Managing Lakehouse Catalog Access

Use these tutorials to create and modify your Saagie Lakehouse catalogs access.

Lakehouse Catalog Access is available only if the Lakehouse is enabled on your Saagie installation. This must have been enabled by your administrator during the configuration of the Saagie installer, saagiectl. They must have answered the prompt to use Lakehouse when configuring your cluster settings.

Creating a Lakehouse Catalog Access

Create lakehouse catalogs access to manage lakehouse users roles. These roles allow only authorized users to access to a specific catalog.
For more information on the available roles, see Roles on Lakehouse Catalogs.

Assign roles to a group to give its members the same set of rights.
For more information to assign a role, see Manage Lakehouse Role on a group.

Click Security from the primary navigation menu.
By default, the Users page opens, listing the existing user accounts.
Click Lakehouse from the secondary navigation menu.
The Lakehouse page opens, listing the existing Lakehouse Catalog Access.
Click Create lakehouse catalog access to create a new lakehouse catalog access.
Enter the lakehouse catalog name.
Click Create access to confirm the access creation.
A message appears saying that your catalog access has been created.

The newly created Lakehouse Access appears in the list.

3 roles are automatically created based on the catalog name:

trino-catalog-catalog_name-admin
trino-catalog-catalog_name-read
trino-catalog-catalog_name-write

Editing a Lakehouse Catalog Access

Click on the catalog name of the corresponding catalog access row.
Catalog name is editable.
Click Save to confirm the modification.
A confirmation message appears.

Deleting a Lakehouse Catalog Access

Click Delete at the end of the corresponding catalog access row.
A confirmation message appears.
Click Delete again to confirm the deletion.
A progress bar appears. Wait for the end of the operation to validate the deletion.

Roles on Lakehouse Catalogs

At least one role on a Lakehouse catalog is needed to access it. A role allows to list the catalogs, schemas, tables, columns, and to execute queries on them.

A role is defined by the following pattern: trino-catalog-catalog_name-<role> with <role> in read, write, or admin according to the needed access.

The specific role trino-admin allows to execute all SQL queries supported by Trino on all catalogs. We can’t create this role, but it’s set for the administrators group by default.

The following table lists the minimal role required to execute the corresponding command on a Lakehouse catalog:

Table 1. Access Roles Lakehouse
Command	Minimal Role on Catalog
SHOW CATALOGS	trino-catalog-catalog_name-read
SHOW SCHEMAS	trino-catalog-catalog_name-read
SHOW TABLES	trino-catalog-catalog_name-read
SHOW COLUMNS	trino-catalog-catalog_name-read
SELECT * FROM table	trino-catalog-catalog_name-read
SELECT * FROM view	trino-catalog-catalog_name-read
INSERT INTO table … VALUES …	trino-catalog-catalog_name-write
DELETE FROM table WHERE …	trino-catalog-catalog_name-write
UPDATE table SET … WHERE …	trino-catalog-catalog_name-write
SHOW CREATE TABLE	trino-catalog-catalog_name-admin
CREATE SCHEMA	trino-catalog-catalog_name-admin
DROP SCHEMA	trino-catalog-catalog_name-admin
SHOW CREATE SCHEMA	trino-catalog-catalog_name-admin
ALTER SCHEMA … RENAME TO	trino-catalog-catalog_name-admin
ALTER SCHEMA … SET AUTHORIZATION	trino-catalog-catalog_name-admin
CREATE TABLE	trino-catalog-catalog_name-admin
DROP TABLE	trino-catalog-catalog_name-admin
ALTER TABLE … RENAME TO	trino-catalog-catalog_name-admin
ALTER TABLE … SET PROPERTIES	trino-catalog-catalog_name-admin
ALTER VIEW … RENAME TO	trino-catalog-catalog_name-admin
SHOW CREATE VIEW	trino-catalog-catalog_name-admin
CREATE VIEW	trino-catalog-catalog_name-admin
DROP VIEW	trino-catalog-catalog_name-admin
ALTER VIEW … RENAME TO	trino-catalog-catalog_name-admin
REFRESH MATERIALIZED VIEW	trino-catalog-catalog_name-admin
COMMENT ON TABLE	trino-catalog-catalog_name-admin
COMMENT ON COLUMN	trino-catalog-catalog_name-admin
ALTER TABLE … ADD COLUMN	trino-catalog-catalog_name-admin
ALTER TABLE … DROP COLUMN	trino-catalog-catalog_name-admin
ALTER TABLE … RENAME COLUMN	trino-catalog-catalog_name-admin
Others commands on a specific catalog	trino-catalog-catalog_name-admin
Manage catalogs	trino-admin