Connect Snowflake

Kubit connects directly to Snowflake and queries your data in place. You create a dedicated role, user, database and warehouse, all named KUBIT, then grant the role read-only access to the schemas Kubit should see. Nothing is copied out of your account. The setup takes about 20 minutes.

Before you start

A Snowflake role that can create roles, users, databases and warehouses (ACCOUNTADMIN, or SECURITYADMIN plus SYSADMIN)
openssl on your machine, to generate the key pair
The schemas that hold the tables or views Kubit should query
If your Snowflake account has a network policy, Kubit’s IP ranges. See Allow Kubit’s IP ranges.

Steps

Create a role

Create a role named KUBIT.

CREATE ROLE KUBIT;

Generate a key pair

Kubit authenticates to Snowflake with key pair auth. Generate an encrypted private key and its public key. openssl asks for a passphrase. Keep it, since Kubit needs it with the private key.

openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 des3 -inform PEM -out rsa_key.p8
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

Snowflake’s key pair authentication guide covers the options.

Create a user

Create a user named KUBIT with the public key from the previous step. Paste the contents of rsa_key.pub without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- lines.

CREATE USER KUBIT RSA_PUBLIC_KEY = '<contents-of-rsa_key.pub>' DEFAULT_ROLE = KUBIT;
GRANT ROLE KUBIT TO USER KUBIT;

Create a database

Kubit keeps a small auxiliary table in its own database to support some features. Create a database named KUBIT and make the KUBIT role its owner, so Kubit can create and run the tasks that need an owner role.

CREATE DATABASE KUBIT;
GRANT OWNERSHIP ON DATABASE KUBIT TO ROLE KUBIT;

Create a warehouse

Create a warehouse named KUBIT and grant the KUBIT role MONITOR, USAGE and OPERATE on it. Start small. Warehouse configuration explains when to size up.

CREATE OR REPLACE WAREHOUSE KUBIT
  WAREHOUSE_SIZE = 'XSMALL'
  AUTO_RESUME = TRUE
  AUTO_SUSPEND = 60
  INITIALLY_SUSPENDED = TRUE;
GRANT MONITOR ON WAREHOUSE KUBIT TO ROLE KUBIT;
GRANT USAGE ON WAREHOUSE KUBIT TO ROLE KUBIT;
GRANT OPERATE ON WAREHOUSE KUBIT TO ROLE KUBIT;

Grant read access

Give the KUBIT role read-only access to each schema that holds the views Kubit queries. The FUTURE grant covers views you add later. Replace <database> and <schema> with your own names.

GRANT USAGE ON DATABASE <database> TO ROLE KUBIT;
GRANT USAGE ON SCHEMA <database>.<schema> TO ROLE KUBIT;
GRANT SELECT ON ALL VIEWS IN SCHEMA <database>.<schema> TO ROLE KUBIT;
GRANT SELECT ON FUTURE VIEWS IN SCHEMA <database>.<schema> TO ROLE KUBIT;

Add the connection in Kubit

Kubit needs four values: your Snowflake account locator, the private key (rsa_key.p8), the key passphrase and the warehouse name (KUBIT).

For help with the setup, share the same four values with the Kubit team through a secure channel such as a password manager.

Split test and production (optional)

Create a second role, user and warehouse for development. Keeping development queries off the production warehouse avoids any impact on live workloads.

Verify

Check the grants as an admin. The output lists USAGE and SELECT on your schemas, and MONITOR, USAGE and OPERATE on warehouse KUBIT.

SHOW GRANTS TO ROLE KUBIT;
SHOW FUTURE GRANTS IN SCHEMA <database>.<schema>;

Best practices

Clustering keys

Kubit queries time series data, so cluster fact tables larger than 1 TB by date. Most Kubit reports also filter by event name, so add event name as the second clustering column. Snowflake’s clustering keys reference covers the syntax.

Warehouse configuration

Four warehouse settings affect Kubit’s cost and speed.

Setting	Recommendation
Type	Gen2, for analytical workloads
Size	Start small. Size up only when Query History shows it’s needed. If reports are slow, open them in Query Profile and look for bytes spilled to disk above 0. Frequent spilling means the warehouse is too small.
Auto resume	On, so any Kubit query wakes the warehouse
Auto suspend	The minimum, 1 minute. A longer idle time saves a few seconds of wake-up on some reports and costs more.

Next steps

Bring your own warehouse: how Kubit queries your warehouse in place.
Allow Kubit’s IP ranges: let Kubit through a network policy or firewall.

Start here

Agent Observability

Product Analytics

Bring your own warehouse

Connect Snowflake

Before you start

Steps

Create a role

Generate a key pair

Create a user

Create a database

Create a warehouse

Grant read access

Add the connection in Kubit

Split test and production (optional)

Verify

Best practices

Clustering keys

Warehouse configuration

Next steps

​Before you start

​Steps

Create a role

Generate a key pair

Create a user

Create a database

Create a warehouse

Grant read access

Add the connection in Kubit

Split test and production (optional)

​Verify

​Best practices

​Clustering keys

​Warehouse configuration

​Next steps

Before you start

Steps

Verify

Best practices

Clustering keys

Warehouse configuration

Next steps