Mahmoud Hassanen created HDDS-16188:
---------------------------------------
Summary: Multi-Tenancy: Implement state-aware validation for
Ranger role and policy creation
Key: HDDS-16188
URL: https://issues.apache.org/jira/browse/HDDS-16188
Project: Apache Ozone
Issue Type: Improvement
Components: Security
Affects Versions: 2.2.0
Reporter: Mahmoud Hassanen
Assignee: Mahmoud Hassanen
Background:
In HDDS-15982, idempotent deletion was added to
RangerClientMultiTenantAccessController, while role/policy creation remains
fail-fast if an entity already exists in Ranger to prevent security
misconfigurations.
Problem:
If tenant creation partially fails or times out after entities have already
been created in Ranger (but before OM completes the operation), retrying tenant
creation will fail with an entity-already-exists error, leaving the tenant in
an uncreatable/orphaned state.
Goal:
Explore and discuss the proper handling/recovery strategy for tenant creation
retries when associated Ranger entities already exist:
Evaluate cleanup/rollback mechanisms on creation failure.
Discuss safe recovery or reconciliation paths when re-creating tenants with
pre-existing Ranger entities.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
