vyommani opened a new pull request, #1208:
URL: https://github.com/apache/ranger/pull/1208
## What changes were proposed in this pull request?
Strengthens how Ranger Admin protects certain encrypted configuration values
(e.g. service
connection passwords) at rest, and migrates existing data to the improved
approach. New writes
get the improved protection immediately; a one-time patch upgrades data
written before this
change.
## How was this patch tested?
Ran end-to-end against a real running instance
(`dev-support/ranger-docker`), not just unit
tests, using genuine legacy-format data:
- **Migration**: all genuinely-legacy rows converted; each row's stored
value differs from its
pre-migration value (confirms a real decrypt/re-encrypt, not a relabel);
zero failures.
- **HA mismatch**: pointed one node at a different key than the one data was
migrated under —
fails closed with an actionable error instead of a silent bad-password
auth failure; reverting
the key restores correct decryption.
- **Idempotency**: re-running the migration patch against already-migrated
data is a no-op, no
failures.
- Full `mvn test` / project build verification is still pending — this pass
was done in an
environment without Maven Central access, so verification so far is
against the modified
classes compiled and run directly, not through the project's own build.
### Open questions for reviewers (flagged in-code, not silently decided)
1. Migration patch runs single-pass/single-transaction (matches existing
precedent in this
codebase) — acceptable at very large scale, or should it batch?
2. The new consistency checker WARNs and lets startup continue on a key
mismatch rather than
failing it outright, to avoid turning a legitimate transient state (e.g.
an in-progress key
rotation) into an outage. Right trade-off, or should a hard mismatch
block startup?
3. The new read-path branch relies on the new decrypt call throwing reliably
on a wrong key,
rather than repeating the existing byte-exact re-encrypt-and-compare
self-check the legacy
branches use. Is that reliance justified as-is?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
