubernetes.authenticate.submission.caCertFile=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt \
--conf spark.kubernetes.authenticate.submission.oauthTokenFile=/var/run/secrets/kubernetes.io/serviceaccount/token \
--conf spark.kubernetes.authenticate.driver.serviceAccountName=${SPARK_PLUGIN_SERVICE_ACCOUNT}\
--conf spark.kubernetes.container.image=${SPARK_PLUGIN_IMAGE}\
--conf spark.kubernetes.container.image.pullPolicy=Always \
--conf spark.kubernetes.container.image.pullSecrets=${SPARK_DOCKER_PULL_SECRET}\
--conf "spark.hadoop.privacera.jwt.token.str=${JWT_TOKEN}"\
--conf spark.driver.bindAddress='0.0.0.0'\
--conf spark.driver.host=$SPARK_PLUGIN_POD_IP\
--conf spark.port.maxRetries=4\
--conf spark.kubernetes.driver.pod.name=$SPARK_PLUGIN_POD_NAME\
--class com.privacera.spark.poc.SparkSample \
<your-code-jar/file>

To check the read access on the S3 file, run the following command in the open spark-shell:

val df= spark.read.csv("s3a://${S3_BUCKET}/customer_data/customer_data_without_header.csv")
df.show()

To check the write access on the S3 file, run the following command in the open spark-shell:

df.write.format("csv").mode("overwrite").save("s3a://${S3_BUCKET}/output/k8s/sample/csv")

Check the Audit logs on the Privacera Portal.

To verify the spark-shell setup, open another SSH connection for Kubernetes cluster and run the following command to check the running pods:

kubectl get pods -n ${SPARK_NAME_SPACE}

You will see the spark executor pods -exec-x. For example, spark-shell-xxxxxxxxxxxxxxxx-exec-1 and spark-shell-xxxxxxxxxxxxxxxx-exec-2.

SSH to the instance as USER.

Run the following commands:

cd ~/privacera/privacera-manager
cp config/sample-vars/vars.trino.opensource.yml config/custom-vars/
vi config/custom-vars/vars.trino.opensource.yml

Edit the following properties. For property details and descriptions, see Table 4, “Trino Open Source Properties”.

TRINO_STANDALONE_ENABLE: "true"
TRINO_USER_HOME: "<PLEASE_CHANGE>"
TRINO_INSTALL_DIR_NAME: "<PLEASE_CHANGE>"

Run the following commands:

cd ~/privacera/privacera-manager
./privacera-manager.sh update

After the update is complete, the setup script (privacera_trino_setup.sh) and Trino custom configurations (privacera_trino_plugin_conf.zip) for SSL will be generated at the path, cd ~/privacera/privacera-manager/output/trino-opensource/.

In your Trino environment, do the following:

1. Copy privacera_trino_setup.sh and privacera_trino_plugin_conf.zip. Both the files should be placed under the same folder.

2. Add permissions to execute the script.

   chmod +x privacera_trino_setup.sh

3. Run the script to install the Privacera plugin in your Trino environment.

   ./privacera_trino_setup.sh

Generate an access-control file for Starburst.

Generate an access-control file for Hive catalogs [optional].

Generate a Ranger Audit XML file.

Generate a Ranger SSL XML file required for TLS secure Privacera installations.

To enable Privacera for authorization, you need to update the etc/config.properties with one of the following entries:

# privacera auth for hive and system access control
access-control.config-files=/etc/starburst/access-control-privacera.properties,/etc/starburst/access-control-priv-hive.properties

Or

# privacera auth for only system access control
access-control.config-files=/etc/starburst/access-control-privacera.properties

Edit etc/access-control-privacera.properties. The following is an example of the properties. You need to configure the properties in the file, so that it points to the instance where Privacera is installed. Replace <PRIVACERA_HOST_INSTANCE_IP> with the IP address of Privacera host.

access-control.name=privacera-starburst
ranger.policy-rest-url=http://<PRIVACERA_HOST_INSTANCE_IP>:6080
ranger.service-name=privacera_starburstenterprise
ranger.username=admin
ranger.password=welcome1
ranger.policy-refresh-interval=3s
ranger.config-resources=/etc/starburst/ranger-hive-audit.xml
ranger.policy-cache-dir=/etc/starburst/tmp/ranger

To install this file into the Docker container, you can add option to your container creation script:

-v $DOCKER_HOME/$STARBURST_VERSION/etc/access-control-privacera.properties:$STARBURST_TGT/access-control-privacera.properties \

Edit etc/access-control-priv-hive.properties. The following is an example of the properties. You need to configure the properties in the file, so that it points to the instance where Privacera is installed. Replace <PRIVACERA_HOST_INSTANCE_IP> with the IP address of Privacera host. Similarly, you need to configure the properties of the comma-separated files such as Hive, Glue, Delta, and so on.

This file is optional if you are not configuring Hive catalogs with privacera_hive policies.

access-control.name=privacera
ranger.policy-rest-url=http://<PRIVACERA_HOST_INSTANCE_IP>:6080
ranger.service-name=privacera_hive
privacera.catalogs=hive,glue
ranger.username=admin
ranger.password=welcome1
ranger.policy-refresh-interval=3s
ranger.config-resources=/etc/starburst/ranger-hive-audit.xml
ranger.policy-cache-dir=/etc/starburst/tmp/ranger
privacera.fallback-access-control=allow-all

To install this file into the Docker container, you can add option to your container creation script:

-v $DOCKER_HOME/$STARBURST_VERSION/etc/access-control-priv-hive.properties:$STARBURST_TGT/access-control-priv-hive.properties \

Edit etc/ranger-hive-audit.xml. This file describes the method of auditing the access from Starburst to Privacera Ranger and Solr. The example below is for unsecured Privacera Ranger deployments only. Replace <PRIVACERA_HOST_INSTANCE_IP> with the IP address of Privacera host.

    <?xml version="1.0" encoding="UTF-8"?>
    <configuration>
    <property>
    <name>ranger.plugin.hive.service.name</name>
    <value>privacera_hive</value>
    </property>
    <property>
    <name>ranger.plugin.hive.policy.pollIntervalMs</name>
    <value>5000</value>
    </property>
    <property>
    <name>ranger.service.store.rest.url</name>
    <value>http://<PRIVACERA_HOST_INSTANCE_IP>:6080</value>
    </property>
    <property>
    <name>ranger.plugin.hive.policy.rest.url</name>
    <value>http://<PRIVACERA_HOST_INSTANCE_IP>:6080</value>
    </property>
    <property>
    <name>xasecure.audit.destination.solr</name>
    <value>true</value>
    </property>
    <property>
    <name>xasecure.audit.destination.solr.batch.filespool.dir</name>
    <value>/opt/presto/logs/audits/solr/</value>
    </property>
    <property>
    <name>xasecure.audit.destination.solr.urls</name>
    <value>http://<PRIVACERA_HOST_INSTANCE_IP>:8983/solr/ranger_audits</value>
    </property>
    <property>
    <name>xasecure.audit.is.enabled</name>
    <value>true</value>
    </property>
    </configuration>

To install this file into the Docker container, you can add option to your container creation script:

-v $DOCKER_HOME/$STARBURST_VERSION/etc/ranger-hive-audit.xml:$STARBURST_TGT/ranger-hive-audit.xml \