You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@impala.apache.org by ja...@apache.org on 2026/06/05 21:17:43 UTC
(impala) 03/03: IMPALA-14977: Add optional Ranger Helm resources
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/impala.git
commit 221270d58a551ae04423e8dec36d7bc06be6e94c
Author: anubhav <an...@gmail.com>
AuthorDate: Wed Jun 3 15:36:56 2026 -0700
IMPALA-14977: Add optional Ranger Helm resources
Add optional Ranger deployment and service templates behind a chart flag
so policy-admin components can be deployed when needed.
Add chart validation to require auth.ranger.adminUrl when Ranger auth is
enabled against an external Ranger service.
Add ASF license headers to newly added Ranger chart templates.
Testing:
- helm lint helm/impala
- helm template impala14977-check helm/impala --set ranger.enabled=true
- helm template impala14977-ranger-valid helm/impala --set auth.ranger.enabled=true --set ranger.enabled=false --set auth.ranger.adminUrl=http://ranger.example.org:6080
- helm template impala14977-ranger-invalid helm/impala --set auth.ranger.enabled=true --set ranger.enabled=false (fails as expected)
- kubectl config current-context (k3d-impala-live)
- kubectl create namespace impala-14977-policy-live
- helm upgrade --install impala-14977-live helm/impala -n impala-14977-policy-live --set ranger.enabled=true --set auth.ranger.enabled=true --set auth.ranger.adminUrl=http://impala-14977-live-impala-ranger:6080 --set persistence.accessModes[0]=ReadWriteOnce
- kubectl rollout status deployment/impala-14977-live-impala-{statestored,catalogd,impalad,hms,ranger} -n impala-14977-policy-live
- kubectl get deployment impala-14977-live-impala-impalad -n impala-14977-policy-live -o jsonpath='{.spec.template.spec.containers[0].args}' (contains -authorization_provider=ranger and -server_name=server1)
- kubectl apply -n impala-14977-policy-live -f - <<'EOT' (ranger-db postgres deployment/service)
- kubectl exec -n impala-14977-policy-live deploy/ranger-db -- psql -U postgres -d ranger -c "DO $$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname='rangeradmin') THEN CREATE ROLE rangeradmin LOGIN PASSWORD 'rangerR0cks!'; END IF; END $$;"
- kubectl rollout restart deployment/impala-14977-live-impala-ranger -n impala-14977-policy-live
- python3 Ranger API smoke: create Hive service server1 and Ranger user anubhav; apply deny policy on database/table/column '*' for anubhav
- python3 Impyla smoke against svc/impala-14977-live-impala-impalad:21050: create/insert/select on default.ranger_policy_test fail with AuthorizationException under deny policy
- python3 Ranger API update: replace deny policy with allow policy for anubhav on database/table/column '*'
- python3 Impyla smoke against svc/impala-14977-live-impala-impalad:21050: create/insert/select on default.ranger_policy_test succeed under allow policy
Change-Id: I34efcce101038161dfd4007ec7a64c0870e4b0b9
Assisted-by: GPT-5.3 (Cursor)
Reviewed-on: http://gerrit.cloudera.org:8080/24343
Reviewed-by: Jason Fehr <jf...@cloudera.com>
Tested-by: Jason Fehr <jf...@cloudera.com>
---
helm/impala/files/ranger-hive-audit.xml | 33 ++++++++++++++++
helm/impala/files/ranger-hive-security.xml | 48 ++++++++++++++++++++++++
helm/impala/templates/catalogd-deployment.yaml | 8 ++++
helm/impala/templates/configmap.yaml | 6 +++
helm/impala/templates/impalad-deployment.yaml | 8 ++++
helm/impala/templates/ranger-deployment.yaml | 52 ++++++++++++++++++++++++++
helm/impala/templates/ranger-service.yaml | 37 ++++++++++++++++++
helm/impala/templates/ranger-validation.yaml | 22 +++++++++++
helm/impala/values.yaml | 3 ++
9 files changed, 217 insertions(+)
diff --git a/helm/impala/files/ranger-hive-audit.xml b/helm/impala/files/ranger-hive-audit.xml
new file mode 100644
index 000000000..f6670a409
--- /dev/null
+++ b/helm/impala/files/ranger-hive-audit.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<configuration>
+ <property>
+ <name>xasecure.audit.is.enabled</name>
+ <value>true</value>
+ </property>
+ <property>
+ <name>xasecure.audit.destination.log4j</name>
+ <value>true</value>
+ </property>
+ <property>
+ <name>ranger.plugin.hive.access.cluster.name</name>
+ <value>{{ include "impala.fullname" . }}</value>
+ </property>
+</configuration>
diff --git a/helm/impala/files/ranger-hive-security.xml b/helm/impala/files/ranger-hive-security.xml
new file mode 100644
index 000000000..78a5a703e
--- /dev/null
+++ b/helm/impala/files/ranger-hive-security.xml
@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+{{- $rangerAdminUrl := .Values.auth.ranger.adminUrl | default (printf "http://%s-ranger:%d" (include "impala.fullname" .) (.Values.ranger.adminPort | int)) -}}
+<configuration>
+ <property>
+ <name>ranger.plugin.hive.service.name</name>
+ <value>{{ .Values.auth.ranger.serverName }}</value>
+ <description>Name of the Ranger service containing policies.</description>
+ </property>
+ <property>
+ <name>ranger.plugin.hive.policy.rest.url</name>
+ <value>{{ $rangerAdminUrl }}</value>
+ <description>URL to Ranger Admin.</description>
+ </property>
+ <property>
+ <name>ranger.plugin.hive.policy.cache.dir</name>
+ <value>/tmp</value>
+ </property>
+ <property>
+ <name>ranger.plugin.hive.policy.pollIntervalMs</name>
+ <value>30000</value>
+ </property>
+ <property>
+ <name>ranger.plugin.hive.policy.rest.client.connection.timeoutMs</name>
+ <value>120000</value>
+ </property>
+ <property>
+ <name>ranger.plugin.hive.policy.rest.client.read.timeoutMs</name>
+ <value>30000</value>
+ </property>
+</configuration>
diff --git a/helm/impala/templates/catalogd-deployment.yaml b/helm/impala/templates/catalogd-deployment.yaml
index 2fb14a01b..4d7eba7c1 100644
--- a/helm/impala/templates/catalogd-deployment.yaml
+++ b/helm/impala/templates/catalogd-deployment.yaml
@@ -83,6 +83,14 @@ spec:
- name: conf
mountPath: /opt/impala/conf/hive-site.xml
subPath: hive-site.xml
+{{- if .Values.auth.ranger.enabled }}
+ - name: conf
+ mountPath: /opt/impala/conf/ranger-hive-security.xml
+ subPath: ranger-hive-security.xml
+ - name: conf
+ mountPath: /opt/impala/conf/ranger-hive-audit.xml
+ subPath: ranger-hive-audit.xml
+{{- end }}
volumes:
- name: conf
configMap:
diff --git a/helm/impala/templates/configmap.yaml b/helm/impala/templates/configmap.yaml
index 796a04a0f..cdd3c0a54 100644
--- a/helm/impala/templates/configmap.yaml
+++ b/helm/impala/templates/configmap.yaml
@@ -24,3 +24,9 @@ metadata:
data:
hive-site.xml: |
{{ .Files.Get "files/hive-site.xml" | replace "quickstart-hive-metastore" (printf "%s-hms" (include "impala.fullname" .)) | indent 4 }}
+{{- if .Values.auth.ranger.enabled }}
+ ranger-hive-security.xml: |
+{{ tpl (.Files.Get "files/ranger-hive-security.xml") . | indent 4 }}
+ ranger-hive-audit.xml: |
+{{ tpl (.Files.Get "files/ranger-hive-audit.xml") . | indent 4 }}
+{{- end }}
diff --git a/helm/impala/templates/impalad-deployment.yaml b/helm/impala/templates/impalad-deployment.yaml
index e1427cd03..12d440544 100644
--- a/helm/impala/templates/impalad-deployment.yaml
+++ b/helm/impala/templates/impalad-deployment.yaml
@@ -98,6 +98,14 @@ spec:
- name: conf
mountPath: /opt/impala/conf/hive-site.xml
subPath: hive-site.xml
+{{- if .Values.auth.ranger.enabled }}
+ - name: conf
+ mountPath: /opt/impala/conf/ranger-hive-security.xml
+ subPath: ranger-hive-security.xml
+ - name: conf
+ mountPath: /opt/impala/conf/ranger-hive-audit.xml
+ subPath: ranger-hive-audit.xml
+{{- end }}
volumes:
- name: conf
configMap:
diff --git a/helm/impala/templates/ranger-deployment.yaml b/helm/impala/templates/ranger-deployment.yaml
new file mode 100644
index 000000000..6e0382e76
--- /dev/null
+++ b/helm/impala/templates/ranger-deployment.yaml
@@ -0,0 +1,52 @@
+{{/*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied. See the License for the
+specific language governing permissions and limitations
+under the License.
+*/}}
+
+{{- if .Values.ranger.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: {{ include "impala.fullname" . }}-ranger
+ labels:
+{{ include "impala.labels" . | indent 4 }}
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/name: {{ include "impala.name" . }}
+ app.kubernetes.io/component: ranger
+ template:
+ metadata:
+ labels:
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/name: {{ include "impala.name" . }}
+ app.kubernetes.io/component: ranger
+ spec:
+ containers:
+ - name: ranger
+ image: {{ .Values.ranger.image | quote }}
+ imagePullPolicy: {{ .Values.ranger.imagePullPolicy | default "IfNotPresent" }}
+ ports:
+ - name: http
+ containerPort: {{ .Values.ranger.adminPort | default 6080 }}
+{{- with .Values.ranger.env }}
+ env:
+{{ toYaml . | indent 12 }}
+{{- end }}
+{{- end }}
diff --git a/helm/impala/templates/ranger-service.yaml b/helm/impala/templates/ranger-service.yaml
new file mode 100644
index 000000000..450cbc53a
--- /dev/null
+++ b/helm/impala/templates/ranger-service.yaml
@@ -0,0 +1,37 @@
+{{/*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied. See the License for the
+specific language governing permissions and limitations
+under the License.
+*/}}
+
+{{- if .Values.ranger.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ include "impala.fullname" . }}-ranger
+ labels:
+{{ include "impala.labels" . | indent 4 }}
+spec:
+ type: {{ .Values.ranger.service.type | default "ClusterIP" }}
+ ports:
+ - name: http
+ port: {{ .Values.ranger.adminPort | default 6080 }}
+ targetPort: http
+ selector:
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/name: {{ include "impala.name" . }}
+ app.kubernetes.io/component: ranger
+{{- end }}
diff --git a/helm/impala/templates/ranger-validation.yaml b/helm/impala/templates/ranger-validation.yaml
new file mode 100644
index 000000000..5e39d17b4
--- /dev/null
+++ b/helm/impala/templates/ranger-validation.yaml
@@ -0,0 +1,22 @@
+{{/*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied. See the License for the
+specific language governing permissions and limitations
+under the License.
+*/}}
+
+{{- if and .Values.auth.ranger.enabled (not .Values.ranger.enabled) (eq (.Values.auth.ranger.adminUrl | default "") "") -}}
+{{- fail "auth.ranger.adminUrl is required when auth.ranger.enabled=true and ranger.enabled=false" -}}
+{{- end -}}
diff --git a/helm/impala/values.yaml b/helm/impala/values.yaml
index 57ddf085a..99c7faa0e 100644
--- a/helm/impala/values.yaml
+++ b/helm/impala/values.yaml
@@ -72,6 +72,9 @@ auth:
serviceType: "hive"
appId: "impala"
serverName: "server1"
+ # Optional override for Ranger Admin URL. When empty, chart uses
+ # http://<release>-ranger:<ranger.adminPort>.
+ adminUrl: ""
kudu:
enabled: false