Docs / Apache Pinot

Connect Apache Pinot

Real-time OLAP datastore

Pinot is a real-time distributed OLAP datastore. Like Druid, its SQL layer has no DML — data arrives through batch or streaming ingestion — so queries are read-only by construction. climpt connects to the Broker.

Credentials

Broker URL
The Broker endpoint, for example https://pinot.example.com. Not the Controller — that is for admin operations.
Port
8099 by default.
Username
Optional, if authentication is enabled.
Password
Optional, if authentication is enabled.

Enabling authentication

Without it, anyone who can reach the Broker can query every table. Configure basic auth in broker.conf:

pinot.broker.access.control.class=org.apache.pinot.broker.broker.BasicAuthAccessControlFactory
pinot.broker.access.control.principals=admin,climpt_readonly
pinot.broker.access.control.principals.admin.password=admin_password
pinot.broker.access.control.principals.climpt_readonly.password=strong_password_here
pinot.broker.access.control.principals.climpt_readonly.tables=*
pinot.broker.access.control.principals.climpt_readonly.permissions=READ

Replace tables=* with the specific tables you want analysed if you can.

Protect the Controller too

controller.admin.access.control.factory.class=org.apache.pinot.controller.api.access.BasicAuthAccessControlFactory
controller.admin.access.control.principals=admin
controller.admin.access.control.principals.admin.password=admin_password

TLS

pinot.broker.tls.keystore.path=/path/to/keystore.jks
pinot.broker.tls.keystore.password=keystore_pass
pinot.broker.tls.truststore.path=/path/to/truststore.jks
pinot.broker.tls.truststore.password=truststore_pass

Restart the Broker afterwards, and open its port only to the addresses that need it.

Managed Pinot

  • StarTree Cloud — fully managed, with connection details and auth tokens in the console. Token authentication is supported and preferable to basic auth.
  • Self-managed on Kubernetes — the Pinot Helm chart with TLS terminated at the ingress and auth enabled.

Worth knowing

  • The Broker (8099) serves SQL. The Controller (9000) is for administration and is not what you connect to.
  • Pinot supports both real-time and offline tables, and climpt can query either.