Installing the Trino Protector

The single-node installation script generated by the configurator script is used to install the Trino Protector. Copy and execute the single-node installation script to all the nodes in the Trino cluster.

Execute the following steps on every coordinator and worker node of the Trino Cluster.

Important: If you want to add a new node to the Trino cluster after installing the Trino protector, then ensure that you run the installation script on the new node.

1. Log in to the node, where you want to execute the installation script.

2. Copy/Download the single-node installation script previously generated by the configurator script to any directory.

3. Navigate to the directory where the single-node installation script is located.

4. To view the syntax and the usage of the installation script, run the following command.

   ./TrinoProtector_InstallationScript_10.0.0+x.sh --help
   

5. Press ENTER.

   The command displays the syntax with the mandatory and optional arguments. The mandatory and optional arguments are explained in the following tables.

   Argument	Description
   --install-rpagent-and-logforwarder=<yes|no>	Instructs the script whether to install the RPAgent and the Log Forwarder on the current node in the Trino cluster. The acceptable values are: yes - install the RPAgent and the Log Forwarder on the current node in the Trino cluster. no - skip installing the RPAgent and the Log Forwarder if it is already installed and running on the current node in the Trino cluster.
   --trino-plugin-dir=</path/to/plugin/>	Specifies the absolute path of the Trino plugin directory. Note You can set a custom plugin path using the plugin.dir property in the node.properties Trino configuration file. Ensure the current sudoer user has permissions to read and write into this directory
   --trino-service-user=<user>	Specifies the name of the user running the Trino server. You can use this argument to set the ownership of the peptrino plugin directory and also to restart the Trino server if you specify the --restart-trino-server-via=launcher argument. Note Ensure the current sudoer user is able to run commands as Trino service user using the sudo -u command. Ensure the Trino service user is able to read files from the <installation_directory>.

   Table 2. Optional Arguments for the Installation Script

   Argument	Description
   –sudo-disabled	Use this flag if sudoers is disabled on the cluster. If you use this flag, the script will skip the use of the sudo command. The current user will be used to install and start the Protegrity services. Therefore, the user must have permissions to create the Protegrity files under the <installation_directory> and the Trino plugin directory and to modify the config.properties file. The –trino-service-user and –protegrity-user must be same as the current user. You will be unable to use the –restart-trino-server-via argument. When you exclude this argument, a user with sudoer privileges is required to execute the script. It is recommended to use a NOPASSWD sudoer user. Else, the script will prompt for a password.
   –protegrity-user=<user>	If you specify this argument, then the script will create the given Protegrity service user if it is unavailable and will set it as the owner of the directories and files in the <installation_directory>. Ensure that the Protegrity service user has read permissions on the parent directories of the <installation_directory> path. Note If you set the value of the –install-pepserver-and-logforwarder argument to yes, then the installation script will use this user account to start the RPAgent and the Log Forwarder services. Ensure that the current user with sudoer privileges is able to execute the commands as the Protegrity service user (using the sudo -u command) to start the Protegrity services. If you set the value of the –sudo-disabled argument to yes, then the script will use the current user account to start the Protegrity services. If you fail to specify this argument, then the installation script will set the current user as the Protegrity service user.
   –protegrity-group=<group>	This script will create the given Protegrity service group if it is unavailable and will set it as the group for the directories and the files in the <installation_directory> path. If you fail to specify this argument, then the installation script will set the current user’s primary group root as the Protegrity service group.
   –restart-trino-server-via=<systemd|init|launcher>	If you specify this argument, then the script will restart the running Trino server after installing the peptrino plugin. The script will not restart the Trino server if the server is in the stopped state. If you want to use this argument, ensure that you enable Sudo to restart the Trino server. The acceptable values are: systemd - instructs the script to use the systemctl command to check the status and restart the Trino server. This argument requires the –trino-systemd-service-name argument to be specified. init - instructs the script to use the service command to check the status and restart the Trino server. This argument also requires you to specify the –trino-init-service-name argument. launcher - instructs the script to use the Trino launcher script to check the status and restart Trino server. This argument requires the –trino-launcher-path and the optional –trino-launcher-args arguments. If you exclude this argument, then the script will not attempt to restart the Trino server. You must manually restart the Trino server after the script execution is complete.
   –trino-systemd-service-name=<systemd service name>	Specifies the name of the systemd service associated with the Trino server. You must specify this argument when you use the –restart-trino-server-via=systemd argument.
   –trino-init-service-name=<init service name>	Specifies the name of the Sys V init service associated with the Trino server. You must pass this argument when you specify the –restart-trino-server-via=init argument.
   –trino-launcher-path=</path/to/bin/launcher>	Specifies the absolute path to the Trino server launcher script. For example, /usr/lib/trino/bin/launcher. You must specify this argument when you use the –restart-trino-server-via=launcher argument.
   –trino-launcher-args=“arg1 [arg2…]"	Specifies the valid command line arguments to the Trino launcher script. You can use this argument with the –trino-launcher-path argument. If you specify this argument, then the arguments listed between the double-quotes will be passed to the Trino launcher script for the status and restart commands. If you fail to specify this argument, then no argument will be passed to the Trino launcher script for the status and restart commands.
   –reuse-jpeplite-from-path=</path/to/jpeplite/lib>	Specifies the absolute path to the existing jpeplite/lib/ directory on the cluster node. You can use this argument with the –install-pepserver-and-logforwarder=no argument when the JpepLite libraries packaged in this build is incompatible with the existing installed PEP server version. The existing /path/to/jpeplite/lib/ directory must contain the jpeplite.jar, jpeplite.properties, and jpeplite.plm files and must be readable.
   –protector-logs-output=<tcp|stdout|file>	Instructs the Trino Protector to write the protector logs to this output. If you specify an attribute for this argument, then the installation script will change the output property in the pepserver.cfg file. The acceptable values are: tcp (Default) - specifies that the logs are written to the TCP socket specified in the pepserver.cfg file. stdout - specifies that the logs are written to the Trino server’s stdout parameter. file - specifies that the logs are written to the file whose path is set in the –protector-logs-output-filename argument.
   –protector-logs-output-filename=</path/to/logs.txt>	Specifies the absolute path to the file on the cluster node on which the protector logs are written. You must use this argument with the –protector-logs-output=file argument. If you fail to specify this argument, then the default file name of /opt/logs.txt will be used. This argument will add the outputfilename property in the pepserver.cfg file. This script will create the file on the cluster node if the file is not available. Ensure that the Trino service user has write permissions to this file path.
   –wait-for-trino-installation	If you specify this argument, then the installation script will create and run a secondary bash script as a background process that will wait for the Trino server to be installed and started on the node and only then install the plugin .jar files and restart the Trino server. This argument can be used in scenarios where the Trino server will always be installed and started after this installation script is executed. E.g. EMR clusters. This flag requires the –restart-trino-server-via argument for restarting the Trino server. You must enable Sudo for this argument. If you fail to specify this argument, then the installation script will not wait for the Trino server to be installed and started and will proceed to install the plugin. Ensure that the Trino server is installed and the plugin directory exists before the you execute the installation script.

6. Depending on the requirements, run the installation script with the required arguments.

   For example, on a Starburst Trino cluster installed via RPM, one combination of the arguments to the single-node installation script is listed below.

   ./TrinoProtector_InstallationScript_10.0.0.x.sh \
                  --install-rpagent-and-logforwarder=yes \
                  --trino-plugin-dir=/usr/lib/starburst/plugin \
                  --trino-service-user=starburst \
                  --protegrity-user=ptyitusr \
                  --protegrity-group=ptyitusrgroup \
                  --restart-trino-server-via=systemd \
                  --trino-systemd-service-name=starburst \
   

   Note: If you want the Trino Server to automatically restart after installing the components, then specify the value for the –restart-trino-server-via argument for the installation script. Otherwise, you will have to manually restart the Trino Server after the installation is complete.

7. Press ENTER.

   The script installs the components as specified in the arguments.

   
   ./TrinoProtector_InstallationScript_10.0.0+6.sh \
   > --install-rpagent-and-logforwarder=yes \
   > --trino-plugin-dir=/usr/lib/starburst/plugin \
   > --trino-service-user=starburst \
   > --restart-trino-server-via=systemd \
   > --protegrity-user=ptyitusr \
   > --protegrity-group=ptyitusrgroup \
   > --trino-systemd-service-name=starburst
   > --restart-trino-server-via=systemd \
   > --trino-systemd-service-name=starburst
   
   Protegrity Trino Protector Installation Script started...
   
   Validating sudo permissions for root
   ************************************************************************************
                   Welcome to the Trino Protector Install Wizard.
   ************************************************************************************
   This will install the Trino Protector on your system.
   
   Group 'ptyitusrgroup' created
   
   User 'ptyitusr' created
   
   RPAgent installation started
   ************************************************************************************
                       Welcome to the RPAgent Setup Wizard.
   ************************************************************************************
   
   RPAgent installed on current node at location /opt/protegrity/rpagent/
   
   Logforwarder installation started
   ************************************************************************************
                       Welcome to the LogForwarder Setup Wizard.
   ************************************************************************************
   
   Unpacking...................
   Extracting files...
   Unpacked logforwarder compressed file...
   
   LogForwarder installed on current node at location /opt/protegrity/logforwarder/
   
   PepTrino Plugin Jars installation started
   ************************************************************************************
                       Welcome to the PepTrino Setup Wizard.
   ************************************************************************************
   
   Unpacking...................
   Extracting files...
   Unpacked peptrino compressed file...
   
   PepTrino installed on current node at location /opt/protegrity/peptrino/
   
   JcoreLite installation started
   ************************************************************************************
                           Welcome to the JcoreLite Setup Wizard.
   ************************************************************************************
   
   Unpacking...................
   Extracting files...
   Unpacked jcorelite compressed file...
   
   JcoreLite for Trino Protector installed on current node at location /opt/protegrity/peptrino/lib/
   
   Moving Uninstallation Script to /opt/protegrity/peptrino/scripts/
   
   Creating cluster_utils directory in /opt/protegrity/peptrino/scripts/
   
   Creating data directory in /opt/protegrity/peptrino/
   
   Starting Logforwarder on current node...
   
   Starting RPAgent on current node...
   
   Trino Protector plugin jars and JcoreLite libraries are installed within /opt/protegrity/peptrino/ directory
   
   Finished executing TrinoProtectorInstall468_Linux-ALL_10.0.0+x.sh script. Check the logs at /opt/protegrity/logs/
   
   NOT waiting for Trino Server Installation and Start...
   
   Started installation of PepTrino in plugin dir in foreground...
   
   Checking if Trino Plugin Dir is present on node.
   Trino Plugin Directory /usr/lib/starburst/plugin found.
   
   Creating peptrino directory within Trino plugin directory.
   
   Getting the names of plugin jars
   
   Creating Symbolic Links within Plugin Directory...
   
   Trino Protector jars' symbolic links created in /usr/lib/starburst/plugin/peptrino/
   
   Checking if Trino service user exists.
   
   Service User starburst exists on node
   
   Changing ownership of PepTrino Plugin dir to starburst
   
   Checking if systemctl is on PATH.
   systemctl found on PATH.
   
   Checking if 'starburst' is a valid systemd unit.
   'starburst' is a valid systemd unit.
   
   Checking if Trino Server is started and running via systemctl
   Trino server is running
   Restarting Trino Server...
   
   Trino Server successfully restarted via systemctl.
   Successfully completed all steps of Installation Script.
   

   The installation script generates the logs in the /<installation_directory>/logs/ directory.