ramackri commented on code in PR #1073:
URL: https://github.com/apache/ranger/pull/1073#discussion_r3600179515
##########
security-admin/src/main/java/org/apache/ranger/patch/PatchForOzoneServiceDefPolicyConditionUpdate_J10065.java:
##########
@@ -18,6 +18,7 @@
package org.apache.ranger.patch;
Review Comment:
Pre-upgrade (ozone DB)
Stock Ranger 2.9 / unreleased 3.0 (feature not shipped):
{
"enableTagBasedPolicies": "true",
"enableDenyAndExceptionsInPolicies": "true"
}
No enableOzoneActionPolicy. No enableActionMatcherInPoliciesCondition until
upgrade or first admin sync.
Flag OFF (false in site.xml)
Ozone DB def_options after J10065:
{
"enableTagBasedPolicies": "true",
"enableDenyAndExceptionsInPolicies": "true",
"enableActionMatcherInPoliciesCondition": "false"
}
Ozone API options (GET service-def):
{
"enableTagBasedPolicies": "true",
"enableDenyAndExceptionsInPolicies": "true",
"enableActionMatcherInPoliciesCondition": "false"
}
J10065 adds enableActionMatcherInPoliciesCondition: "false".
Flag ON (true in site.xml)
Ozone DB def_options after J10065:
{
"enableTagBasedPolicies": "true",
"enableDenyAndExceptionsInPolicies": "true",
"enableActionMatcherInPoliciesCondition": "true"
}
Ozone API options (GET service-def):
{
"enableTagBasedPolicies": "true",
"enableDenyAndExceptionsInPolicies": "true",
"enableActionMatcherInPoliciesCondition": "true"
}
J10065 adds enableActionMatcherInPoliciesCondition: "true".
| Option | Pre-upgrade (stock) | Flag OFF after J10065 | Flag ON after
J10065 |
|--------|---------------------|------------------------|----------------------|
| `enableTagBasedPolicies` | `"true"` | `"true"` | `"true"` |
| `enableDenyAndExceptionsInPolicies` | `"true"` | `"true"` | `"true"` |
| `enableActionMatcherInPoliciesCondition` | absent | `"false"` | `"true"` |
| `enableOzoneActionPolicy` | absent | absent | absent |
@fimugdha Are you looking for this sort this behaviour ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
