ramackri opened a new pull request, #1040: URL: https://github.com/apache/ranger/pull/1040
## Summary Fixes upstream Kafka plugin packaging so `RangerKafkaAuthorizer` can run on Kafka 3.9.x using a broker-delegate classloading model (shim + classloader on the broker classpath; implementation jars without duplicate broker libraries). - **Add `plugin-kafka/template/configuration.xml`** — `plugin-kafka.xml` assembly references `plugin-kafka/template/` for `install/conf.templates/default`, but the directory was never committed. Without it, the assembled tarball can be incomplete and `enable-kafka-plugin.sh` may fail before writing Kafka security/audit configuration (same class of issue as YARN in RANGER-5660). - **Exclude broker-supplied jars from `ranger-kafka-plugin-impl`** — stop shipping Jackson, Jersey/HK2, `kafka-clients`, SLF4J/log4j, and both JAX-RS API jars (`javax.ws.rs-api`, `jakarta.ws.rs-api`) that Kafka 3.9 already provides. Duplicate copies cause `LinkageError`, `ClassCastException`, or policy REST client failures at broker startup. ## Changes | File | Change | |------|--------| | `plugin-kafka/template/configuration.xml` | New empty Hadoop-style template for assembly `conf.templates/default` | | `distro/src/main/assembly/plugin-kafka.xml` | Exclude broker classpath artifacts from `ranger-kafka-plugin-impl`; remove explicit Jersey Jackson includes superseded by excludes | ## Manual testing Tested on Kafka **3.9.1** with Kerberos (`SASL_PLAINTEXT`) and `authorizer.class.name=org.apache.ranger.authorization.kafka.authorizer.RangerKafkaAuthorizer`. 1. **Build** — `mvn package -Pranger-kafka-plugin` (distro assembly) completed successfully. 2. **Tarball packaging** — assembled `ranger-*-kafka-plugin.tar.gz` contains `install/conf.templates/enable/` XML/CFG files and `install/conf.templates/default/configuration.xml`. 3. **Impl contents** — `ranger-kafka-plugin-impl` contains no jackson, jersey, hk2, `kafka-clients`, slf4j, reload4j/log4j, or ws.rs API jars (broker-delegated). 4. **Broker startup** — Kafka broker started cleanly with `RangerKafkaAuthorizer` enabled (no `LinkageError` / `ClassCastException` on startup). 5. **Authorization** — `testuser2` console produce to a restricted topic was **denied**; `testuser1` with allow policy **succeeded**. ## Test plan - [ ] `mvn package -Pranger-kafka-plugin` produces tarball with `install/conf.templates/enable/` and `install/conf.templates/default/configuration.xml` - [ ] `ranger-kafka-plugin-impl` excludes broker-supplied Jackson, Jersey, HK2, `kafka-clients`, SLF4J, log4j/reload4j, and JAX-RS API jars - [ ] Kafka 3.9.x broker starts with `RangerKafkaAuthorizer` configured - [ ] Topic publish authorization enforced per Ranger policies https://issues.apache.org/jira/browse/RANGER-5661 Made with [Cursor](https://cursor.com) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
