Deployment¶

Prerequisites

1. kubectl, Helm v3 and Java are required.

2. Configure the authentication to the Container image registry where the Denodo Lakehouse Accelerator (formerly known as Denodo Embedded MPP) container images reside.

   See the Container Image Registry Credentials section.

Engine Selection (Presto on Velox)

By default, the Lakehouse Accelerator uses the Java-based Presto engine. To enable the high-performance C++ Velox-based workers, you must configure the following in your values.yaml: Presto on Velox is the recommended engine provided your specific use case is not impacted by current feature gaps.

prestoOnVelox:
  enabled: true

When this engine is enabled, you must also configure the connection details in the presto.denodoOnVeloxConnector section of the values.yaml, so the VDP query optimizer can apply Embedded MPP Acceleration techniques. For detailed property descriptions, see the Denodo Server configuration page.

Credentials Management

To manage credentials is necessary to use Kubernetes secrets. The /hive-metastore/conf/core-site.xml and /presto/conf/catalog/core-site.xml assumes that the Denodo Lakehouse Accelerator Credentials are available as environment variables. These environment variables are expected to be injected from a Secret named mpp-credentials. To create a secret you need to run kubectl create secret generic mpp-credentials comand adding the necessary environment variables.

You always need to include the environment variable for the connection password used in the Hive Metastore.

kubectl create secret generic mpp-credentials --from-literal=METASTORE_DB_PASSWORD=hive

Depending on the specific kind of object storage, it will be necessary to include different environment variables in the mpp-credentials secret. This information is detailed in the individual section for each of the Object Storages.

Note that you also need to configure objectStorage section in values.yaml.

User Authentication and Access Control

While the standard approach is to use a single presto user and manage permissions via Virtual DataPort How to configure the Lakehouse accelerator to allow different Denodo developers to access different storage routes and catalogs , some environments require stricter isolation. If you need to restrict specific external catalogs within the Lakehouse Accelerator, follow these steps to configure multiple users and define their access levels:

You can configure multiple Presto users and their corresponding passwords in your values.yaml file under the passwordAuth section.

# -- Presto users and passwords.
passwordAuth:
  - prestoUser: "presto"
    prestoPassword: "pr3st%"
  - prestoUser: "user2"
    prestoPassword: "password2"

To control catalog access for these users, you can use Presto’s Built-in System Access Control. You must define the rules in the rules.json file.

By default, the rules.json file is configured to allow all users full access to all catalogs:

{
  "catalogs": [
    {
      "user": ".*",
      "catalog": ".*",
      "allow": "all"
    }
  ]
}

If you want to restrict access, you can modify this file. For example, to grant the presto user full access to the hive catalog, allow all users full access to the iceberg catalog, and restrict user2 to read-only access for the hive catalog, configure rules.json as follows:

{
  "catalogs": [
    {
      "user": "presto",
      "catalog": "hive",
      "allow": "all"
    },
    {
      "catalog": "iceberg",
      "allow": "all"
    },
    {
      "user": "user2",
      "catalog": "hive",
      "allow": "read-only"
    }
  ]
}

Installation and registration

Finally, you must run the helm install command:

helm install lakehouseaccelerator lakehouseaccelerator/

To use the Denodo Lakehouse Accelerator you have to register it in Denodo. The registration process can be executed using the REGISTER_EMBEDDED_MPP stored procedure:

select * from register_embedded_mpp()
where
num_workers = 4 and
cpus_per_node = 16 and
user_denodo_connector = 'denodo_mpp_user' and
password_denodo_connector = 'd3n0do_MPP_p*d' and
presto_password = 'pr3st%' and
presto_host = 'presto-denodo' and
presto_port = 8443;

If you have configured multiple users and want to define different access privileges or storage routes for different developers, you can create multiple copies of this data source in Denodo. For detailed instructions on this advanced setup, please see the section How to configure the Lakehouse accelerator to allow different Denodo developers to access different storage routes and catalogs.

This Section Includes