This is an automated email from the ASF dual-hosted git repository. ramackri pushed a commit to branch ranger-2.9 in repository https://gitbox.apache.org/repos/asf/ranger.git
commit 44339f66b041e436b8f4027dd376c27e8dc8cc48 Author: ramk <[email protected]> AuthorDate: Tue Jul 28 22:11:47 2026 +0530 RANGER-5687: RC1 validation fixes for 2.9.0 docker and KMS Align OZONE_VERSION to 2.1.1, remove audit-server README refs not shipped in 2.9.0, fix DB audit multi-value search fields, and use getServiceByNameForDP for KMS role downloads. Co-authored-by: Cursor <[email protected]> --- dev-support/ranger-docker/.env | 2 +- dev-support/ranger-docker/README.md | 51 ---------------------- .../org/apache/ranger/AccessAuditsService.java | 2 +- .../main/java/org/apache/ranger/rest/RoleREST.java | 8 ++-- .../apache/ranger/service/XAccessAuditService.java | 6 ++- 5 files changed, 11 insertions(+), 58 deletions(-) diff --git a/dev-support/ranger-docker/.env b/dev-support/ranger-docker/.env index 1e9ea2966..4db6300e3 100644 --- a/dev-support/ranger-docker/.env +++ b/dev-support/ranger-docker/.env @@ -38,7 +38,7 @@ KERBEROS_MASTER_PASSWORD=rangerR0cks! KERBEROS_ADMIN_PRINCIPAL=admin/admin KERBEROS_ADMIN_PASSWORD=rangerR0cks! -OZONE_VERSION=1.4.0 +OZONE_VERSION=2.1.1 OZONE_RUNNER_VERSION=20230615-1 OZONE_RUNNER_IMAGE=apache/ozone-runner diff --git a/dev-support/ranger-docker/README.md b/dev-support/ranger-docker/README.md index 4c09881c5..e4956ef64 100644 --- a/dev-support/ranger-docker/README.md +++ b/dev-support/ranger-docker/README.md @@ -158,43 +158,9 @@ docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-opensearch. OpenSearch can replace Solr for **audit storage and UI queries**. Ranger Admin reads audits via `audit_store=opensearch` using a native low-level REST client (compatible with any OpenSearch version). -**Write path:** access audits flow through audit-server ingestor, Kafka, and the Java -`ranger-audit-dispatcher-opensearch` service into the OpenSearch `ranger_audits` index. Ranger Admin policy/admin transaction audits remain DB-backed; this is the same boundary used by the Solr audit path. -##### Setup - -~~~ -# Prerequisites: build the audit-dispatcher tarball and download archives -mvn clean package -DskipTests -pl distro -am -cp target/ranger-*-audit-dispatcher.tar.gz dev-support/ranger-docker/dist/ -cd dev-support/ranger-docker -./download-archives.sh kafka opensearch hadoop - -export RANGER_DB_TYPE=postgres - -# 1. Start OpenSearch first (Ranger Admin's bootstrapper needs it on startup) -docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-opensearch.yml \ - -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-hadoop.yml \ - -f docker-compose.ranger-audit-server.yml \ - -f docker-compose.ranger-audit-dispatcher-opensearch.yml up -d ranger-opensearch - -# 2. Start core stack (Ranger Admin, Kafka, Hadoop) -# Kafka auto-creates the ranger_audits topic on startup. -# Ranger Admin auto-creates the OpenSearch index via OpenSearchIndexBootStrapper. -docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-opensearch.yml \ - -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-hadoop.yml \ - -f docker-compose.ranger-audit-server.yml \ - -f docker-compose.ranger-audit-dispatcher-opensearch.yml up -d ranger ranger-kafka ranger-hadoop - -# 3. Start audit ingestor and OpenSearch dispatcher -docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-opensearch.yml \ - -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-hadoop.yml \ - -f docker-compose.ranger-audit-server.yml \ - -f docker-compose.ranger-audit-dispatcher-opensearch.yml up -d ranger-audit-ingestor ranger-audit-dispatcher-opensearch -~~~ - For **fresh Ranger installs** using OpenSearch for audits, set `audit_store=opensearch` in `scripts/admin/ranger-admin-install-postgres.properties` and configure the `audit_opensearch_*` properties. @@ -212,20 +178,3 @@ docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-usersync.ym ~~~ docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-usersync.yml -f docker-compose.ranger-tagsync.yml -f docker-compose.ranger-kms.yml -f docker-compose.ranger-hadoop.yml -f docker-compose.ranger-hbase.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-hive.yml -f docker-compose.ranger-trino.yml -f docker-compose.ranger-knox.yml up -d --no-deps --force-recreate --build <service-1> <service-2> ~~~ - -#### To bring up audit server ingestor + dispatchers. Make sure kafka, solr, and hdfs containers are running before bringing up audit server services. -~~~ -docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-hadoop.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-audit-server.yml up -d -~~~ - -#### To bring up audit server services individually: -~~~ -# Audit ingestor -docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-audit-ingestor.yml up -d - -# Solr dispatcher -docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-audit-dispatcher-solr.yml up -d - -# HDFS dispatcher -docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-hadoop.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-audit-dispatcher-hdfs.yml up -d -~~~ diff --git a/security-admin/src/main/java/org/apache/ranger/AccessAuditsService.java b/security-admin/src/main/java/org/apache/ranger/AccessAuditsService.java index 4dde28f6b..4fd33cc6c 100644 --- a/security-admin/src/main/java/org/apache/ranger/AccessAuditsService.java +++ b/security-admin/src/main/java/org/apache/ranger/AccessAuditsService.java @@ -84,7 +84,7 @@ public AccessAuditsService() { searchFields.add(new SearchField("-repoType", "-repoType", SearchField.DATA_TYPE.INTEGER, SearchField.SEARCH_TYPE.FULL)); searchFields.add(new SearchField("-requestUser", "-reqUser", - SearchField.DATA_TYPE.STRING, SearchField.SEARCH_TYPE.FULL)); + SearchField.DATA_TYPE.STR_LIST, SearchField.SEARCH_TYPE.FULL)); searchFields.add(new SearchField("excludeResourceName", "-resource", SearchField.DATA_TYPE.STRING, SearchField.SEARCH_TYPE.PARTIAL)); searchFields.add(new SearchField("resourceType", "resType", diff --git a/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java b/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java index 13ca10fe3..33675ebcd 100644 --- a/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java +++ b/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java @@ -1088,18 +1088,20 @@ public RangerRoles getSecureRangerRolesIfUpdated( false); } XXServiceDef xServiceDef = daoManager.getXXServiceDef().getById(xService.getType()); - RangerService rangerService = svcStore.getServiceByName(serviceName); + RangerService rangerService; if (StringUtils.equals(xServiceDef.getImplclassname(), EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) { + rangerService = svcStore.getServiceByNameForDP(serviceName); if (isKeyAdmin) { isAllowed = true; }else { isAllowed = bizUtil.isUserAllowed(rangerService, POLICY_DOWNLOAD_USERS); } - }else{ + } else { + rangerService = svcStore.getServiceByName(serviceName); if (isAdmin) { isAllowed = true; - }else{ + } else { isAllowed = bizUtil.isUserAllowed(rangerService, POLICY_DOWNLOAD_USERS); } } diff --git a/security-admin/src/main/java/org/apache/ranger/service/XAccessAuditService.java b/security-admin/src/main/java/org/apache/ranger/service/XAccessAuditService.java index 4b9201434..65bd713eb 100644 --- a/security-admin/src/main/java/org/apache/ranger/service/XAccessAuditService.java +++ b/security-admin/src/main/java/org/apache/ranger/service/XAccessAuditService.java @@ -58,7 +58,9 @@ public XAccessAuditService() { searchFields.add(new SearchField("sessionId", "obj.sessionId", SearchField.DATA_TYPE.STRING, SearchField.SEARCH_TYPE.PARTIAL)); searchFields.add(new SearchField("requestUser", "obj.requestUser", - SearchField.DATA_TYPE.STRING, SearchField.SEARCH_TYPE.PARTIAL)); + SearchField.DATA_TYPE.STR_LIST, SearchField.SEARCH_TYPE.PARTIAL)); + searchFields.add(new SearchField("-requestUser", "obj.requestUser", + SearchField.DATA_TYPE.STR_LIST, SearchField.SEARCH_TYPE.PARTIAL)); searchFields.add(new SearchField("requestData", "obj.requestData", SearchField.DATA_TYPE.STRING, SearchField.SEARCH_TYPE.PARTIAL)); searchFields.add(new SearchField("resourcePath", "obj.resourcePath", @@ -85,7 +87,7 @@ public XAccessAuditService() { searchFields.add(new SearchField("cluster", "obj.cluster", SearchField.DATA_TYPE.STRING, SearchField.SEARCH_TYPE.FULL)); searchFields.add(new SearchField("zoneName", "obj.zoneName", - SearchField.DATA_TYPE.STRING, SearchField.SEARCH_TYPE.FULL)); + SearchField.DATA_TYPE.STR_LIST, SearchField.SEARCH_TYPE.FULL)); searchFields.add(new SearchField("agentHost", "obj.agentHost", SearchField.DATA_TYPE.STRING, SearchField.SEARCH_TYPE.PARTIAL));
