This is an automated email from the ASF dual-hosted git repository.
kumaab pushed a commit to branch ranger-2.10
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/ranger-2.10 by this push:
new 3053a67b2 RANGER-5680: Restructure audit services in docker compose
and use OpenSearch as the default Index Store (#1167)
3053a67b2 is described below
commit 3053a67b2e0c2bf594eff5d8381a467ed211e262
Author: Abhishek Kumar <[email protected]>
AuthorDate: Thu Aug 20 21:18:32 2026 -0700
RANGER-5680: Restructure audit services in docker compose and use
OpenSearch as the default Index Store (#1167)
(cherry picked from commit d4a0759a4017daee93e91f05983e386448efa14b)
---
dev-support/ranger-docker/README.md | 154 +++------------------
.../ranger-docker/docker-compose.ranger-solr.yml | 66 ---------
.../ranger-docker/docker-compose.ranger.yml | 1 +
.../admin/ranger-admin-install-mysql.properties | 28 ++--
.../admin/ranger-admin-install-oracle.properties | 28 ++--
5 files changed, 41 insertions(+), 236 deletions(-)
diff --git a/dev-support/ranger-docker/README.md
b/dev-support/ranger-docker/README.md
index 76c9968a3..a1ff6ce4f 100644
--- a/dev-support/ranger-docker/README.md
+++ b/dev-support/ranger-docker/README.md
@@ -34,7 +34,7 @@ Use Dockerfiles in this directory to create docker images and
run them to build
~~~
chmod +x download-archives.sh
# use a subset of the below to download specific services
- ./download-archives.sh hadoop hive hbase kafka knox ozone opensearch
+ ./download-archives.sh hadoop hive hbase kafka knox ozone
~~~
- Execute following commands to set environment variables to build Apache
Ranger docker containers:
@@ -74,169 +74,59 @@ cd dev-support/ranger-docker
### Run Ranger Services in Containers
-#### Bring up ranger-core services: ranger, usersync, tagsync, pdp and kms in
containers
+#### Bring up ranger-core services: ranger, usersync, tagsync, pdp, kms and
audit in containers
~~~
# To enable file based sync source for usersync do:
-# export ENABLE_FILE_SYNC_SOURCE=true
+export ENABLE_FILE_SYNC_SOURCE=true
# valid values for RANGER_DB_TYPE: mysql/postgres/oracle
+export RANGER_DB_TYPE=postgres
-docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-solr.yml
-f docker-compose.ranger-usersync.yml -f docker-compose.ranger-tagsync.yml -f
docker-compose.ranger-pdp.yml -f docker-compose.ranger-kms.yml up -d
+# valid values for AUDIT_INDEX_STORE: opensearch (default) | solr
+# Ranger Admin audit_store (via ranger.sh); set matching profile for compose:
+export AUDIT_INDEX_STORE=opensearch
+export AUDIT_DESTINATIONS=audit-store-${AUDIT_INDEX_STORE}
+docker compose --profile ${AUDIT_DESTINATIONS} -f docker-compose.ranger.yml -f
docker-compose.ranger-audit-service.yml -f docker-compose.ranger-usersync.yml
-f docker-compose.ranger-tagsync.yml -f docker-compose.ranger-pdp.yml -f
docker-compose.ranger-kms.yml up -d
# Ranger Admin can be accessed at http://localhost:6080 (admin/rangerR0cks!)
~~~
#### Bring up hive container
~~~
-docker compose -f docker-compose.ranger.yml -f
docker-compose.ranger-hadoop.yml -f docker-compose.ranger-hive.yml up -d
+docker compose --profile ${AUDIT_DESTINATIONS} -f docker-compose.ranger.yml -f
docker-compose.ranger-audit-service.yml -f docker-compose.ranger-hadoop.yml -f
docker-compose.ranger-hive.yml up -d
~~~
#### Bring up hbase container
~~~
-docker compose -f docker-compose.ranger.yml -f
docker-compose.ranger-hadoop.yml -f docker-compose.ranger-hbase.yml up -d
+docker compose --profile ${AUDIT_DESTINATIONS} -f docker-compose.ranger.yml -f
docker-compose.ranger-audit-service.yml -f docker-compose.ranger-hadoop.yml -f
docker-compose.ranger-hbase.yml up -d
~~~
#### Bring up ozone containers
-
-##### Ozone action-matcher feature flag
-
-The flag is controlled at runtime by
-`ranger.servicedef.ozone.enableActionMatcherInPoliciesCondition` in
-`ranger-admin-site.xml`. Docker maps it from
-`FF_ENABLE_OZONE_ACTION_MATCHES_CONDITION` in
-`scripts/admin/ranger-admin-install-*.properties` during Admin setup.
-
-**Prerequisite:** the admin distribution must include an uncommented property
-entry in `conf.dist/ranger-admin-site.xml`. Rebuild dist before building the
-Admin image:
-
-~~~
-docker compose -f docker-compose.ranger-build.yml build
-docker compose -f docker-compose.ranger-build.yml up
-~~~
-
-**First-time setup:** set `FF_ENABLE_OZONE_ACTION_MATCHES_CONDITION=true` in
-`scripts/admin/ranger-admin-install-<db>.properties`, then bring up services.
-
-**Changing the flag later** (choose one):
-
-1. Edit `FF_ENABLE_OZONE_ACTION_MATCHES_CONDITION` in
- `scripts/admin/ranger-admin-install-<db>.properties` and recreate Admin so
- setup runs again:
- ~~~
- docker compose -f docker-compose.ranger.yml -f
docker-compose.ranger-solr.yml -f docker-compose.ranger-ozone.yml \
- up -d --build --force-recreate ranger
- ~~~
- Works even if the DB already exists; setup re-runs on a fresh container.
-
-2. Edit the live value in the container's
- `ranger-admin-site.xml` and restart Admin.
-
-`install.properties` is not re-read on restart alone — only when setup runs.
-`RangerServiceDefService` applies the site.xml value when serving the ozone
-service-def.
-
~~~
./scripts/ozone/ozone-plugin-docker-setup.sh
-docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-solr.yml
-f docker-compose.ranger-ozone.yml up -d
+docker compose --profile ${AUDIT_DESTINATIONS} -f docker-compose.ranger.yml -f
docker-compose.ranger-audit-service.yml -f docker-compose.ranger-ozone.yml up -d
~~~
-Verify (after login):
-
-~~~
-curl -s -u admin:rangerR0cks!
http://localhost:6080/service/plugins/definitions/name/ozone \
- | python3 -c "import json,sys; d=json.load(sys.stdin); print('options',
d.get('options')); print('conditions', [c['name'] for c in
d.get('policyConditions',[])])"
-~~~
#### Bring up trino container (requires docker build with jdk 11):
~~~
-docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-trino.yml
up -d
-~~~
-#### Bring up solr container:
-~~~
-docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-solr.yml
up -d
-~~~
-#### Bring up opensearch container:
+docker compose --profile ${AUDIT_DESTINATIONS} -f docker-compose.ranger.yml -f
docker-compose.ranger-audit-service.yml -f docker-compose.ranger-trino.yml up -d
~~~
-docker compose -f docker-compose.ranger.yml -f
docker-compose.ranger-opensearch.yml up -d
-~~~
-
-#### OpenSearch audit flow (replace Solr for access audits)
-
-OpenSearch can replace Solr for **audit storage and UI queries**. Ranger Admin
reads audits via
-`audit_store=opensearch` using a native low-level REST client (compatible with
any OpenSearch version).
-
-**Write path:** access audits flow through audit-server ingestor, Kafka, and
the Java
-`ranger-audit-dispatcher-opensearch` service into the OpenSearch
`ranger_audits` index.
-Ranger Admin policy/admin transaction audits remain DB-backed; this is the
same boundary
-used by the Solr audit path.
-
-##### Setup
-
-With the default `RANGER_DB_TYPE=postgres`, OpenSearch auditing is
preconfigured and runs
-out of the box — the commands below need no `install.properties` changes.
-
-~~~
-# Prerequisites: build Ranger artifacts (admin, audit ingestor/dispatcher,
...) and download archives
-mvn clean package -DskipTests -pl distro -am
-cp target/ranger-* dev-support/ranger-docker/dist/
-cd dev-support/ranger-docker
-./download-archives.sh kafka opensearch hadoop
-
-export RANGER_DB_TYPE=postgres
-# 1. Start OpenSearch first (Ranger Admin's bootstrapper needs it on startup)
-docker compose -f docker-compose.ranger.yml -f
docker-compose.ranger-opensearch.yml \
- -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-hadoop.yml \
- -f docker-compose.ranger-audit-ingestor.yml \
- -f docker-compose.ranger-audit-dispatcher-opensearch.yml up -d
ranger-opensearch
-
-# 2. Start core stack (Ranger Admin, Kafka, Hadoop)
-# Kafka auto-creates the ranger_audits topic on startup.
-# Ranger Admin auto-creates the OpenSearch index via
OpenSearchIndexBootStrapper.
-docker compose -f docker-compose.ranger.yml -f
docker-compose.ranger-opensearch.yml \
- -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-hadoop.yml \
- -f docker-compose.ranger-audit-ingestor.yml \
- -f docker-compose.ranger-audit-dispatcher-opensearch.yml up -d ranger
ranger-kafka ranger-hadoop
-
-# 3. Start audit ingestor and OpenSearch dispatcher
-docker compose -f docker-compose.ranger.yml -f
docker-compose.ranger-opensearch.yml \
- -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-hadoop.yml \
- -f docker-compose.ranger-audit-ingestor.yml \
- -f docker-compose.ranger-audit-dispatcher-opensearch.yml up -d
ranger-audit-ingestor ranger-audit-dispatcher-opensearch
-~~~
-
-To use OpenSearch with **mysql or oracle** instead, enable the OpenSearch
block in the matching
-`scripts/admin/ranger-admin-install-${RANGER_DB_TYPE}.properties` (uncomment
the `audit_store=opensearch`
-and `audit_opensearch_*` lines and comment out the Solr block) before running
the setup commands.
-
-For **existing Solr-based installs**, switch stores by setting
`audit_store=opensearch` (and the
-`audit_opensearch_*` properties) in install.properties and restarting Ranger
Admin.
-Similarly, check the `depends` section of the
`docker-compose.ranger-service.yaml` file and add docker-compose files for
these services when trying to bring up the `service` container.
#### Bring up all containers
~~~
./scripts/ozone/ozone-plugin-docker-setup.sh
-docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-solr.yml
-f docker-compose.ranger-usersync.yml -f docker-compose.ranger-tagsync.yml -f
docker-compose.ranger-pdp.yml -f docker-compose.ranger-kms.yml -f
docker-compose.ranger-hadoop.yml -f docker-compose.ranger-hbase.yml -f
docker-compose.ranger-kafka.yml -f docker-compose.ranger-hive.yml -f
docker-compose.ranger-knox.yml -f docker-compose.ranger-ozone.yml up -d
+docker compose --profile ${AUDIT_DESTINATIONS} -f docker-compose.ranger.yml -f
docker-compose.ranger-audit-service.yml -f docker-compose.ranger-usersync.yml
-f docker-compose.ranger-tagsync.yml -f docker-compose.ranger-pdp.yml -f
docker-compose.ranger-kms.yml -f docker-compose.ranger-hadoop.yml -f
docker-compose.ranger-hbase.yml -f docker-compose.ranger-hive.yml -f
docker-compose.ranger-knox.yml -f docker-compose.ranger-ozone.yml up -d
~~~
#### To rebuild specific images and start containers with the new image:
~~~
-docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-solr.yml
-f docker-compose.ranger-usersync.yml -f docker-compose.ranger-tagsync.yml -f
docker-compose.ranger-kms.yml -f docker-compose.ranger-hadoop.yml -f
docker-compose.ranger-hbase.yml -f docker-compose.ranger-kafka.yml -f
docker-compose.ranger-hive.yml -f docker-compose.ranger-trino.yml -f
docker-compose.ranger-knox.yml up -d --no-deps --force-recreate --build
<service-1> <service-2>
+docker compose --profile ${AUDIT_DESTINATIONS} -f docker-compose.ranger.yml -f
docker-compose.ranger-audit-service.yml -f docker-compose.ranger-usersync.yml
-f docker-compose.ranger-tagsync.yml -f docker-compose.ranger-kms.yml -f
docker-compose.ranger-hadoop.yml -f docker-compose.ranger-hbase.yml -f
docker-compose.ranger-hive.yml -f docker-compose.ranger-trino.yml -f
docker-compose.ranger-knox.yml up -d --no-deps --force-recreate --build
<service-1> <service-2>
~~~
-#### To bring up audit server ingestor + dispatchers. Make sure kafka, solr,
and hdfs containers are running before bringing up audit server services.
-~~~
-docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-solr.yml
-f docker-compose.ranger-hadoop.yml -f docker-compose.ranger-kafka.yml -f
docker-compose.ranger-audit-server.yml up -d
+##### Also send audits to HDFS
+Audits fan out to `AUDIT_INDEX_STORE` **and** HDFS when the `audit-store-hdfs`
profile is enabled:
~~~
-
-#### To bring up audit server services individually:
-~~~
-# Audit ingestor
-docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-kafka.yml
-f docker-compose.ranger-audit-ingestor.yml up -d
-
-# Solr dispatcher (requires the ranger-solr container; see "Bring up solr
container" above)
-docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-solr.yml
-f docker-compose.ranger-kafka.yml -f
docker-compose.ranger-audit-dispatcher-solr.yml up -d
-
-# OpenSearch dispatcher (requires the ranger-opensearch container; see
"OpenSearch audit flow" above)
-docker compose -f docker-compose.ranger.yml -f
docker-compose.ranger-opensearch.yml -f docker-compose.ranger-kafka.yml -f
docker-compose.ranger-audit-dispatcher-opensearch.yml up -d
-
-# HDFS dispatcher
-docker compose -f docker-compose.ranger.yml -f
docker-compose.ranger-hadoop.yml -f docker-compose.ranger-kafka.yml -f
docker-compose.ranger-audit-dispatcher-hdfs.yml up -d
+export AUDIT_DESTINATIONS=audit-store-${AUDIT_INDEX_STORE}
+docker compose --profile ${AUDIT_DESTINATIONS} --profile audit-store-hdfs \
+ -f docker-compose.ranger.yml \
+ -f docker-compose.ranger-audit-service.yml \
+ -f docker-compose.ranger-audit-destination-hdfs.yml up -d
~~~
diff --git a/dev-support/ranger-docker/docker-compose.ranger-solr.yml
b/dev-support/ranger-docker/docker-compose.ranger-solr.yml
deleted file mode 100644
index bc3b7e18b..000000000
--- a/dev-support/ranger-docker/docker-compose.ranger-solr.yml
+++ /dev/null
@@ -1,66 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements. See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership. The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-services:
- ranger-solr:
- build:
- context: .
- dockerfile: Dockerfile.ranger-solr
- args:
- - RANGER_BASE_IMAGE=${RANGER_BASE_IMAGE}
- - RANGER_BASE_VERSION=${RANGER_BASE_VERSION}
- - SOLR_VERSION=${SOLR_VERSION}
- - SOLR_PLUGIN_VERSION=${SOLR_PLUGIN_VERSION}
- - KERBEROS_ENABLED=${KERBEROS_ENABLED}
- image: ranger-solr
- container_name: ranger-solr
- hostname: ranger-solr.rangernw
- volumes:
- - ./dist/keytabs/ranger-solr:/etc/keytabs
- -
./scripts/solr/solr-ranger_audits:/opt/solr/server/solr/configsets/ranger_audits/conf
- # Core conf is copied once by solr-precreate; mount so Solr 9 cache
updates apply without recreating the core
- - ./scripts/solr/solr-ranger_audits:/var/solr/data/ranger_audits/conf
- -
./scripts/solr/ranger_audits/core.properties:/var/solr/data/ranger_audits/core.properties
- -
./scripts/solr/ranger-solr-plugin-install.properties:/opt/ranger/ranger-solr-plugin/install.properties
- # Keep enable templates in sync with repo (image tarball may be stale)
- -
../../plugin-solr/conf/ranger-solr-security-changes.cfg:/opt/ranger/ranger-solr-plugin/install/conf.templates/enable/ranger-solr-security-changes.cfg:ro
- - ./scripts/solr/core-site.xml:/opt/solr/server/resources/core-site.xml
- - ./scripts/solr/solr-jaas.conf:/var/solr/data/jaas.conf
- - ./scripts/solr/solr-security.json:/var/solr/data/security.json
- - ./scripts/solr/ranger-solr.sh:/opt/ranger/ranger-solr.sh
- - ./scripts/kdc/krb5.conf:/etc/krb5.conf
- networks:
- - ranger
- ports:
- - "8983:8983"
- depends_on:
- ranger-kdc:
- condition: service_started
- ranger-zk:
- condition: service_started
- environment:
- - KERBEROS_ENABLED
- - KRB5_CONFIG=/etc/krb5.conf
- # Solr 9 enables Java SecurityManager by default; Ranger keytab login
and policy cache need broader access
- - SOLR_SECURITY_MANAGER_ENABLED=false
- command:
- - solr-precreate
- - ranger_audits
- - /opt/solr/server/solr/configsets/ranger_audits/
-
-networks:
- ranger:
- name: rangernw
diff --git a/dev-support/ranger-docker/docker-compose.ranger.yml
b/dev-support/ranger-docker/docker-compose.ranger.yml
index c737fab86..5d9ebe6e0 100644
--- a/dev-support/ranger-docker/docker-compose.ranger.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger.yml
@@ -34,6 +34,7 @@ services:
environment:
- RANGER_VERSION
- RANGER_DB_TYPE
+ - AUDIT_INDEX_STORE
- KERBEROS_ENABLED
- DEBUG_ADMIN=${DEBUG_ADMIN:-false}
- JAVA_OPTS
diff --git
a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-mysql.properties
b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-mysql.properties
index 2ba46c336..67a1fd4ce 100644
---
a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-mysql.properties
+++
b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-mysql.properties
@@ -42,29 +42,19 @@ rangerTagsync_password=rangerR0cks!
rangerUsersync_password=rangerR0cks!
keyadmin_password=rangerR0cks!
+audit_store=opensearch
+
+audit_opensearch_urls=ranger-opensearch
+audit_opensearch_port=9200
+audit_opensearch_protocol=http
+audit_opensearch_user=admin
+audit_opensearch_password=admin
+audit_opensearch_index=ranger_audits
+audit_opensearch_bootstrap_enabled=true
-audit_store=solr
audit_solr_urls=http://ranger-solr:8983/solr/ranger_audits
audit_solr_collection_name=ranger_audits
-# audit_store=elasticsearch
-audit_elasticsearch_urls=
-audit_elasticsearch_port=9200
-audit_elasticsearch_protocol=http
-audit_elasticsearch_user=elastic
-audit_elasticsearch_password=elasticsearch
-audit_elasticsearch_index=ranger_audits
-audit_elasticsearch_bootstrap_enabled=true
-
-# audit_store=opensearch
-# audit_opensearch_urls=ranger-opensearch
-# audit_opensearch_port=9200
-# audit_opensearch_protocol=http
-# audit_opensearch_user=admin
-# audit_opensearch_password=admin
-# audit_opensearch_index=ranger_audits
-# audit_opensearch_bootstrap_enabled=true
-
policymgr_external_url=http://ranger-admin:6080
policymgr_http_enabled=true
diff --git
a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-oracle.properties
b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-oracle.properties
index f83688c80..77adc3787 100644
---
a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-oracle.properties
+++
b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-oracle.properties
@@ -44,29 +44,19 @@ rangerTagsync_password=rangerR0cks!
rangerUsersync_password=rangerR0cks!
keyadmin_password=rangerR0cks!
+audit_store=opensearch
+
+audit_opensearch_urls=ranger-opensearch
+audit_opensearch_port=9200
+audit_opensearch_protocol=http
+audit_opensearch_user=admin
+audit_opensearch_password=admin
+audit_opensearch_index=ranger_audits
+audit_opensearch_bootstrap_enabled=true
-audit_store=solr
audit_solr_urls=http://ranger-solr:8983/solr/ranger_audits
audit_solr_collection_name=ranger_audits
-# audit_store=elasticsearch
-audit_elasticsearch_urls=
-audit_elasticsearch_port=9200
-audit_elasticsearch_protocol=http
-audit_elasticsearch_user=elastic
-audit_elasticsearch_password=elasticsearch
-audit_elasticsearch_index=ranger_audits
-audit_elasticsearch_bootstrap_enabled=true
-
-# audit_store=opensearch
-# audit_opensearch_urls=ranger-opensearch
-# audit_opensearch_port=9200
-# audit_opensearch_protocol=http
-# audit_opensearch_user=admin
-# audit_opensearch_password=admin
-# audit_opensearch_index=ranger_audits
-# audit_opensearch_bootstrap_enabled=true
-
policymgr_external_url=http://ranger-admin:6080
policymgr_http_enabled=true
