pan3793 commented on PR #7437: URL: https://github.com/apache/kyuubi/pull/7437#issuecomment-5568154881
If we have to make a breaking change here eventually, I wonder if we should do more things to move to Ranger 2.9 and [PDP mode](https://ranger.apache.org/blogs/integrating_applications.html#s5). The current architecture- pulling all policies from the Ranger Admin Server on Spark application start, and evaluating authz requests on the client side (Spark driver), does not fit short-lived Spark ETL cases, and another disadvantage is that we have to bundle a heavy Ranger client that pulls in many dependencies. In PDP mode, the Ranger client becomes lightweight and is almost an HTTP client, also no need to download the whole policies to the client. There are many organizations have similar enhancements to make the Ranger Spark Plugin fit large-scale lakehouses; now this is supported by the upstream Ranger community, we should migrate to it ASAP. UT infrastructure might require a significant adjustment to allow us to adopt the Ranger PDP ... -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
