Snowflake

PlainID supports key-pair authentication when the PIP connects to Snowflake. The PIP authenticates with an RSA private key stored as a Kubernetes Secret in the PlainID Authorization Agent (PAA) namespace, and Snowflake checks it against the public key assigned to the Snowflake user.

Placeholders

Replace these placeholders with the actual values throughout this page.

Configuring key-pair authentication

To configure key-pair authentication:

1. Assign the public key to the Snowflake user. In Snowflake, run:

   ALTER USER <SF_USER> SET RSA_PUBLIC_KEY='<contents of rsa_key.pub without the BEGIN/END lines>';
   

2. Create a Kubernetes Secret for the private key. Run:

   kubectl --context <CONTEXT> -n <NS> create secret generic snowflake-rsa-key \
     --from-file=rsa_key.p8=/path/to/rsa_key.p8
   

3. Add the driver and mount the key in the PIP Operator. In the values file, add the following under pipOperator::

   pipOperator:
     # Download the Snowflake JDBC driver into /app/lib, then start the PIP as usual
     command:
       - /bin/sh
       - -ec
       - |
         curl -o /app/lib/snowflake-jdbc-4.3.4.jar https://repo1.maven.org/maven2/net/snowflake/snowflake-jdbc/4.3.4/snowflake-jdbc-4.3.4.jar && \
         exec java ${JVM_OPTS} -Dcom.sun.jndi.ldap.connect.pool.protocol="plain ssl" -cp "$JAR_NAME" -Dorg.apache.cxf.transport.http.forceVersion=1.1 -Djava.net.preferIPv4Stack=true -Dloader.path=/app/lib/ -Dloader.main=com.plainid.pipoperator.Starter org.springframework.boot.loader.launch.PropertiesLauncher
   
     # Mount the private key at /etc/snowflake/rsa_key.p8
     extraVolumes:
       - name: snowflake-rsa-key
         secret:
           secretName: snowflake-rsa-key
           defaultMode: 0444
     extraVolumeMounts:
       - name: snowflake-rsa-key
         mountPath: /etc/snowflake
         readOnly: true
   

   Important: Keep defaultMode set to 0444. The pod runs as UID 1000, and a mode of 0400 makes the key unreadable.

   The pod downloads the driver from Maven Central each time it starts, so it needs internet access. Without internet access, build the JAR into the image or mount it into /app/lib.

4. Upgrade the release. Run:

   helm --kube-context <CONTEXT> upgrade <RELEASE> . -n <NS> \
     -f <VALUES_FILE>
   

   To confirm that the pod has the driver and the key, run:

   kubectl --context <CONTEXT> -n <NS> exec deploy/<RELEASE>-pip-operator -- \
     sh -c 'ls /app/lib | grep snowflake; ls -l /etc/snowflake/'
   

   If the values file sets fullnameOverride, use that name in place of <RELEASE>.

5. Set up the PIP data source with these settings:

   Field	Value
   URL	jdbc:snowflake://<ACCOUNT>.snowflakecomputing.com/?db=<DB>&schema=<SCHEMA>&warehouse=<WAREHOUSE>&role=<ROLE>&authenticator=snowflake_jwt&private_key_file=/etc/snowflake/rsa_key.p8
   Driver Class	net.snowflake.client.jdbc.SnowflakeDriver
   Username	<SF_USER>
   Password	Leave empty

Notes

• If the private key has a passphrase (the file starts with BEGIN ENCRYPTED PRIVATE KEY), add &private_key_file_pwd=<passphrase> to the URL.
• The driver generates a new JSON Web Token (JWT) each time, so the one-hour token expiry has no effect.
• The role in the URL must have access to the database and warehouse. Otherwise, Snowflake returns "object does not exist" errors.