[ranger] branch ranger-2.4 updated: RANGER-4008: updated RangerTagEnricher to ignore invalid resources

[madhan]

This is an automated email from the ASF dual-hosted git repository.

madhan pushed a commit to branch ranger-2.4
in repository https://gitbox.apache.org/repos/asf/ranger.git


The following commit(s) were added to refs/heads/ranger-2.4 by this push:
     new 950aa7187 RANGER-4008: updated RangerTagEnricher to ignore invalid 
resources
950aa7187 is described below

commit 950aa71871879fe4815de9961433ca55f559f841
Author: Madhan Neethiraj <mad...@apache.org>
AuthorDate: Thu Dec 8 14:13:21 2022 -0800

    RANGER-4008: updated RangerTagEnricher to ignore invalid resources
    
    (cherry picked from commit 623a6afdc2b5b4bd3dc43ab927a16db4f3ce6573)
---
 .../plugin/contextenricher/RangerTagEnricher.java  | 36 ++++++++++------------
 1 file changed, 16 insertions(+), 20 deletions(-)

diff --git 
a/agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagEnricher.java
 
b/agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagEnricher.java
index 2e442c2d0..da06e4161 100644
--- 
a/agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagEnricher.java
+++ 
b/agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagEnricher.java
@@ -62,6 +62,7 @@ import java.util.Date;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
+import java.util.ListIterator;
 import java.util.Map;
 import java.util.Set;
 import java.util.Timer;
@@ -418,44 +419,39 @@ public class RangerTagEnricher extends 
RangerAbstractContextEnricher {
                        LOG.debug("Processing all service-tags");
                }
 
-               boolean isInError = false;
-
                if (CollectionUtils.isEmpty(serviceTags.getServiceResources())) 
{
                        LOG.info("There are no tagged resources for service " + 
serviceName);
                        enrichedServiceTags = null;
                } else {
-
-                       ResourceHierarchies    hierarchies      = new 
ResourceHierarchies();
-
+                       ResourceHierarchies                hierarchies      = 
new ResourceHierarchies();
                        List<RangerServiceResourceMatcher> resourceMatchers = 
new ArrayList<>();
                        List<RangerServiceResource>        serviceResources = 
serviceTags.getServiceResources();
 
-                       for (RangerServiceResource serviceResource : 
serviceResources) {
+                       for (ListIterator<RangerServiceResource> iter = 
serviceResources.listIterator(); iter.hasNext(); ) {
+                               RangerServiceResource        serviceResource    
    = iter.next();
                                RangerServiceResourceMatcher 
serviceResourceMatcher = createRangerServiceResourceMatcher(serviceResource, 
serviceDefHelper, hierarchies);
+
                                if (serviceResourceMatcher != null) {
                                        
resourceMatchers.add(serviceResourceMatcher);
                                } else {
-                                       LOG.error("Could not create 
service-resource-matcher for service-resource:[" + serviceResource + "]");
-                                       isInError = true;
-                                       break;
+                                       iter.remove();
+
+                                       List<Long> tags = 
serviceTags.getResourceToTagIds().remove(serviceResource.getId());
+
+                                       LOG.warn("Invalid resource [" + 
serviceResource + "]: failed to create resource-matcher. Ignoring " + (tags != 
null ? tags.size() : 0) + " tags associated with the resource");
                                }
                        }
 
-                       if (isInError) {
-                               serviceTags.setTagVersion(-1L);
-                               LOG.error("Error in processing tag-deltas. Will 
continue to use old tags");
-                       } else {
-                               Map<String, 
RangerResourceTrie<RangerServiceResourceMatcher>> serviceResourceTrie = null;
+                       Map<String, 
RangerResourceTrie<RangerServiceResourceMatcher>> serviceResourceTrie = null;
 
-                               if (!disableTrieLookupPrefilter) {
-                                       serviceResourceTrie = new HashMap<>();
+                       if (!disableTrieLookupPrefilter) {
+                               serviceResourceTrie = new HashMap<>();
 
-                                       for (RangerServiceDef.RangerResourceDef 
resourceDef : serviceDef.getResources()) {
-                                               
serviceResourceTrie.put(resourceDef.getName(), new 
RangerResourceTrie(resourceDef, resourceMatchers, 
getPolicyEngineOptions().optimizeTagTrieForRetrieval, 
getPolicyEngineOptions().optimizeTagTrieForSpace, null));
-                                       }
+                               for (RangerServiceDef.RangerResourceDef 
resourceDef : serviceDef.getResources()) {
+                                       
serviceResourceTrie.put(resourceDef.getName(), new 
RangerResourceTrie(resourceDef, resourceMatchers, 
getPolicyEngineOptions().optimizeTagTrieForRetrieval, 
getPolicyEngineOptions().optimizeTagTrieForSpace, null));
                                }
-                               enrichedServiceTags = new 
EnrichedServiceTags(serviceTags, resourceMatchers, serviceResourceTrie);
                        }
+                       enrichedServiceTags = new 
EnrichedServiceTags(serviceTags, resourceMatchers, serviceResourceTrie);
                }
        }