This is an automated email from the ASF dual-hosted git repository.
vikaskr22 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/master by this push:
new 79343e6a9 RANGER-5530: Fix for KMS API not working in docker kerberos
env (#1004)
79343e6a9 is described below
commit 79343e6a9b8b5411ef18c455931ca2c9314798a0
Author: Vikas Kumar <[email protected]>
AuthorDate: Fri Jun 19 16:21:50 2026 +0530
RANGER-5530: Fix for KMS API not working in docker kerberos env (#1004)
* RANGER-5530: Fix for KMS API not working in docker kerberos env
* RANGER-5530: Fix for KMS API not working in docker kerberos env-fixed
Linkage error
---
.../ranger-docker/docker-compose.ranger-kms.yml | 3 +-
.../scripts/admin/create-ranger-services.py | 2 +-
.../ranger-docker/scripts/kdc/entrypoint.sh | 1 +
.../ranger-docker/scripts/kms/core-site.xml | 18 ++
dev-support/ranger-docker/scripts/kms/kms-site.xml | 196 +++++++++++++++++++++
.../ranger-docker/scripts/kms/ranger-kms.sh | 1 +
distro/src/main/assembly/kms.xml | 2 +
7 files changed, 221 insertions(+), 2 deletions(-)
diff --git a/dev-support/ranger-docker/docker-compose.ranger-kms.yml
b/dev-support/ranger-docker/docker-compose.ranger-kms.yml
index 36b01875b..8c2be20c6 100644
--- a/dev-support/ranger-docker/docker-compose.ranger-kms.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger-kms.yml
@@ -15,7 +15,8 @@ services:
volumes:
- ./dist/keytabs/ranger-kms:/etc/keytabs
- ./scripts/kdc/krb5.conf:/etc/krb5.conf
- - ./scripts/hadoop/core-site.xml:/home/ranger/scripts/core-site.xml:ro
+ - ./scripts/kms/core-site.xml:/home/ranger/scripts/core-site.xml:ro
+ - ./scripts/kms/kms-site.xml:/home/ranger/scripts/kms-site.xml:ro
- ./dist/version:/home/ranger/dist/version:ro
-
./scripts/kms/ranger-kms-install-${RANGER_DB_TYPE}.properties:/opt/ranger/kms/install.properties
stdin_open: true
diff --git a/dev-support/ranger-docker/scripts/admin/create-ranger-services.py
b/dev-support/ranger-docker/scripts/admin/create-ranger-services.py
index d073faa5f..7e2eae0ee 100644
--- a/dev-support/ranger-docker/scripts/admin/create-ranger-services.py
+++ b/dev-support/ranger-docker/scripts/admin/create-ranger-services.py
@@ -104,7 +104,7 @@ def service_not_exists(service):
kms = RangerService({'name': 'dev_kms', 'type': 'kms',
'configs': {'username': 'keyadmin', 'password':
'rangerR0cks!',
- 'provider': 'http://ranger-kms.rangernw:9292',
+ 'provider':
'kms://[email protected]:9292/kms',
'policy.download.auth.users': 'rangerkms',
'tag.download.auth.users': 'rangerkms',
'userstore.download.auth.users': 'rangerkms',
diff --git a/dev-support/ranger-docker/scripts/kdc/entrypoint.sh
b/dev-support/ranger-docker/scripts/kdc/entrypoint.sh
index 4e35f5457..ce2a7871e 100644
--- a/dev-support/ranger-docker/scripts/kdc/entrypoint.sh
+++ b/dev-support/ranger-docker/scripts/kdc/entrypoint.sh
@@ -89,6 +89,7 @@ function create_keytabs() {
create_principal_and_keytab rangerusersync ranger-usersync
create_principal_and_keytab rangerkms ranger-kms
+ create_principal_and_keytab HTTP ranger-kms
create_principal_and_keytab HTTP ranger-pdp
create_principal_and_keytab rangerpdp ranger-pdp
diff --git a/dev-support/ranger-docker/scripts/kms/core-site.xml
b/dev-support/ranger-docker/scripts/kms/core-site.xml
new file mode 100644
index 000000000..28492e4fb
--- /dev/null
+++ b/dev-support/ranger-docker/scripts/kms/core-site.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+ <property>
+ <name>hadoop.security.authentication</name>
+ <value>kerberos</value>
+ </property>
+ <property>
+ <name>hadoop.security.auth_to_local</name>
+
<value>RULE:[2:$1/$2@$0](rangeradmin/ranger\.rangernw@EXAMPLE\.COM)s/.*/ranger/
+RULE:[2:$1/$2@$0](rangertagsync/ranger-tagsync\.rangernw@EXAMPLE\.COM)s/.*/rangertagsync/
+RULE:[2:$1/$2$0](rangerusersync/ranger-usersync\.rangernw@EXAMPLE\.COM)s/.*/rangerusersync/
+RULE:[2:$1/$2$0](rangerkms/ranger-kms\.rangernw@EXAMPLE\.COM)s/.*/keyadmin/
+DEFAULT</value>
+ <description>
+ Rules used to resolve Kerberos principal names.
+ </description>
+ </property>
+</configuration>
diff --git a/dev-support/ranger-docker/scripts/kms/kms-site.xml
b/dev-support/ranger-docker/scripts/kms/kms-site.xml
new file mode 100755
index 000000000..541292b6c
--- /dev/null
+++ b/dev-support/ranger-docker/scripts/kms/kms-site.xml
@@ -0,0 +1,196 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<configuration>
+
+ <!-- KMS Backend KeyProvider -->
+
+ <property>
+ <name>hadoop.kms.key.provider.uri</name>
+ <value>dbks://http@localhost:9292/kms</value>
+ <description>
+ URI of the backing KeyProvider for the KMS.
+ </description>
+ </property>
+
+ <property>
+ <name>hadoop.security.keystore.JavaKeyStoreProvider.password</name>
+ <value>none</value>
+ <description>
+ If using the JavaKeyStoreProvider, the password for the keystore file.
+ </description>
+ </property>
+
+ <!-- KMS Cache -->
+
+ <property>
+ <name>hadoop.kms.cache.enable</name>
+ <value>true</value>
+ <description>
+ Whether the KMS will act as a cache for the backing KeyProvider.
+ When the cache is enabled, operations like getKeyVersion, getMetadata,
+ and getCurrentKey will sometimes return cached data without consulting
+ the backing KeyProvider. Cached values are flushed when keys are deleted
+ or modified.
+ </description>
+ </property>
+
+ <property>
+ <name>hadoop.kms.cache.timeout.ms</name>
+ <value>600000</value>
+ <description>
+ Expiry time for the KMS key version and key metadata cache, in
+ milliseconds. This affects getKeyVersion and getMetadata.
+ </description>
+ </property>
+
+ <property>
+ <name>hadoop.kms.current.key.cache.timeout.ms</name>
+ <value>30000</value>
+ <description>
+ Expiry time for the KMS current key cache, in milliseconds. This
+ affects getCurrentKey operations.
+ </description>
+ </property>
+
+ <!-- KMS Audit -->
+
+ <property>
+ <name>hadoop.kms.audit.aggregation.window.ms</name>
+ <value>10000</value>
+ <description>
+ Duplicate audit log events within the aggregation window (specified in
+ ms) are quashed to reduce log traffic. A single message for aggregated
+ events is printed at the end of the window, along with a count of the
+ number of aggregated events.
+ </description>
+ </property>
+
+ <!-- KMS Security -->
+
+ <property>
+ <name>hadoop.kms.authentication.type</name>
+ <value>kerberos</value>
+ <description>
+ Authentication type for the KMS. Can be either "simple"
+ or "kerberos".
+ </description>
+ </property>
+
+ <property>
+ <name>hadoop.kms.authentication.kerberos.keytab</name>
+ <value>/etc/keytabs/HTTP.keytab</value>
+ <description>
+ Path to the keytab with credentials for the configured Kerberos
principal.
+ </description>
+ </property>
+
+ <property>
+ <name>hadoop.kms.authentication.kerberos.principal</name>
+ <value>HTTP/[email protected]</value>
+ <description>
+ The Kerberos principal to use for the HTTP endpoint.
+ The principal must start with 'HTTP/' as per the Kerberos HTTP SPNEGO
specification.
+ </description>
+ </property>
+
+ <property>
+ <name>hadoop.kms.authentication.kerberos.name.rules</name>
+
<value>RULE:[2:$1/$2@$0](rangeradmin/ranger\.rangernw@EXAMPLE\.COM)s/.*/ranger/
+RULE:[2:$1/$2@$0](rangertagsync/ranger-tagsync\.rangernw@EXAMPLE\.COM)s/.*/rangertagsync/
+RULE:[2:$1/$2$0](rangerusersync/ranger-usersync\.rangernw@EXAMPLE\.COM)s/.*/rangerusersync/
+RULE:[2:$1/$2$0](rangerkms/ranger-kms\.rangernw@EXAMPLE\.COM)s/.*/keyadmin/
+DEFAULT</value>
+ <description>
+ Rules used to resolve Kerberos principal names.
+ </description>
+ </property>
+
+ <!-- Authentication cookie signature source -->
+
+ <property>
+ <name>hadoop.kms.authentication.signer.secret.provider</name>
+ <value>random</value>
+ <description>
+ Indicates how the secret to sign the authentication cookies will be
+ stored. Options are 'random' (default), 'string' and 'zookeeper'.
+ If using a setup with multiple KMS instances, 'zookeeper' should be used.
+ </description>
+ </property>
+
+ <!-- Configuration for 'zookeeper' authentication cookie signature source -->
+
+ <property>
+
<name>hadoop.kms.authentication.signer.secret.provider.zookeeper.path</name>
+ <value>/hadoop-kms/hadoop-auth-signature-secret</value>
+ <description>
+ The Zookeeper ZNode path where the KMS instances will store and retrieve
+ the secret from.
+ </description>
+ </property>
+
+ <property>
+
<name>hadoop.kms.authentication.signer.secret.provider.zookeeper.connection.string</name>
+ <value>#HOSTNAME#:#PORT#,...</value>
+ <description>
+ The Zookeeper connection string, a list of hostnames and port comma
+ separated.
+ </description>
+ </property>
+
+ <property>
+
<name>hadoop.kms.authentication.signer.secret.provider.zookeeper.auth.type</name>
+ <value>kerberos</value>
+ <description>
+ The Zookeeper authentication type, 'none' or 'sasl' (Kerberos).
+ </description>
+ </property>
+
+ <property>
+
<name>hadoop.kms.authentication.signer.secret.provider.zookeeper.kerberos.keytab</name>
+ <value>/etc/hadoop/conf/kms.keytab</value>
+ <description>
+ The absolute path for the Kerberos keytab with the credentials to
+ connect to Zookeeper.
+ </description>
+ </property>
+
+ <property>
+
<name>hadoop.kms.authentication.signer.secret.provider.zookeeper.kerberos.principal</name>
+ <value>kms/#HOSTNAME#</value>
+ <description>
+ The Kerberos service principal used to connect to Zookeeper.
+ </description>
+ </property>
+
+ <property>
+ <name>hadoop.kms.security.authorization.manager</name>
+
<value>org.apache.ranger.authorization.kms.authorizer.RangerKmsAuthorizer</value>
+ </property>
+
+ <property>
+ <name>hadoop.kms.proxyuser.ranger.groups</name>
+ <value>*</value>
+ </property>
+
+ <property>
+ <name>hadoop.kms.proxyuser.ranger.hosts</name>
+ <value>*</value>
+ </property>
+
+ <property>
+ <name>hadoop.kms.proxyuser.ranger.users</name>
+ <value>*</value>
+ </property>
+</configuration>
diff --git a/dev-support/ranger-docker/scripts/kms/ranger-kms.sh
b/dev-support/ranger-docker/scripts/kms/ranger-kms.sh
index 3e6b9c707..b88c1197f 100755
--- a/dev-support/ranger-docker/scripts/kms/ranger-kms.sh
+++ b/dev-support/ranger-docker/scripts/kms/ranger-kms.sh
@@ -37,6 +37,7 @@ then
if [ "${KERBEROS_ENABLED}" == "true" ]
then
cp ${RANGER_SCRIPTS}/core-site.xml
${RANGER_HOME}/kms/ews/webapp/WEB-INF/classes/conf/core-site.xml
+ cp ${RANGER_SCRIPTS}/kms-site.xml
${RANGER_HOME}/kms/ews/webapp/WEB-INF/classes/conf/kms-site.xml
fi
touch "${RANGER_HOME}"/.setupDone
diff --git a/distro/src/main/assembly/kms.xml b/distro/src/main/assembly/kms.xml
index c786761a0..b190ea54c 100755
--- a/distro/src/main/assembly/kms.xml
+++ b/distro/src/main/assembly/kms.xml
@@ -201,6 +201,7 @@
<include>com.fasterxml.jackson.core:jackson-core:jar:${fasterxml.jackson.version}</include>
<include>com.fasterxml.jackson.core:jackson-databind:jar:${fasterxml.jackson.databind.version}</include>
<include>org.javassist:javassist</include>
+
<include>org.apache.ranger:ranger-common-utils</include>
</includes>
</dependencySet>
</dependencySets>
@@ -273,6 +274,7 @@
<useAllReactorProjects>true</useAllReactorProjects>
<includes>
<include>org.apache.ranger:ranger-util</include>
+ <include>org.apache.ranger:ranger-common-utils</include>
<include>org.apache.ranger:ranger-kms-plugin-shim</include>
<include>org.apache.ranger:ranger-plugin-classloader</include>
<include>org.apache.ranger:credentialbuilder</include>
