From 8fede8782c222ddd0d5dd270eaf274590cd9e91c Mon Sep 17 00:00:00 2001 From: Nick Larsen Date: Thu, 12 Mar 2026 21:21:18 +0100 Subject: [PATCH 1/5] fix(stack/spark-trino-superset-s3): Deploy TrinoCatalogs before TrinoCluster --- stacks/stacks-v2.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/stacks/stacks-v2.yaml b/stacks/stacks-v2.yaml index 125034e8..228ad553 100644 --- a/stacks/stacks-v2.yaml +++ b/stacks/stacks-v2.yaml @@ -311,8 +311,10 @@ stacks: - helmChart: https://raw.githubusercontent.com/stackabletech/demos/release-25.11/stacks/_templates/postgresql-superset.yaml - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.11/stacks/spark-trino-superset-s3/s3-connection.yaml - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.11/stacks/spark-trino-superset-s3/hive-metastore.yaml - - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.11/stacks/trino-superset-s3/trino.yaml + # For now, on K8s 1.35, the TrinoCatalog needs to be deployed before the TrinoCluster + # See: https://github.com/stackabletech/trino-operator/issues/854 - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.11/stacks/spark-trino-superset-s3/trino-prediction-catalog.yaml + - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.11/stacks/trino-superset-s3/trino.yaml - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/release-25.11/stacks/trino-superset-s3/superset.yaml supportedNamespaces: [] resourceRequests: From 9c88fab0bb7596e643fdfbc6dc060dc1f5eef3d9 Mon Sep 17 00:00:00 2001 From: Nick Larsen Date: Thu, 12 Mar 2026 21:25:04 +0100 Subject: [PATCH 2/5] fix(stack/data-lakehouse-iceberg-trino-spark): Deploy TrinoCatalogs before TrinoCluster --- .../trino.yaml | 98 ++++++++++--------- 1 file changed, 50 insertions(+), 48 deletions(-) diff --git a/stacks/data-lakehouse-iceberg-trino-spark/trino.yaml b/stacks/data-lakehouse-iceberg-trino-spark/trino.yaml index 5b668896..41b4bf7b 100644 --- a/stacks/data-lakehouse-iceberg-trino-spark/trino.yaml +++ b/stacks/data-lakehouse-iceberg-trino-spark/trino.yaml @@ -1,3 +1,53 @@ +# For now, on K8s 1.35, TrinoCatalogs need to be deployed before the TrinoCluster +# See: https://github.com/stackabletech/trino-operator/issues/854 +--- +apiVersion: trino.stackable.tech/v1alpha1 +kind: TrinoCatalog +metadata: + name: staging + labels: + trino: trino +spec: + connector: + hive: + metastore: + configMap: hive + s3: + reference: minio +--- +apiVersion: trino.stackable.tech/v1alpha1 +kind: TrinoCatalog +metadata: + name: lakehouse + labels: + trino: trino +spec: + connector: + iceberg: + metastore: + configMap: hive-iceberg + s3: + reference: minio +--- +apiVersion: trino.stackable.tech/v1alpha1 +kind: TrinoCatalog +metadata: + name: tpcds + labels: + trino: trino +spec: + connector: + tpcds: {} +--- +apiVersion: trino.stackable.tech/v1alpha1 +kind: TrinoCatalog +metadata: + name: tpch + labels: + trino: trino +spec: + connector: + tpch: {} --- apiVersion: trino.stackable.tech/v1alpha1 kind: TrinoCluster @@ -61,54 +111,6 @@ type: kubernetes.io/opaque stringData: admin: "{{ trinoAdminPassword }}" --- -apiVersion: trino.stackable.tech/v1alpha1 -kind: TrinoCatalog -metadata: - name: staging - labels: - trino: trino -spec: - connector: - hive: - metastore: - configMap: hive - s3: - reference: minio ---- -apiVersion: trino.stackable.tech/v1alpha1 -kind: TrinoCatalog -metadata: - name: lakehouse - labels: - trino: trino -spec: - connector: - iceberg: - metastore: - configMap: hive-iceberg - s3: - reference: minio ---- -apiVersion: trino.stackable.tech/v1alpha1 -kind: TrinoCatalog -metadata: - name: tpcds - labels: - trino: trino -spec: - connector: - tpcds: {} ---- -apiVersion: trino.stackable.tech/v1alpha1 -kind: TrinoCatalog -metadata: - name: tpch - labels: - trino: trino -spec: - connector: - tpch: {} ---- apiVersion: opa.stackable.tech/v1alpha1 kind: OpaCluster metadata: From c4b7e112bbddbaaa40696cf0fc63d944d3357a4e Mon Sep 17 00:00:00 2001 From: Nick Larsen Date: Thu, 12 Mar 2026 21:26:34 +0100 Subject: [PATCH 3/5] fix(stack/end-to-end-security): Deploy TrinoCatalogs before TrinoCluster --- stacks/end-to-end-security/trino.yaml | 102 +++++++++++++------------- 1 file changed, 52 insertions(+), 50 deletions(-) diff --git a/stacks/end-to-end-security/trino.yaml b/stacks/end-to-end-security/trino.yaml index 56302ca6..13a7f6f3 100644 --- a/stacks/end-to-end-security/trino.yaml +++ b/stacks/end-to-end-security/trino.yaml @@ -1,3 +1,55 @@ +# For now, on K8s 1.35, TrinoCatalogs need to be deployed before the TrinoCluster +# See: https://github.com/stackabletech/trino-operator/issues/854 +--- +apiVersion: trino.stackable.tech/v1alpha1 +kind: TrinoCatalog +metadata: + name: lakehouse + labels: + trino: trino +spec: + connector: + iceberg: + metastore: + configMap: hive-iceberg + hdfs: + configMap: hdfs + configOverrides: + # HDFS configuration + hive.hdfs.authentication.type: KERBEROS + hive.hdfs.trino.principal: trino/trino.default.svc.cluster.local@KNAB.COM + hive.hdfs.trino.keytab: /stackable/kerberos/keytab + hive.hdfs.impersonation.enabled: "false" + hive.hdfs.wire-encryption.enabled: "true" + # HMS configuration + hive.metastore.authentication.type: KERBEROS + hive.metastore.client.principal: trino/trino.default.svc.cluster.local@KNAB.COM + hive.metastore.client.keytab: /stackable/kerberos/keytab + hive.metastore.service.principal: hive/hive-iceberg.default.svc.cluster.local@KNAB.COM + hive.metastore.thrift.impersonation.enabled: "false" + # By default, Hive views are executed with the RUN AS DEFINER security mode. Set the hive.hive-views.run-as-invoker catalog configuration property to true to use RUN AS INVOKER semantics. + # However, this does *not* work for Iceberg catalogs :/ (I asked on the Trino slack: https://trinodb.slack.com/archives/CJ6UC075E/p1711449384648869) + # hive.hive-views.run-as-invoker: "true" +--- +apiVersion: trino.stackable.tech/v1alpha1 +kind: TrinoCatalog +metadata: + name: tpcds + labels: + trino: trino +spec: + connector: + tpcds: {} +--- +apiVersion: trino.stackable.tech/v1alpha1 +kind: TrinoCatalog +metadata: + name: tpch + labels: + trino: trino +spec: + connector: + tpch: {} --- apiVersion: trino.stackable.tech/v1alpha1 kind: TrinoCluster @@ -67,56 +119,6 @@ spec: default: replicas: 1 --- -apiVersion: trino.stackable.tech/v1alpha1 -kind: TrinoCatalog -metadata: - name: lakehouse - labels: - trino: trino -spec: - connector: - iceberg: - metastore: - configMap: hive-iceberg - hdfs: - configMap: hdfs - configOverrides: - # HDFS configuration - hive.hdfs.authentication.type: KERBEROS - hive.hdfs.trino.principal: trino/trino.default.svc.cluster.local@KNAB.COM - hive.hdfs.trino.keytab: /stackable/kerberos/keytab - hive.hdfs.impersonation.enabled: "false" - hive.hdfs.wire-encryption.enabled: "true" - # HMS configuration - hive.metastore.authentication.type: KERBEROS - hive.metastore.client.principal: trino/trino.default.svc.cluster.local@KNAB.COM - hive.metastore.client.keytab: /stackable/kerberos/keytab - hive.metastore.service.principal: hive/hive-iceberg.default.svc.cluster.local@KNAB.COM - hive.metastore.thrift.impersonation.enabled: "false" - # By default, Hive views are executed with the RUN AS DEFINER security mode. Set the hive.hive-views.run-as-invoker catalog configuration property to true to use RUN AS INVOKER semantics. - # However, this does *not* work for Iceberg catalogs :/ (I asked on the Trino slack: https://trinodb.slack.com/archives/CJ6UC075E/p1711449384648869) - # hive.hive-views.run-as-invoker: "true" ---- -apiVersion: trino.stackable.tech/v1alpha1 -kind: TrinoCatalog -metadata: - name: tpcds - labels: - trino: trino -spec: - connector: - tpcds: {} ---- -apiVersion: trino.stackable.tech/v1alpha1 -kind: TrinoCatalog -metadata: - name: tpch - labels: - trino: trino -spec: - connector: - tpch: {} ---- apiVersion: v1 kind: Secret metadata: From 0a4ebd70b033ac46d6b07130b452945fc30b609f Mon Sep 17 00:00:00 2001 From: Nick Larsen Date: Thu, 12 Mar 2026 21:27:01 +0100 Subject: [PATCH 4/5] fix(stack/trino-iceberg): Deploy TrinoCatalogs before TrinoCluster --- stacks/trino-iceberg/trino.yaml | 70 +++++++++++++++++---------------- 1 file changed, 36 insertions(+), 34 deletions(-) diff --git a/stacks/trino-iceberg/trino.yaml b/stacks/trino-iceberg/trino.yaml index 56060f75..da3ac3e2 100644 --- a/stacks/trino-iceberg/trino.yaml +++ b/stacks/trino-iceberg/trino.yaml @@ -1,3 +1,39 @@ +# For now, on K8s 1.35, TrinoCatalogs need to be deployed before the TrinoCluster +# See: https://github.com/stackabletech/trino-operator/issues/854 +--- +apiVersion: trino.stackable.tech/v1alpha1 +kind: TrinoCatalog +metadata: + name: lakehouse + labels: + trino: trino +spec: + connector: + iceberg: + metastore: + configMap: hive-iceberg + s3: + reference: minio +--- +apiVersion: trino.stackable.tech/v1alpha1 +kind: TrinoCatalog +metadata: + name: tpcds + labels: + trino: trino +spec: + connector: + tpcds: {} +--- +apiVersion: trino.stackable.tech/v1alpha1 +kind: TrinoCatalog +metadata: + name: tpch + labels: + trino: trino +spec: + connector: + tpch: {} --- apiVersion: trino.stackable.tech/v1alpha1 kind: TrinoCluster @@ -60,40 +96,6 @@ type: kubernetes.io/opaque stringData: admin: "{{ trinoAdminPassword }}" --- -apiVersion: trino.stackable.tech/v1alpha1 -kind: TrinoCatalog -metadata: - name: lakehouse - labels: - trino: trino -spec: - connector: - iceberg: - metastore: - configMap: hive-iceberg - s3: - reference: minio ---- -apiVersion: trino.stackable.tech/v1alpha1 -kind: TrinoCatalog -metadata: - name: tpcds - labels: - trino: trino -spec: - connector: - tpcds: {} ---- -apiVersion: trino.stackable.tech/v1alpha1 -kind: TrinoCatalog -metadata: - name: tpch - labels: - trino: trino -spec: - connector: - tpch: {} ---- apiVersion: opa.stackable.tech/v1alpha1 kind: OpaCluster metadata: From f1034e02f4c3d2d4284659e503789f2430398618 Mon Sep 17 00:00:00 2001 From: Nick Larsen Date: Thu, 12 Mar 2026 21:27:20 +0100 Subject: [PATCH 5/5] fix(stack/trino-superset-s3): Deploy TrinoCatalogs before TrinoCluster --- stacks/trino-superset-s3/trino.yaml | 30 +++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/stacks/trino-superset-s3/trino.yaml b/stacks/trino-superset-s3/trino.yaml index ba13f3e9..69cc6ebe 100644 --- a/stacks/trino-superset-s3/trino.yaml +++ b/stacks/trino-superset-s3/trino.yaml @@ -1,3 +1,19 @@ +# For now, on K8s 1.35, TrinoCatalogs need to be deployed before the TrinoCluster +# See: https://github.com/stackabletech/trino-operator/issues/854 +--- +apiVersion: trino.stackable.tech/v1alpha1 +kind: TrinoCatalog +metadata: + name: hive + labels: + trino: trino +spec: + connector: + hive: + metastore: + configMap: hive + s3: + reference: minio --- apiVersion: trino.stackable.tech/v1alpha1 kind: TrinoCluster @@ -52,20 +68,6 @@ type: kubernetes.io/opaque stringData: admin: "{{ trinoAdminPassword }}" --- -apiVersion: trino.stackable.tech/v1alpha1 -kind: TrinoCatalog -metadata: - name: hive - labels: - trino: trino -spec: - connector: - hive: - metastore: - configMap: hive - s3: - reference: minio ---- apiVersion: opa.stackable.tech/v1alpha1 kind: OpaCluster metadata: