This is an automated email from the ASF dual-hosted git repository. ramackri pushed a commit to branch RANGER-ozone-action-policy-feature-flag in repository https://gitbox.apache.org/repos/asf/ranger.git
commit 82649e7c0d76ccb950cac74f6100df6eb357b495 Author: ramk <[email protected]> AuthorDate: Tue Jul 14 21:33:12 2026 +0530 RANGER-5628: Add Ozone action-policy feature flag testing docs and scripts Document upgrade/E2E scenarios (flag OFF/ON, J10065 patch behavior) and add quick-rule lab script for patch gating validation in ranger-docker. --- dev-support/ranger-docker/README.md | 14 + .../OZONE-ACTION-POLICY-FEATURE-FLAG-TESTING.md | 335 +++++++++++++++++++++ .../ozone/test-ozone-action-feature-flag.sh | 5 + .../ozone/test-ozone-action-patch-quick-rule.sh | 212 +++++++++++++ 4 files changed, 566 insertions(+) diff --git a/dev-support/ranger-docker/README.md b/dev-support/ranger-docker/README.md index 64276a4ef..8f89b9030 100644 --- a/dev-support/ranger-docker/README.md +++ b/dev-support/ranger-docker/README.md @@ -95,6 +95,20 @@ docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-hadoop.yml ./scripts/ozone/ozone-plugin-docker-setup.sh docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-ozone.yml up -d ~~~ + +#### Ozone action-policy feature flag (RANGER-5628) testing + +Upgrade and E2E steps (flag OFF/ON, fresh install vs upgrade, DB patch `J10065`): + +~~~ +./scripts/ozone/OZONE-ACTION-POLICY-FEATURE-FLAG-TESTING.md + +EXPECT_ENABLED=false ./scripts/ozone/test-ozone-action-feature-flag.sh +EXPECT_ENABLED=true ./scripts/ozone/test-ozone-action-feature-flag.sh + +# Quick rule lab test (delete J10065, javapatch with flag OFF then ON): +./scripts/ozone/test-ozone-action-patch-quick-rule.sh both +~~~ #### Bring up trino container (requires docker build with jdk 11): ~~~ docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-trino.yml up -d diff --git a/dev-support/ranger-docker/scripts/ozone/OZONE-ACTION-POLICY-FEATURE-FLAG-TESTING.md b/dev-support/ranger-docker/scripts/ozone/OZONE-ACTION-POLICY-FEATURE-FLAG-TESTING.md new file mode 100644 index 000000000..a759ef99d --- /dev/null +++ b/dev-support/ranger-docker/scripts/ozone/OZONE-ACTION-POLICY-FEATURE-FLAG-TESTING.md @@ -0,0 +1,335 @@ +<!--- +Licensed to the Apache Software Foundation (ASF) under one +or more contributor license agreements. See the NOTICE file +distributed with this work for additional information +regarding copyright ownership. The ASF licenses this file +to you under the Apache License, Version 2.0 (the +"License"); you may not use this file except in compliance +with the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +--> + +# Ozone action-policy feature flag — upgrade and E2E testing + +RANGER-5628 gates Ozone `action-matches` policy support behind feature flags (default **off**). + +| Layer | Property | Default | +|-------|----------|---------| +| Ranger Admin + DB patch | `ranger.ozone.action.policy.enabled` in `ranger-admin-default-site.xml` / `ranger-admin-site.xml` | `false` | +| Ozone authorizer plugin | `ranger.plugin.ozone.action.policy.enabled` in `ranger-ozone-security.xml` | `false` | +| Admin UI | `ozoneActionPolicyEnabled` via `/service/users/profile` → `configProperties` | `false` | + +DB patch **`PatchForOzoneServiceDefPolicyConditionUpdate_J10065`** is tracked in `x_db_version_h` as version **`J10065`**. It runs **at most once** per database. If the flag is `false` on that first run, the patch skips the service-def update but is still marked applied — enabling the flag later does **not** re-trigger the patch. + +--- + +## Prerequisites + +1. Working directory: `dev-support/ranger-docker` +2. Ranger built and images available (`ranger:latest`, `ranger-ozone:latest`), or use `docker compose` build. +3. Ozone stack (optional but recommended for full E2E): + ```bash + ./scripts/ozone/ozone-plugin-docker-setup.sh + docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-ozone.yml up -d + ``` +4. Postgres admin DB (default in `.env`: `RANGER_DB_TYPE=postgres`). + +--- + +## Quick smoke (flag OFF / ON) + +Automated checks: login, user profile flag, ozone service-def info, ozone-om HTTP (and CLI when keytab exists). + +```bash +cd dev-support/ranger-docker + +# Flag OFF (default) +EXPECT_ENABLED=false ./scripts/ozone/test-ozone-action-feature-flag.sh + +# Flag ON (after setting properties below and restarting services) +EXPECT_ENABLED=true ./scripts/ozone/test-ozone-action-feature-flag.sh +``` + +Environment overrides: + +```bash +export RANGER_URL=http://localhost:6080 +export RANGER_USER=admin +export RANGER_PASS='rangerR0cks!' +export EXPECT_ENABLED=false # or true +``` + +--- + +## Enable flag ON (admin + plugin) + +**Ranger Admin** — add to `ranger-admin-site.xml` (inside the `ranger` container or mounted conf): + +```xml +<property> + <name>ranger.ozone.action.policy.enabled</name> + <value>true</value> +</property> +``` + +Restart admin: + +```bash +docker compose -f docker-compose.ranger.yml restart ranger +``` + +**Ozone plugin** — add to `ranger-ozone-security.xml` on the ozone OM host/container: + +```xml +<property> + <name>ranger.plugin.ozone.action.policy.enabled</name> + <value>true</value> +</property> +``` + +Restart ozone OM: + +```bash +docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-ozone.yml restart ozone-om +``` + +To return to flag OFF, set both values to `false` (or remove overrides and rely on defaults), then restart admin and `ozone-om`. + +--- + +## Verification helpers + +### DB patch status + +Connect to Postgres (adjust host/user/db for your `.env`): + +```bash +docker exec -it ranger-postgres psql -U postgres -d ranger -c \ + "SELECT version, active, inst_at, updated_by FROM x_db_version_h WHERE version = 'J10065';" +``` + +- **Row with `active='Y'`** → patch already applied; will not run again on admin restart. +- **No row** → patch is pending; runs on next admin startup that executes Java patches. + +### Admin logs (patch run / skip) + +```bash +docker logs ranger 2>&1 | grep -iE 'J10065|ozone.action.policy|ozone service-def' +``` + +Expected messages: + +- First run, flag OFF: `ranger.ozone.action.policy.enabled=false; skipping ozone service-def patch` +- First run, flag ON: service-def update applied +- Subsequent starts: patch already applied (no re-execution) + +### User profile API (UI flag) + +```bash +COOKIE_JAR=$(mktemp) +curl -s -c "$COOKIE_JAR" -X POST http://localhost:6080/login \ + -d 'username=admin&password=rangerR0cks!' +curl -s -b "$COOKIE_JAR" http://localhost:6080/service/users/profile \ + | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('configProperties',{}).get('ozoneActionPolicyEnabled'))" +rm -f "$COOKIE_JAR" +``` + +Expect `false` (default) or `true` when admin property is enabled. + +### Ozone service-def (`action-matches` condition) + +```bash +COOKIE_JAR=$(mktemp) +curl -s -c "$COOKIE_JAR" -X POST http://localhost:6080/login \ + -d 'username=admin&password=rangerR0cks!' +curl -s -b "$COOKIE_JAR" http://localhost:6080/service/plugins/definitions/name/ozone \ + | python3 -c "import json,sys; d=json.load(sys.stdin); print([c.get('name') for c in (d.get('policyConditions') or [])])" +rm -f "$COOKIE_JAR" +``` + +Note: embedded ozone service-def JSON may still list `action-matches` even when the flag is OFF. The flag gates **UI exposure** and **authorizer behavior**, not necessarily the static JSON in all upgrade paths. + +### Unit tests (no Docker) + +```bash +cd plugin-ozone +mvn test -Dtest=TestRangerOzoneAuthorizer +``` + +--- + +## What each layer does when flag is OFF vs ON + +| Layer | Flag OFF | Flag ON | +|-------|----------|---------| +| DB patch `J10065` (first run only) | Runs once if pending; skips service-def update | Runs once if pending; applies service-def update | +| Admin UI | `ozoneActionPolicyEnabled=false`; no Action column on permission rows | `true`; Action condition visible per row | +| Ozone authorizer | Does not set S3 action on authorize context | Sets action from request for `action-matches` evaluation | + +--- + +## Scenario A — Fresh install, flag OFF (default) + +Simulates a new Ranger 2.9 admin: default flag, patch not yet in DB. + +1. **Use a fresh Postgres volume** (or lab-only: delete patch row): + ```sql + DELETE FROM x_db_version_h WHERE version = 'J10065'; + ``` +2. Ensure **no** override in `ranger-admin-site.xml` (default from `ranger-admin-default-site.xml` is `false`). +3. Deploy the feature-flag build and **start Ranger Admin** (first startup). +4. **Verify:** + - `x_db_version_h` contains `J10065` with `active='Y'`. + - Admin log shows skip message when flag is false. + - `EXPECT_ENABLED=false ./scripts/ozone/test-ozone-action-feature-flag.sh` passes. +5. **Restart admin** — confirm patch does **not** run again (already applied). + +### A.1 — Enable flag later (documents patch limitation) + +6. Set `ranger.ozone.action.policy.enabled=true` in `ranger-admin-site.xml`; restart admin. +7. **Verify:** profile API returns `ozoneActionPolicyEnabled=true`, but **`J10065` does not re-run** (row still `active='Y'`). +8. Set `ranger.plugin.ozone.action.policy.enabled=true` in `ranger-ozone-security.xml`; restart `ozone-om`. +9. Run `EXPECT_ENABLED=true ./scripts/ozone/test-ozone-action-feature-flag.sh`. + +This confirms: turning the flag ON after first boot activates UI + plugin only; it does **not** re-apply the Java patch. + +--- + +## Scenario B — Upgrade from 2.9 with patch already applied (#1054 / RC smoke) + +Simulates production upgrade where `J10065` already ran before the feature-flag change. + +1. **Check DB:** + ```sql + SELECT * FROM x_db_version_h WHERE version = 'J10065'; + ``` + If a row exists, the patch will never run again. + +2. Deploy new admin image (feature-flag build); restart `ranger`. + +3. **Flag OFF test:** + - Leave `ranger.ozone.action.policy.enabled` at default `false`. + - `EXPECT_ENABLED=false ./scripts/ozone/test-ozone-action-feature-flag.sh` + - Service-def may still include `action-matches` from the earlier patch — expected; flag gates UI and authorizer. + +4. **Flag ON test:** + - Set admin and plugin properties to `true`; restart admin and `ozone-om`. + - `EXPECT_ENABLED=true ./scripts/ozone/test-ozone-action-feature-flag.sh` + - Optionally confirm Action condition in the policy UI for an Ozone policy. + +This is the primary sign-off path for RC0 / existing smoke environments. + +--- + +## Scenario C — Fresh install, flag ON from day one + +Simulates greenfield install with the feature enabled before first admin startup. + +1. Fresh DB; ensure no `J10065` row (or delete it on a lab DB only). +2. **Before first admin start**, set in `ranger-admin-site.xml`: + ```xml + <property> + <name>ranger.ozone.action.policy.enabled</name> + <value>true</value> + </property> + ``` +3. Set in `ranger-ozone-security.xml`: + ```xml + <property> + <name>ranger.plugin.ozone.action.policy.enabled</name> + <value>true</value> + </property> + ``` +4. Start admin → patch runs **once** and applies ozone service-def update. +5. Bring up ozone stack; run `EXPECT_ENABLED=true ./scripts/ozone/test-ozone-action-feature-flag.sh`. + +--- + +## Scenario D — Quick rule lab test (delete `J10065`, flag OFF/ON) + +Use this to prove patch gating on a **smoke / lab DB** (not production). + +### Quick rule + +| DB state | Flag | Patch runs? | Service-def updated? | `J10065` row after | +|----------|------|-------------|----------------------|--------------------| +| No `J10065` row | OFF | Yes, once | No | `active=Y` | +| No `J10065` row | ON | Yes, once | Yes | `active=Y` | +| `J10065` active=Y | OFF or ON | **No** | From prior run only | unchanged | + +**Important:** On an existing DB, `JAVA_PATCHES` is already `active=Y`, so a normal admin **restart does not** re-run java patches. To re-test `J10065`, delete both rows and invoke `db_setup.py -javapatch` (other `J*` patches are skipped because they are already applied). + +### Automated (recommended) + +```bash +cd dev-support/ranger-docker +chmod +x scripts/ozone/test-ozone-action-patch-quick-rule.sh + +# Flag OFF: patch runs, skips service-def update, J10065 inserted +./scripts/ozone/test-ozone-action-patch-quick-rule.sh off + +# Flag ON: delete J10065 again, patch runs, applies service-def update +./scripts/ozone/test-ozone-action-patch-quick-rule.sh on + +# Or both back-to-back +./scripts/ozone/test-ozone-action-patch-quick-rule.sh both +``` + +Set `RUN_E2E=false` if Ranger Admin HTTP is down; patch + DB checks still validate the quick rule. + +### Manual steps (same logic) + +```sql +-- before each half of the quick rule test +DELETE FROM x_db_version_h WHERE version = 'J10065'; +DELETE FROM x_db_version_h WHERE version = 'JAVA_PATCHES' AND inst_by = 'Ranger 2.9.0'; +``` + +1. Set `ranger.ozone.action.policy.enabled` to `false` or `true` in `ranger-admin-site.xml`. +2. Inside the `ranger` container: + ```bash + cd /opt/ranger/admin && python3 db_setup.py -javapatch + ``` +3. Verify: + ```sql + SELECT version, active FROM x_db_version_h WHERE version = 'J10065'; + ``` +4. Check javapatch output: + - OFF: `skipping ozone service-def policy condition update` + - ON: patch completes without skip message +5. Optional E2E: + ```bash + EXPECT_ENABLED=false ./scripts/ozone/test-ozone-action-feature-flag.sh + EXPECT_ENABLED=true ./scripts/ozone/test-ozone-action-feature-flag.sh + ``` + +Do **not** run on production DBs. + +--- + +## Recommended PR / release sign-off order + +1. **Scenario B** on existing smoke Postgres (upgrade path) — OFF, then ON. +2. **Scenario A** on fresh Postgres volume — default OFF, patch-once behavior. +3. **Scenario C** on fresh Postgres — flag ON at install, patch applies service-def. +4. **Unit tests:** `TestRangerOzoneAuthorizer` (flag on/off). + +--- + +## Troubleshooting + +| Symptom | Check | +|---------|--------| +| E2E profile flag mismatch | `ranger-admin-site.xml` override; admin restarted after change? | +| Flag ON but no Action in UI | Profile API `ozoneActionPolicyEnabled`; browser cache / re-login | +| Ozone authorize ignores action | `ranger.plugin.ozone.action.policy.enabled` in ozone plugin conf; `ozone-om` restarted | +| Patch never updates service-def | `J10065` already applied with flag OFF earlier; need fresh DB or lab delete of patch row | +| `ozone-om` / CLI skipped in E2E | Container not running or `ozone.service.keytab` missing (OM HTTP check still valid) | +| Solr audit errors in docker | Use log4j audit in `scripts/ozone/ranger-ozone-plugin-install.properties` as in release smoke setup | diff --git a/dev-support/ranger-docker/scripts/ozone/test-ozone-action-feature-flag.sh b/dev-support/ranger-docker/scripts/ozone/test-ozone-action-feature-flag.sh index 3b544f411..953521e34 100755 --- a/dev-support/ranger-docker/scripts/ozone/test-ozone-action-feature-flag.sh +++ b/dev-support/ranger-docker/scripts/ozone/test-ozone-action-feature-flag.sh @@ -17,6 +17,11 @@ set -euo pipefail +# Full upgrade/E2E matrix (scenarios A–D, SQL checks, flag ON/OFF steps): +# ./OZONE-ACTION-POLICY-FEATURE-FLAG-TESTING.md +# Quick rule lab test (delete J10065 + javapatch, flag OFF/ON): +# ./test-ozone-action-patch-quick-rule.sh off|on|both + RANGER_URL="${RANGER_URL:-http://localhost:6080}"; RANGER_USER="${RANGER_USER:-admin}" RANGER_PASS="${RANGER_PASS:-rangerR0cks!}" diff --git a/dev-support/ranger-docker/scripts/ozone/test-ozone-action-patch-quick-rule.sh b/dev-support/ranger-docker/scripts/ozone/test-ozone-action-patch-quick-rule.sh new file mode 100755 index 000000000..1b397d78f --- /dev/null +++ b/dev-support/ranger-docker/scripts/ozone/test-ozone-action-patch-quick-rule.sh @@ -0,0 +1,212 @@ +#!/usr/bin/env bash +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Lab test for J10065 patch gating (flag OFF vs ON). +# +# Quick rule: +# | DB state | Flag | Patch runs? | Service-def updated? | +# | No J10065 row | OFF | Yes, once | No | +# | No J10065 row | ON | Yes, once | Yes | +# | J10065 active=Y | * | No | From prior run only | +# +# On an existing smoke DB, admin restart alone does NOT re-run java patches. +# Delete J10065 + JAVA_PATCHES, then run db_setup.py -javapatch (other J* skip). +# +# Usage: +# ./test-ozone-action-patch-quick-rule.sh off +# ./test-ozone-action-patch-quick-rule.sh on +# ./test-ozone-action-patch-quick-rule.sh both +# +# Optional env: +# RANGER_CONTAINER=ranger +# POSTGRES_CONTAINER=ranger-postgres +# RANGER_INST_BY='Ranger 2.9.0' +# RANGER_URL=http://localhost:6080 +# RUN_E2E=true|false (default true when admin HTTP is up) +# RANGER_DOCKER_DIR=.../dev-support/ranger-docker (auto-detected) + +set -euo pipefail + +MODE="${1:-}" +RANGER_CONTAINER="${RANGER_CONTAINER:-ranger}" +POSTGRES_CONTAINER="${POSTGRES_CONTAINER:-ranger-postgres}" +RANGER_INST_BY="${RANGER_INST_BY:-Ranger 2.9.0}" +RANGER_URL="${RANGER_URL:-http://localhost:6080}"; +RUN_E2E="${RUN_E2E:-true}" +PROP_NAME="ranger.ozone.action.policy.enabled" +PATCH_CLASS="PatchForOzoneServiceDefPolicyConditionUpdate_J10065" +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +RANGER_DOCKER_DIR="${RANGER_DOCKER_DIR:-$(cd "${SCRIPT_DIR}/../.." && pwd)}" +INSTALL_PROPS="${RANGER_DOCKER_DIR}/scripts/admin/ranger-admin-install-postgres.properties" +WORK_DIR="$(mktemp -d)" +RANGER_LAB_IMAGE="${RANGER_LAB_IMAGE:-ranger-quickrule:local}" +LOG_FILE="/tmp/ranger-javapatch-quick-rule.log" +SITE_XML="${WORK_DIR}/ranger-admin-site.xml" + +fail() { echo "FAIL: $*"; exit 1; } +pass() { echo "PASS: $*"; } +info() { echo "INFO: $*"; } + +cleanup() { rm -rf "${WORK_DIR}"; } +trap cleanup EXIT + +usage() { + cat <<EOF +Usage: $0 <off|on|both> + + off - delete J10065, flag=false, javapatch (expect skip + J10065 row) + on - delete J10065, flag=true, javapatch (expect apply + J10065 row) + both - run off then on + +Lab only. Requires ranger container that completed setup at least once. +EOF + exit 1 +} + +[[ -n "${MODE}" ]] || usage +[[ "${MODE}" =~ ^(off|on|both)$ ]] || usage +[[ -f "${INSTALL_PROPS}" ]] || fail "missing install properties: ${INSTALL_PROPS}" + +psql_query() { + docker exec "${POSTGRES_CONTAINER}" psql -U postgres -d ranger -tAc "$1" +} + +ensure_lab_image() { + docker ps -a --format '{{.Names}}' | grep -qx "${RANGER_CONTAINER}" \ + || fail "ranger container '${RANGER_CONTAINER}' not found (run setup once first)" + docker image inspect "${RANGER_LAB_IMAGE}" >/dev/null 2>&1 || { + info "creating lab image ${RANGER_LAB_IMAGE} from ${RANGER_CONTAINER}" + docker commit "${RANGER_CONTAINER}" "${RANGER_LAB_IMAGE}" >/dev/null + } + docker cp "${RANGER_CONTAINER}:/opt/ranger/admin/conf/ranger-admin-site.xml" "${SITE_XML}.base" \ + || docker cp "${RANGER_CONTAINER}:/opt/ranger/ranger-2.9.0-admin/conf/ranger-admin-site.xml" "${SITE_XML}.base" \ + || fail "cannot copy ranger-admin-site.xml from ${RANGER_CONTAINER}" +} + +set_admin_flag_file() { + local value="$1" + cp "${SITE_XML}.base" "${SITE_XML}" + python3 - <<PY +from pathlib import Path +import xml.etree.ElementTree as ET + +path = Path("${SITE_XML}") +tree = ET.parse(path) +root = tree.getroot() +prop_name = "${PROP_NAME}" +found = False +for prop in root.findall("property"): + name = prop.find("name") + if name is not None and name.text == prop_name: + val = prop.find("value") + if val is None: + val = ET.SubElement(prop, "value") + val.text = "${value}" + found = True + break +if not found: + prop = ET.SubElement(root, "property") + ET.SubElement(prop, "name").text = prop_name + ET.SubElement(prop, "value").text = "${value}" +tree.write(path, encoding="unicode", xml_declaration=False) +PY + pass "admin flag ${PROP_NAME}=${value} (site xml prepared)" +} + +reset_patch_state() { + psql_query "DELETE FROM x_db_version_h WHERE version = 'J10065';" + psql_query "DELETE FROM x_db_version_h WHERE version = 'JAVA_PATCHES' AND inst_by = '${RANGER_INST_BY}';" + pass "cleared J10065 and JAVA_PATCHES (inst_by=${RANGER_INST_BY})" +} + +run_javapatch() { + info "running db_setup.py -javapatch (lab image ${RANGER_LAB_IMAGE})" + docker run --rm --network rangernw --entrypoint bash \ + -v "${INSTALL_PROPS}:/opt/ranger/admin/install.properties:ro" \ + -v "${SITE_XML}:/opt/ranger/admin/conf/ranger-admin-site.xml:ro" \ + "${RANGER_LAB_IMAGE}" \ + -lc 'cd /opt/ranger/admin && python3 db_setup.py -javapatch' \ + > "${LOG_FILE}" 2>&1 + tail -5 "${LOG_FILE}" + if grep -q "java patch ${PATCH_CLASS} is applied" "${LOG_FILE}"; then + pass "javapatch applied ${PATCH_CLASS}" + elif grep -q "${PATCH_CLASS}" "${LOG_FILE}"; then + pass "javapatch ran ${PATCH_CLASS}" + else + fail "javapatch log does not mention ${PATCH_CLASS}" + fi +} + +verify_j10065_row() { + local row + row="$(psql_query "SELECT version||'|active='||active FROM x_db_version_h WHERE version='J10065';")" + [[ -n "${row}" ]] || fail "J10065 row missing after patch" + [[ "${row}" == *"active=Y"* ]] || fail "J10065 not active=Y: ${row}" + pass "x_db_version_h: ${row}" +} + +verify_patch_log_expectation() { + local expect_enabled="$1" + if [[ "${expect_enabled}" == "false" ]]; then + # Skip message is emitted by the patch Java process (not always on db_setup stdout). + # Successful apply with flag OFF still marks J10065 active=Y. + pass "flag OFF case: J10065 applied with skip inside patch (see ranger logs if needed)" + else + if grep -qi "skipping ozone service-def policy condition update" "${LOG_FILE}"; then + fail "patch skipped but flag was ON" + fi + pass "flag ON case: javapatch completed without skip in db_setup output" + fi +} + +maybe_run_e2e() { + local expect_enabled="$1" + [[ "${RUN_E2E}" == "true" ]] || { info "RUN_E2E=false; skipping E2E"; return 0; } + local code + code="$(curl -s -o /dev/null -w '%{http_code}' "${RANGER_URL}/" 2>/dev/null || echo 000)" + if [[ ! "${code}" =~ ^[23] ]]; then + info "Ranger Admin HTTP ${code}; skipping E2E (patch + DB checks are sufficient)" + return 0 + fi + EXPECT_ENABLED="${expect_enabled}" "${SCRIPT_DIR}/test-ozone-action-feature-flag.sh" +} + +run_case() { + local flag_value="$1" + local label="$2" + echo "" + echo "========== Quick rule case: ${label} (flag=${flag_value}) ==========" + docker ps --format '{{.Names}}' | grep -qx "${POSTGRES_CONTAINER}" \ + || fail "postgres container '${POSTGRES_CONTAINER}' not running" + ensure_lab_image + reset_patch_state + set_admin_flag_file "${flag_value}" + run_javapatch + verify_j10065_row + verify_patch_log_expectation "${flag_value}" + maybe_run_e2e "${flag_value}" + echo "========== Case ${label} complete ==========" +} + +case "${MODE}" in + off) run_case "false" "OFF" ;; + on) run_case "true" "ON" ;; + both) run_case "false" "OFF"; run_case "true" "ON" ;; +esac + +echo "" +echo "=== Quick rule test (${MODE}) finished successfully ==="
