Skip to content

Conversation

@Flgado
Copy link
Member

@Flgado Flgado commented Dec 12, 2025

Description

This PR adds support for the Secure SOCKS Proxy in the Grafana Trino plugin. This feature allows datasource connections to be proxied through a SOCKS5 proxy with TLS, enabling Grafana users to connect to Trino instances that reside in different networks than Grafana, even when opening ports to the public internet is not possible.

Implementation details

  • The feature is now available in Grafana OSS without a feature toggle. However, non-core datasources still use a feature toggle until the frontend dependency @grafana/runtime is upgraded to at least version 10.0.0. Once upgraded, we can switch this check
    to `config.secureSocksDSProxyEnabled instead of using the feature toggle.

  • The grafana-plugin-sdk injects variables into the context. To build the proxy settings here
    , the context needs to be injected in main.go.

    • This required updating sqlds to version 3, as version 2 did not support passing the context to the necessary functions.
  • Apart from updating sqlds, changes to the backend are minimal, since grafana-plugin-sdk handles most of the heavy lifting, and Trino supports custom clients.

Considerations

  • This implementation will not work for the Spooling protocol when not using COORDINATOR_PROXY in all scenarios
    - The HTTP client used to communicate with the coordinator is the same one used to fetch spooled segments. When the proxy is enabled, all traffic goes through the proxy. If the proxy resides in a private network, it may not be able to fetch data from external storage, such as S3 buckets.

Screenshot of config page

image

Screenshot showing the traffic going through proxy

image

This PR close issue #312

@cla-bot cla-bot bot added the cla-signed label Dec 12, 2025
@Flgado
Copy link
Member Author

Flgado commented Dec 12, 2025

@nineinchnick Is there anything I need to do on #325 to start unlocking or merging some of the pending PRs?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Development

Successfully merging this pull request may close these issues.

1 participant