---
title: "Snowflake"
slug: "snowflake-pip"
updated: 2026-10-18T16:24:34Z
published: 2026-10-18T16:24:34Z
canonical: "docs.plainid.io/snowflake-pip"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plainid.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Snowflake

PlainID supports key-pair authentication when the PIP connects to Snowflake. The PIP authenticates with an RSA private key stored as a Kubernetes Secret in the PlainID Authorization Agent (PAA) namespace, and Snowflake checks it against the public key assigned to the Snowflake user.

## Placeholders

Replace these placeholders with the actual values throughout this page.

| Placeholder | Description |
| --- | --- |
| `<CONTEXT>` | The Kubernetes context |
| `<NS>` | The namespace where the PAA runs |
| `<RELEASE>` | The Helm release name of the PAA |
| `<VALUES_FILE>` | The Helm values file |
| `<SF_USER>` | The Snowflake user the PIP connects as |

## Configuring key-pair authentication

**To configure key-pair authentication**:

1. Assign the public key to the Snowflake user. In Snowflake, run:

```
ALTER USER <SF_USER> SET RSA_PUBLIC_KEY='<contents of rsa_key.pub without the BEGIN/END lines>';
```
2. Create a Kubernetes Secret for the private key. Run:

```
kubectl --context <CONTEXT> -n <NS> create secret generic snowflake-rsa-key \
  --from-file=rsa_key.p8=/path/to/rsa_key.p8
```
3. Add the driver and mount the key in the PIP Operator. In the values file, add the following under `pipOperator:`:

```
pipOperator:
  # Download the Snowflake JDBC driver into /app/lib, then start the PIP as usual
  command:
    - /bin/sh
    - -ec
    - |
      curl -o /app/lib/snowflake-jdbc-4.3.4.jar https://repo1.maven.org/maven2/net/snowflake/snowflake-jdbc/4.3.4/snowflake-jdbc-4.3.4.jar && \
      exec java ${JVM_OPTS} -Dcom.sun.jndi.ldap.connect.pool.protocol="plain ssl" -cp "$JAR_NAME" -Dorg.apache.cxf.transport.http.forceVersion=1.1 -Djava.net.preferIPv4Stack=true -Dloader.path=/app/lib/ -Dloader.main=com.plainid.pipoperator.Starter org.springframework.boot.loader.launch.PropertiesLauncher

  # Mount the private key at /etc/snowflake/rsa_key.p8
  extraVolumes:
    - name: snowflake-rsa-key
      secret:
        secretName: snowflake-rsa-key
        defaultMode: 0444
  extraVolumeMounts:
    - name: snowflake-rsa-key
      mountPath: /etc/snowflake
      readOnly: true
```

**Important:** Keep `defaultMode` set to `0444`. The pod runs as UID 1000, and a mode of `0400` makes the key unreadable.

The pod downloads the driver from Maven Central each time it starts, so it needs internet access. Without internet access, build the JAR into the image or mount it into `/app/lib`.
4. Upgrade the release. Run:

```
helm --kube-context <CONTEXT> upgrade <RELEASE> . -n <NS> \
  -f <VALUES_FILE>
```

To confirm that the pod has the driver and the key, run:

```
kubectl --context <CONTEXT> -n <NS> exec deploy/<RELEASE>-pip-operator -- \
  sh -c 'ls /app/lib | grep snowflake; ls -l /etc/snowflake/'
```

If the values file sets `fullnameOverride`, use that name in place of `&lt;RELEASE&gt;`.
5. Set up the PIP data source with these settings:

| Field | Value |
| --- | --- |
| **URL** | `jdbc:snowflake://&lt;ACCOUNT&gt;.snowflakecomputing.com/?db=&lt;DB&gt;&amp;schema=&lt;SCHEMA&gt;&amp;warehouse=&lt;WAREHOUSE&gt;&amp;role=&lt;ROLE&gt;&amp;authenticator=snowflake_jwt&amp;private_key_file=/etc/snowflake/rsa_key.p8` |
| **Driver Class** | `net.snowflake.client.jdbc.SnowflakeDriver` |
| **Username** | `&lt;SF_USER&gt;` |
| **Password** | Leave empty |

## Notes

- If the private key has a passphrase (the file starts with `BEGIN ENCRYPTED PRIVATE KEY`), add `&amp;private_key_file_pwd=&lt;passphrase&gt;` to the URL.
- The driver generates a new JSON Web Token (JWT) each time, so the one-hour token expiry has no effect.
- The `role` in the URL must have access to the database and warehouse. Otherwise, Snowflake returns "object does not exist" errors.