kumaab opened a new pull request, #17:
URL: https://github.com/apache/ranger-tools/pull/17
## What changes were proposed in this pull request?
- Adds release/Dockerfile.ranger-pdp so the PDP can be published alongside
ranger, ranger-db and ranger-solr by workflow:
`build-and-tag-ranger-image.yaml`, which now builds, pushes and tags ranger-pdp
as well.
- The image downloads the released `ranger-<version>-pdp.tar.gz` from the
Apache mirrors, GPG-verifies and unpacks it in a single layer so the tarballs
don't remain in the image. `download-ranger.sh` is parameterized by
`RANGER_SERVICE` (default: admin) to fetch it.
- Configuration needs no compose file. On every start, render-pdp-site.py
renders ranger-pdp-site.xml from the YAML at RANGER_PDP_SITE_YAML. By default
that is the image's `ranger-pdp-site-defaults.yaml`, whose values reference
environment variables as ${VAR:-default}; a user-supplied YAML (e.g. from a
Kubernetes ConfigMap) replaces it entirely. A mounted `ranger-pdp-site.xml` is
used as-is. `python3-yaml` is installed from the Ubuntu archive for the
renderer.
- The PDP refuses to start without a usable inbound authentication handler,
so the image always enables header-based authn (X-Forwarded-User by default),
and the entrypoint fails fast with an actionable message when the effective
config leaves no handler usable.
- release/README.md gains PDP build and run commands; usage and
configuration details are in release/README-pdp.md.
## How was this patch tested?
- Built `Dockerfile.ranger-pdp` locally for the released 2.9.0 PDP tarball
(GPG check passed) and ran it with ranger and ranger-db images built from the
same release/ directory; the PDP downloaded policies from Ranger Admin and
returned the expected ALLOW/DENY decisions.
- Verified header authentication: requests without the header get 401, and a
non-delegation caller asking on behalf of another user gets 403. The container
reports healthy on /health/ready.
- Verified configuration: default rendering (checked unchanged after the
YAML refactor), a user-supplied RANGER_PDP_SITE_YAML replacing the defaults,
env var expansion, and a mounted `ranger-pdp-site.xml` used as-is. Missing or
invalid YAML, or a config with no usable auth handler, fails at startup with
exit code 1.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
