You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by Abhay Kulkarni <ak...@hortonworks.com> on 2019/06/25 02:07:33 UTC
Review Request 70940: RANGER-2481:Create a tag service when a resource
service is created and link it to resource service
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70940/
-----------------------------------------------------------
Review request for ranger, Madhan Neethiraj, Ramesh Mani, and Velmurugan Periasamy.
Bugs: RANGER-2481
https://issues.apache.org/jira/browse/RANGER-2481
Repository: ranger
Description
-------
Ranger supports tag-based policies out of the box. However, there are a few configuration steps that need to be performed in order to set up Ranger to perform tag-based authorization. As these steps are often missed, it will be useful to provide a commonly used/structured way of automatically creating tag service and linking it to resource service.
This may be controlled through few configuration parameters:
tag.service.auto.create=<true|false> ==> If tag-service needs to be created when resource-service is created.
tag.service.name=<auto|tag-service-name> ==> If tag-service needs to be created, how is it named (automatically or user-specified)
tag.service.auto.link=<true|false> ==> If resource-service needs to be linked to the tag-service
Diffs
-----
security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java 4a426b78a
security-admin/src/main/java/org/apache/ranger/common/TimedExecutor.java 6f97337b7
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java 1d9391f20
Diff: https://reviews.apache.org/r/70940/diff/1/
Testing
-------
Tested by creating a resource service, and ensuring that corresponding tag service is created and linked with resource service
Thanks,
Abhay Kulkarni
Re: Review Request 70940: RANGER-2481:Create a tag service when a
resource service is created and link it to resource service
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70940/#review216164
-----------------------------------------------------------
Ship it!
Ship It!
- Madhan Neethiraj
On June 26, 2019, 9:53 p.m., Abhay Kulkarni wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/70940/
> -----------------------------------------------------------
>
> (Updated June 26, 2019, 9:53 p.m.)
>
>
> Review request for ranger, Madhan Neethiraj, Ramesh Mani, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-2481
> https://issues.apache.org/jira/browse/RANGER-2481
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Ranger supports tag-based policies out of the box. However, there are a few configuration steps that need to be performed in order to set up Ranger to perform tag-based authorization. As these steps are often missed, it will be useful to provide a commonly used/structured way of automatically creating tag service and linking it to resource service.
>
> This may be controlled through few configuration parameters:
>
> tag.service.auto.create=<true|false> ==> If tag-service needs to be created when resource-service is created.
>
> tag.service.name=<auto|tag-service-name> ==> If tag-service needs to be created, how is it named (automatically or user-specified)
>
> tag.service.auto.link=<true|false> ==> If resource-service needs to be linked to the tag-service
>
>
> Diffs
> -----
>
> security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java 1d9391f20
> security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java 321d1c522
>
>
> Diff: https://reviews.apache.org/r/70940/diff/4/
>
>
> Testing
> -------
>
> Tested by creating a resource service, and ensuring that corresponding tag service is created and linked with resource service
>
>
> Thanks,
>
> Abhay Kulkarni
>
>
Re: Review Request 70940: RANGER-2481:Create a tag service when a
resource service is created and link it to resource service
Posted by Abhay Kulkarni <ak...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70940/
-----------------------------------------------------------
(Updated June 26, 2019, 9:53 p.m.)
Review request for ranger, Madhan Neethiraj, Ramesh Mani, and Velmurugan Periasamy.
Changes
-------
RangerTransactionService class is now used to wire up function to create and link tag service. With this design, only changes needed are local to ServiceREST class. Changes are retested and verified for various configuration settings described in the JIRA for correctness.
Bugs: RANGER-2481
https://issues.apache.org/jira/browse/RANGER-2481
Repository: ranger
Description
-------
Ranger supports tag-based policies out of the box. However, there are a few configuration steps that need to be performed in order to set up Ranger to perform tag-based authorization. As these steps are often missed, it will be useful to provide a commonly used/structured way of automatically creating tag service and linking it to resource service.
This may be controlled through few configuration parameters:
tag.service.auto.create=<true|false> ==> If tag-service needs to be created when resource-service is created.
tag.service.name=<auto|tag-service-name> ==> If tag-service needs to be created, how is it named (automatically or user-specified)
tag.service.auto.link=<true|false> ==> If resource-service needs to be linked to the tag-service
Diffs (updated)
-----
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java 1d9391f20
security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java 321d1c522
Diff: https://reviews.apache.org/r/70940/diff/4/
Changes: https://reviews.apache.org/r/70940/diff/3-4/
Testing
-------
Tested by creating a resource service, and ensuring that corresponding tag service is created and linked with resource service
Thanks,
Abhay Kulkarni
Re: Review Request 70940: RANGER-2481:Create a tag service when a
resource service is created and link it to resource service
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70940/#review216144
-----------------------------------------------------------
Ship it!
Ship It!
- Madhan Neethiraj
On June 25, 2019, 10:24 p.m., Abhay Kulkarni wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/70940/
> -----------------------------------------------------------
>
> (Updated June 25, 2019, 10:24 p.m.)
>
>
> Review request for ranger, Madhan Neethiraj, Ramesh Mani, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-2481
> https://issues.apache.org/jira/browse/RANGER-2481
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Ranger supports tag-based policies out of the box. However, there are a few configuration steps that need to be performed in order to set up Ranger to perform tag-based authorization. As these steps are often missed, it will be useful to provide a commonly used/structured way of automatically creating tag service and linking it to resource service.
>
> This may be controlled through few configuration parameters:
>
> tag.service.auto.create=<true|false> ==> If tag-service needs to be created when resource-service is created.
>
> tag.service.name=<auto|tag-service-name> ==> If tag-service needs to be created, how is it named (automatically or user-specified)
>
> tag.service.auto.link=<true|false> ==> If resource-service needs to be linked to the tag-service
>
>
> Diffs
> -----
>
> security-admin/src/main/java/org/apache/ranger/common/TimedExecutor.java 6f97337b7
> security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java 1d9391f20
>
>
> Diff: https://reviews.apache.org/r/70940/diff/3/
>
>
> Testing
> -------
>
> Tested by creating a resource service, and ensuring that corresponding tag service is created and linked with resource service
>
>
> Thanks,
>
> Abhay Kulkarni
>
>
Re: Review Request 70940: RANGER-2481:Create a tag service when a
resource service is created and link it to resource service
Posted by Abhay Kulkarni <ak...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70940/
-----------------------------------------------------------
(Updated June 25, 2019, 10:24 p.m.)
Review request for ranger, Madhan Neethiraj, Ramesh Mani, and Velmurugan Periasamy.
Changes
-------
Addressed review comment.
Bugs: RANGER-2481
https://issues.apache.org/jira/browse/RANGER-2481
Repository: ranger
Description
-------
Ranger supports tag-based policies out of the box. However, there are a few configuration steps that need to be performed in order to set up Ranger to perform tag-based authorization. As these steps are often missed, it will be useful to provide a commonly used/structured way of automatically creating tag service and linking it to resource service.
This may be controlled through few configuration parameters:
tag.service.auto.create=<true|false> ==> If tag-service needs to be created when resource-service is created.
tag.service.name=<auto|tag-service-name> ==> If tag-service needs to be created, how is it named (automatically or user-specified)
tag.service.auto.link=<true|false> ==> If resource-service needs to be linked to the tag-service
Diffs (updated)
-----
security-admin/src/main/java/org/apache/ranger/common/TimedExecutor.java 6f97337b7
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java 1d9391f20
Diff: https://reviews.apache.org/r/70940/diff/3/
Changes: https://reviews.apache.org/r/70940/diff/2-3/
Testing
-------
Tested by creating a resource service, and ensuring that corresponding tag service is created and linked with resource service
Thanks,
Abhay Kulkarni
Re: Review Request 70940: RANGER-2481:Create a tag service when a
resource service is created and link it to resource service
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70940/#review216141
-----------------------------------------------------------
Fix it, then Ship it!
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
Lines 3989 (patched)
<https://reviews.apache.org/r/70940/#comment303158>
LOG.info("creating tag-service " + context.tagServiceName);
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
Lines 3995 (patched)
<https://reviews.apache.org/r/70940/#comment303159>
LOG.info("created tag-service " + context.tagServiceName);
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
Lines 4010 (patched)
<https://reviews.apache.org/r/70940/#comment303162>
LOG.info("Linking service[" + context.resourceServiceName + " with tag-service " + context.tagServiceName);
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
Lines 4014 (patched)
<https://reviews.apache.org/r/70940/#comment303163>
LOG.error("Failed to link service[" + context.resourceServiceName + " with tag-service " + context.tagServiceName);
- Madhan Neethiraj
On June 25, 2019, 8:46 p.m., Abhay Kulkarni wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/70940/
> -----------------------------------------------------------
>
> (Updated June 25, 2019, 8:46 p.m.)
>
>
> Review request for ranger, Madhan Neethiraj, Ramesh Mani, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-2481
> https://issues.apache.org/jira/browse/RANGER-2481
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Ranger supports tag-based policies out of the box. However, there are a few configuration steps that need to be performed in order to set up Ranger to perform tag-based authorization. As these steps are often missed, it will be useful to provide a commonly used/structured way of automatically creating tag service and linking it to resource service.
>
> This may be controlled through few configuration parameters:
>
> tag.service.auto.create=<true|false> ==> If tag-service needs to be created when resource-service is created.
>
> tag.service.name=<auto|tag-service-name> ==> If tag-service needs to be created, how is it named (automatically or user-specified)
>
> tag.service.auto.link=<true|false> ==> If resource-service needs to be linked to the tag-service
>
>
> Diffs
> -----
>
> security-admin/src/main/java/org/apache/ranger/common/TimedExecutor.java 6f97337b7
> security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java 1d9391f20
>
>
> Diff: https://reviews.apache.org/r/70940/diff/2/
>
>
> Testing
> -------
>
> Tested by creating a resource service, and ensuring that corresponding tag service is created and linked with resource service
>
>
> Thanks,
>
> Abhay Kulkarni
>
>
Re: Review Request 70940: RANGER-2481:Create a tag service when a
resource service is created and link it to resource service
Posted by Abhay Kulkarni <ak...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70940/
-----------------------------------------------------------
(Updated June 25, 2019, 8:46 p.m.)
Review request for ranger, Madhan Neethiraj, Ramesh Mani, and Velmurugan Periasamy.
Changes
-------
Addressed review comments.
Bugs: RANGER-2481
https://issues.apache.org/jira/browse/RANGER-2481
Repository: ranger
Description
-------
Ranger supports tag-based policies out of the box. However, there are a few configuration steps that need to be performed in order to set up Ranger to perform tag-based authorization. As these steps are often missed, it will be useful to provide a commonly used/structured way of automatically creating tag service and linking it to resource service.
This may be controlled through few configuration parameters:
tag.service.auto.create=<true|false> ==> If tag-service needs to be created when resource-service is created.
tag.service.name=<auto|tag-service-name> ==> If tag-service needs to be created, how is it named (automatically or user-specified)
tag.service.auto.link=<true|false> ==> If resource-service needs to be linked to the tag-service
Diffs (updated)
-----
security-admin/src/main/java/org/apache/ranger/common/TimedExecutor.java 6f97337b7
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java 1d9391f20
Diff: https://reviews.apache.org/r/70940/diff/2/
Changes: https://reviews.apache.org/r/70940/diff/1-2/
Testing
-------
Tested by creating a resource service, and ensuring that corresponding tag service is created and linked with resource service
Thanks,
Abhay Kulkarni
Re: Review Request 70940: RANGER-2481:Create a tag service when a
resource service is created and link it to resource service
Posted by Abhay Kulkarni <ak...@hortonworks.com>.
> On June 25, 2019, 2:26 p.m., Madhan Neethiraj wrote:
> > security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
> > Lines 4004 (patched)
> > <https://reviews.apache.org/r/70940/diff/1/?file=2152033#file2152033line4004>
> >
> > Please review handling of condition where multiple threads are simultanously in this block (perhaps across Ranger admin instances), trying to create the same tag service (while trying to create different resource services?). svcStore.createService() will succeed in only thread, others will get error like ERROR_DUPLICATE_OBJECT. In such cases, this block should try to retrieve the tag-service.
What action needs to be taken if retrival of tag service also fails?
- Abhay
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70940/#review216118
-----------------------------------------------------------
On June 25, 2019, 2:07 a.m., Abhay Kulkarni wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/70940/
> -----------------------------------------------------------
>
> (Updated June 25, 2019, 2:07 a.m.)
>
>
> Review request for ranger, Madhan Neethiraj, Ramesh Mani, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-2481
> https://issues.apache.org/jira/browse/RANGER-2481
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Ranger supports tag-based policies out of the box. However, there are a few configuration steps that need to be performed in order to set up Ranger to perform tag-based authorization. As these steps are often missed, it will be useful to provide a commonly used/structured way of automatically creating tag service and linking it to resource service.
>
> This may be controlled through few configuration parameters:
>
> tag.service.auto.create=<true|false> ==> If tag-service needs to be created when resource-service is created.
>
> tag.service.name=<auto|tag-service-name> ==> If tag-service needs to be created, how is it named (automatically or user-specified)
>
> tag.service.auto.link=<true|false> ==> If resource-service needs to be linked to the tag-service
>
>
> Diffs
> -----
>
> security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java 4a426b78a
> security-admin/src/main/java/org/apache/ranger/common/TimedExecutor.java 6f97337b7
> security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java 1d9391f20
>
>
> Diff: https://reviews.apache.org/r/70940/diff/1/
>
>
> Testing
> -------
>
> Tested by creating a resource service, and ensuring that corresponding tag service is created and linked with resource service
>
>
> Thanks,
>
> Abhay Kulkarni
>
>
Re: Review Request 70940: RANGER-2481:Create a tag service when a
resource service is created and link it to resource service
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70940/#review216118
-----------------------------------------------------------
security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java
Line 166 (original)
<https://reviews.apache.org/r/70940/#comment303113>
This file has only whitespace changes. Please review and revert.
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
Lines 1313 (patched)
<https://reviews.apache.org/r/70940/#comment303115>
duplicate call, of the previous line. Please review and remove.
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
Lines 3917 (patched)
<https://reviews.apache.org/r/70940/#comment303116>
- LOG.error => LOG.info
- Consider the following alternate message:
LOG.info("failed to retrieve tag-service [" + tagServiceName + "]. Will attempt to create.", e);
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
Lines 4004 (patched)
<https://reviews.apache.org/r/70940/#comment303118>
Please review handling of condition where multiple threads are simultanously in this block (perhaps across Ranger admin instances), trying to create the same tag service (while trying to create different resource services?). svcStore.createService() will succeed in only thread, others will get error like ERROR_DUPLICATE_OBJECT. In such cases, this block should try to retrieve the tag-service.
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
Lines 4021 (patched)
<https://reviews.apache.org/r/70940/#comment303117>
Instead of another timedTask to link, why not remove lines #4021 - #4035?
- Madhan Neethiraj
On June 25, 2019, 2:07 a.m., Abhay Kulkarni wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/70940/
> -----------------------------------------------------------
>
> (Updated June 25, 2019, 2:07 a.m.)
>
>
> Review request for ranger, Madhan Neethiraj, Ramesh Mani, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-2481
> https://issues.apache.org/jira/browse/RANGER-2481
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Ranger supports tag-based policies out of the box. However, there are a few configuration steps that need to be performed in order to set up Ranger to perform tag-based authorization. As these steps are often missed, it will be useful to provide a commonly used/structured way of automatically creating tag service and linking it to resource service.
>
> This may be controlled through few configuration parameters:
>
> tag.service.auto.create=<true|false> ==> If tag-service needs to be created when resource-service is created.
>
> tag.service.name=<auto|tag-service-name> ==> If tag-service needs to be created, how is it named (automatically or user-specified)
>
> tag.service.auto.link=<true|false> ==> If resource-service needs to be linked to the tag-service
>
>
> Diffs
> -----
>
> security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java 4a426b78a
> security-admin/src/main/java/org/apache/ranger/common/TimedExecutor.java 6f97337b7
> security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java 1d9391f20
>
>
> Diff: https://reviews.apache.org/r/70940/diff/1/
>
>
> Testing
> -------
>
> Tested by creating a resource service, and ensuring that corresponding tag service is created and linked with resource service
>
>
> Thanks,
>
> Abhay Kulkarni
>
>