Ramachandran Krishnan created RANGER-5721:
---------------------------------------------
Summary: Adding Admin-managed audit partition plan REST and
lifecycle
Key: RANGER-5721
URL: https://issues.apache.org/jira/browse/RANGER-5721
Project: Ranger
Issue Type: Sub-task
Components: Ranger
Reporter: Ramachandran Krishnan
Assignee: Ramachandran Krishnan
Fix For: 3.0.0
Makes Ranger Admin the source of truth for audit Kafka partition routing and
per-service audit POST allow-lists.
When operators create, update, rename, delete, or re-type a Ranger service,
Admin automatically updates the audit partition plan stored in
{{x_ranger_global_state}} and bumps the plan version. The Audit Ingestor polls
for changes via a new download API
This PR covers Admin-side plan management and REST only. Ingestor polling,
dynamic Kafka routing, and plugin SPIFFE auth are out of scope here.
h3. Plan lifecycle (automatic)
Admin hooks into service CRUD and keeps the plan in sync:
||Event||Behavior||
|Service created|Onboard service under its plugin type; assign partition slots
from buffer or defaults|
|Service deleted|Remove service from plan; return slots to buffer when
applicable|
|Service renamed|Update plan entry for the service|
|Service type changed|Offboard from old plugin type, onboard under new type|
|{{policy.download.auth.users}} changed|Refresh {{serviceAllowedUsers}} in the
plan (who may POST audits per repo)|
h3. REST API
Exposes a global download endpoint for the audit ingestor (and authorized Admin
users):
* {{GET /service/global/audit-partition-plan/download}}
* Query param: {{lastKnownAuditPartitionPlanVersion}} (default {{-1}} = always
return current)
* 200 OK + full plan JSON when version is newer than the client’s
* 304 Not Modified when the client already has the latest version
* Requires Admin or Audit Admin role (ingestor authenticates as
{{rangerauditserver}} via SPIFFE — RANGER-5700)
h3. Configuration
Adds Admin-side settings for default partition slots per plugin and optional
per-plugin overrides (e.g. Hive vs HDFS slot counts).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
