Trino 428 and empty catalogs

[dshershov]

Hello everyone!
I have a next question
After upgrade from 414 - trino version and 23.7.0 - operator version to 428 and 0.0.0-dev I see that my catalog lists became empty

~/Downloads/trino-cli-428-executable.jar --server https://trino.some.me:443 --external-authentication      
trino> SHOW CATALOGS;
 Catalog
---------
(0 rows)

trino> SHOW SCHEMAS From hive;
 Schema
--------
(0 rows)

trino> SHOW SCHEMAS From test1;
Query 20231101_qwerty failed: Catalog 'test1' does not exist

After downgrading my version to 414 and 23.7 all catalogs were restored

trino> SHOW CATALOGS;
   Catalog
-------------
 anothertest
 hive
 iceberg
 system
(4 rows)

Maybe I use wrong version of some operators?
Can anyone help me with that?
Thanks a lot stackable team!

[dshershov]

auth param:

    authentication:
      - authenticationClass: trino-users
    authorization:
      opa:
        configMapName: opa
        package: trino
  coordinators:
    configOverrides:
      config.properties:
        web-ui.authentication.type: oauth2
        http-server.authentication.type: oauth2, password

Opa version - 0.57.0 with 0.0.0-dev
Opa policy have been cleared for testing:

    package trino


    import future.keywords.in
    import future.keywords.if

    default allow = true

[soenkeliebau]

Hi @dshershov ,

can you see any errors about failed reconciliation for TrinoCatalog objects in the Trino Operator's log?
afaik there were no breaking changes there between 23.7 and 0.0.0-dev, but it sounds a bit like for some reason the operator is not picking up the TrinoCatalog objects..

[soenkeliebau]

Never mind, I managed to recreate the issue and at least for me there are no log messages :)

[soenkeliebau]

I have not made much progress on this tbh - I can see Trino loading stuff for the catalogs in the log, so they are there ...

I suspect this is to do with the switch to a new authorizer that happened for the 428 image. I'll talk to @maltesander tomorrow, who made that change. Maybe he has an idea.

[sbernauer]

Hi @dshershov!

I have not tested it, but seems to me like the catalogs are loaded, but you are missing the permissions to access them.
The new authorizer does not only have a simple check "can user foo do bar?", but also an batched API, which sends an array of (catalogs/schemas/tables) to OPA and gets a yes/no for each entry. All of that with a single OPA API call, so we can save round-trips.

You can see the OPA rules used in integration-tests here.
I guess you are missing something like

    extended[i] {
        some i
        input.action.filterResources[i]
        is_admin
    }

[dshershov]

@sbernauer
Hi, Sebastian!
Yeap, default allow = true not enough for allow access for every user in 428 version
Thanks a lot, team!

[sbernauer]

You can also read on the details in the PR from Pablo: https://github.com/bloomberg/trino/blob/add-open-policy-agent/plugin/trino-opa/README.md#batch-mode
Please keep in mind this is WIp and not yet merged into Trino

[maltesander]

Added clarification in the docs here stackabletech/trino-operator#494

[dshershov]

Awesome! thanks!