[
https://issues.apache.org/jira/browse/AMBARI-26643?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18111048#comment-18111048
]
Jialiang Cai commented on AMBARI-26643:
---------------------------------------
Implementation and validation update for AMBARI-26643
Scope completed on branch AMBARI-26643:
* Python runtime contract: Ambari Agent and Server require CPython >= 3.9.2.
The build resolves locked runtime wheels for the target manylinux/CPython ABI,
stages them under the product-private lib directory, audits
hashes/licenses/SBOM, and never runs pip on deployment hosts. The RPM declares
the external Python interpreter capability while carrying the Python
distributions inside the Ambari package for offline installation.
* Dependency modernization: removed obsolete Ambari-vendored Python libraries
and stale Python 2 artifacts; migrated callers to the standard library or
locked official packages; retained the AES-CBC v1 wire format and official
stomp.py WebSocket adapter. The only source distribution exception is the
separately locked docopt package, built without network build isolation.
* Runtime correctness and security: hardened service command timeouts and
process cleanup, rollback/error paths, temporary-secret handling, credential
argument handling, JMX/HTTP request validation, Kerberos/HDFS operations, and
Ranger bootstrap failure closure. Focused failure-path tests and artifact
audits cover these contracts.
* Stack scope: BIGTOP is the supported community stack. BIGTOP 3.2/3.3/3.4
service definitions were reviewed and corrected for the supported Hive,
Zeppelin, Flink, Spark, ZooKeeper, HDFS, YARN, HBase, Kafka, Livy, Solr,
Ranger, Metrics, Tez, and Alluxio workflows. HDP-only assumptions, obsolete HDP
URL/runtime paths, and Nagios integration code were removed because the
supported deployment no longer ships the HDP stack or Nagios service.
* Platform scope: Windows support was intentionally removed from
product/runtime/package entry points. This avoids maintaining an untested
second launcher and packaging contract while the supported deployment target is
Linux RPM with Python 3.9. Ember/classic remains only as migration baseline;
the deployed default entry point is React latest.
* Packaging and offline delivery: Maven lock/wheelhouse bundling,
normalization, audit, LICENSE/NOTICE/SBOM assembly, RPM mappings, and the
deployment repository are aligned. The build cache (`.m2`) is used for Maven
artifacts only; Python wheels come from the locked wheelhouse. Deployment
installs the RPM from the local repository and does not invoke pip.
* UI evidence: the React runtime was exercised against the three-node BIGTOP
cluster. Screenshots for Dashboard, Hosts, Services, HDFS, YARN, Views, Files,
and Capacity Scheduler are committed under
docs/frontend-refactor/visual-baseline/react-2026-09-03/ in the branch and
linked from the pull request.
Validation evidence:
* Ambari Agent Python runner: 629/629.
* Ambari Server Python runner: 1391/1391.
* deploy workflow tests: 438/438; Ruff and metadata/artifact audits passed.
* Final build run: ambari-26643-final-v5. Agent RPM SHA-256:
cd2ff2a60406bdd0c18ad5dc89c01d41dc5c79c7a5dba6a480b192571dc5b916. Server RPM
SHA-256: 0489693dedf2686af3545ce4b872c072cd23346e5549628c4ff9ba94c5bb9a60.
* Final deployment: minimal8g-admin-v3, 13 phases applied, seven core services
healthy, no host desired-state mismatch, Python 3.9.25 runtime verified on the
server and all agents, and Java 17 base services/Hive Java 8 compatibility
verified.
* Three-pass post-validation covered source/static contracts,
RPM/SBOM/repository metadata, and live container/service/runtime behavior. No
high or medium finding remains in the reviewed scope.
This comment records the implementation decisions and evidence so the issue can
be reviewed against product behavior rather than commit messages alone.
> Modernize Ambari Agent Python runtime and dependencies
> ------------------------------------------------------
>
> Key: AMBARI-26643
> URL: https://issues.apache.org/jira/browse/AMBARI-26643
> Project: Ambari
> Issue Type: Improvement
> Reporter: Jialiang Cai
> Priority: Major
>
> Ambari Agent and related Server Python utilities still mix an implicit system
> Python with old vendored libraries and distribution-specific packages. On
> Rocky Linux 8, /usr/bin/python3 remains Python 3.6 while the supported Ambari
> runtime requires an explicitly installed modern interpreter. The current
> packaging also allows build-host Python and platform details to leak into
> release artifacts.\n\nThis change establishes a three-layer Python
> modernization boundary:\n\n1. Require Python 3.9.2 or newer and explicitly
> use the Rocky 8 python39 interpreter in installation, bootstrap, wrappers,
> RPM dependencies, and runtime entry points.\n2. Replace obsolete vendored
> general-purpose libraries with the standard library or hash-locked official
> packages, and bundle a reproducible manylinux/CPython 3.9 dependency closure
> in Ambari private libraries.\n3. Adapt Agent scheduling, STOMP over
> WebSocket, template, encryption, repository, OS detection, and directly
> related Server utility behavior with focused compatibility tests.\n\nThe
> patch must preserve the existing AES-CBC v1 wire format, use the official
> stomp.py WebSocket adapter, keep Agent and Server on the same Python runtime
> contract, reject source distributions except the separately hash-locked
> pure-Python docopt dependency, and verify dependency metadata and native
> artifact architecture. Windows and unrelated frontend changes are out of
> scope.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
