[
https://issues.apache.org/jira/browse/RANGER-5543?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Bhavesh Amre updated RANGER-5543:
---------------------------------
Description:
GCP HSM Integration Issues in Ranger KMS
The integration of GCP HSM with Ranger KMS was failing due to the following
issues:
1. Missing Dependencies
Required dependencies such as protobuf-java, failureaccess, and guava were not
included, causing compatibility issues with GCP libraries.
Resolution:
Added the missing dependencies (Guava, failureaccess, protobuf-java) to the
project.
Updated the KMS assembly configuration to ensure all required dependencies are
packaged correctly.
2. Unconditional Master Key Creation Attempts
The system was repeatedly attempting to call create master key even when it
already existed. This led to unnecessary exceptions and instability.
Additionally, the logic did not differentiate between user roles:
Owner role → has permission to create a master key
Viewer role → has permission to read/view the master key only
However, both roles were attempting to generate the master key, which caused
permission-related failures.
Resolution:
Introduced a masterKeyExists() check in the GCP HSM provider.
Updated the logic to:
First verify whether the master key already exists.
Avoid call for creating the key if it already exists.
Ensure that:
Owner role can create the master key if it does not exist.
Viewer role only checks for the existence of the master key and does not
attempt creation.
was:
GCP HSM integration in Ranger KMS was failing due to missing dependencies and
repeated attempts to create an already existing master key, leading to
unnecessary exceptions and instability.
Introduced a master key existence check in the GCP HSM provider to prevent
duplicate key creation attempts.
Updated the generateMasterKey() method to handle existing keys more gracefully
and reduce redundant API calls.
Implemented a new masterKeyExists() method using GCP KMS APIs for reliable key
validation.
Added missing dependencies (Guava, failureaccess, protobuf) to ensure
compatibility with GCP libraries.
Updated KMS assembly configuration to package required dependencies correctly.
Improved dependency version management by introducing a dedicated property for
failureaccess.
Removed redundant self-referencing code and enhanced overall code clarity.
Ensured minimal and targeted code changes without impacting existing
functionality.
Improved overall stability and reliability of GCP HSM integration in Ranger KMS.
> Ranger KMS GCP always try to create master key irrespective of its existence
> -----------------------------------------------------------------------------
>
> Key: RANGER-5543
> URL: https://issues.apache.org/jira/browse/RANGER-5543
> Project: Ranger
> Issue Type: Bug
> Components: Ranger
> Reporter: Bhavesh Amre
> Assignee: Bhavesh Amre
> Priority: Major
>
> GCP HSM Integration Issues in Ranger KMS
>
> The integration of GCP HSM with Ranger KMS was failing due to the following
> issues:
>
> 1. Missing Dependencies
>
> Required dependencies such as protobuf-java, failureaccess, and guava were
> not included, causing compatibility issues with GCP libraries.
>
> Resolution:
>
> Added the missing dependencies (Guava, failureaccess, protobuf-java) to the
> project.
> Updated the KMS assembly configuration to ensure all required dependencies
> are packaged correctly.
>
> 2. Unconditional Master Key Creation Attempts
>
> The system was repeatedly attempting to call create master key even when it
> already existed. This led to unnecessary exceptions and instability.
>
> Additionally, the logic did not differentiate between user roles:
>
> Owner role → has permission to create a master key
> Viewer role → has permission to read/view the master key only
>
> However, both roles were attempting to generate the master key, which caused
> permission-related failures.
>
> Resolution:
>
> Introduced a masterKeyExists() check in the GCP HSM provider.
> Updated the logic to:
> First verify whether the master key already exists.
> Avoid call for creating the key if it already exists.
> Ensure that:
> Owner role can create the master key if it does not exist.
> Viewer role only checks for the existence of the master key and does not
> attempt creation.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
