Trino
The Trino module is an SQL editor for Trino with syntax highlighting, code completion and a schema browser.
Connection
Set trino.url to connect all users to one Trino cluster:
trino:
url: https://trino-coordinator-default-headless:8443 (1)
publicUrl: https://trino.example.com (2)
auth:
type: basic (3)
username: cockpit
password:
secretKeyRef:
name: cockpit
key: trino-auth-password| 1 | The coordinator as Cockpit reaches it.
With a certificate from the Secret Operator, use the headless Service of the role group (<cluster>-coordinator-<role group>-headless), which the certificate covers.
From another namespace, append .<namespace>.svc.cluster.local. |
| 2 | Optional. The URL for links to the Trino web UI, defaults to url. |
| 3 | none (default) or basic. basic requires username and password, otherwise Cockpit does not start. |
For a Trino cluster with a private CA, see CA certificates.
trino.tls.insecure: true skips certificate verification instead.
Without trino.url, each user enters a connection in the UI.
These connections are kept in memory and are lost when Cockpit restarts.
User identity
Cockpit sends queries with the logged-in user as X-Trino-User, so Trino applies its access control to that user.
The user is taken from the OIDC claim trino.userImpersonation.userClaim (default preferred_username), and updated on every login.
If the claim is missing, Cockpit uses preferred_username, then the email address.
With basic authentication, Trino must allow the Cockpit user to impersonate other users.
Set trino.userImpersonation.enabled: false to run all queries as trino.auth.username instead.
Errors
Users see the Trino error message only for errors in their own query, such as a syntax error or a missing table. For server-side errors, Cockpit shows a generic message, because the Trino message can contain hostnames or storage paths. The full message is logged as a warning with the Trino query ID.