[
https://issues.apache.org/jira/browse/RANGER-5723?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18106889#comment-18106889
]
Ramachandran Krishnan commented on RANGER-5723:
-----------------------------------------------
Merged into master commit
details:[https://github.com/apache/ranger/commit/8e7716cd3c36da395b8edc8470e328f736fbd984]
> Plugin SPIFFE outbound auth for audit-server destination
> --------------------------------------------------------
>
> Key: RANGER-5723
> URL: https://issues.apache.org/jira/browse/RANGER-5723
> Project: Ranger
> Issue Type: Sub-task
> Components: Ranger
> Reporter: Ramachandran Krishnan
> Assignee: Ramachandran Krishnan
> Priority: Major
> Time Spent: 1h 40m
> Remaining Estimate: 0h
>
> Wires all Ranger plugins to send workload SPIFFE identity on audit POSTs to
> the Audit Ingestor, completing the plugin → ingestor trust boundary.
> Plugins already batch authorization audits to the audit-server destination
> ({{{}POST /api/audit/access{}}}). This change adds optional SPIFFE header
> authentication on those outbound calls so the ingestor can validate the
> caller’s Kubernetes service account without username/password.
> h3. Audit destination changes
> Extends the shared audit-server destination so each audit HTTP request can
> include:
> * {{X-Spiffe-Id}} (or configured header name) with the plugin workload’s
> SPIFFE ID
> * SPIFFE ID resolved from install-time value, identity file, or standard
> workload identity path (via shared utilities from PR1)
> When SPIFFE auth is disabled, behavior matches today (no header; existing
> Kerberos/JWT paths on ingestor still apply if configured).
> h3. Plugin install and enable templates
> Updates install properties and config changers across all supported plugins
> (HDFS, Hive, HBase, Knox, Kafka, Ozone, YARN, Storm, Atlas, Elasticsearch,
> Solr, Sqoop, Trino, Presto, Kylin, KMS, etc.) so {{enable-*-plugin.sh}} /
> install writes SPIFFE settings into each plugin’s audit and security
> configuration, for example:
> * Enable flag for audit-server SPIFFE auth
> * Header name (default {{{}X-Spiffe-Id{}}})
> * SPIFFE ID value or file path per workload ({{{}…/sa/hive{}}},
> {{{}…/sa/hdfs{}}}, {{{}…/sa/om{}}}, …)
> Operators set these at install/upgrade time; the service account in the
> SPIFFE ID must match that repo’s {{policy.download.auth.users}} (enforced by
> ingestor allow-list in dynamic mode).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
