ramackri opened a new pull request, #1054: URL: https://github.com/apache/ranger/pull/1054
## Summary - Backports [RANGER-5628 (#995)](https://github.com/apache/ranger/pull/995) / commit [dcf5947fe](https://github.com/apache/ranger/commit/dcf5947fe96f71e311e3f8d94f0786496cf8adf4) to the `ranger-2.9` release branch. - Adds Ozone STS action-based policy evaluation (`RangerActionMatcher`, `RangerActionListMatcher`) and UI support for action conditions on permission rows. - Bumps `ozone.version` from 2.1.0 to 2.1.1 (required for `RequestContext.getS3Action()` and `OzoneGrant.getS3Actions()` APIs). ## Backport conflict resolutions - **RangerOzoneAuthorizer.java**: Kept ranger-2.9 logging/style; applied only the functional change to pass `context.getS3Action()` as the request action. - **Editable.jsx / PolicyConditionsComp.jsx**: Took master UI refactor (fixes React hooks violations, adds action-matches support). - **checkstyle-suppressions.xml**: Kept ranger-2.9 minimal suppressions; added only the new patch class suppression. - **GovernedData views** (`AccessGrantForm.jsx`, `DatashareDetailLayout.jsx`): Dropped — these files do not exist on `ranger-2.9` (GDS UI not present in this branch). ## Potential risk areas for ranger-2.9 - **Ozone dependency bump (2.1.0 → 2.1.1)**: Required for compilation and runtime STS action APIs. Deployments must use Ozone 2.1.1+ for full action support. - **DB patch `PatchForOzoneServiceDefPolicyConditionUpdate_J10065`**: Will run on Ranger admin startup to add the `action-matches` policy condition to the Ozone service definition. - **React UI changes in `Editable.jsx`**: Large refactor; recommend manual UI testing of Ozone policy create/edit flows. ## Test plan - [ ] `mvn -pl agents-common,plugin-ozone,security-admin -am test` compiles and unit tests pass - [ ] Ozone policy UI: create/edit policy with action-matches on permission rows - [ ] Ozone STS end-to-end: verify action-based authorization with Ranger docker + Ozone 2.1.1 - [ ] Verify DB patch applies cleanly on upgrade from existing ranger-2.9 install Made with [Cursor](https://cursor.com) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
