Docs / Apache Druid

Connect Apache Druid

Real-time analytics database

Druid is a real-time analytics database. Its SQL layer has no INSERT, UPDATE or DELETE at all — data arrives through ingestion, not queries — so a Druid connection is read-only whatever else you configure. climpt connects to the Broker or Router endpoint.

Credentials

Broker URL
The Broker or Router endpoint, for example https://druid.example.com.
Port
8082 for the Broker, 8888 for the Router.
Username
Optional, if authentication is enabled.
Password
Optional, if authentication is enabled.

The Broker handles SQL directly; the Router adds query routing and the web console. Either works.

Enabling authentication

Optional as far as Druid is concerned, but without it anyone who can reach the port can query every datasource. Configure the Basic Security extension in common.runtime.properties:

druid.auth.authenticatorChain=["BasicMetadataAuthenticator"]
druid.auth.authenticator.BasicMetadataAuthenticator.type=basic
druid.auth.authenticator.BasicMetadataAuthenticator.initialAdminPassword=admin_password
druid.auth.authenticator.BasicMetadataAuthenticator.initialInternalClientPassword=internal_password

Creating a read-only user

Users and roles are managed through the Coordinator API.

1 · The user

curl -u admin:admin_password -X POST \
  https://coordinator:8081/druid-ext/basic-security/authentication/db/basic/users/climpt_readonly

curl -u admin:admin_password -X POST \
  -H "Content-Type: application/json" \
  -d '{"password": "strong_password_here"}' \
  https://coordinator:8081/druid-ext/basic-security/authentication/db/basic/users/climpt_readonly/credentials

2 · A read-only role, and assigning it

curl -u admin:admin_password -X POST \
  https://coordinator:8081/druid-ext/basic-security/authorization/db/basic/roles/readonly_role

curl -u admin:admin_password -X POST \
  -H "Content-Type: application/json" \
  -d '[{"type":"DATASOURCE","name":".*","action":"READ"}]' \
  https://coordinator:8081/druid-ext/basic-security/authorization/db/basic/roles/readonly_role/permissions

curl -u admin:admin_password -X POST \
  https://coordinator:8081/druid-ext/basic-security/authorization/db/basic/users/climpt_readonly/roles/readonly_role

The .* above matches every datasource. Naming them explicitly is tighter if you know which ones you want analysed.

TLS and network

Set druid.enableTlsPort=true on the Broker or Router, and open its port only to the addresses that need it.

Managed Druid

  • Imply Cloud — managed Druid with authentication and TLS already in place.
  • Imply Polaris — serverless Druid; connection details come from the Polaris console.
  • Self-managed on Kubernetes — the Druid Helm charts with TLS terminated at the ingress.

Worth knowing

  • Include a __time filter in queries wherever you can. Druid partitions on time, so it is the difference between scanning a window and scanning everything.
  • For enterprise deployments, LDAP authentication is usually preferable to basic auth.