Creating a Managed Service for Trino cluster

The Trino cluster is created in a namespace within the project. If you already have a project and a namespace within it, you can create a cluster in that namespace.

Using the CLIUsing the CLI

1. Make sure there is a namespace in the project. If not, create one.

2. Create the TrinoCluster resource file, e.g., using the touch trinocluster.yaml command.

3. Open the file and paste the configuration below into it:

   Minimum configuration

   Configuration with settings and access rules

   apiVersion: trino.stackland.yandex.cloud/v1alpha1
   kind: TrinoCluster
   metadata:
     name: trino-min
   spec:
     version: "483"
     coordinator:
       resources:
         requests:
           cpu: 500m
           memory: 1Gi
         limits:
           cpu: "1"
           memory: 2Gi
     worker:
       replicas: 1
       resources:
         requests:
           cpu: 500m
           memory: 1Gi
         limits:
           cpu: "1"
           memory: 2Gi
   

   An example with logging settings (spec.config) and access rules for catalogs, schemas, and tables (spec.accessControl). To learn more about access rules, see Access management.

   apiVersion: trino.stackland.yandex.cloud/v1alpha1
   kind: TrinoCluster
   metadata:
     name: trino-full
   spec:
     version: "483"
     deletionProtection: false
     coordinator:
       resources:
         requests:
           cpu: 500m
           memory: 1Gi
         limits:
           cpu: "1"
           memory: 2Gi
     worker:
       replicas: 3
       resources:
         requests:
           cpu: 500m
           memory: 1Gi
         limits:
           cpu: "1"
           memory: 2Gi
     config:
       io.trino: INFO
       io.trino.plugin.iceberg: DEBUG
     accessControl:
       catalogs:
         - user: admin@stackland
           catalog: ".*"
           privileges: all
       schemas:
         - user: analyst@stackland
           catalog: ".*"
           schema: ".*"
           owner: false
       tables:
         - user: analyst@stackland
           catalog: ".*"
           schema: public
           table: ".*"
           privileges:
             - SELECT
   

4. Apply the manifest: kubectl apply -f trinocluster.yaml -n <namespace>. Optionally, you can specify the namespace in the metadata.namespace resource property and skip it in the command.

Using the management consoleUsing the management console

1. If you have not opened a project yet, select one.

2. Select the namespace you want to create the cluster in.

3. In the left-hand menu, select Trino → Clusters.

4. Click Create cluster.

5. Fill out the fields as follows:

   Basic properties

   • Name: Cluster name. Written in metadata.name.
   • Trino version: Trino version. The list of values ​​is formed from the TrinoImageCatalog operator.
   • Deletion protection: Toggle for protection against accidental cluster deletion. Disabled by default.

   Coordinator configuration

   • Requested CPUs: Guaranteed number of CPUs for the coordinator pod.
   • Requested RAM: Guaranteed RAM for the coordinator pod.
   • CPU limit: Maximum number of CPUs for the coordinator pod.
   • RAM limit: Maximum RAM for the coordinator pod.

   Worker configuration

   • Number of workers: Number of worker pods. Minimum 1.
   • Requested CPUs: Guaranteed number of CPUs for the worker pod.
   • Requested RAM: Guaranteed RAM for the worker pod.
   • CPU limit: Maximum number of CPUs for the worker pod.
   • RAM limit: Maximum RAM for the worker pod.

   Additional settings (optional)

   Section for adding Trino settings in the key-value format. You can add each key only once.

   Access settings (optional)

   Section for access rules pertaining to Trino resources. Subsections:

   • Catalog rules: user, catalog, privileges (all, read-only, none).
   • Schema rules: user, catalog, schema, owner.
   • Table rules: user, catalog, schema, table, privileges (SELECT, INSERT, DELETE, UPDATE, OWNERSHIP, GRANT_SELECT), plus row filter and column restrictions.
   • Function rules: user, catalog, schema, function, privileges (EXECUTE, GRANT_EXECUTE, OWNERSHIP).
   • Procedure rules: user, catalog, schema, procedure, privileges (EXECUTE, GRANT_EXECUTE).
   • Query rules: user, queryOwner, privileges (execute, view, kill). If queryOwner is specified, the execute privilege is not available.

   In the User field, you can enter the value as a regular expression or select from Identity and Access Management. For a service account, specify the ServiceAccount resource name in Kubernetes, not the IAM subject ID. If the mapping field (e.g., Catalog, Schema, or Table) is left blank, Trino substitutes .*.

6. Click Create.

Done. The cluster has now appeared in the Clusters list. Once created, the cluster status is displayed in the Status column. Go to the cluster card for detailed info.

Connecting to a clusterConnecting to a cluster

Once the cluster enters the Running state, you can connect to it using the coordinator's address.

Getting connection addressesGetting connection addresses

kubectl get trinocluster <cluster_name> -n <namespace> -o jsonpath='{.status.fqdn}'

Trino CLITrino CLI

To connect via an external address, use TLS and Identity and Access Management authentication via a browser. For Trino CLI, prepare a trusted certificate store, TrustStore. The commands for Linux and macOS are listed below.

IAM user loginIAM user login

1. Install the Trino CLI as per the official guide. To create a TrustStore, you will need keytool from JDK.

2. Get the certificate authority (CA) certificate and create a TrustStore. If you already have a TrustStore configured for this cluster, use it for the connection.

   Save the CA certificate from the <cluster_name>-trino-ingress-tls secret resource in the cluster namespace:

   mkdir -p ~/.trino
   kubectl get secret <cluster_name>-trino-ingress-tls -n <namespace> \
     -o jsonpath='{.data.ca\.crt}' | base64 -d > ~/.trino/stackland-ca.crt
   

   If you do not have access to the secret, get the CA certificate from the Stackland administrator and save it at ~/.trino/stackland-ca.crt.

   Import the certificate into the TrustStore.

   keytool -importcert -trustcacerts -noprompt \
     -alias stackland \
     -file ~/.trino/stackland-ca.crt \
     -keystore ~/.trino/truststore.jks \
     -storetype JKS \
     -storepass stackland
   

   In the example, the TrustStore password is stackland; specify the same password when connecting.

3. Add the CA certificate to your OS trusted certificates to sign in via a browser:

   Linux (Debian, Ubuntu)

   Linux (RHEL, Fedora)

   macOS

   sudo cp ~/.trino/stackland-ca.crt /usr/local/share/ca-certificates/stackland.crt
   sudo update-ca-certificates
   

   sudo cp ~/.trino/stackland-ca.crt /etc/pki/ca-trust/source/anchors/stackland.crt
   sudo update-ca-trust
   

   sudo security add-trusted-cert -d -r trustRoot \
     -k /Library/Keychains/System.keychain ~/.trino/stackland-ca.crt
   

   If the browser uses its own certificate store, add the CA into it as well. Restart your browser.

4. Connect to the cluster. Under --server, specify the status.fqdn.external value which is the full coordinator URL in https://... format:

   trino --server https://<coordinator_FQDN> \
     --external-authentication \
     --truststore-path ~/.trino/truststore.jks \
     --truststore-password stackland
   

   When the CLI prompts you to authenticate, open the provided link in your browser and sign in to Identity and Access Management. The current_user value matches the IAM login you used during the OAuth authentication. The --user parameter is optional. If required, provide --user '<IAM_login>' as a hint for the login form, or to run queries as another user if permitted by spec.accessControl rules.

5. To test the connection, run a query in the Trino CLI:

   SELECT current_user, version();
   

   In the current_user column, you should see the IAM login you used to sign in.

Service account loginService account login

For automation and CI, connect with a service account IAM token (t1.*) instead of browser-based OAuth authentication.

1. Create a service account in your cluster’s namespace:

   kubectl create serviceaccount <service_account_name> -n <namespace>
   

   Wait until the IAM service account ID appears in the iam.stackland.yandex.cloud/service-account-id annotation.

2. Add rules to the cluster’s spec.accessControl section. In the user field, specify the ServiceAccount resource name in Kubernetes, not the IAM subject ID. To learn more, see Access management.

3. Get an IAM token for your service account (in t1.* format) via the IAM API.

4. Create a TrustStore by following steps 1-2 of the IAM user login section. You do not need to add the CA to your OS trusted certificates for browser logins.

5. Connect to the cluster. Under --server, specify the status.fqdn.external value:

   trino --server https://<coordinator_FQDN> \
     --access-token '<IAM_token>' \
     --truststore-path ~/.trino/truststore.jks \
     --truststore-password stackland
   

6. Test the connection:

   SELECT current_user, version();
   

   Under current_user, you should see the name of the ServiceAccount resource from spec.accessControl.

JDBCJDBC

Use the Trino JDBC driver with a URL in this format:

jdbc:trino://<coordinator_FQDN>:443

Get the<coordinator_FQDN> value from status.fqdn.external (the part of the URL without the https:// schema).