Copilot commented on code in PR #12700:
URL: https://github.com/apache/gravitino/pull/12700#discussion_r3877375089
##########
docs/trino-connector/configuration.md:
##########
@@ -7,25 +7,126 @@ license: "This software is licensed under the Apache License
version 2."
## Introduction
-| Property | Type | Default Value
| Description
|
Required |
-|---------------------------------------------|---------|-----------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|
-| connector.name | string | (none)
| The `connector.name` defines the type of Trino connector, this value is
always 'gravitino'.
|
Yes |
-| gravitino.metalake | string | (none)
| The `gravitino.metalake` defines which metalake in Gravitino server the
Trino connector uses. Trino connector should set it at start, the value of
`gravitino.metalake` needs to be a valid name, Trino connector can detect and
load the metalake with catalogs, schemas and tables once created and keep in
sync. | Yes |
-| gravitino.uri | string |
http://localhost:8090 | The `gravitino.uri` defines the connection URL of the
Gravitino server, the default value is `http://localhost:8090`. Trino connector
can detect and connect to Gravitino server once it is ready, no need to start
Gravitino server beforehand.
| No |
-| trino.jdbc.user | string | admin
| The jdbc user name of current Trino.
| NO
|
-| trino.jdbc.password | string | (none)
| The jdbc password of current Trino.
| NO
|
-| gravitino.metadata.refresh-interval-seconds | integer | 10
| The `gravitino.metadata.refresh-interval-seconds` defines the interval in
seconds to refresh metadata from Gravitino server, the default value is 10
seconds.
| No |
-| gravitino.trino.skip-version-validation | boolean | false
| The `gravitino.trino.skip-version-validation` defines whether to skip Trino
version validation. Gravitino supports Trino versions between 435 and 478. If
this option is `true`, unsupported Trino versions can still be used, but
compatibility is not guaranteed.
| No |
-| gravitino.client. | string | (none)
| The configuration key prefix for the Gravitino client config.
| No
|
-| gravitino.trino.skip-catalog-patterns | string | (none)
| The `gravitino.trino.skip-catalog-patterns` defines a comma-separated list
of catalog name regex patterns that should be excluded from loading. For
example, `test_.*, .*_tmp` excludes all catalogs starting with `test_` or
ending with `_tmp`.
| No |
-| gravitino.use-single-metalake | boolean | true
| If `true`, only one metalake is used and catalogs are identified by
`<catalog_name>`. If `false`, multi-metalake mode is enabled and catalogs are
identified by `<metalake_name>.<catalog_name>`.
| No |
+| Property | Type | Default Value
| Description
| Required |
+|---------------------------------------------|---------|-----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|
+| connector.name | string | (none)
| The `connector.name` defines the type of Trino connector, this value is
always 'gravitino'.
| Yes |
+| gravitino.metalake | string | (none)
| The `gravitino.metalake` defines which metalake in Gravitino server the
Trino connector uses. Trino connector should set it at start, the value of
`gravitino.metalake` needs to be a valid name, Trino connector can detect and
load the metalake with catalogs, schemas and tables once created and keep in
sync. | Yes |
+| gravitino.uri | string |
http://localhost:8090 | The `gravitino.uri` defines the connection URL of the
Gravitino server, the default value is `http://localhost:8090`. Trino connector
can detect and connect to Gravitino server once it is ready, no need to start
Gravitino server beforehand.
| No |
+| trino.jdbc.user | string | admin
| The jdbc user name of current Trino.
| NO |
+| trino.jdbc.password | string | (none)
| The jdbc password of current Trino.
| NO |
+| trino.jdbc.ssl.enabled | boolean | (derived)
| Whether the internal JDBC connection to the Trino coordinator uses TLS. If
not set, it is derived from the scheme of the Trino `discovery.uri`, so a
coordinator whose `discovery.uri` is `https://...` needs no explicit setting.
| No |
+| trino.jdbc.ssl.truststore.path | string | (none)
| Path of the truststore holding the Trino coordinator certificate. If
omitted, the default JVM truststore is used. Requires TLS, which is enabled
automatically for an HTTPS `discovery.uri` or explicitly with
`trino.jdbc.ssl.enabled=true`, and a `trino.jdbc.ssl.verification` other than
`NONE`. | No |
+| trino.jdbc.ssl.truststore.password | string | (none)
| Password of the truststore configured by `trino.jdbc.ssl.truststore.path`.
Requires TLS and `trino.jdbc.ssl.truststore.path`, otherwise the connector
fails to start.
| No |
+| trino.jdbc.ssl.truststore.type | string | (none)
| Type of the truststore, for example `JKS` or `PKCS12`. If omitted, the
default JVM truststore type is used. Requires TLS and
`trino.jdbc.ssl.truststore.path`, otherwise the connector fails to start.
| No |
+| trino.jdbc.ssl.keystore.path | string | (none)
| Path of the keystore holding the client certificate presented to the
coordinator, for coordinators that require mutual TLS. Requires TLS, which is
enabled automatically for an HTTPS `discovery.uri` or explicitly with
`trino.jdbc.ssl.enabled=true`, and a `trino.jdbc.ssl.verification` other than
`NONE`. See the note on mutual TLS below. | No |
+| trino.jdbc.ssl.keystore.password | string | (none)
| Password of the keystore configured by `trino.jdbc.ssl.keystore.path`.
Requires TLS and `trino.jdbc.ssl.keystore.path`, otherwise the connector fails
to start.
| No |
+| trino.jdbc.ssl.keystore.type | string | (none)
| Type of the keystore, for example `JKS` or `PKCS12`. If omitted, the default
JVM keystore type is used. Requires TLS and `trino.jdbc.ssl.keystore.path`,
otherwise the connector fails to start.
| No |
+| trino.jdbc.ssl.verification | string | FULL
| Certificate verification mode of the internal JDBC connection: `FULL`, `CA`
or `NONE`. Any value other than `FULL` requires TLS, which may be derived from
an HTTPS `discovery.uri`. `NONE` disables certificate verification entirely and
should only be used for troubleshooting.
| No |
+| trino.jdbc.roles | string | (none)
| Session roles applied to the internal JDBC connection, for example
`system:sysadmin`. Required by deployments that only allow `CREATE CATALOG`
with a privileged role.
| No |
+| trino.jdbc.properties. | string | (none)
| The configuration key prefix for raw Trino JDBC driver properties, see
[Connecting to a TLS-enabled
coordinator](#connecting-to-a-tls-enabled-coordinator).
|
No |
+| gravitino.metadata.refresh-interval-seconds | integer | 10
| The `gravitino.metadata.refresh-interval-seconds` defines the interval in
seconds to refresh metadata from Gravitino server, the default value is 10
seconds.
| No |
+| gravitino.trino.skip-version-validation | boolean | false
| The `gravitino.trino.skip-version-validation` defines whether to skip Trino
version validation. Gravitino supports Trino versions between 435 and 478. If
this option is `true`, unsupported Trino versions can still be used, but
compatibility is not guaranteed.
| No |
+| gravitino.client. | string | (none)
| The configuration key prefix for the Gravitino client config.
| No |
+| gravitino.trino.skip-catalog-patterns | string | (none)
| The `gravitino.trino.skip-catalog-patterns` defines a comma-separated list
of catalog name regex patterns that should be excluded from loading. For
example, `test_.*, .*_tmp` excludes all catalogs starting with `test_` or
ending with `_tmp`.
| No |
+| gravitino.use-single-metalake | boolean | true
| If `true`, only one metalake is used and catalogs are identified by
`<catalog_name>`. If `false`, multi-metalake mode is enabled and catalogs are
identified by `<metalake_name>.<catalog_name>`.
| No |
To configure the Gravitino client, use properties prefixed with
`gravitino.client.`. These properties will directly passed to the Gravitino
client.
**Note:** Invalid configuration properties will result in exceptions. Please
see [Gravitino Java client
configurations](../how-to-use-gravitino-client.md#java-client-configuration)
for more support client configuration.
Multi-metalake mode (`gravitino.use-single-metalake=false`) is supported on
Trino connector versions 435-445 and 469-478. On versions 446-468, a warning is
logged and the connector initializes, but the mode is not fully supported and
some operations may fail.
+## Connecting to a TLS-enabled coordinator
+
+The Gravitino Trino connector registers catalogs by connecting back to the
Trino coordinator over
+JDBC and running `CREATE CATALOG` / `DROP CATALOG`. This connection is
established when the
+connector starts and is reused by the metadata refresh loop, so it must be
configured for the
+coordinator's own TLS and authorization settings.
+
+```properties
+connector.name=gravitino
+gravitino.metalake=metalake
+gravitino.uri=http://localhost:8090
+
+# The internal JDBC connection to the coordinator.
+trino.jdbc.user=admin
+trino.jdbc.password=YourSecureTrinoPassword
+trino.jdbc.ssl.truststore.path=/etc/trino/truststore.jks
+trino.jdbc.ssl.truststore.password=YourSecureTruststorePassword
Review Comment:
The TLS configuration example contains invalid placeholder lines
(`trino.jdbc.******` / `trino.jdbc.ssl.truststore.******`), which makes the
sample configuration unusable. These lines should be the actual properties
(e.g., `trino.jdbc.password=...` and `trino.jdbc.ssl.truststore.password=...`)
with non-secret placeholder values so users can copy/paste the example.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
