This is an automated email from the ASF dual-hosted git repository.
ramackri pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/master by this push:
new ac42df29f RANGER-5712: Fix Trino/Ozone plugin auth in ranger-docker
(#1116)
ac42df29f is described below
commit ac42df29fde3efaed69508ab44b92265f05d8c3c
Author: Ramachandran Krishnan <[email protected]>
AuthorDate: Fri Jul 31 10:57:16 2026 +0530
RANGER-5712: Fix Trino/Ozone plugin auth in ranger-docker (#1116)
* RANGER-5712: Add Ranger Admin basic auth to Trino docker plugin config
Configure policy.rest.client username/password so the Trino plugin uses
secure download endpoints instead of relying on unauthenticated Admin access.
* RANGER-5712: Add Kerberos setup for Ozone in ranger-docker
Wire OM/SCM/DN keytabs, ozone-site kerberos settings, and plugin JAAS so
the Ozone plugin authenticates to Ranger Admin via secure download instead of
unauthenticated access.
* RANGER-5712: Revert unused Ozone audit JAAS install properties
Policy download uses OM kerberos from docker-config; Solr audit JAAS
settings are not needed in install.properties.
* RANGER-5712: Revert Ozone service auth type in create-ranger-services
Policy download auth is driven by policy.download.auth.users and OM
Kerberos from docker-config, not the service hadoop.security.authentication
field.
* RANGER-5712: Avoid Ozone krb5:8081 wait; use Ranger KDC keytabs
Do not pass KERBEROS_ENABLED into Ozone containers because Ozone
libexec/entrypoint.sh waits for its own mini-KDC at krb5:8081. Ranger already
provisions om/scm/dn keytabs via ranger-kdc; use RANGER_KERBEROS_ENABLED for
setup-script keytab wait and keep Kerberos enabled via ozone-site.xml plus
mounted keytabs.
* RANGER-5712: Pin Ozone docker image to 2.1.1
Align dev-support/ranger-docker .env with pom.xml ozone.version for
Kerberos policy-download testing on Ozone 2.1.x.
* RANGER-5712: Automate Ozone jersey-server quarantine for policy download
Quarantine jersey-server from Ozone lib on host setup and OM startup to
avoid WadlAutoDiscoverable ClassCastException when Kerberos secure download
uses the Ranger plugin Jersey client.
* RANGER-5712: Exclude Jersey/Jackson from Ozone plugin tarball
Align plugin-ozone.xml packaging with RANGER-5642 so the plugin uses Ozone's
Jersey on the app classpath and avoids WadlAutoDiscoverable
ClassCastException
when Kerberos secure policy download is enabled.
* RANGER-5712: Drop README changes from plugin packaging commit
Keep the Jersey/Jackson assembly fix in plugin-ozone.xml only.
* RANGER-5712: Revert all README.md changes
Restore dev-support/ranger-docker/README.md to match master.
* RANGER-5712: Remove Ozone jersey-server quarantine workaround
The plugin-ozone.xml packaging fix excludes duplicate Jersey/Jackson from
the
plugin tarball; quarantining Ozone lib jars is no longer needed.
* RANGER-5712: Add javax.annotation-api to Ozone OM classpath
Jersey 2.x needs javax.annotation.Priority on the same classpath as Ozone's
jersey-client after excluding duplicate Jersey from the plugin tarball.
* RANGER-5712: Drop duplicate OZONE_MANAGER_CLASSPATH from compose
OM classpath is already set in Dockerfile.ranger-ozone and extended at
runtime by ranger-ozone-setup.sh when needed.
---------
Co-authored-by: ramk <[email protected]>
---
dev-support/ranger-docker/.env | 4 +-
dev-support/ranger-docker/Dockerfile.ranger-ozone | 5 ++-
.../ranger-docker/docker-compose.ranger-ozone.yml | 26 +++++++++--
.../ranger-docker/scripts/kdc/entrypoint.sh | 6 ++-
.../ranger-docker/scripts/ozone/docker-config | 11 +++++
.../ozone/ranger-ozone-plugin-install.properties | 2 +-
.../scripts/ozone/ranger-ozone-setup.sh | 51 ++++++++++++++++++++++
.../scripts/trino/ranger-trino-security.xml | 16 +++++++
distro/src/main/assembly/plugin-ozone.xml | 36 +++++++--------
9 files changed, 127 insertions(+), 30 deletions(-)
diff --git a/dev-support/ranger-docker/.env b/dev-support/ranger-docker/.env
index c6439db0e..9ec9bdf7c 100644
--- a/dev-support/ranger-docker/.env
+++ b/dev-support/ranger-docker/.env
@@ -75,8 +75,8 @@ ORACLE_VERSION=23.6
SQLSERVER_VERSION=2022-latest
# Ozone Configuration
-# Align runtime with Ranger plugin compile target (pom.xml ozone.version=2.1.0)
-OZONE_VERSION=2.1.0
+# Align runtime with Ranger plugin compile target (pom.xml ozone.version=2.1.1)
+OZONE_VERSION=2.1.1
OZONE_PLUGIN_VERSION=3.0.0-SNAPSHOT
OZONE_RUNNER_IMAGE=apache/ozone-runner
# Ozone 2.0+ requires jdk21 runner (jdk11/jdk17 tags are for Ozone 1.x).
Multi-arch arm64+amd64.
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-ozone
b/dev-support/ranger-docker/Dockerfile.ranger-ozone
index 0e435e1f5..17264e7b7 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger-ozone
+++ b/dev-support/ranger-docker/Dockerfile.ranger-ozone
@@ -27,5 +27,6 @@ USER root
RUN useradd -g hadoop -ms /bin/bash ozone
RUN mkdir -p -m 755 /var/log/ozone
-# Required to locate the plugin jars and the config files
-ENV
OZONE_MANAGER_CLASSPATH="${OZONE_HOME}/ranger-ozone-plugin/lib/libext/*:${OZONE_HOME}/ranger-ozone-plugin/conf"
+# Required to locate the plugin jars and the config files.
+# javax.annotation-api is also required on the OM classpath for Jersey 2.x
(see ranger-ozone-setup.sh).
+ENV
OZONE_MANAGER_CLASSPATH="${OZONE_HOME}/ranger-ozone-plugin/lib/libext/*:${OZONE_HOME}/ranger-ozone-plugin/conf:${OZONE_HOME}/share/ozone/lib/javax.annotation-api-*.jar"
diff --git a/dev-support/ranger-docker/docker-compose.ranger-ozone.yml
b/dev-support/ranger-docker/docker-compose.ranger-ozone.yml
index 3de291674..9db3fecfb 100644
--- a/dev-support/ranger-docker/docker-compose.ranger-ozone.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger-ozone.yml
@@ -5,13 +5,20 @@ services:
hostname: datanode.rangernw
volumes:
- ./downloads/ozone-${OZONE_VERSION}:/opt/hadoop
+ - ./dist/keytabs/datanode:/etc/keytabs
+ - ./scripts/kdc/krb5.conf:/etc/krb5.conf:ro
networks:
- ranger
ports:
- 9864
- command: bash -c "sudo mkdir -p /data/hdds /data/metadata && sudo chown -R
hadoop:hadoop /data && exec /opt/hadoop/bin/ozone datanode"
+ depends_on:
+ ranger-kdc:
+ condition: service_started
+ command: bash -c "unset KERBEROS_ENABLED; sudo mkdir -p /data/hdds
/data/metadata && sudo chown -R hadoop:hadoop /data && exec
/opt/hadoop/bin/ozone datanode"
env_file:
- ./scripts/ozone/docker-config
+ environment:
+ RANGER_KERBEROS_ENABLED: ${KERBEROS_ENABLED}
om:
build:
context: .
@@ -27,12 +34,16 @@ services:
volumes:
- ./downloads/ozone-${OZONE_VERSION}:/opt/hadoop
-
./dist/ranger-${OZONE_PLUGIN_VERSION}-ozone-plugin:/opt/hadoop/ranger-ozone-plugin
+ - ./dist/keytabs/om:/etc/keytabs
+ - ./scripts/kdc/krb5.conf:/etc/krb5.conf:ro
networks:
- ranger
ports:
- 9874:9874
- 9862:9862
depends_on:
+ ranger-kdc:
+ condition: service_started
scm:
condition: service_started
datanode:
@@ -46,26 +57,33 @@ services:
OZONE_HOME: /opt/hadoop
OZONE_PLUGIN_VERSION: ${OZONE_PLUGIN_VERSION}
OZONE_VERSION: ${OZONE_VERSION}
+ RANGER_KERBEROS_ENABLED: ${KERBEROS_ENABLED}
env_file:
- ./scripts/ozone/docker-config
- # Ozone 2.1 entrypoint init uses obsolete -createObjectStore fallback; use
--init explicitly.
- command: bash -c "/opt/hadoop/ranger-ozone-plugin/ranger-ozone-setup.sh &&
(test -f /data/metadata/om/current/VERSION || /opt/hadoop/bin/ozone om --init)
&& exec /opt/hadoop/bin/ozone om"
+ # Do not pass KERBEROS_ENABLED: Ozone libexec/entrypoint.sh waits for
krb5:8081.
+ command: bash -c "unset KERBEROS_ENABLED; source
/opt/hadoop/ranger-ozone-plugin/ranger-ozone-setup.sh && (test -f
/data/metadata/om/current/VERSION || /opt/hadoop/bin/ozone om --init) && exec
/opt/hadoop/bin/ozone om"
scm:
image: ${OZONE_RUNNER_IMAGE}:${OZONE_RUNNER_VERSION}
container_name: ozone-scm
hostname: scm.rangernw
volumes:
- ./downloads/ozone-${OZONE_VERSION}:/opt/hadoop
+ - ./dist/keytabs/scm:/etc/keytabs
+ - ./scripts/kdc/krb5.conf:/etc/krb5.conf:ro
networks:
- ranger
ports:
- 9876:9876
- 9860:9860
+ depends_on:
+ ranger-kdc:
+ condition: service_started
env_file:
- ./scripts/ozone/docker-config
environment:
+ RANGER_KERBEROS_ENABLED: ${KERBEROS_ENABLED}
OZONE-SITE.XML_hdds.scm.safemode.min.datanode:
"${OZONE_SAFEMODE_MIN_DATANODES:-1}"
- command: bash -c "(test -f /data/metadata/scm/current/VERSION ||
/opt/hadoop/bin/ozone scm --init) && exec /opt/hadoop/bin/ozone scm"
+ command: bash -c "unset KERBEROS_ENABLED; (test -f
/data/metadata/scm/current/VERSION || /opt/hadoop/bin/ozone scm --init) && exec
/opt/hadoop/bin/ozone scm"
networks:
ranger:
diff --git a/dev-support/ranger-docker/scripts/kdc/entrypoint.sh
b/dev-support/ranger-docker/scripts/kdc/entrypoint.sh
index db788684f..4946cc026 100644
--- a/dev-support/ranger-docker/scripts/kdc/entrypoint.sh
+++ b/dev-support/ranger-docker/scripts/kdc/entrypoint.sh
@@ -122,6 +122,10 @@ function create_keytabs() {
create_principal_and_keytab opensearch ranger-opensearch
create_principal_and_keytab HTTP ranger-opensearch
+ create_principal_and_keytab om om
+ create_principal_and_keytab scm scm
+ create_principal_and_keytab dn datanode
+
create_principal_and_keytab zookeeper ranger-zk
}
@@ -149,7 +153,7 @@ if [ ! -f $DB_DIR/principal ]; then
echo "Database initialized"
create_keytabs
- create_testusers ranger ranger-usersync ranger-tagsync ranger-pdp
ranger-audit-ingestor ranger-audit-dispatcher-solr ranger-audit-dispatcher-hdfs
ranger-audit-dispatcher-opensearch ranger-hadoop ranger-hive ranger-hbase
ranger-kafka ranger-solr ranger-knox ranger-kms ranger-ozone ranger-trino
ranger-opensearch
+ create_testusers ranger ranger-usersync ranger-tagsync ranger-pdp
ranger-audit-ingestor ranger-audit-dispatcher-solr ranger-audit-dispatcher-hdfs
ranger-audit-dispatcher-opensearch ranger-hadoop ranger-hive ranger-hbase
ranger-kafka ranger-solr ranger-knox ranger-kms ranger-ozone ranger-trino
ranger-opensearch om scm datanode
touch /etc/keytabs/.provisioned
echo "All keytabs provisioned"
diff --git a/dev-support/ranger-docker/scripts/ozone/docker-config
b/dev-support/ranger-docker/scripts/ozone/docker-config
index 33f4d5847..78f661e26 100644
--- a/dev-support/ranger-docker/scripts/ozone/docker-config
+++ b/dev-support/ranger-docker/scripts/ozone/docker-config
@@ -16,6 +16,8 @@
CORE-SITE.XML_fs.defaultFS=ofs://om
CORE-SITE.XML_fs.trash.interval=1
+CORE-SITE.XML_hadoop.security.authentication=kerberos
+CORE-SITE.XML_hadoop.security.auth_to_local=DEFAULT
# For HttpFS service it is required to enable proxying users.
CORE-SITE.XML_hadoop.proxyuser.hadoop.hosts=*
CORE-SITE.XML_hadoop.proxyuser.hadoop.groups=*
@@ -67,6 +69,15 @@ no_proxy=om,scm,s3g,recon,kdc,localhost,127.0.0.1
# Explicitly enable filesystem snapshot feature for this Docker compose cluster
OZONE-SITE.XML_ozone.filesystem.snapshot.enabled=true
+# Kerberos via Ranger KDC keytabs (do not set KERBEROS_ENABLED env; Ozone
entrypoint expects krb5:8081)
+OZONE-SITE.XML_ozone.security.enabled=true
+OZONE-SITE.XML_hdds.scm.kerberos.principal=scm/[email protected]
+OZONE-SITE.XML_hdds.scm.kerberos.keytab.file=/etc/keytabs/scm.keytab
+OZONE-SITE.XML_ozone.om.kerberos.principal=om/[email protected]
+OZONE-SITE.XML_ozone.om.kerberos.keytab.file=/etc/keytabs/om.keytab
+OZONE-SITE.XML_hdds.datanode.kerberos.principal=dn/[email protected]
+OZONE-SITE.XML_hdds.datanode.kerberos.keytab.file=/etc/keytabs/dn.keytab
+
# To enable Ranger as the Authorizer in Ozone
OZONE-SITE.XML_ozone.acl.enabled=true
OZONE-SITE.XML_ozone.acl.authorizer.class=org.apache.ranger.authorization.ozone.authorizer.RangerOzoneAuthorizer
diff --git
a/dev-support/ranger-docker/scripts/ozone/ranger-ozone-plugin-install.properties
b/dev-support/ranger-docker/scripts/ozone/ranger-ozone-plugin-install.properties
index 90e97a330..e101d57d3 100644
---
a/dev-support/ranger-docker/scripts/ozone/ranger-ozone-plugin-install.properties
+++
b/dev-support/ranger-docker/scripts/ozone/ranger-ozone-plugin-install.properties
@@ -13,7 +13,7 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-POLICY_MGR_URL=http://ranger:6080
+POLICY_MGR_URL=http://ranger.rangernw:6080
REPOSITORY_NAME=dev_ozone
COMPONENT_INSTALL_DIR_NAME=ranger-ozone-plugin
diff --git a/dev-support/ranger-docker/scripts/ozone/ranger-ozone-setup.sh
b/dev-support/ranger-docker/scripts/ozone/ranger-ozone-setup.sh
index 72bd1f32f..ad539676c 100644
--- a/dev-support/ranger-docker/scripts/ozone/ranger-ozone-setup.sh
+++ b/dev-support/ranger-docker/scripts/ozone/ranger-ozone-setup.sh
@@ -18,6 +18,51 @@
cd "${OZONE_HOME}"/ranger-ozone-plugin || exit
+# Ozone 2.1.x ships javax.annotation-api under share/ozone/lib but omits it
from the
+# default OM classpath. Jersey 2.x (used for Kerberos policy download after
RANGER-5642
+# style packaging) needs javax.annotation.Priority on the same classpath as
jersey-client.
+ensure_javax_annotation_on_om_classpath() {
+ local annotation_jar
+ annotation_jar="$(ls
"${OZONE_HOME}"/share/ozone/lib/javax.annotation-api-*.jar 2>/dev/null | head
-1)"
+ if [ -z "${annotation_jar}" ]; then
+ echo "WARN: javax.annotation-api jar not found under
${OZONE_HOME}/share/ozone/lib" >&2
+ return 0
+ fi
+ if [[ "${OZONE_MANAGER_CLASSPATH}" == *"javax.annotation-api"* ]]; then
+ return 0
+ fi
+ case ":${OZONE_MANAGER_CLASSPATH}:" in
+ *:"${annotation_jar}":*) return 0 ;;
+ esac
+ if [ -n "${OZONE_MANAGER_CLASSPATH}" ]; then
+ export
OZONE_MANAGER_CLASSPATH="${OZONE_MANAGER_CLASSPATH}:${annotation_jar}"
+ else
+ export OZONE_MANAGER_CLASSPATH="${annotation_jar}"
+ fi
+ echo "Extended OZONE_MANAGER_CLASSPATH with ${annotation_jar}"
+}
+ensure_javax_annotation_on_om_classpath
+
+wait_for_keytab() {
+ local keytab_name=$1
+ if [ "${RANGER_KERBEROS_ENABLED}" != "true" ]; then
+ return 0
+ fi
+ local keytab_path="/etc/keytabs/${keytab_name}"
+ local max_wait_sec="${OZONE_KEYTAB_WAIT_SEC:-120}"
+ local deadline=$((SECONDS + max_wait_sec))
+ echo "Waiting for keytab ${keytab_path} (up to ${max_wait_sec}s)..."
+ while (( SECONDS < deadline )); do
+ if [ -f "${keytab_path}" ]; then
+ echo "Found keytab ${keytab_path}"
+ return 0
+ fi
+ sleep 2
+ done
+ echo "ERROR: timed out waiting for keytab ${keytab_path}" >&2
+ exit 1
+}
+
# SCM Ratis leader election can lag compose depends_on; avoid OM failing with
# Connection refused / ServerNotLeaderException on first SCM RPC.
wait_for_scm() {
@@ -42,6 +87,12 @@ wait_for_scm
if [[ ! -f "${OZONE_HOME}"/.setupDone ]];
then
+ wait_for_keytab om.keytab
+
+ if [ -f "${OZONE_HOME}/libexec/envtoconf.py" ]; then
+ python3 "${OZONE_HOME}/libexec/envtoconf.py" --destination
"${OZONE_CONF_DIR:-/etc/hadoop}"
+ fi
+
if [ ! -d conf ]; then
mkdir -p conf
echo "conf directory created!"
diff --git a/dev-support/ranger-docker/scripts/trino/ranger-trino-security.xml
b/dev-support/ranger-docker/scripts/trino/ranger-trino-security.xml
index 25fb49ba4..18af7b99b 100644
--- a/dev-support/ranger-docker/scripts/trino/ranger-trino-security.xml
+++ b/dev-support/ranger-docker/scripts/trino/ranger-trino-security.xml
@@ -72,6 +72,22 @@
</description>
</property>
+ <property>
+ <name>ranger.plugin.trino.policy.rest.client.username</name>
+ <value>admin</value>
+ <description>
+ Ranger Admin login for policy download (dev docker sandbox)
+ </description>
+ </property>
+
+ <property>
+ <name>ranger.plugin.trino.policy.rest.client.password</name>
+ <value>rangerR0cks!</value>
+ <description>
+ Ranger Admin password for policy download (dev docker sandbox)
+ </description>
+ </property>
+
<property>
<name>ranger.plugin.trino.policy.cache.dir</name>
<value>/tmp</value>
diff --git a/distro/src/main/assembly/plugin-ozone.xml
b/distro/src/main/assembly/plugin-ozone.xml
index 7d14d2ab5..82d1aa109 100644
--- a/distro/src/main/assembly/plugin-ozone.xml
+++ b/distro/src/main/assembly/plugin-ozone.xml
@@ -97,11 +97,6 @@
<include>org.apache.solr:solr-solrj:jar:${solr.version}</include>
<include>com.fasterxml.woodstox:woodstox-core:jar:${fasterxml.woodstox.version}</include>
<include>org.codehaus.woodstox:stax2-api:jar:${codehaus.woodstox.stax2api.version}</include>
-
<include>com.fasterxml.jackson.core:jackson-annotations:jar:${fasterxml.jackson.version}</include>
-
<include>com.fasterxml.jackson.core:jackson-core:jar:${fasterxml.jackson.version}</include>
-
<include>com.fasterxml.jackson.core:jackson-databind:jar:${fasterxml.jackson.version}</include>
-
<include>com.fasterxml.jackson.jaxrs:jackson-jaxrs-base:jar:${fasterxml.jackson.version}</include>
-
<include>com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:jar:${fasterxml.jackson.version}</include>
<include>com.sun.xml.bind:jaxb-impl</include>
<include>org.apache.httpcomponents:httpcore-nio:jar:${httpcomponents.httpcore.version}</include>
<include>org.apache.httpcomponents:httpasyncclient:jar:${httpcomponents.httpasyncclient.version}</include>
@@ -109,22 +104,7 @@
<include>com.carrotsearch:hppc</include>
<include>io.airlift:aircompressor:jar:${aircompressor.version}</include>
<include>javax.annotation:javax.annotation-api:jar:${javax.annotation-api.version}</include>
- <include>javax.inject:javax.inject</include>
- <include>javax.ws.rs:javax.ws.rs-api</include>
<include>org.apache.hadoop.thirdparty:hadoop-shaded-guava:jar:${hadoop-shaded-guava.version}</include>
- <include>org.glassfish.hk2:hk2-api</include>
- <include>org.glassfish.hk2:hk2-locator</include>
- <include>org.glassfish.hk2:hk2-utils</include>
-
<include>org.glassfish.hk2.external:aopalliance-repackaged</include>
-
<include>org.glassfish.hk2.external:jakarta.inject</include>
- <include>org.glassfish.hk2.external:javax.inject</include>
- <include>org.glassfish:osgi-resource-locator</include>
- <include>org.glassfish.jersey.core:jersey-client</include>
- <include>org.glassfish.jersey.core:jersey-common</include>
-
<include>org.glassfish.jersey.ext:jersey-entity-filtering:jar:${jersey-client.version}</include>
- <include>org.glassfish.jersey.inject:jersey-hk2</include>
-
<include>org.glassfish.jersey.media:jersey-media-json-jackson:jar:${jersey-client.version}</include>
-
<include>com.fasterxml.jackson.module:jackson-module-jaxb-annotations:jar:${fasterxml.jackson.version}</include>
<!-- GraalJS 25.x runtime (js is now a POM, not a JAR) -->
<include>org.graalvm.js:js-language:jar:${graalvm.version}</include>
<include>org.graalvm.js:js-scriptengine:jar:${graalvm.version}</include>
@@ -141,6 +121,22 @@
<include>org.graalvm.shadowed:xz:jar:${graalvm.version}</include>
</includes>
+ <excludes>
+ <exclude>com.fasterxml.jackson.core:*</exclude>
+ <exclude>com.fasterxml.jackson.jaxrs:*</exclude>
+ <exclude>com.fasterxml.jackson.module:*</exclude>
+ <exclude>com.fasterxml.jackson.dataformat:*</exclude>
+ <exclude>org.glassfish.jersey.core:*</exclude>
+ <exclude>org.glassfish.jersey.ext:*</exclude>
+ <exclude>org.glassfish.jersey.inject:*</exclude>
+ <exclude>org.glassfish.jersey.media:*</exclude>
+ <exclude>org.glassfish.hk2:*</exclude>
+ <exclude>javax.ws.rs:javax.ws.rs-api</exclude>
+ <exclude>jakarta.ws.rs:jakarta.ws.rs-api</exclude>
+ <exclude>org.slf4j:*</exclude>
+ <exclude>org.apache.logging.log4j:*</exclude>
+ <exclude>ch.qos.reload4j:*</exclude>
+ </excludes>
</binaries>
</moduleSet>
</moduleSets>
