demos/stacks/trino-iceberg/trino.yaml at 1acb8aafc9d61ca17a69ac3466cf5edaf8a36687 · stackabletech/demos · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
# For now, on K8s 1.35, TrinoCatalogs need to be deployed before the TrinoCluster
# See: https://github.com/stackabletech/trino-operator/issues/854
---
apiVersion: trino.stackable.tech/v1alpha1
kind: TrinoCatalog
metadata:
  name: lakehouse
  labels:
    trino: trino
spec:
  connector:
    iceberg:
      metastore:
        configMap: hive-iceberg
      s3:
        reference: minio
---
apiVersion: trino.stackable.tech/v1alpha1
kind: TrinoCatalog
metadata:
  name: tpcds
  labels:
    trino: trino
spec:
  connector:
    tpcds: {}
---
apiVersion: trino.stackable.tech/v1alpha1
kind: TrinoCatalog
metadata:
  name: tpch
  labels:
    trino: trino
spec:
  connector:
    tpch: {}
---
apiVersion: trino.stackable.tech/v1alpha1
kind: TrinoCluster
metadata:
  name: trino
spec:
  image:
    productVersion: "479"
  clusterConfig:
    catalogLabelSelector:
      matchLabels:
        trino: trino
    authentication:
      - authenticationClass: trino-users
    authorization:
      opa:
        enableColumnMasking: false
        configMapName: opa
        package: trino
  coordinators:
    config:
      queryMaxMemory: 10TB
      resources:
        cpu:
          min: "500m"
          max: "2"
        memory:
          limit: '4Gi'
    roleGroups:
      default:
        replicas: 1
    roleConfig:
      listenerClass: external-stable
  workers:
    config:
      resources:
        cpu:
          min: "1"
          max: "4"
        memory:
          limit: '8Gi'
    roleGroups:
      default:
        replicas: 1
---
apiVersion: authentication.stackable.tech/v1alpha1
kind: AuthenticationClass
metadata:
  name: trino-users
spec:
  provider:
    static:
      userCredentialsSecret:
        name: trino-users
---
apiVersion: v1
kind: Secret
metadata:
  name: trino-users
type: kubernetes.io/opaque
stringData:
  admin: "{{ trinoAdminPassword }}"
---
apiVersion: opa.stackable.tech/v1alpha1
kind: OpaCluster
metadata:
  name: opa
spec:
  image:
    productVersion: 1.12.3
  servers:
    roleGroups:
      default:
        replicas: 1
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: trino-opa-bundle
  labels:
    opa.stackable.tech/bundle: "trino"
data:
  trino.rego: |
    package trino

    default allow = false

    # Allow non-batched access
    allow if {
      is_admin
    }
    # Allow batched access
    batch contains i if {
      some i
      input.action.filterResources[i]
      is_admin
    }
    # Corner case: filtering columns is done with a single table item, and many columns inside
    batch contains i if {
      some i
      input.action.operation == "FilterColumns"
      count(input.action.filterResources) == 1
      input.action.filterResources[0].table.columns[i]
      is_admin
    }

    is_admin() if {
      input.context.identity.user == "admin"
    }