Connect Trino CLI on EMR Kerberos & Standard Clusters - E-MapReduce

Use the command-line interface (CLI) to connect to Trino and run SQL queries after you create an E-MapReduce (EMR) cluster with the Trino service.

Prerequisites

Before you begin, ensure that you have:

An EMR cluster with the Trino service. For more information, see Create a cluster

Limitations

Ranger authentication and Kerberos authentication cannot be enabled on the same cluster at the same time.

DataLake clusters and custom clusters

When you create a cluster, turning on Kerberos Authentication makes it a high-security cluster. Otherwise, it is a common cluster.

The CLI binary name depends on your EMR version. In EMR V3.44.0 and later, or EMR V5.10.0 and later, the service is named Trino and the binary is trino. In earlier versions, the service is named Presto and the binary is presto.

Common clusters

Log on to your cluster in SSH mode. For more information, see Log on to a cluster.
Connect to the Trino CLI.
In EMR V3.44.0, EMR V5.10.0, or a minor version later than EMR V3.44.0 or EMR V5.10.0
```
trino --server master-1-1:9090
```
In a minor version earlier than EMR V3.44.0 or EMR V5.10.0
```
presto --server master-1-1:9090
```

Query a table:

Placeholder	Description	Example
`<catalog>`	The name of the data source	`hive`
`<schema>`	The name of the database	`default`
`<table>`	The name of the table to query	`test`

select * from <catalog>.<schema>.<table>;

Replace the placeholders with actual values: For example, to query the test table in the default Hive database:

select * from hive.default.test;

(Optional) Run quit; to exit the CLI.

High-security clusters

High-security clusters use Kerberos authentication over HTTPS. The connection command requires both TLS (keystore) and Kerberos (keytab) parameters.

Tip: Save the connection command as a shell script to avoid retyping it every session.

Log on to your cluster in SSH mode. For more information, see Log on to a cluster.

Connect to the Trino CLI.

In EMR V3.44.0, EMR V5.10.0, or a minor version later than EMR V3.44.0 or EMR V5.10.0

trino --server https://${FQDN}:7778 \
      --krb5-config-path /etc/krb5.conf \
      --keystore-path /etc/emr/trino-conf/keystore \
      --keystore-password ${pwd} \
      --krb5-keytab-path /etc/emr/trino-conf/trino.keytab \
      --krb5-principal trino/${FQDN}@${REALM} \
      --krb5-remote-service-name trino \
      --user trino/${FQDN} \
      --catalog ${CATALOG}

In a minor version earlier than EMR V3.44.0 or EMR V5.10.0

presto --server https://${FQDN}:7778 \
       --krb5-config-path /etc/krb5.conf \
       --keystore-path /etc/emr/trino-conf/keystore \
       --keystore-password ${pwd} \
       --krb5-keytab-path /etc/emr/trino-conf/trino.keytab \
       --krb5-principal trino/${FQDN}@${REALM} \
       --krb5-remote-service-name trino \
       --user trino/${FQDN}

Parameter	Description	How to obtain
`${FQDN}`	Fully Qualified Domain Name (FQDN) of the master-1-1 node. Format: `master-1-1.c-xxxxxxx.cn-xxxxxx.emr.aliyuncs.com`	Run `hostname -f` on the master-1-1 node
`${pwd}`	Value of `http-server.https.keystore.key` in config.properties	Run `awk -F= '/http-server.https.keystore.key/{print $2}' ${TRINO_CONF_DIR}/config.properties` on the master-1-1 node
`${REALM}`	Kerberos realm. Format: `EMR.C-XXXXXX.COM`	Check `http-server.authentication.krb5.user-mapping.pattern` in config.properties
`${CATALOG}`	The data source to connect to	For example, `hive`

Parameter	Fixed value
`--krb5-config-path`	`/etc/krb5.conf`
`--keystore-path`	`/etc/emr/trino-conf/keystore`
`--krb5-keytab-path`	`/etc/emr/trino-conf/trino.keytab`
`--krb5-remote-service-name`	`trino`

Replace the placeholders with values from your cluster: The following parameters have fixed values in EMR:

List the schemas in the connected catalog:
```
show schemas;
```
(Optional) Run quit; to exit the CLI.

Hadoop clusters

For Hadoop clusters, the service name is always Presto. Use the presto binary regardless of your EMR version.

Common clusters

Log on to your cluster in SSH mode. For more information, see Log on to a cluster.

Connect to the Presto CLI:

Parameter	Description
`--server emr-header-1:9090`	Address and port of the Presto service
`--catalog hive`	The data source to connect to. Replace `hive` with the name of your data source.
`--schema default`	The database to use. Replace `default` with your target database.
`--user hadoop`	The username for authentication

presto --server emr-header-1:9090 --catalog hive --schema default --user hadoop

List the schemas in the connected catalog:
```
show schemas;
```
(Optional) Run quit; to exit the CLI.

High-security clusters

Log on to your cluster in SSH mode. For more information, see Log on to a cluster.
Add a principal and export a keytab file.
1. Enable the Kerberos administration tool.
  - EMR V3.30.0 and later, or EMR V4.5.1 and later:
```
sh /usr/lib/has-current/bin/admin-local.sh /etc/ecm/has-conf -k /etc/ecm/has-conf/admin.keytab
```
  - Earlier versions:
```
sh /usr/lib/has-current/bin/hadmin-local.sh /etc/ecm/has-conf -k /etc/ecm/has-conf/admin.keytab
```
2. Add a principal:
```
addprinc -randkey test
```
  This example adds the principal test. Replace test with your username.
3. Export the keytab file:
```
xst -k /home/test.keytab test
```
  The keytab file is exported to the /home/ directory by default.

Connect to the Presto CLI:

Parameter	Description	How to obtain
`<hostname>`	Hostname of the emr-header-1 node. Format: `emr-header-1.cluster-xxx`	Run `hostname` on the emr-header-1 node
`<passwd>`	The keystore password	Run `sed -n 's/http-server.https.keystore.key=$[^;]*$/\1/p' /etc/ecm/presto-conf/config.properties` on the emr-header-1 node
`<keytab_file>`	Path to the exported keytab file	For example, `/home/test.keytab`
`<username>`	The principal of the keytab file	For example, `test`
`<cluster_id>`	The cluster ID	Run `hostname	grep -Eo '[0-9]+$'` on the emr-header-1 node

presto --server https://<hostname>:7778 \
       --catalog hive \
       --schema default \
       --keystore-path /etc/ecm/presto-conf/keystore \
       --keystore-password <passwd> \
       --krb5-keytab-path <keytab_file> \
       --krb5-principal <username>@EMR.<cluster_id>.COM \
       --krb5-remote-service-name presto \
       --user <username>

Replace the placeholders with values from your cluster:

List the schemas in the connected catalog:
```
show schemas;
```
(Optional) Run quit; to exit the CLI.

What's next

Use Java Database Connectivity (JDBC) to connect to Trino for querying, analyzing, and processing complex data, or to integrate query results into Java applications. For more information, see Use JDBC.