Prerequisites¶

1. kubectl, Helm v3 and Java are required.

2. Configure the authentication to the Container image registry where the Denodo Lakehouse Accelerator (formerly known as Denodo Embedded MPP) container images reside.

   See the Container Image Registry Credentials section.

Credentials Management¶

To manage credentials is necessary to use Kubernetes secrets. The /hive-metastore/conf/core-site.xml and /presto/conf/catalog/core-site.xml assumes that the Denodo Lakehouse Accelerator Credentials are available as environment variables. These environment variables are expected to be injected from a Secret named mpp-credentials. To create a secret you need to run kubectl create secret generic mpp-credentials comand adding the necessary environment variables.

You always need to include the environment variable for the connection password used in the Hive Metastore.

kubectl create secret generic mpp-credentials --from-literal=METASTORE_DB_PASSWORD=hive

Depending on the specific kind of object storage, it will be necessary to include different environment variables in the mpp-credentials secret. This information is detailed in the individual section for each of the Object Storages.

Note that you also need to configure objectStorage section in values.yaml.

User Authentication and Access Control¶

While the standard approach is to use a single presto user and manage permissions via Virtual DataPort, some environments require stricter isolation. If you need to restrict specific external catalogs within the Lakehouse Accelerator, follow these steps to configure multiple users and define their access levels:

You can configure multiple Presto users and their corresponding passwords in your values.yaml file under the passwordAuth section.

# -- Presto users and passwords.
passwordAuth:
  - prestoUser: "presto"
    prestoPassword: "pr3st%"
  - prestoUser: "user2"
    prestoPassword: "password2"

To control catalog access for these users, you can use Presto’s Built-in System Access Control. You must define the rules in the rules.json file.

By default, the rules.json file is configured to allow all users full access to all catalogs:

{
  "catalogs": [
    {
      "user": ".*",
      "catalog": ".*",
      "allow": "all"
    }
  ]
}

If you want to restrict access, you can modify this file. For example, to grant the presto user full access to the hive catalog, allow all users full access to the iceberg catalog, and restrict user2 to read-only access for the hive catalog, configure rules.json as follows:

{
  "catalogs": [
    {
      "user": "presto",
      "catalog": "hive",
      "allow": "all"
    },
    {
      "catalog": "iceberg",
      "allow": "all"
    },
    {
      "user": "user2",
      "catalog": "hive",
      "allow": "read-only"
    }
  ]
}

Installation and registration¶

Finally, you must run the helm install command:

helm install lakehouseaccelerator lakehouseaccelerator/

To use the Denodo Lakehouse Accelerator you have to register it in Denodo. The registration process can be executed using the register.sh script:

./register.sh

Check the Lakehouse Accelerator at Denodo section for more details.