You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by ma...@apache.org on 2025/11/04 04:21:41 UTC
(ranger) branch ranger-2.8 updated: RANGER-4898: docker setup updated to use kerberos authentication (#720)
This is an automated email from the ASF dual-hosted git repository.
madhan pushed a commit to branch ranger-2.8
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/ranger-2.8 by this push:
new e71532847 RANGER-4898: docker setup updated to use kerberos authentication (#720)
e71532847 is described below
commit e71532847306e8f12bc0c06dc004f84f1a05f2c0
Author: Madhan Neethiraj <ma...@apache.org>
AuthorDate: Mon Nov 3 18:24:06 2025 -0800
RANGER-4898: docker setup updated to use kerberos authentication (#720)
(cherry picked from commit d529cc38882749834bf330caa08a2f5aac0e5d4b)
---
.github/workflows/ci.yml | 6 +-
dev-support/ranger-docker/.env | 18 ++-
dev-support/ranger-docker/Dockerfile.ranger | 13 +-
dev-support/ranger-docker/Dockerfile.ranger-build | 4 +-
dev-support/ranger-docker/Dockerfile.ranger-hadoop | 25 ++--
dev-support/ranger-docker/Dockerfile.ranger-hbase | 15 ++-
dev-support/ranger-docker/Dockerfile.ranger-hive | 15 ++-
dev-support/ranger-docker/Dockerfile.ranger-kafka | 14 ++-
.../ranger-hive-setup.sh => Dockerfile.ranger-kdc} | 58 ++++-----
dev-support/ranger-docker/Dockerfile.ranger-kms | 12 +-
dev-support/ranger-docker/Dockerfile.ranger-knox | 22 ++--
dev-support/ranger-docker/Dockerfile.ranger-mysql | 6 +-
dev-support/ranger-docker/Dockerfile.ranger-oracle | 7 +-
.../ranger-docker/Dockerfile.ranger-postgres | 6 +-
dev-support/ranger-docker/Dockerfile.ranger-solr | 20 ++-
.../ranger-docker/Dockerfile.ranger-sqlserver | 4 +-
.../ranger-docker/Dockerfile.ranger-tagsync | 12 +-
dev-support/ranger-docker/Dockerfile.ranger-trino | 2 +-
.../ranger-docker/Dockerfile.ranger-usersync | 12 +-
dev-support/ranger-docker/README.md | 4 +-
.../ranger-docker/docker-compose.ranger-build.yml | 3 +-
.../ranger-docker/docker-compose.ranger-db.yml | 8 +-
.../ranger-docker/docker-compose.ranger-hadoop.yml | 10 +-
.../ranger-docker/docker-compose.ranger-hbase.yml | 6 +-
.../ranger-docker/docker-compose.ranger-hive.yml | 6 +-
.../ranger-docker/docker-compose.ranger-kafka.yml | 6 +-
.../ranger-docker/docker-compose.ranger-kms.yml | 6 +-
.../ranger-docker/docker-compose.ranger-knox.yml | 6 +-
.../ranger-docker/docker-compose.ranger-ozone.yml | 11 +-
.../docker-compose.ranger-tagsync.yml | 6 +-
.../ranger-docker/docker-compose.ranger-trino.yml | 4 +
.../docker-compose.ranger-usersync.yml | 6 +-
.../ranger-docker/docker-compose.ranger.yml | 48 ++++++-
.../scripts/{ => admin}/create-ranger-services.py | 53 ++++++--
.../ranger-admin-install-mysql.properties | 17 +++
.../ranger-admin-install-oracle.properties | 17 +++
.../ranger-admin-install-postgres.properties | 17 +++
.../ranger-admin-install-sqlserver.properties | 17 +++
.../ranger-docker/scripts/{ => admin}/ranger.sh | 13 +-
.../scripts/{ => build}/ranger-build.sh | 0
dev-support/ranger-docker/scripts/core-site.xml | 7 --
.../ranger-docker/scripts/hadoop/core-site.xml | 20 +++
.../ranger-docker/scripts/hadoop/hdfs-site.xml | 63 ++++++++++
.../hadoop/ranger-hadoop-healthcheck.sh} | 18 ++-
.../scripts/{ => hadoop}/ranger-hadoop-mkdir.sh | 11 ++
.../scripts/hadoop/ranger-hadoop-setup.sh | 55 ++++++++
.../scripts/{ => hadoop}/ranger-hadoop.sh | 3 +-
.../ranger-hdfs-plugin-install.properties | 18 +--
.../ranger-yarn-plugin-install.properties | 18 +--
.../ranger-docker/scripts/hadoop/yarn-site.xml | 35 ++++++
.../scripts/{ => hbase}/hbase-site.xml | 32 ++++-
.../ranger-hbase-plugin-install.properties | 18 +--
.../scripts/{ => hbase}/ranger-hbase-setup.sh | 6 +
.../scripts/{ => hbase}/ranger-hbase.sh | 1 -
.../scripts/{ => hive}/hive-site-mysql.xml | 28 ++++-
.../scripts/{ => hive}/hive-site-oracle.xml | 28 ++++-
.../scripts/{ => hive}/hive-site-postgres.xml | 28 ++++-
.../scripts/{ => hive}/hive-site-sqlserver.xml | 28 ++++-
.../ranger-hive-plugin-install.properties | 18 +--
.../scripts/hive/ranger-hive-setup.sh | 104 ++++++++++++++++
.../scripts/{ => hive}/ranger-hive.sh | 1 -
.../scripts/kafka/kafka-server-jaas.conf | 6 +
.../ranger-kafka-plugin-install.properties | 24 ++--
.../scripts/kafka/ranger-kafka-setup.sh | 61 +++++++++
.../scripts/{ => kafka}/ranger-kafka.sh | 3 +-
.../ranger-docker/scripts/kdc/entrypoint.sh | 138 +++++++++++++++++++++
dev-support/ranger-docker/scripts/kdc/kadm5.acl | 1 +
dev-support/ranger-docker/scripts/kdc/kdc.conf | 16 +++
dev-support/ranger-docker/scripts/kdc/krb5.conf | 16 +++
.../{ => kms}/ranger-kms-install-mysql.properties | 30 ++---
.../{ => kms}/ranger-kms-install-oracle.properties | 30 ++---
.../ranger-kms-install-postgres.properties | 30 ++---
.../ranger-kms-install-sqlserver.properties | 32 ++---
.../ranger-docker/scripts/{ => kms}/ranger-kms.sh | 11 +-
.../scripts/{ => knox}/ranger-knox-expect.py | 0
.../ranger-knox-plugin-install.properties | 18 +--
.../scripts/{ => knox}/ranger-knox-sandbox.xml | 14 +--
.../scripts/{ => knox}/ranger-knox-setup.sh | 5 +
.../scripts/{ => knox}/ranger-knox.sh | 1 -
.../{config => scripts}/ozone/docker-config | 0
.../ozone/enable-ozone-plugin.sh | 0
.../{ => ozone}/ozone-plugin-docker-setup.sh | 6 +-
.../ozone/ranger-ozone-plugin-install.properties | 0
.../ozone/ranger-ozone-setup.sh | 0
.../ranger-docker/scripts/ranger-kafka-setup.sh | 33 -----
.../{config => scripts/rdbms}/init_mssql.sh | 0
.../{config => scripts/rdbms}/init_mysql.sql | 0
.../{config => scripts/rdbms}/init_oracle.sh | 0
.../{config => scripts/rdbms}/init_postgres.sh | 0
.../ranger-docker/{config => scripts/rdbms}/my.cnf | 0
.../ranger-docker/scripts/solr/ranger-solr.sh | 47 +++++++
.../ranger-docker/scripts/solr/solr-jaas.conf | 27 ++++
.../solr}/solr-ranger_audits/managed-schema | 0
.../solr}/solr-ranger_audits/solrconfig.xml | 0
.../ranger-docker/scripts/solr/solr-security.json | 11 ++
.../ranger-tagsync-install.properties | 20 ++-
.../scripts/{ => tagsync}/ranger-tagsync-tags.json | 0
.../scripts/{ => tagsync}/ranger-tagsync.sh | 11 +-
.../trino/access-control.properties | 0
.../trino/catalog/hive.properties | 0
.../trino/ranger-policymgr-ssl.xml | 0
.../trino/ranger-trino-audit.xml | 2 +-
.../trino/ranger-trino-security.xml | 2 +-
.../ranger-usersync-install.properties | 4 +-
.../scripts/{ => usersync}/ranger-usersync.sh | 11 +-
.../scripts/{ => usersync}/ugsync-file-source.csv | 0
.../{ranger-hbase-setup.sh => wait_for_keytab.sh} | 30 +++--
107 files changed, 1372 insertions(+), 343 deletions(-)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 512236162..b91876edb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -154,7 +154,7 @@ jobs:
- name: Bring up containers
run: |
cd dev-support/ranger-docker
- ./scripts/ozone-plugin-docker-setup.sh
+ ./scripts/ozone/ozone-plugin-docker-setup.sh
export RANGER_DB_TYPE=postgres
docker compose \
-f docker-compose.ranger.yml \
@@ -178,7 +178,9 @@ jobs:
echo "Container $container is running!";
else
flag=false;
- echo "Container $container is NOT running!";
+ echo "Container $container is NOT running! Status: $(docker inspect -f '{{.State.Status}}' $container 2>/dev/null)";
+ echo "docker logs $container:";
+ docker logs $container
fi
done
diff --git a/dev-support/ranger-docker/.env b/dev-support/ranger-docker/.env
index 456c81326..7d95aa161 100644
--- a/dev-support/ranger-docker/.env
+++ b/dev-support/ranger-docker/.env
@@ -8,15 +8,15 @@ BUILD_OPTS=
# DockerHub Ranger Base Image
RANGER_BASE_IMAGE=apache/ranger-base
# Java version used to run Ranger and dependent services is present as suffix: -8, valid values for suffix: -8, -11, -17
-RANGER_BASE_VERSION=20250707-1-8
+RANGER_BASE_VERSION=20251023-1-8
# Java version used to build Apache Ranger is present as suffix: -8, valid values for suffix: -8, -11, -17
-RANGER_BASE_BUILD_VERSION=20250707-1-8
+RANGER_BASE_BUILD_VERSION=20251023-1-8
# third party image versions
MARIADB_VERSION=10.7.3
-POSTGRES_VERSION=12
+POSTGRES_VERSION=13.16
ORACLE_VERSION=23.6
-SQLSERVER_VERSION=2019-latest
+SQLSERVER_VERSION=2022-latest
ENABLE_DB_MOUNT=true
ZK_VERSION=3.9.2
SOLR_VERSION=8.11.3
@@ -29,10 +29,18 @@ HIVE_HADOOP_VERSION=3.1.1
KAFKA_VERSION=2.8.2
KNOX_VERSION=2.0.0
TRINO_VERSION=latest
+
+# Kerberos
+KERBEROS_ENABLED=true
+KERBEROS_REALM=EXAMPLE.COM
+KERBEROS_KDC_HOST=ranger-kdc.example.com
+KERBEROS_MASTER_PASSWORD=rangerR0cks!
+KERBEROS_ADMIN_PRINCIPAL=admin/admin
+KERBEROS_ADMIN_PASSWORD=rangerR0cks!
+
OZONE_VERSION=1.4.0
OZONE_RUNNER_VERSION=20230615-1
OZONE_RUNNER_IMAGE=apache/ozone-runner
-OZONE_OPTS=
# versions of ranger services
RANGER_VERSION=2.8.0-SNAPSHOT
diff --git a/dev-support/ranger-docker/Dockerfile.ranger b/dev-support/ranger-docker/Dockerfile.ranger
index 452d1ed19..ed6770832 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger
+++ b/dev-support/ranger-docker/Dockerfile.ranger
@@ -23,12 +23,17 @@ ARG RANGER_VERSION
ARG RANGER_DB_TYPE
ARG TARGETARCH
+VOLUME /etc/keytabs
+
COPY ./dist/version /home/ranger/dist/
COPY ./dist/ranger-${RANGER_VERSION}-admin.tar.gz /home/ranger/dist/
-COPY ./scripts/ranger.sh ${RANGER_SCRIPTS}/
-COPY ./scripts/ranger-admin-install-${RANGER_DB_TYPE}.properties ${RANGER_SCRIPTS}/ranger-admin-install.properties
-COPY ./scripts/create-ranger-services.py ${RANGER_SCRIPTS}/
+COPY ./scripts/admin/ranger.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/admin/ranger-admin-install-${RANGER_DB_TYPE}.properties ${RANGER_SCRIPTS}/ranger-admin-install.properties
+COPY ./scripts/admin/create-ranger-services.py ${RANGER_SCRIPTS}/
+COPY ./scripts/hadoop/core-site.xml ${RANGER_SCRIPTS}/
+COPY ./scripts/wait_for_keytab.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/kdc/krb5.conf /etc/krb5.conf
RUN tar xvfz /home/ranger/dist/ranger-${RANGER_VERSION}-admin.tar.gz --directory=${RANGER_HOME} \
&& ln -s ${RANGER_HOME}/ranger-${RANGER_VERSION}-admin ${RANGER_HOME}/admin \
@@ -37,7 +42,7 @@ RUN tar xvfz /home/ranger/dist/ranger-${RANGER_VERSION}-admin.tar.gz --direct
&& mkdir -p /var/run/ranger \
&& mkdir -p /var/log/ranger \
&& chown -R ranger:ranger ${RANGER_HOME}/admin/ ${RANGER_SCRIPTS}/ /var/run/ranger/ /var/log/ranger/ \
- && chmod 755 ${RANGER_SCRIPTS}/ranger.sh ${RANGER_SCRIPTS}/create-ranger-services.py \
+ && chmod 755 ${RANGER_SCRIPTS}/ranger.sh ${RANGER_SCRIPTS}/wait_for_keytab.sh \
&& mkdir -p /usr/share/java/
FROM ranger AS ranger_postgres
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-build b/dev-support/ranger-docker/Dockerfile.ranger-build
index ad09ab1c6..0a8bf263f 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger-build
+++ b/dev-support/ranger-docker/Dockerfile.ranger-build
@@ -37,10 +37,10 @@ ENV PATH=/usr/java/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/
RUN mkdir -p /home/ranger/git /home/ranger/.m2 && \
chown -R ranger:ranger /home/ranger
-COPY ./scripts/ranger-build.sh /home/ranger/scripts/
+COPY ./scripts/build/* ${RANGER_SCRIPTS}/
+RUN chmod 755 ${RANGER_SCRIPTS}/ranger-build.sh
VOLUME /home/ranger/.m2
-VOLUME /home/ranger/scripts
VOLUME /home/ranger/patches
VOLUME /home/ranger/dist
VOLUME /home/ranger/src
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-hadoop b/dev-support/ranger-docker/Dockerfile.ranger-hadoop
index 5fc455e4b..f6bcefa87 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger-hadoop
+++ b/dev-support/ranger-docker/Dockerfile.ranger-hadoop
@@ -22,17 +22,24 @@ ARG HADOOP_VERSION
ARG HDFS_PLUGIN_VERSION
ARG YARN_PLUGIN_VERSION
+VOLUME /etc/keytabs
COPY ./dist/version /home/ranger/dist/
COPY ./dist/ranger-${HDFS_PLUGIN_VERSION}-hdfs-plugin.tar.gz /home/ranger/dist/
COPY ./dist/ranger-${YARN_PLUGIN_VERSION}-yarn-plugin.tar.gz /home/ranger/dist/
COPY ./downloads/hadoop-${HADOOP_VERSION}.tar.gz /home/ranger/dist/
-COPY ./scripts/ranger-hadoop-setup.sh /home/ranger/scripts/
-COPY ./scripts/ranger-hadoop.sh /home/ranger/scripts/
-COPY ./scripts/ranger-hadoop-mkdir.sh /home/ranger/scripts/
-COPY ./scripts/ranger-hdfs-plugin-install.properties /home/ranger/scripts/
-COPY ./scripts/ranger-yarn-plugin-install.properties /home/ranger/scripts/
+COPY ./scripts/hadoop/ranger-hadoop-setup.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/hadoop/ranger-hadoop.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/hadoop/ranger-hadoop-mkdir.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/hadoop/ranger-hadoop-healthcheck.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/hadoop/ranger-hdfs-plugin-install.properties ${RANGER_SCRIPTS}/
+COPY ./scripts/hadoop/ranger-yarn-plugin-install.properties ${RANGER_SCRIPTS}/
+COPY ./scripts/hadoop/core-site.xml ${RANGER_SCRIPTS}/
+COPY ./scripts/hadoop/hdfs-site.xml ${RANGER_SCRIPTS}/
+COPY ./scripts/hadoop/yarn-site.xml ${RANGER_SCRIPTS}/
+COPY ./scripts/wait_for_keytab.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/kdc/krb5.conf /etc/krb5.conf
RUN tar xvfz /home/ranger/dist/hadoop-${HADOOP_VERSION}.tar.gz --directory=/opt/ && \
ln -s /opt/hadoop-${HADOOP_VERSION} /opt/hadoop && \
@@ -40,12 +47,16 @@ RUN tar xvfz /home/ranger/dist/hadoop-${HADOOP_VERSION}.tar.gz --directory=/opt/
tar xvfz /home/ranger/dist/ranger-${HDFS_PLUGIN_VERSION}-hdfs-plugin.tar.gz --directory=/opt/ranger && \
ln -s /opt/ranger/ranger-${HDFS_PLUGIN_VERSION}-hdfs-plugin /opt/ranger/ranger-hdfs-plugin && \
rm -f /home/ranger/dist/ranger-${HDFS_PLUGIN_VERSION}-hdfs-plugin.tar.gz && \
- cp -f /home/ranger/scripts/ranger-hdfs-plugin-install.properties /opt/ranger/ranger-hdfs-plugin/install.properties && \
+ cp -f ${RANGER_SCRIPTS}/ranger-hdfs-plugin-install.properties /opt/ranger/ranger-hdfs-plugin/install.properties && \
tar xvfz /home/ranger/dist/ranger-${YARN_PLUGIN_VERSION}-yarn-plugin.tar.gz --directory=/opt/ranger && \
ln -s /opt/ranger/ranger-${YARN_PLUGIN_VERSION}-yarn-plugin /opt/ranger/ranger-yarn-plugin && \
rm -f /home/ranger/dist/ranger-${YARN_PLUGIN_VERSION}-yarn-plugin.tar.gz && \
- cp -f /home/ranger/scripts/ranger-yarn-plugin-install.properties /opt/ranger/ranger-yarn-plugin/install.properties && \
+ cp -f ${RANGER_SCRIPTS}/ranger-yarn-plugin-install.properties /opt/ranger/ranger-yarn-plugin/install.properties && \
chmod 744 ${RANGER_SCRIPTS}/ranger-hadoop-setup.sh ${RANGER_SCRIPTS}/ranger-hadoop.sh ${RANGER_SCRIPTS}/ranger-hadoop-mkdir.sh && \
+ useradd -g hadoop -ms /bin/bash healthcheck && \
+ chmod 744 ${RANGER_SCRIPTS}/ranger-hadoop-healthcheck.sh && \
+ chmod 755 ${RANGER_SCRIPTS}/wait_for_keytab.sh && \
+ chown healthcheck:hadoop ${RANGER_SCRIPTS}/ranger-hadoop-healthcheck.sh && \
chown hdfs:hadoop ${RANGER_SCRIPTS}/ranger-hadoop-mkdir.sh
RUN apt-get update && \
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-hbase b/dev-support/ranger-docker/Dockerfile.ranger-hbase
index 0d0120079..0a6e5dfc8 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger-hbase
+++ b/dev-support/ranger-docker/Dockerfile.ranger-hbase
@@ -21,15 +21,19 @@ FROM ${RANGER_BASE_IMAGE}:${RANGER_BASE_VERSION}
ARG HBASE_VERSION
ARG HBASE_PLUGIN_VERSION
+VOLUME /etc/keytabs
COPY ./dist/version /home/ranger/dist/
COPY ./dist/ranger-${HBASE_PLUGIN_VERSION}-hbase-plugin.tar.gz /home/ranger/dist/
COPY ./downloads/hbase-${HBASE_VERSION}-bin.tar.gz /home/ranger/dist/
-COPY ./scripts/ranger-hbase-setup.sh /home/ranger/scripts/
-COPY ./scripts/ranger-hbase.sh /home/ranger/scripts/
-COPY ./scripts/ranger-hbase-plugin-install.properties /home/ranger/scripts/
-COPY ./scripts/hbase-site.xml /home/ranger/scripts/
+COPY ./scripts/hbase/ranger-hbase-setup.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/hbase/ranger-hbase.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/hbase/ranger-hbase-plugin-install.properties ${RANGER_SCRIPTS}/
+COPY ./scripts/hbase/hbase-site.xml ${RANGER_SCRIPTS}/
+COPY ./scripts/hadoop/core-site.xml ${RANGER_SCRIPTS}/
+COPY ./scripts/wait_for_keytab.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/kdc/krb5.conf /etc/krb5.conf
RUN tar xvfz /home/ranger/dist/hbase-${HBASE_VERSION}-bin.tar.gz --directory=/opt/ && \
ln -s /opt/hbase-${HBASE_VERSION} /opt/hbase && \
@@ -37,7 +41,8 @@ RUN tar xvfz /home/ranger/dist/hbase-${HBASE_VERSION}-bin.tar.gz --directory=/op
tar xvfz /home/ranger/dist/ranger-${HBASE_PLUGIN_VERSION}-hbase-plugin.tar.gz --directory=/opt/ranger && \
ln -s /opt/ranger/ranger-${HBASE_PLUGIN_VERSION}-hbase-plugin /opt/ranger/ranger-hbase-plugin && \
rm -f /home/ranger/dist/ranger-${HBASE_PLUGIN_VERSION}-hbase-plugin.tar.gz && \
- cp -f /home/ranger/scripts/ranger-hbase-plugin-install.properties /opt/ranger/ranger-hbase-plugin/install.properties && \
+ cp -f ${RANGER_SCRIPTS}/ranger-hbase-plugin-install.properties /opt/ranger/ranger-hbase-plugin/install.properties && \
+ chmod 755 ${RANGER_SCRIPTS}/wait_for_keytab.sh && \
chmod 744 ${RANGER_SCRIPTS}/ranger-hbase-setup.sh ${RANGER_SCRIPTS}/ranger-hbase.sh
RUN apt-get update && \
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-hive b/dev-support/ranger-docker/Dockerfile.ranger-hive
index a0c57a072..01ec3febd 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger-hive
+++ b/dev-support/ranger-docker/Dockerfile.ranger-hive
@@ -24,6 +24,7 @@ ARG HIVE_HADOOP_VERSION
ARG HIVE_PLUGIN_VERSION
ARG RANGER_DB_TYPE
+VOLUME /etc/keytabs
COPY ./dist/version /home/ranger/dist/
COPY ./dist/ranger-${HIVE_PLUGIN_VERSION}-hive-plugin.tar.gz /home/ranger/dist/
@@ -32,10 +33,13 @@ COPY ./downloads/hadoop-${HIVE_HADOOP_VERSION}.tar.gz /home/ranger/dist/
COPY ./downloads/mysql-connector-java-8.0.28.jar /home/ranger/dist/
COPY ./downloads/ojdbc8.jar /home/ranger/dist/
-COPY ./scripts/ranger-hive-setup.sh /home/ranger/scripts/
-COPY ./scripts/ranger-hive.sh /home/ranger/scripts/
-COPY ./scripts/ranger-hive-plugin-install.properties /home/ranger/scripts/
-COPY ./scripts/hive-site-${RANGER_DB_TYPE}.xml /home/ranger/scripts/hive-site.xml
+COPY ./scripts/hive/ranger-hive-setup.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/hive/ranger-hive.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/hive/ranger-hive-plugin-install.properties ${RANGER_SCRIPTS}/
+COPY ./scripts/hive/hive-site-${RANGER_DB_TYPE}.xml ${RANGER_SCRIPTS}/hive-site.xml
+COPY ./scripts/hadoop/core-site.xml ${RANGER_SCRIPTS}/
+COPY ./scripts/wait_for_keytab.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/kdc/krb5.conf /etc/krb5.conf
RUN tar xvfz /home/ranger/dist/apache-hive-${HIVE_VERSION}-bin.tar.gz --directory=/opt/ && \
ln -s /opt/apache-hive-${HIVE_VERSION}-bin /opt/hive && \
@@ -48,7 +52,8 @@ RUN tar xvfz /home/ranger/dist/apache-hive-${HIVE_VERSION}-bin.tar.gz --director
tar xvfz /home/ranger/dist/ranger-${HIVE_PLUGIN_VERSION}-hive-plugin.tar.gz --directory=/opt/ranger && \
ln -s /opt/ranger/ranger-${HIVE_PLUGIN_VERSION}-hive-plugin /opt/ranger/ranger-hive-plugin && \
rm -f /home/ranger/dist/ranger-${HIVE_PLUGIN_VERSION}-hive-plugin.tar.gz && \
- cp -f /home/ranger/scripts/ranger-hive-plugin-install.properties /opt/ranger/ranger-hive-plugin/install.properties && \
+ cp -f ${RANGER_SCRIPTS}/ranger-hive-plugin-install.properties /opt/ranger/ranger-hive-plugin/install.properties && \
+ chmod 755 ${RANGER_SCRIPTS}/wait_for_keytab.sh && \
chmod 744 ${RANGER_SCRIPTS}/ranger-hive-setup.sh ${RANGER_SCRIPTS}/ranger-hive.sh
ENV HIVE_HOME=/opt/hive
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-kafka b/dev-support/ranger-docker/Dockerfile.ranger-kafka
index 48c5789a7..ff828cc3e 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger-kafka
+++ b/dev-support/ranger-docker/Dockerfile.ranger-kafka
@@ -21,14 +21,19 @@ FROM ${RANGER_BASE_IMAGE}:${RANGER_BASE_VERSION}
ARG KAFKA_VERSION
ARG KAFKA_PLUGIN_VERSION
+VOLUME /etc/keytabs
COPY ./dist/version /home/ranger/dist/
COPY ./dist/ranger-${KAFKA_PLUGIN_VERSION}-kafka-plugin.tar.gz /home/ranger/dist/
COPY ./downloads/kafka_2.12-${KAFKA_VERSION}.tgz /home/ranger/dist/
-COPY ./scripts/ranger-kafka-setup.sh /home/ranger/scripts/
-COPY ./scripts/ranger-kafka.sh /home/ranger/scripts/
-COPY ./scripts/ranger-kafka-plugin-install.properties /home/ranger/scripts/
+COPY ./scripts/kafka/ranger-kafka-setup.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/kafka/ranger-kafka.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/kafka/ranger-kafka-plugin-install.properties ${RANGER_SCRIPTS}/
+COPY ./scripts/kafka/kafka-server-jaas.conf ${RANGER_SCRIPTS}/
+COPY ./scripts/hadoop/core-site.xml ${RANGER_SCRIPTS}/
+COPY ./scripts/wait_for_keytab.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/kdc/krb5.conf /etc/krb5.conf
RUN tar xvfz /home/ranger/dist/kafka_2.12-${KAFKA_VERSION}.tgz --directory=/opt/ && \
ln -s /opt/kafka_2.12-${KAFKA_VERSION} /opt/kafka && \
@@ -36,7 +41,8 @@ RUN tar xvfz /home/ranger/dist/kafka_2.12-${KAFKA_VERSION}.tgz --directory=/opt/
tar xvfz /home/ranger/dist/ranger-${KAFKA_PLUGIN_VERSION}-kafka-plugin.tar.gz --directory=/opt/ranger && \
ln -s /opt/ranger/ranger-${KAFKA_PLUGIN_VERSION}-kafka-plugin /opt/ranger/ranger-kafka-plugin && \
rm -f /home/ranger/dist/ranger-${KAFKA_PLUGIN_VERSION}-kafka-plugin.tar.gz && \
- cp -f /home/ranger/scripts/ranger-kafka-plugin-install.properties /opt/ranger/ranger-kafka-plugin/install.properties && \
+ cp -f ${RANGER_SCRIPTS}/ranger-kafka-plugin-install.properties /opt/ranger/ranger-kafka-plugin/install.properties && \
+ chmod 755 ${RANGER_SCRIPTS}/wait_for_keytab.sh && \
chmod 744 ${RANGER_SCRIPTS}/ranger-kafka-setup.sh ${RANGER_SCRIPTS}/ranger-kafka.sh
ENV KAFKA_HOME=/opt/kafka
diff --git a/dev-support/ranger-docker/scripts/ranger-hive-setup.sh b/dev-support/ranger-docker/Dockerfile.ranger-kdc
old mode 100755
new mode 100644
similarity index 50%
rename from dev-support/ranger-docker/scripts/ranger-hive-setup.sh
rename to dev-support/ranger-docker/Dockerfile.ranger-kdc
index c0e7ee406..f3ce89d18
--- a/dev-support/ranger-docker/scripts/ranger-hive-setup.sh
+++ b/dev-support/ranger-docker/Dockerfile.ranger-kdc
@@ -1,5 +1,3 @@
-#!/bin/bash
-
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
@@ -16,30 +14,32 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-echo "export JAVA_HOME=${JAVA_HOME}" >> ${HADOOP_HOME}/etc/hadoop/hadoop-env.sh
-
-cat <<EOF > /etc/ssh/ssh_config
-Host *
- StrictHostKeyChecking no
- UserKnownHostsFile=/dev/null
-EOF
-
-cat <<EOF > ${HADOOP_HOME}/etc/hadoop/core-site.xml
-<configuration>
- <property>
- <name>fs.defaultFS</name>
- <value>hdfs://ranger-hadoop:9000</value>
- </property>
-</configuration>
-EOF
-
-cp ${RANGER_SCRIPTS}/hive-site.xml ${HIVE_HOME}/conf/hive-site.xml
-cp ${RANGER_SCRIPTS}/hive-site.xml ${HIVE_HOME}/conf/hiveserver2-site.xml
-su -c "${HIVE_HOME}/bin/schematool -dbType ${RANGER_DB_TYPE} -initSchema" hive
-
-mkdir -p /opt/hive/logs
-chown -R hive:hadoop /opt/hive/
-chmod g+w /opt/hive/logs
-
-cd ${RANGER_HOME}/ranger-hive-plugin
-./enable-hive-plugin.sh
+ARG RANGER_BASE_JAVA_VERSION=8
+
+FROM eclipse-temurin:${RANGER_BASE_JAVA_VERSION}-jdk-jammy
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV REALM=EXAMPLE.COM
+ENV KDC_HOST=kdc.example.com
+ENV ADMIN_PRINCIPAL=admin/admin
+ENV ADMIN_PASSWORD=rangerR0cks!
+ENV MASTER_PASSWORD=rangerR0cks!
+
+# Install Kerberos components
+RUN apt-get update && \
+ apt-get install -y krb5-kdc krb5-admin-server krb5-user && \
+ rm -rf /var/lib/apt/lists/*
+
+# Copy configuration files
+COPY ./scripts/kdc/krb5.conf /etc/krb5.conf
+COPY ./scripts/kdc/kdc.conf /etc/krb5kdc/kdc.conf
+COPY ./scripts/kdc/kadm5.acl /etc/krb5kdc/kadm5.acl
+COPY ./scripts/kdc/entrypoint.sh /entrypoint.sh
+
+RUN chmod +x /entrypoint.sh
+
+VOLUME /etc/keytabs
+
+EXPOSE 88/tcp 88/udp 749/tcp
+
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-kms b/dev-support/ranger-docker/Dockerfile.ranger-kms
index 55401ef60..7a3edc4dd 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger-kms
+++ b/dev-support/ranger-docker/Dockerfile.ranger-kms
@@ -21,11 +21,16 @@ FROM ${RANGER_BASE_IMAGE}:${RANGER_BASE_VERSION} AS ranger-kms
ARG KMS_VERSION
ARG RANGER_DB_TYPE
+VOLUME /etc/keytabs
+
COPY ./dist/version /home/ranger/dist/
COPY ./dist/ranger-${KMS_VERSION}-kms.tar.gz /home/ranger/dist/
-COPY ./scripts/ranger-kms.sh ${RANGER_SCRIPTS}/
-COPY ./scripts/ranger-kms-install-${RANGER_DB_TYPE}.properties ${RANGER_SCRIPTS}/ranger-kms-install.properties
+COPY ./scripts/kms/ranger-kms.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/kms/ranger-kms-install-${RANGER_DB_TYPE}.properties ${RANGER_SCRIPTS}/ranger-kms-install.properties
+COPY ./scripts/hadoop/core-site.xml ${RANGER_SCRIPTS}/
+COPY ./scripts/wait_for_keytab.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/kdc/krb5.conf /etc/krb5.conf
RUN tar xvfz /home/ranger/dist/ranger-${KMS_VERSION}-kms.tar.gz --directory=${RANGER_HOME} && \
ln -s ${RANGER_HOME}/ranger-${KMS_VERSION}-kms ${RANGER_HOME}/kms && \
@@ -38,7 +43,8 @@ RUN tar xvfz /home/ranger/dist/ranger-${KMS_VERSION}-kms.tar.gz --directory=${RA
ln -s /etc/init.d/ranger-kms /etc/rc3.d/S88ranger-kms && \
ln -s /etc/init.d/ranger-kms /etc/rc3.d/K90ranger-kms && \
ln -s ${RANGER_HOME}/kms/ranger-kms-services.sh /usr/bin/ranger-kms-services.sh && \
- chown -R rangerkms:ranger ${RANGER_HOME}/kms/ ${RANGER_SCRIPTS}/ /var/run/ranger_kms/ /var/log/ranger/ && \
+ chown -R rangerkms:ranger ${RANGER_HOME}/kms/ ${RANGER_SCRIPTS}/ /var/run/ranger_kms/ /var/log/ranger/ /etc/ranger && \
+ chmod 755 ${RANGER_SCRIPTS}/wait_for_keytab.sh && \
chmod 744 ${RANGER_SCRIPTS}/ranger-kms.sh
FROM ranger-kms AS ranger_postgres
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-knox b/dev-support/ranger-docker/Dockerfile.ranger-knox
index 653af09ee..313ba60a4 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger-knox
+++ b/dev-support/ranger-docker/Dockerfile.ranger-knox
@@ -21,16 +21,19 @@ FROM ${RANGER_BASE_IMAGE}:${RANGER_BASE_VERSION}
ARG KNOX_VERSION
ARG KNOX_PLUGIN_VERSION
+VOLUME /etc/keytabs
COPY ./dist/version /home/ranger/dist/
COPY ./dist/ranger-${KNOX_PLUGIN_VERSION}-knox-plugin.tar.gz /home/ranger/dist/
COPY ./downloads/knox-${KNOX_VERSION}.tar.gz /home/ranger/dist/
-COPY ./scripts/ranger-knox-setup.sh /home/ranger/scripts/
-COPY ./scripts/ranger-knox.sh /home/ranger/scripts/
-COPY ./scripts/ranger-knox-plugin-install.properties /home/ranger/scripts/
-COPY ./scripts/ranger-knox-expect.py /home/ranger/scripts/
-COPY ./scripts/ranger-knox-sandbox.xml /home/ranger/scripts/
+COPY ./scripts/knox/ranger-knox-setup.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/knox/ranger-knox.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/knox/ranger-knox-plugin-install.properties ${RANGER_SCRIPTS}/
+COPY ./scripts/knox/ranger-knox-expect.py ${RANGER_SCRIPTS}/
+COPY ./scripts/knox/ranger-knox-sandbox.xml ${RANGER_SCRIPTS}/
+COPY ./scripts/wait_for_keytab.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/kdc/krb5.conf /etc/krb5.conf
RUN tar xvfz /home/ranger/dist/knox-${KNOX_VERSION}.tar.gz --directory=/opt/ && \
ln -s /opt/knox-${KNOX_VERSION} /opt/knox && \
@@ -38,16 +41,17 @@ RUN tar xvfz /home/ranger/dist/knox-${KNOX_VERSION}.tar.gz --directory=/opt/ &&
tar xvfz /home/ranger/dist/ranger-${KNOX_PLUGIN_VERSION}-knox-plugin.tar.gz --directory=/opt/ranger && \
ln -s /opt/ranger/ranger-${KNOX_PLUGIN_VERSION}-knox-plugin /opt/ranger/ranger-knox-plugin && \
rm -f /home/ranger/dist/ranger-${KNOX_PLUGIN_VERSION}-knox-plugin.tar.gz && \
- cp -f /home/ranger/scripts/ranger-knox-plugin-install.properties /opt/ranger/ranger-knox-plugin/install.properties && \
- cp -f /home/ranger/scripts/ranger-knox-sandbox.xml /opt/knox/conf/topologies/sandbox.xml && \
+ cp -f ${RANGER_SCRIPTS}/ranger-knox-plugin-install.properties /opt/ranger/ranger-knox-plugin/install.properties && \
+ cp -f ${RANGER_SCRIPTS}/ranger-knox-sandbox.xml /opt/knox/conf/topologies/sandbox.xml && \
+ chmod 755 ${RANGER_SCRIPTS}/wait_for_keytab.sh && \
chmod 744 ${RANGER_SCRIPTS}/ranger-knox-setup.sh ${RANGER_SCRIPTS}/ranger-knox.sh ${RANGER_SCRIPTS}/ranger-knox-expect.py
ENV KNOX_HOME=/opt/knox
ENV PATH=/usr/java/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/knox/bin
-RUN chmod a+rwx /home/ranger/scripts/ranger-knox-expect.py
+RUN chmod a+rwx ${RANGER_SCRIPTS}/ranger-knox-expect.py
RUN pip3 install pexpect
-RUN python3 /home/ranger/scripts/ranger-knox-expect.py
+RUN python3 ${RANGER_SCRIPTS}/ranger-knox-expect.py
ENTRYPOINT [ "/home/ranger/scripts/ranger-knox.sh" ]
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-mysql b/dev-support/ranger-docker/Dockerfile.ranger-mysql
index a9f0e676f..48e57e5d4 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger-mysql
+++ b/dev-support/ranger-docker/Dockerfile.ranger-mysql
@@ -21,8 +21,10 @@ FROM mariadb:${MARIADB_VERSION}
USER 0
RUN mkdir -p /docker-entrypoint-initdb.d /home/mysql
-COPY config/init_mysql.sql /docker-entrypoint-initdb.d/
-COPY config/my.cnf /home/mysql/.my.cnf
+
+COPY ./scripts/rdbms/init_mysql.sql /docker-entrypoint-initdb.d/
+COPY ./scripts/rdbms/my.cnf /home/mysql/.my.cnf
+
RUN sed -i "s/skip-name-resolve/# skip-name-resolve/" /etc/mysql/mariadb.cnf
RUN chown -R mysql:mysql /docker-entrypoint-initdb.d/ /home/mysql
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-oracle b/dev-support/ranger-docker/Dockerfile.ranger-oracle
index 5b83334c8..f5ef510e6 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger-oracle
+++ b/dev-support/ranger-docker/Dockerfile.ranger-oracle
@@ -19,8 +19,13 @@ FROM gvenzl/oracle-free:${ORACLE_VERSION}-slim
# Copy DB init script
USER 0
+
RUN mkdir -p /docker-entrypoint-initdb.d
-COPY config/init_oracle.sh /docker-entrypoint-initdb.d/
+
+COPY ./scripts/rdbms/init_oracle.sh /docker-entrypoint-initdb.d/
+
RUN chown -R oracle /docker-entrypoint-initdb.d/
+
ENV ORACLE_PASSWORD=rangerR0cks!
+
USER oracle
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-postgres b/dev-support/ranger-docker/Dockerfile.ranger-postgres
index 47a3f4586..5cf60f9a5 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger-postgres
+++ b/dev-support/ranger-docker/Dockerfile.ranger-postgres
@@ -19,7 +19,11 @@ FROM postgres:${POSTGRES_VERSION}
# Copy DB init script
USER 0
+
RUN mkdir -p /docker-entrypoint-initdb.d
-COPY config/init_postgres.sh /docker-entrypoint-initdb.d/
+
+COPY ./scripts/rdbms/init_postgres.sh /docker-entrypoint-initdb.d/
+
RUN chown -R postgres:postgres /docker-entrypoint-initdb.d/
+
ENV POSTGRES_PASSWORD=rangerR0cks!
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-solr b/dev-support/ranger-docker/Dockerfile.ranger-solr
index 8b212d4c5..81197480a 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger-solr
+++ b/dev-support/ranger-docker/Dockerfile.ranger-solr
@@ -17,10 +17,24 @@
ARG SOLR_VERSION
FROM solr:${SOLR_VERSION}
+VOLUME /etc/keytabs
+
# Copy audit config set
USER 0
-RUN mkdir -p /opt/solr/server/solr/configsets/ranger_audits/conf
-COPY config/solr-ranger_audits/* /opt/solr/server/solr/configsets/ranger_audits/conf/
+
+RUN apt update && DEBIAN_FRONTEND="noninteractive" apt-get install -y krb5-user
+
+RUN mkdir -p /opt/solr/server/solr/configsets/ranger_audits/conf /home/ranger/scripts
+
+COPY ./scripts/solr/solr-ranger_audits/* /opt/solr/server/solr/configsets/ranger_audits/conf/
+COPY ./scripts/solr/solr-jaas.conf /opt/solr/server/etc/jaas.conf
+COPY ./scripts/solr/solr-security.json /var/solr/data/security.json
+COPY ./scripts/solr/ranger-solr.sh /home/ranger/scripts/
+COPY ./scripts/wait_for_keytab.sh /home/ranger/scripts/
+COPY ./scripts/kdc/krb5.conf /etc/krb5.conf
+
RUN chown -R solr:solr /opt/solr/server/solr/configsets/ranger_audits/
+RUN chmod +x /home/ranger/scripts/ranger-solr.sh /home/ranger/scripts/wait_for_keytab.sh
-USER solr
+ENTRYPOINT [ "/home/ranger/scripts/ranger-solr.sh" ]
+CMD ["solr-foreground"]
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-sqlserver b/dev-support/ranger-docker/Dockerfile.ranger-sqlserver
index 3559fa49d..926e37b20 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger-sqlserver
+++ b/dev-support/ranger-docker/Dockerfile.ranger-sqlserver
@@ -26,7 +26,9 @@ EXPOSE 1433
USER root
RUN mkdir -p /docker-entrypoint-initdb.d
-COPY config/init_mssql.sh /docker-entrypoint-initdb.d/
+
+COPY ./scripts/rdbms/init_mssql.sh /docker-entrypoint-initdb.d/
+
RUN chown -R mssql /docker-entrypoint-initdb.d/
RUN chmod +x /docker-entrypoint-initdb.d/init_mssql.sh
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-tagsync b/dev-support/ranger-docker/Dockerfile.ranger-tagsync
index 59efb40eb..9f95a8fce 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger-tagsync
+++ b/dev-support/ranger-docker/Dockerfile.ranger-tagsync
@@ -20,12 +20,17 @@ FROM ${RANGER_BASE_IMAGE}:${RANGER_BASE_VERSION}
ARG TAGSYNC_VERSION
+VOLUME /etc/keytabs
+
COPY ./dist/version /home/ranger/dist/
COPY ./dist/ranger-${TAGSYNC_VERSION}-tagsync.tar.gz /home/ranger/dist/
-COPY ./scripts/ranger-tagsync.sh ${RANGER_SCRIPTS}/
-COPY ./scripts/ranger-tagsync-install.properties ${RANGER_SCRIPTS}/
-COPY ./scripts/ranger-tagsync-tags.json ${RANGER_SCRIPTS}/
+COPY ./scripts/tagsync/ranger-tagsync.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/tagsync/ranger-tagsync-install.properties ${RANGER_SCRIPTS}/
+COPY ./scripts/tagsync/ranger-tagsync-tags.json ${RANGER_SCRIPTS}/
+COPY ./scripts/hadoop/core-site.xml ${RANGER_SCRIPTS}/
+COPY ./scripts/wait_for_keytab.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/kdc/krb5.conf /etc/krb5.conf
RUN tar xvfz /home/ranger/dist/ranger-${TAGSYNC_VERSION}-tagsync.tar.gz --directory=${RANGER_HOME} && \
ln -s ${RANGER_HOME}/ranger-${TAGSYNC_VERSION}-tagsync ${RANGER_HOME}/tagsync && \
@@ -43,6 +48,7 @@ RUN tar xvfz /home/ranger/dist/ranger-${TAGSYNC_VERSION}-tagsync.tar.gz --direct
ln -s /etc/init.d/ranger-tagsync /etc/rc3.d/K00ranger-tagsync && \
ln -s ${RANGER_HOME}/tagsync/ranger-tagsync-services.sh /usr/bin/ranger-tagsync-services.sh && \
chown -R ranger:ranger ${RANGER_HOME}/tagsync/ ${RANGER_SCRIPTS}/ /var/run/ranger/ /var/log/ranger/ /etc/ranger /etc/init.d/ranger-tagsync && \
+ chmod 755 ${RANGER_SCRIPTS}/wait_for_keytab.sh && \
chmod 744 ${RANGER_SCRIPTS}/ranger-tagsync.sh
USER ranger
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-trino b/dev-support/ranger-docker/Dockerfile.ranger-trino
index 05e93c898..b31f52c76 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger-trino
+++ b/dev-support/ranger-docker/Dockerfile.ranger-trino
@@ -19,4 +19,4 @@ FROM trinodb/trino:${TRINO_VERSION}
USER trino
-COPY ./config/trino/* /etc/trino/
+COPY ./scripts/trino/* /etc/trino/
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-usersync b/dev-support/ranger-docker/Dockerfile.ranger-usersync
index 9b164cad0..89e711d60 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger-usersync
+++ b/dev-support/ranger-docker/Dockerfile.ranger-usersync
@@ -20,12 +20,17 @@ FROM ${RANGER_BASE_IMAGE}:${RANGER_BASE_VERSION}
ARG USERSYNC_VERSION
+VOLUME /etc/keytabs
+
COPY ./dist/version /home/ranger/dist/
COPY ./dist/ranger-${USERSYNC_VERSION}-usersync.tar.gz /home/ranger/dist/
-COPY ./scripts/ranger-usersync.sh ${RANGER_SCRIPTS}/
-COPY ./scripts/ranger-usersync-install.properties ${RANGER_SCRIPTS}/
-COPY ./scripts/ugsync-file-source.csv ${RANGER_SCRIPTS}/
+COPY ./scripts/usersync/ranger-usersync.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/usersync/ranger-usersync-install.properties ${RANGER_SCRIPTS}/
+COPY ./scripts/usersync/ugsync-file-source.csv ${RANGER_SCRIPTS}/
+COPY ./scripts/hadoop/core-site.xml ${RANGER_SCRIPTS}/
+COPY ./scripts/wait_for_keytab.sh ${RANGER_SCRIPTS}/
+COPY ./scripts/kdc/krb5.conf /etc/krb5.conf
RUN tar xvfz /home/ranger/dist/ranger-${USERSYNC_VERSION}-usersync.tar.gz --directory=${RANGER_HOME} && \
ln -s ${RANGER_HOME}/ranger-${USERSYNC_VERSION}-usersync ${RANGER_HOME}/usersync && \
@@ -42,6 +47,7 @@ RUN tar xvfz /home/ranger/dist/ranger-${USERSYNC_VERSION}-usersync.tar.gz --dire
ln -s /etc/init.d/ranger-usersync /etc/rc3.d/K00ranger-usersync && \
ln -s ${RANGER_HOME}/usersync/ranger-usersync-services.sh /usr/bin/ranger-usersync && \
chown -R ranger:ranger ${RANGER_HOME}/usersync/ ${RANGER_SCRIPTS}/ /var/run/ranger/ /var/log/ranger/ /etc/ranger /etc/init.d/ranger-usersync && \
+ chmod 755 ${RANGER_SCRIPTS}/wait_for_keytab.sh && \
chmod 744 ${RANGER_SCRIPTS}/ranger-usersync.sh
USER ranger
diff --git a/dev-support/ranger-docker/README.md b/dev-support/ranger-docker/README.md
index 1388ed351..e10166706 100644
--- a/dev-support/ranger-docker/README.md
+++ b/dev-support/ranger-docker/README.md
@@ -92,7 +92,7 @@ docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-hadoop.yml
~~~
#### Bring up ozone containers
~~~
-./scripts/ozone-plugin-docker-setup.sh
+./scripts/ozone/ozone-plugin-docker-setup.sh
docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-ozone.yml up -d
~~~
#### Bring up trino container (requires docker build with jdk 11):
@@ -103,7 +103,7 @@ Similarly, check the `depends` section of the `docker-compose.ranger-service.yam
#### Bring up all containers
~~~
-./scripts/ozone-plugin-docker-setup.sh
+./scripts/ozone/ozone-plugin-docker-setup.sh
docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-usersync.yml -f docker-compose.ranger-tagsync.yml -f docker-compose.ranger-kms.yml -f docker-compose.ranger-hadoop.yml -f docker-compose.ranger-hbase.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-hive.yml -f docker-compose.ranger-knox.yml -f docker-compose.ranger-ozone.yml up -d
~~~
diff --git a/dev-support/ranger-docker/docker-compose.ranger-build.yml b/dev-support/ranger-docker/docker-compose.ranger-build.yml
index cfdd6a8c2..26da9f119 100644
--- a/dev-support/ranger-docker/docker-compose.ranger-build.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger-build.yml
@@ -8,12 +8,11 @@ services:
- RANGER_BASE_BUILD_VERSION=${RANGER_BASE_BUILD_VERSION}
image: ranger-build
container_name: ranger-build
- hostname: ranger-build.example.com
+ hostname: ranger-build.rangernw
networks:
- ranger
volumes:
- ${HOME:-~}/.m2:/home/ranger/.m2:delegated
- - ./scripts:/home/ranger/scripts
- ./patches:/home/ranger/patches
- ./dist:/home/ranger/dist:delegated
- ${RANGER_HOME:-./../../}:/home/ranger/src:delegated
diff --git a/dev-support/ranger-docker/docker-compose.ranger-db.yml b/dev-support/ranger-docker/docker-compose.ranger-db.yml
index 3688a2a6d..5a3dda120 100644
--- a/dev-support/ranger-docker/docker-compose.ranger-db.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger-db.yml
@@ -7,7 +7,7 @@ services:
- POSTGRES_VERSION=${POSTGRES_VERSION}
image: ranger-postgres
container_name: ranger-postgres
- hostname: ranger-db.example.com
+ hostname: ranger-db.rangernw
ports:
- "5432:5432"
networks:
@@ -27,7 +27,7 @@ services:
image: ranger-mysql
command: --default-authentication-plugin=mysql_native_password
container_name: ranger-mysql
- hostname: ranger-db.example.com
+ hostname: ranger-db.rangernw
ports:
- "3306:3306"
networks:
@@ -47,7 +47,7 @@ services:
- ORACLE_VERSION=${ORACLE_VERSION}
image: ranger-oracle
container_name: ranger-oracle
- hostname: ranger-db.example.com
+ hostname: ranger-db.rangernw
ports:
- "1521:1521"
networks:
@@ -66,7 +66,7 @@ services:
- SQLSERVER_VERSION=${SQLSERVER_VERSION}
image: ranger-sqlserver
container_name: ranger-sqlserver
- hostname: ranger-db.example.com
+ hostname: ranger-db.rangernw
ports:
- "1433:1433"
networks:
diff --git a/dev-support/ranger-docker/docker-compose.ranger-hadoop.yml b/dev-support/ranger-docker/docker-compose.ranger-hadoop.yml
index dacbbf0cc..cf8460e70 100644
--- a/dev-support/ranger-docker/docker-compose.ranger-hadoop.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger-hadoop.yml
@@ -9,9 +9,12 @@ services:
- HADOOP_VERSION=${HADOOP_VERSION}
- HDFS_PLUGIN_VERSION=${HDFS_PLUGIN_VERSION}
- YARN_PLUGIN_VERSION=${YARN_PLUGIN_VERSION}
+ - KERBEROS_ENABLED=${KERBEROS_ENABLED}
image: ranger-hadoop
container_name: ranger-hadoop
- hostname: ranger-hadoop.example.com
+ hostname: ranger-hadoop.rangernw
+ volumes:
+ - ./dist/keytabs/ranger-hadoop:/etc/keytabs
stdin_open: true
tty: true
networks:
@@ -23,8 +26,8 @@ services:
ranger:
condition: service_started
healthcheck:
- test: "hdfs dfs -ls /hbase"
- interval: 1m30s
+ test: 'su -c "/home/ranger/scripts/ranger-hadoop-healthcheck.sh" healthcheck'
+ interval: 15s
timeout: 10s
retries: 30
start_period: 40s
@@ -32,6 +35,7 @@ services:
- HADOOP_VERSION
- HDFS_PLUGIN_VERSION
- YARN_PLUGIN_VERSION
+ - KERBEROS_ENABLED
networks:
ranger:
diff --git a/dev-support/ranger-docker/docker-compose.ranger-hbase.yml b/dev-support/ranger-docker/docker-compose.ranger-hbase.yml
index e39bc7461..103eba661 100644
--- a/dev-support/ranger-docker/docker-compose.ranger-hbase.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger-hbase.yml
@@ -8,9 +8,12 @@ services:
- RANGER_BASE_VERSION=${RANGER_BASE_VERSION}
- HBASE_VERSION=${HBASE_VERSION}
- HBASE_PLUGIN_VERSION=${HBASE_PLUGIN_VERSION}
+ - KERBEROS_ENABLED=${KERBEROS_ENABLED}
image: ranger-hbase
container_name: ranger-hbase
- hostname: ranger-hbase.example.com
+ hostname: ranger-hbase.rangernw
+ volumes:
+ - ./dist/keytabs/ranger-hbase:/etc/keytabs
stdin_open: true
tty: true
networks:
@@ -28,6 +31,7 @@ services:
environment:
- HBASE_VERSION
- HBASE_PLUGIN_VERSION
+ - KERBEROS_ENABLED
networks:
ranger:
diff --git a/dev-support/ranger-docker/docker-compose.ranger-hive.yml b/dev-support/ranger-docker/docker-compose.ranger-hive.yml
index 5815a472d..25b7227b8 100644
--- a/dev-support/ranger-docker/docker-compose.ranger-hive.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger-hive.yml
@@ -10,9 +10,12 @@ services:
- HIVE_VERSION=${HIVE_VERSION}
- HIVE_PLUGIN_VERSION=${HIVE_PLUGIN_VERSION}
- RANGER_DB_TYPE=${RANGER_DB_TYPE}
+ - KERBEROS_ENABLED=${KERBEROS_ENABLED}
image: ranger-hive
container_name: ranger-hive
- hostname: ranger-hive.example.com
+ hostname: ranger-hive.rangernw
+ volumes:
+ - ./dist/keytabs/ranger-hive:/etc/keytabs
stdin_open: true
tty: true
networks:
@@ -31,6 +34,7 @@ services:
- HIVE_VERSION
- HIVE_PLUGIN_VERSION
- RANGER_DB_TYPE
+ - KERBEROS_ENABLED
networks:
ranger:
diff --git a/dev-support/ranger-docker/docker-compose.ranger-kafka.yml b/dev-support/ranger-docker/docker-compose.ranger-kafka.yml
index 72fe904b1..7aa363c4f 100644
--- a/dev-support/ranger-docker/docker-compose.ranger-kafka.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger-kafka.yml
@@ -8,9 +8,12 @@ services:
- RANGER_BASE_VERSION=${RANGER_BASE_VERSION}
- KAFKA_VERSION=${KAFKA_VERSION}
- KAFKA_PLUGIN_VERSION=${KAFKA_PLUGIN_VERSION}
+ - KERBEROS_ENABLED=${KERBEROS_ENABLED}
image: ranger-kafka
container_name: ranger-kafka
- hostname: ranger-kafka.example.com
+ hostname: ranger-kafka.rangernw
+ volumes:
+ - ./dist/keytabs/ranger-kafka:/etc/keytabs
stdin_open: true
tty: true
networks:
@@ -25,6 +28,7 @@ services:
environment:
- KAFKA_VERSION
- KAFKA_PLUGIN_VERSION
+ - KERBEROS_ENABLED
networks:
ranger:
diff --git a/dev-support/ranger-docker/docker-compose.ranger-kms.yml b/dev-support/ranger-docker/docker-compose.ranger-kms.yml
index 82cd619f0..5dd6679fd 100644
--- a/dev-support/ranger-docker/docker-compose.ranger-kms.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger-kms.yml
@@ -8,9 +8,12 @@ services:
- RANGER_BASE_VERSION=${RANGER_BASE_VERSION}
- KMS_VERSION=${KMS_VERSION}
- RANGER_DB_TYPE=${RANGER_DB_TYPE}
+ - KERBEROS_ENABLED=${KERBEROS_ENABLED}
image: ranger-kms:latest
container_name: ranger-kms
- hostname: ranger-kms.example.com
+ hostname: ranger-kms.rangernw
+ volumes:
+ - ./dist/keytabs/ranger-kms:/etc/keytabs
stdin_open: true
tty: true
networks:
@@ -23,6 +26,7 @@ services:
environment:
- KMS_VERSION
- RANGER_DB_TYPE
+ - KERBEROS_ENABLED
command:
- /home/ranger/scripts/ranger-kms.sh
diff --git a/dev-support/ranger-docker/docker-compose.ranger-knox.yml b/dev-support/ranger-docker/docker-compose.ranger-knox.yml
index 6cb16d288..f9435ef45 100644
--- a/dev-support/ranger-docker/docker-compose.ranger-knox.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger-knox.yml
@@ -8,9 +8,12 @@ services:
- RANGER_BASE_VERSION=${RANGER_BASE_VERSION}
- KNOX_VERSION=${KNOX_VERSION}
- KNOX_PLUGIN_VERSION=${KNOX_PLUGIN_VERSION}
+ - KERBEROS_ENABLED=${KERBEROS_ENABLED}
image: ranger-knox
container_name: ranger-knox
- hostname: ranger-knox.example.com
+ hostname: ranger-knox.rangernw
+ volumes:
+ - ./dist/keytabs/ranger-knox:/etc/keytabs
stdin_open: true
tty: true
networks:
@@ -25,6 +28,7 @@ services:
environment:
- KNOX_VERSION
- KNOX_PLUGIN_VERSION
+ - KERBEROS_ENABLED
networks:
ranger:
diff --git a/dev-support/ranger-docker/docker-compose.ranger-ozone.yml b/dev-support/ranger-docker/docker-compose.ranger-ozone.yml
index 9ceee4c02..9b7aad5c6 100644
--- a/dev-support/ranger-docker/docker-compose.ranger-ozone.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger-ozone.yml
@@ -2,6 +2,7 @@ services:
datanode:
image: ${OZONE_RUNNER_IMAGE}:${OZONE_RUNNER_VERSION}
container_name: ozone-datanode
+ hostname: datanode.rangernw
volumes:
- ./downloads/ozone-${OZONE_VERSION}:/opt/hadoop
networks:
@@ -10,7 +11,7 @@ services:
- 9864
command: ["/opt/hadoop/bin/ozone","datanode"]
env_file:
- - ./config/ozone/docker-config
+ - ./scripts/ozone/docker-config
environment:
OZONE_OPTS:
om:
@@ -24,7 +25,7 @@ services:
- OZONE_PLUGIN_VERSION=${OZONE_PLUGIN_VERSION}
image: ranger-ozone:latest
container_name: ozone-om
- hostname: om
+ hostname: om.rangernw
volumes:
- ./downloads/ozone-${OZONE_VERSION}:/opt/hadoop
- ./dist/ranger-${OZONE_PLUGIN_VERSION}-ozone-plugin:/opt/hadoop/ranger-ozone-plugin
@@ -45,12 +46,12 @@ services:
OZONE_PLUGIN_VERSION: ${OZONE_PLUGIN_VERSION}
OZONE_VERSION: ${OZONE_VERSION}
env_file:
- - ./config/ozone/docker-config
+ - ./scripts/ozone/docker-config
command: bash -c "/opt/hadoop/ranger-ozone-plugin/ranger-ozone-setup.sh && /opt/hadoop/bin/ozone om"
scm:
image: ${OZONE_RUNNER_IMAGE}:${OZONE_RUNNER_VERSION}
container_name: ozone-scm
- hostname: scm
+ hostname: scm.rangernw
volumes:
- ./downloads/ozone-${OZONE_VERSION}:/opt/hadoop
networks:
@@ -59,7 +60,7 @@ services:
- 9876:9876
- 9860:9860
env_file:
- - ./config/ozone/docker-config
+ - ./scripts/ozone/docker-config
environment:
ENSURE_SCM_INITIALIZED: /data/metadata/scm/current/VERSION
OZONE-SITE.XML_hdds.scm.safemode.min.datanode: "${OZONE_SAFEMODE_MIN_DATANODES:-1}"
diff --git a/dev-support/ranger-docker/docker-compose.ranger-tagsync.yml b/dev-support/ranger-docker/docker-compose.ranger-tagsync.yml
index 3bf4ba9e8..6c1e11a45 100644
--- a/dev-support/ranger-docker/docker-compose.ranger-tagsync.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger-tagsync.yml
@@ -7,9 +7,12 @@ services:
- RANGER_BASE_IMAGE=${RANGER_BASE_IMAGE}
- RANGER_BASE_VERSION=${RANGER_BASE_VERSION}
- TAGSYNC_VERSION=${TAGSYNC_VERSION}
+ - KERBEROS_ENABLED=${KERBEROS_ENABLED}
image: ranger-tagsync
container_name: ranger-tagsync
- hostname: ranger-tagsync.example.com
+ hostname: ranger-tagsync.rangernw
+ volumes:
+ - ./dist/keytabs/ranger-tagsync:/etc/keytabs
stdin_open: true
tty: true
networks:
@@ -20,6 +23,7 @@ services:
environment:
- TAGSYNC_VERSION
- DEBUG_TAGSYNC=${DEBUG_TAGSYNC:-false}
+ - KERBEROS_ENABLED
networks:
ranger:
diff --git a/dev-support/ranger-docker/docker-compose.ranger-trino.yml b/dev-support/ranger-docker/docker-compose.ranger-trino.yml
index 2439c4101..e78cd8319 100644
--- a/dev-support/ranger-docker/docker-compose.ranger-trino.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger-trino.yml
@@ -5,8 +5,11 @@ services:
dockerfile: Dockerfile.ranger-trino
args:
- TRINO_VERSION=${TRINO_VERSION}
+ - KERBEROS_ENABLED=${KERBEROS_ENABLED}
image: ranger-trino
hostname: trino
+ volumes:
+ - ./dist/keytabs/ranger-trino:/etc/keytabs
container_name: ranger-trino
stdin_open: true
tty: true
@@ -19,6 +22,7 @@ services:
condition: service_started
environment:
- TRINO_VERSION
+ - KERBEROS_ENABLED
networks:
ranger:
diff --git a/dev-support/ranger-docker/docker-compose.ranger-usersync.yml b/dev-support/ranger-docker/docker-compose.ranger-usersync.yml
index 49238f674..10e3f029e 100644
--- a/dev-support/ranger-docker/docker-compose.ranger-usersync.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger-usersync.yml
@@ -7,9 +7,12 @@ services:
- RANGER_BASE_IMAGE=${RANGER_BASE_IMAGE}
- RANGER_BASE_VERSION=${RANGER_BASE_VERSION}
- USERSYNC_VERSION=${USERSYNC_VERSION}
+ - KERBEROS_ENABLED=${KERBEROS_ENABLED}
image: ranger-usersync
container_name: ranger-usersync
- hostname: ranger-usersync.example.com
+ hostname: ranger-usersync.rangernw
+ volumes:
+ - ./dist/keytabs/ranger-usersync:/etc/keytabs
stdin_open: true
tty: true
networks:
@@ -21,6 +24,7 @@ services:
- USERSYNC_VERSION
- ENABLE_FILE_SYNC_SOURCE
- DEBUG_USERSYNC=${DEBUG_USERSYNC:-false}
+ - KERBEROS_ENABLED
networks:
ranger:
diff --git a/dev-support/ranger-docker/docker-compose.ranger.yml b/dev-support/ranger-docker/docker-compose.ranger.yml
index a81299682..90f65a6f1 100644
--- a/dev-support/ranger-docker/docker-compose.ranger.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger.yml
@@ -8,9 +8,12 @@ services:
- RANGER_BASE_VERSION=${RANGER_BASE_VERSION}
- RANGER_VERSION=${RANGER_VERSION}
- RANGER_DB_TYPE=${RANGER_DB_TYPE}
+ - KERBEROS_ENABLED=${KERBEROS_ENABLED}
image: ranger:latest
container_name: ranger
- hostname: ranger.example.com
+ hostname: ranger.rangernw
+ volumes:
+ - ./dist/keytabs/ranger:/etc/keytabs
stdin_open: true
tty: true
networks:
@@ -18,6 +21,8 @@ services:
ports:
- "6080:6080"
depends_on:
+ ranger-kdc:
+ condition: service_started
ranger-zk:
condition: service_started
ranger-db:
@@ -27,10 +32,33 @@ services:
environment:
- RANGER_VERSION
- RANGER_DB_TYPE
+ - KERBEROS_ENABLED
- DEBUG_ADMIN=${DEBUG_ADMIN:-false}
command:
- /home/ranger/scripts/ranger.sh
+ ranger-kdc:
+ build:
+ context: .
+ dockerfile: Dockerfile.ranger-kdc
+ args:
+ - REALM=${KERBEROS_REALM}
+ - KDC_HOST=${KERBEROS_KDC_HOST}
+ - MASTER_PASSWORD=${KERBEROS_MASTER_PASSWORD}
+ - ADMIN_PRINCIPAL=${KERBEROS_ADMIN_PRINCIPAL}
+ - ADMIN_PASSWORD=${KERBEROS_ADMIN_PASSWORD}
+ image: ranger-kdc:latest
+ container_name: ranger-kdc
+ hostname: ranger-kdc.rangernw
+ volumes:
+ - ./dist/keytabs:/etc/keytabs
+ networks:
+ - ranger
+ ports:
+ - "88:88"
+ - "88:88/udp"
+ - "749:749"
+
ranger-db:
extends:
service: ${RANGER_DB_TYPE}
@@ -42,13 +70,16 @@ services:
dockerfile: Dockerfile.ranger-zk
args:
- ZK_VERSION=${ZK_VERSION}
+ - KERBEROS_ENABLED=${KERBEROS_ENABLED}
image: ranger-zk
container_name: ranger-zk
- hostname: ranger-zk.example.com
+ hostname: ranger-zk.rangernw
networks:
- ranger
ports:
- "2181:2181"
+ environment:
+ - KERBEROS_ENABLED
ranger-solr:
build:
@@ -56,13 +87,24 @@ services:
dockerfile: Dockerfile.ranger-solr
args:
- SOLR_VERSION=${SOLR_VERSION}
+ - KERBEROS_ENABLED=${KERBEROS_ENABLED}
image: ranger-solr
container_name: ranger-solr
- hostname: ranger-solr.example.com
+ hostname: ranger-solr.rangernw
+ volumes:
+ - ./dist/keytabs/ranger-solr:/etc/keytabs
networks:
- ranger
ports:
- "8983:8983"
+ depends_on:
+ ranger-kdc:
+ condition: service_started
+ ranger-zk:
+ condition: service_started
+ environment:
+ - KERBEROS_ENABLED
+ - KRB5_CONFIG=/etc/krb5.conf
command:
- solr-precreate
- ranger_audits
diff --git a/dev-support/ranger-docker/scripts/create-ranger-services.py b/dev-support/ranger-docker/scripts/admin/create-ranger-services.py
similarity index 55%
rename from dev-support/ranger-docker/scripts/create-ranger-services.py
rename to dev-support/ranger-docker/scripts/admin/create-ranger-services.py
index 7e0ad7e38..28ea03429 100644
--- a/dev-support/ranger-docker/scripts/create-ranger-services.py
+++ b/dev-support/ranger-docker/scripts/admin/create-ranger-services.py
@@ -15,30 +15,55 @@ def service_not_exists(service):
hdfs = RangerService({'name': 'dev_hdfs', 'type': 'hdfs',
'configs': {'username': 'hdfs', 'password': 'hdfs',
- 'fs.default.name': 'hdfs://ranger-hadoop:9000',
+ 'fs.default.name': 'hdfs://ranger-hadoop.rangernw:9000',
'hadoop.security.authentication': 'simple',
'hadoop.security.authorization': 'true',
+ 'policy.download.auth.users': 'hdfs',
+ 'tag.download.auth.users': 'hdfs',
+ 'userstore.download.auth.users': 'hdfs',
'ranger.plugin.hdfs.policy.refresh.synchronous':'true'}})
hive = RangerService({'name': 'dev_hive', 'type': 'hive',
'configs': {'username': 'hive', 'password': 'hive',
'jdbc.driverClassName': 'org.apache.hive.jdbc.HiveDriver',
- 'jdbc.url': 'jdbc:hive2://ranger-hive:10000',
+ 'jdbc.url': 'jdbc:hive2://ranger-hive.rangernw:10000',
'hadoop.security.authorization': 'true',
+ 'policy.download.auth.users': 'hive',
+ 'tag.download.auth.users': 'hive',
+ 'userstore.download.auth.users': 'hive',
'ranger.plugin.hive.policy.refresh.synchronous':'true'}})
kafka = RangerService({'name': 'dev_kafka', 'type': 'kafka',
'configs': {'username': 'kafka', 'password': 'kafka',
- 'zookeeper.connect': 'ranger-zk.example.com:2181',
+ 'zookeeper.connect': 'ranger-zk.rangernw:2181',
+ 'policy.download.auth.users': 'kafka',
+ 'tag.download.auth.users': 'kafka',
+ 'setup.additional.default.policies': 'true',
+ 'default-policy.1.name': 'topic: ATLAS_ENTITIES',
+ 'default-policy.1.resource.topic': 'ATLAS_ENTITIES',
+ 'default-policy.1.policyItem.1.users': 'rangertagsync',
+ 'default-policy.1.policyItem.1.accessTypes': 'create,consume',
+ 'default-policy.2.name': 'consumergroup: ranger_entities_consumer',
+ 'default-policy.2.resource.consumergroup': 'ranger_entities_consumer',
+ 'default-policy.2.policyItem.1.users': 'rangertagsync',
+ 'default-policy.2.policyItem.1.accessTypes': 'consume,describe',
+ 'ranger.plugin.audit.filters': "[{'accessResult': 'DENIED', 'isAudited': true},{'resources':{'topic':{'values':['ATLAS_ENTITIES']}},'users':['rangertagsync'],'actions':['create','consume','describe'],'isAudited':false},{'resources':{'consumergroup':{'values':['ranger_entities_consumer']}},'users':['rangertagsync'],'actions':['consume'],'isAudited':false}]",
+ 'userstore.download.auth.users': 'kafka',
'ranger.plugin.kafka.policy.refresh.synchronous':'true'}})
knox = RangerService({'name': 'dev_knox', 'type': 'knox',
- 'configs': {'username': 'knox', 'password': 'knox', 'knox.url': 'https://ranger-knox:8443',
+ 'configs': {'username': 'knox', 'password': 'knox', 'knox.url': 'https://ranger-knox.rangernw:8443',
+ 'policy.download.auth.users': 'knox',
+ 'tag.download.auth.users': 'knox',
+ 'userstore.download.auth.users': 'knox',
'ranger.plugin.knox.policy.refresh.synchronous':'true'}})
yarn = RangerService({'name': 'dev_yarn', 'type': 'yarn',
'configs': {'username': 'yarn', 'password': 'yarn',
- 'yarn.url': 'http://ranger-hadoop:8088',
+ 'yarn.url': 'http://ranger-hadoop.rangernw:8088',
+ 'policy.download.auth.users': 'yarn',
+ 'tag.download.auth.users': 'yarn',
+ 'userstore.download.auth.users': 'yarn',
'ranger.plugin.yarn.policy.refresh.synchronous':'true'}})
hbase = RangerService({'name': 'dev_hbase', 'type': 'hbase',
@@ -47,13 +72,19 @@ def service_not_exists(service):
'hbase.security.authentication': 'simple',
'hadoop.security.authorization': 'true',
'hbase.zookeeper.property.clientPort': '2181',
- 'hbase.zookeeper.quorum': 'ranger-zk',
+ 'hbase.zookeeper.quorum': 'ranger-zk.rangernw',
'zookeeper.znode.parent': '/hbase',
+ 'policy.download.auth.users': 'hbase',
+ 'tag.download.auth.users': 'hbase',
+ 'userstore.download.auth.users': 'hbase',
'ranger.plugin.hbase.policy.refresh.synchronous':'true'}})
kms = RangerService({'name': 'dev_kms', 'type': 'kms',
'configs': {'username': 'keyadmin', 'password': 'rangerR0cks!',
- 'provider': 'http://ranger-kms:9292',
+ 'provider': 'http://ranger-kms.rangernw:9292',
+ 'policy.download.auth.users': 'rangerkms',
+ 'tag.download.auth.users': 'rangerkms',
+ 'userstore.download.auth.users': 'rangerkms',
'ranger.plugin.kms.policy.refresh.synchronous':'true'}})
trino = RangerService({'name': 'dev_trino',
@@ -62,7 +93,10 @@ def service_not_exists(service):
'username': 'trino',
'password': 'trino',
'jdbc.driverClassName': 'io.trino.jdbc.TrinoDriver',
- 'jdbc.url': 'jdbc:trino://ranger-trino:8080',
+ 'jdbc.url': 'jdbc:trino://ranger-trino.rangernw:8080',
+ 'policy.download.auth.users': 'trino',
+ 'tag.download.auth.users': 'trino',
+ 'userstore.download.auth.users': 'trino',
'ranger.plugin.trino.policy.refresh.synchronous':'true'
}})
@@ -72,6 +106,9 @@ def service_not_exists(service):
'configs': {'username': 'hdfs', 'password': 'hdfs',
'ozone.om.http-address': 'http://om:9874',
'hadoop.security.authentication': 'simple',
+ 'policy.download.auth.users': 'ozone',
+ 'tag.download.auth.users': 'ozone',
+ 'userstore.download.auth.users': 'ozone',
'ranger.plugin.ozone.policy.refresh.synchronous':'true'}})
services = [hdfs, yarn, hive, hbase, kafka, knox, kms, trino, ozone]
diff --git a/dev-support/ranger-docker/scripts/ranger-admin-install-mysql.properties b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-mysql.properties
similarity index 78%
rename from dev-support/ranger-docker/scripts/ranger-admin-install-mysql.properties
rename to dev-support/ranger-docker/scripts/admin/ranger-admin-install-mysql.properties
index 4f4ed5898..18a4c8da7 100644
--- a/dev-support/ranger-docker/scripts/ranger-admin-install-mysql.properties
+++ b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-mysql.properties
@@ -90,3 +90,20 @@ STALE_PATCH_ENTRY_HOLD_TIME=10
hadoop_conf=
authentication_method=UNIX
+
+#------------ Kerberos Config -----------------
+spnego_principal=HTTP/ranger.rangernw@EXAMPLE.COM
+spnego_keytab=/etc/keytabs/HTTP.keytab
+token_valid=30
+admin_principal=rangeradmin/ranger.rangernw@EXAMPLE.COM
+admin_keytab=/etc/keytabs/rangeradmin.keytab
+lookup_principal=rangerlookup/ranger.rangernw@EXAMPLE.COM
+lookup_keytab=/etc/keytabs/rangerlookup.keytab
+audit_jaas_client_loginModuleName=com.sun.security.auth.module.Krb5LoginModule
+audit_jaas_client_loginModuleControlFlag=required
+audit_jaas_client_option_useKeyTab=true
+audit_jaas_client_option_storeKey=true
+audit_jaas_client_option_useTicketCache=true
+audit_jaas_client_option_serviceName=ranger
+audit_jaas_client_option_keyTab=/etc/keytabs/rangeradmin.keytab
+audit_jaas_client_option_principal=rangeradmin/ranger.rangernw@EXAMPLE.COM
diff --git a/dev-support/ranger-docker/scripts/ranger-admin-install-oracle.properties b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-oracle.properties
similarity index 79%
rename from dev-support/ranger-docker/scripts/ranger-admin-install-oracle.properties
rename to dev-support/ranger-docker/scripts/admin/ranger-admin-install-oracle.properties
index dfc3c5504..22b177c02 100644
--- a/dev-support/ranger-docker/scripts/ranger-admin-install-oracle.properties
+++ b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-oracle.properties
@@ -91,3 +91,20 @@ STALE_PATCH_ENTRY_HOLD_TIME=10
hadoop_conf=
authentication_method=UNIX
+
+#------------ Kerberos Config -----------------
+spnego_principal=HTTP/ranger.rangernw@EXAMPLE.COM
+spnego_keytab=/etc/keytabs/HTTP.keytab
+token_valid=30
+admin_principal=rangeradmin/ranger.rangernw@EXAMPLE.COM
+admin_keytab=/etc/keytabs/rangeradmin.keytab
+lookup_principal=rangerlookup/ranger.rangernw@EXAMPLE.COM
+lookup_keytab=/etc/keytabs/rangerlookup.keytab
+audit_jaas_client_loginModuleName=com.sun.security.auth.module.Krb5LoginModule
+audit_jaas_client_loginModuleControlFlag=required
+audit_jaas_client_option_useKeyTab=true
+audit_jaas_client_option_storeKey=true
+audit_jaas_client_option_useTicketCache=true
+audit_jaas_client_option_serviceName=ranger
+audit_jaas_client_option_keyTab=/etc/keytabs/rangeradmin.keytab
+audit_jaas_client_option_principal=rangeradmin/ranger.rangernw@EXAMPLE.COM
diff --git a/dev-support/ranger-docker/scripts/ranger-admin-install-postgres.properties b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-postgres.properties
similarity index 78%
rename from dev-support/ranger-docker/scripts/ranger-admin-install-postgres.properties
rename to dev-support/ranger-docker/scripts/admin/ranger-admin-install-postgres.properties
index 26ba2b8ac..cf8a58fec 100644
--- a/dev-support/ranger-docker/scripts/ranger-admin-install-postgres.properties
+++ b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-postgres.properties
@@ -90,3 +90,20 @@ STALE_PATCH_ENTRY_HOLD_TIME=10
hadoop_conf=
authentication_method=UNIX
+
+#------------ Kerberos Config -----------------
+spnego_principal=HTTP/ranger.rangernw@EXAMPLE.COM
+spnego_keytab=/etc/keytabs/HTTP.keytab
+token_valid=30
+admin_principal=rangeradmin/ranger.rangernw@EXAMPLE.COM
+admin_keytab=/etc/keytabs/rangeradmin.keytab
+lookup_principal=rangerlookup/ranger.rangernw@EXAMPLE.COM
+lookup_keytab=/etc/keytabs/rangerlookup.keytab
+audit_jaas_client_loginModuleName=com.sun.security.auth.module.Krb5LoginModule
+audit_jaas_client_loginModuleControlFlag=required
+audit_jaas_client_option_useKeyTab=true
+audit_jaas_client_option_storeKey=true
+audit_jaas_client_option_useTicketCache=true
+audit_jaas_client_option_serviceName=ranger
+audit_jaas_client_option_keyTab=/etc/keytabs/rangeradmin.keytab
+audit_jaas_client_option_principal=rangeradmin/ranger.rangernw@EXAMPLE.COM
diff --git a/dev-support/ranger-docker/scripts/ranger-admin-install-sqlserver.properties b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-sqlserver.properties
similarity index 80%
rename from dev-support/ranger-docker/scripts/ranger-admin-install-sqlserver.properties
rename to dev-support/ranger-docker/scripts/admin/ranger-admin-install-sqlserver.properties
index b69e22d1e..8a1919374 100644
--- a/dev-support/ranger-docker/scripts/ranger-admin-install-sqlserver.properties
+++ b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-sqlserver.properties
@@ -97,3 +97,20 @@ STALE_PATCH_ENTRY_HOLD_TIME=10
hadoop_conf=
authentication_method=UNIX
+
+#------------ Kerberos Config -----------------
+spnego_principal=HTTP/ranger.rangernw@EXAMPLE.COM
+spnego_keytab=/etc/keytabs/HTTP.keytab
+token_valid=30
+admin_principal=rangeradmin/ranger.rangernw@EXAMPLE.COM
+admin_keytab=/etc/keytabs/rangeradmin.keytab
+lookup_principal=rangerlookup/ranger.rangernw@EXAMPLE.COM
+lookup_keytab=/etc/keytabs/rangerlookup.keytab
+audit_jaas_client_1_loginModuleName=com.sun.security.auth.module.Krb5LoginModule
+audit_jaas_client_1_loginModuleControlFlag=required
+audit_jaas_client_1_option_useKeyTab=true
+audit_jaas_client_1_option_storeKey=true
+audit_jaas_client_1_option_useTicketCache=true
+audit_jaas_client_1_option_serviceName=ranger
+audit_jaas_client_1_option_keyTab=/etc/keytabs/rangeradmin.keytab
+audit_jaas_client_1_option_principal=rangeradmin/ranger.rangernw@EXAMPLE.COM
diff --git a/dev-support/ranger-docker/scripts/ranger.sh b/dev-support/ranger-docker/scripts/admin/ranger.sh
similarity index 81%
rename from dev-support/ranger-docker/scripts/ranger.sh
rename to dev-support/ranger-docker/scripts/admin/ranger.sh
index 666a07b22..9dd781c63 100755
--- a/dev-support/ranger-docker/scripts/ranger.sh
+++ b/dev-support/ranger-docker/scripts/admin/ranger.sh
@@ -16,7 +16,6 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-
if [ ! -e ${RANGER_HOME}/.setupDone ]
then
SETUP_RANGER=true
@@ -26,9 +25,21 @@ fi
if [ "${SETUP_RANGER}" == "true" ]
then
+ if [ "${KERBEROS_ENABLED}" == "true" ]
+ then
+ ${RANGER_SCRIPTS}/wait_for_keytab.sh rangeradmin.keytab
+ ${RANGER_SCRIPTS}/wait_for_keytab.sh rangerlookup.keytab
+ ${RANGER_SCRIPTS}/wait_for_keytab.sh HTTP.keytab
+ fi
+
cd "${RANGER_HOME}"/admin || exit
if ./setup.sh;
then
+ if [ "${KERBEROS_ENABLED}" == "true" ]
+ then
+ cp ${RANGER_SCRIPTS}/core-site.xml ${RANGER_HOME}/admin/conf/core-site.xml
+ fi
+
touch "${RANGER_HOME}"/.setupDone
else
echo "Ranger Admin Setup Script didn't complete proper execution."
diff --git a/dev-support/ranger-docker/scripts/ranger-build.sh b/dev-support/ranger-docker/scripts/build/ranger-build.sh
similarity index 100%
rename from dev-support/ranger-docker/scripts/ranger-build.sh
rename to dev-support/ranger-docker/scripts/build/ranger-build.sh
diff --git a/dev-support/ranger-docker/scripts/core-site.xml b/dev-support/ranger-docker/scripts/core-site.xml
deleted file mode 100644
index 2cce9dd9e..000000000
--- a/dev-support/ranger-docker/scripts/core-site.xml
+++ /dev/null
@@ -1,7 +0,0 @@
-<?xml version="1.0"?>
-<configuration>
- <property>
- <name>fs.defaultFS</name>
- <value>hdfs://ranger-hadoop.rangernw:9000</value>
- </property>
-</configuration>
diff --git a/dev-support/ranger-docker/scripts/hadoop/core-site.xml b/dev-support/ranger-docker/scripts/hadoop/core-site.xml
new file mode 100644
index 000000000..476a61c42
--- /dev/null
+++ b/dev-support/ranger-docker/scripts/hadoop/core-site.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0"?>
+<configuration>
+ <property>
+ <name>fs.defaultFS</name>
+ <value>hdfs://ranger-hadoop.rangernw:9000</value>
+ </property>
+ <property>
+ <name>hadoop.security.authentication</name>
+ <value>kerberos</value>
+ </property>
+ <property>
+ <name>hadoop.security.auth_to_local</name>
+ <value>
+ RULE:[2:$1/$2@$0]([ndj]n/.*@EXAMPLE\.COM)s/.*/hdfs/
+ RULE:[2:$1/$2@$0]([rn]m/.*@EXAMPLE\.COM)s/.*/yarn/
+ RULE:[2:$1/$2@$0](jhs/.*@EXAMPLE\.COM)s/.*/mapred/
+ DEFAULT
+ </value>
+ </property>
+</configuration>
diff --git a/dev-support/ranger-docker/scripts/hadoop/hdfs-site.xml b/dev-support/ranger-docker/scripts/hadoop/hdfs-site.xml
new file mode 100644
index 000000000..ab1cc9aee
--- /dev/null
+++ b/dev-support/ranger-docker/scripts/hadoop/hdfs-site.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<configuration>
+ <property>
+ <name>dfs.replication</name>
+ <value>1</value>
+ </property>
+ <property>
+ <name>dfs.webhdfs.enabled</name>
+ <value>true</value>
+ </property>
+ <property>
+ <name>dfs.permissions.enabled</name>
+ <value>true</value>
+ </property>
+ <property>
+ <name>dfs.permissions</name>
+ <value>true</value>
+ </property>
+ <property>
+ <name>dfs.namenode.inode.attributes.provider.class</name>
+ <value>org.apache.ranger.authorization.hadoop.RangerHdfsAuthorizer</value>
+ </property>
+ <property>
+ <name>dfs.permissions.ContentSummary.subAccess</name>
+ <value>true</value>
+ </property>
+ <property>
+ <name>dfs.block.access.token.enable</name>
+ <value>true</value>
+ </property>
+ <property>
+ <name>dfs.namenode.kerberos.principal</name>
+ <value>nn/ranger-hadoop.rangernw@EXAMPLE.COM</value>
+ </property>
+ <property>
+ <name>dfs.namenode.keytab.file</name>
+ <value>/etc/keytabs/nn.keytab</value>
+ </property>
+ <property>
+ <name>dfs.namenode.kerberos.internal.spnego.principal</name>
+ <value>HTTP/ranger-hadoop.rangernw@EXAMPLE.COM</value>
+ </property>
+ <property>
+ <name>dfs.datanode.kerberos.principal</name>
+ <value>dn/ranger-hadoop.rangernw@EXAMPLE.COM</value>
+ </property>
+ <property>
+ <name>dfs.datanode.keytab.file</name>
+ <value>/etc/keytabs/dn.keytab</value>
+ </property>
+ <property>
+ <name>ignore.secure.ports.for.testing</name>
+ <value>true</value>
+ </property>
+ <property>
+ <name>dfs.web.authentication.kerberos.principal</name>
+ <value>HTTP/ranger-hadoop.rangernw@EXAMPLE.COM</value>
+ </property>
+ <property>
+ <name>dfs.web.authentication.kerberos.keytab</name>
+ <value>/etc/keytabs/HTTP.keytab</value>
+ </property>
+</configuration>
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-trino b/dev-support/ranger-docker/scripts/hadoop/ranger-hadoop-healthcheck.sh
old mode 100644
new mode 100755
similarity index 76%
copy from dev-support/ranger-docker/Dockerfile.ranger-trino
copy to dev-support/ranger-docker/scripts/hadoop/ranger-hadoop-healthcheck.sh
index 05e93c898..5ca2d7908
--- a/dev-support/ranger-docker/Dockerfile.ranger-trino
+++ b/dev-support/ranger-docker/scripts/hadoop/ranger-hadoop-healthcheck.sh
@@ -1,3 +1,5 @@
+#!/bin/bash
+
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
@@ -14,9 +16,17 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-ARG TRINO_VERSION
-FROM trinodb/trino:${TRINO_VERSION}
+if [ "${KERBEROS_ENABLED}" == "true" ]
+then
+ kinit -kt /etc/keytabs/nn.keytab nn/`hostname -f`@EXAMPLE.COM
+fi
+
+${HADOOP_HOME}/bin/hdfs dfs -stat /hbase
+ret=$?
-USER trino
+if [ "${KERBEROS_ENABLED}" == "true" ]
+then
+ kdestroy
+fi
-COPY ./config/trino/* /etc/trino/
+exit ${ret}
diff --git a/dev-support/ranger-docker/scripts/ranger-hadoop-mkdir.sh b/dev-support/ranger-docker/scripts/hadoop/ranger-hadoop-mkdir.sh
similarity index 92%
rename from dev-support/ranger-docker/scripts/ranger-hadoop-mkdir.sh
rename to dev-support/ranger-docker/scripts/hadoop/ranger-hadoop-mkdir.sh
index 09bbc49c9..cc1c8c887 100755
--- a/dev-support/ranger-docker/scripts/ranger-hadoop-mkdir.sh
+++ b/dev-support/ranger-docker/scripts/hadoop/ranger-hadoop-mkdir.sh
@@ -17,6 +17,12 @@
# limitations under the License.
# setup directories for Ranger audits
+
+if [ "${KERBEROS_ENABLED}" == "true" ]
+then
+ kinit -kt /etc/keytabs/nn.keytab nn/`hostname -f`@EXAMPLE.COM
+fi
+
${HADOOP_HOME}/bin/hdfs dfs -mkdir -p /ranger/audit/hdfs
${HADOOP_HOME}/bin/hdfs dfs -mkdir -p /ranger/audit/yarn
${HADOOP_HOME}/bin/hdfs dfs -mkdir -p /ranger/audit/hbaseMaster
@@ -42,3 +48,8 @@ ${HADOOP_HOME}/bin/hdfs dfs -mkdir -p /user/hive/warehouse
${HADOOP_HOME}/bin/hdfs dfs -mkdir -p /tmp/hive
${HADOOP_HOME}/bin/hdfs dfs -chown -R hive:hadoop /tmp/hive /user/hive
${HADOOP_HOME}/bin/hdfs dfs -chmod 777 /tmp/hive
+
+if [ "${KERBEROS_ENABLED}" == "true" ]
+then
+ kdestroy
+fi
diff --git a/dev-support/ranger-docker/scripts/hadoop/ranger-hadoop-setup.sh b/dev-support/ranger-docker/scripts/hadoop/ranger-hadoop-setup.sh
new file mode 100755
index 000000000..c7b83e216
--- /dev/null
+++ b/dev-support/ranger-docker/scripts/hadoop/ranger-hadoop-setup.sh
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+echo "export JAVA_HOME=${JAVA_HOME}" >> ${HADOOP_HOME}/etc/hadoop/hadoop-env.sh
+
+cat <<EOF > /etc/ssh/ssh_config
+Host *
+ StrictHostKeyChecking no
+ UserKnownHostsFile=/dev/null
+EOF
+
+if [ "${KERBEROS_ENABLED}" == "true" ]
+then
+ ${RANGER_SCRIPTS}/wait_for_keytab.sh hdfs.keytab
+ ${RANGER_SCRIPTS}/wait_for_keytab.sh nn.keytab
+ ${RANGER_SCRIPTS}/wait_for_keytab.sh dn.keytab
+ ${RANGER_SCRIPTS}/wait_for_keytab.sh HTTP.keytab
+ ${RANGER_SCRIPTS}/wait_for_keytab.sh nm.keytab
+ ${RANGER_SCRIPTS}/wait_for_keytab.sh rm.keytab
+ ${RANGER_SCRIPTS}/wait_for_keytab.sh yarn.keytab
+ ${RANGER_SCRIPTS}/wait_for_keytab.sh healthcheck.keytab
+fi
+
+cp ${RANGER_SCRIPTS}/core-site.xml ${HADOOP_HOME}/etc/hadoop/core-site.xml
+cp ${RANGER_SCRIPTS}/hdfs-site.xml ${HADOOP_HOME}/etc/hadoop/hdfs-site.xml
+cp ${RANGER_SCRIPTS}/yarn-site.xml ${HADOOP_HOME}/etc/hadoop/yarn-site.xml
+
+mkdir -p /opt/hadoop/logs
+chown -R hdfs:hadoop /opt/hadoop/
+chmod g+w /opt/hadoop/logs
+# user logs directory permissions for NodeManager health
+mkdir -p ${HADOOP_HOME}/logs/userlogs
+chown -R yarn:hadoop ${HADOOP_HOME}/logs/userlogs
+chmod -R 777 ${HADOOP_HOME}/logs/userlogs
+
+cd ${RANGER_HOME}/ranger-hdfs-plugin
+./enable-hdfs-plugin.sh
+
+cd ${RANGER_HOME}/ranger-yarn-plugin
+./enable-yarn-plugin.sh
diff --git a/dev-support/ranger-docker/scripts/ranger-hadoop.sh b/dev-support/ranger-docker/scripts/hadoop/ranger-hadoop.sh
similarity index 99%
rename from dev-support/ranger-docker/scripts/ranger-hadoop.sh
rename to dev-support/ranger-docker/scripts/hadoop/ranger-hadoop.sh
index 164c25add..5821431cc 100755
--- a/dev-support/ranger-docker/scripts/ranger-hadoop.sh
+++ b/dev-support/ranger-docker/scripts/hadoop/ranger-hadoop.sh
@@ -34,7 +34,6 @@ then
# pdsh is unavailable with microdnf in rhel based image.
echo "ssh" > /etc/pdsh/rcmd_default
-
if "${RANGER_SCRIPTS}"/ranger-hadoop-setup.sh;
then
su -c "${HADOOP_HOME}/bin/hdfs namenode -format" hdfs
@@ -63,4 +62,4 @@ then
echo "The NameNode process probably exited, no process id found!"
else
tail --pid=$NAMENODE_PID -f /dev/null
-fi
\ No newline at end of file
+fi
diff --git a/dev-support/ranger-docker/scripts/ranger-hdfs-plugin-install.properties b/dev-support/ranger-docker/scripts/hadoop/ranger-hdfs-plugin-install.properties
similarity index 87%
rename from dev-support/ranger-docker/scripts/ranger-hdfs-plugin-install.properties
rename to dev-support/ranger-docker/scripts/hadoop/ranger-hdfs-plugin-install.properties
index 4642b67e7..fb876ee27 100644
--- a/dev-support/ranger-docker/scripts/ranger-hdfs-plugin-install.properties
+++ b/dev-support/ranger-docker/scripts/hadoop/ranger-hdfs-plugin-install.properties
@@ -45,16 +45,16 @@ XAAUDIT.SOLR.USER=NONE
XAAUDIT.SOLR.PASSWORD=NONE
XAAUDIT.SOLR.ZOOKEEPER=NONE
XAAUDIT.SOLR.FILE_SPOOL_DIR=/var/log/hadoop/hdfs/audit/solr/spool
-XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=false
+XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=true
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=%EMPTY%
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=com.sun.security.auth.module.Krb5LoginModule
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=required
+XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=true
+XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=true
+XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=true
+XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=hdfs
+XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/etc/keytabs/hdfs.keytab
+XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=hdfs/ranger-hadoop.rangernw@EXAMPLE.COM
XAAUDIT.ELASTICSEARCH.ENABLE=false
XAAUDIT.ELASTICSEARCH.URL=NONE
diff --git a/dev-support/ranger-docker/scripts/ranger-yarn-plugin-install.properties b/dev-support/ranger-docker/scripts/hadoop/ranger-yarn-plugin-install.properties
similarity index 87%
rename from dev-support/ranger-docker/scripts/ranger-yarn-plugin-install.properties
rename to dev-support/ranger-docker/scripts/hadoop/ranger-yarn-plugin-install.properties
index a61a89896..b537c4565 100644
--- a/dev-support/ranger-docker/scripts/ranger-yarn-plugin-install.properties
+++ b/dev-support/ranger-docker/scripts/hadoop/ranger-yarn-plugin-install.properties
@@ -45,16 +45,16 @@ XAAUDIT.SOLR.USER=NONE
XAAUDIT.SOLR.PASSWORD=NONE
XAAUDIT.SOLR.ZOOKEEPER=NONE
XAAUDIT.SOLR.FILE_SPOOL_DIR=/var/log/hadoop/yarn/audit/solr/spool
-XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=false
+XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=true
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=%EMPTY%
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=com.sun.security.auth.module.Krb5LoginModule
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=required
+XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=true
+XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=true
+XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=true
+XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=yarn
+XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/etc/keytabs/yarn.keytab
+XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=yarn/ranger-hadoop.rangernw@EXAMPLE.COM
XAAUDIT.ELASTICSEARCH.ENABLE=false
XAAUDIT.ELASTICSEARCH.URL=NONE
diff --git a/dev-support/ranger-docker/scripts/hadoop/yarn-site.xml b/dev-support/ranger-docker/scripts/hadoop/yarn-site.xml
new file mode 100644
index 000000000..0381b16a5
--- /dev/null
+++ b/dev-support/ranger-docker/scripts/hadoop/yarn-site.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<configuration>
+ <property>
+ <name>yarn.nodemanager.aux-services</name>
+ <value>mapreduce_shuffle</value>
+ </property>
+ <property>
+ <name>yarn.nodemanager.env-whitelist</name>
+ <value>JAVA_HOME,HADOOP_COMMON_HOME,HADOOP_HDFS_HOME,HADOOP_CONF_DIR,CLASSPATH_PREPEND_DISTCACHE,HADOOP_YARN_HOME,HADOOP_MAPRED_HOME</value>
+ </property>
+ <property>
+ <name>yarn.acl.enable</name>
+ <value>true</value>
+ </property>
+ <property>
+ <name>yarn.authorization-provider</name>
+ <value>org.apache.ranger.authorization.yarn.authorizer.RangerYarnAuthorizer</value>
+ </property>
+ <property>
+ <name>yarn.resourcemanager.principal</name>
+ <value>rm/ranger-hadoop.rangernw@EXAMPLE.COM</value>
+ </property>
+ <property>
+ <name>yarn.resourcemanager.keytab</name>
+ <value>/etc/keytabs/rm.keytab</value>
+ </property>
+ <property>
+ <name>yarn.nodemanager.principal</name>
+ <value>nm/ranger-hadoop.rangernw@EXAMPLE.COM</value>
+ </property>
+ <property>
+ <name>yarn.nodemanager.keytab</name>
+ <value>/etc/keytabs/nm.keytab</value>
+ </property>
+</configuration>
diff --git a/dev-support/ranger-docker/scripts/hbase-site.xml b/dev-support/ranger-docker/scripts/hbase/hbase-site.xml
similarity index 70%
rename from dev-support/ranger-docker/scripts/hbase-site.xml
rename to dev-support/ranger-docker/scripts/hbase/hbase-site.xml
index 6789bf19f..93034e7d7 100644
--- a/dev-support/ranger-docker/scripts/hbase-site.xml
+++ b/dev-support/ranger-docker/scripts/hbase/hbase-site.xml
@@ -43,10 +43,38 @@
</property>
<property>
<name>hbase.rootdir</name>
- <value>hdfs://ranger-hadoop.example.com:9000/hbase</value>
+ <value>hdfs://ranger-hadoop.rangernw:9000/hbase</value>
</property>
<property>
<name>hbase.zookeeper.quorum</name>
- <value>ranger-zk.example.com</value>
+ <value>ranger-zk.rangernw</value>
+ </property>
+ <property>
+ <name>hbase.security.authentication</name>
+ <value>kerberos</value>
+ </property>
+ <property>
+ <name>hbase.security.authorization</name>
+ <value>true</value>
+ </property>
+ <property>
+ <name>hbase.master.kerberos.principal</name>
+ <value>hbase/ranger-hbase.rangernw@EXAMPLE.COM</value>
+ </property>
+ <property>
+ <name>hbase.master.keytab.file</name>
+ <value>/etc/keytabs/hbase.keytab</value>
+ </property>
+ <property>
+ <name>hbase.regionserver.kerberos.principal</name>
+ <value>hbase/ranger-hbase.rangernw@EXAMPLE.COM</value>
+ </property>
+ <property>
+ <name>hbase.regionserver.keytab.file</name>
+ <value>/etc/keytabs/hbase.keytab</value>
+ </property>
+ <property>
+ <name>hbase.coprocessor.region.classes</name>
+ <value>org.apache.hadoop.hbase.security.token.TokenProvider</value>
</property>
</configuration>
diff --git a/dev-support/ranger-docker/scripts/ranger-hbase-plugin-install.properties b/dev-support/ranger-docker/scripts/hbase/ranger-hbase-plugin-install.properties
similarity index 87%
rename from dev-support/ranger-docker/scripts/ranger-hbase-plugin-install.properties
rename to dev-support/ranger-docker/scripts/hbase/ranger-hbase-plugin-install.properties
index b33f97ff8..042c8f3dc 100644
--- a/dev-support/ranger-docker/scripts/ranger-hbase-plugin-install.properties
+++ b/dev-support/ranger-docker/scripts/hbase/ranger-hbase-plugin-install.properties
@@ -48,16 +48,16 @@ XAAUDIT.SOLR.USER=NONE
XAAUDIT.SOLR.PASSWORD=NONE
XAAUDIT.SOLR.ZOOKEEPER=NONE
XAAUDIT.SOLR.FILE_SPOOL_DIR=/var/log/hadoop/hbase/audit/solr/spool
-XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=false
+XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=true
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=%EMPTY%
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=com.sun.security.auth.module.Krb5LoginModule
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=required
+XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=true
+XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=true
+XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=true
+XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=hbase
+XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/etc/keytabs/hbase.keytab
+XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=hbase/ranger-hbase.rangernw@EXAMPLE.COM
XAAUDIT.ELASTICSEARCH.ENABLE=false
XAAUDIT.ELASTICSEARCH.URL=NONE
diff --git a/dev-support/ranger-docker/scripts/ranger-hbase-setup.sh b/dev-support/ranger-docker/scripts/hbase/ranger-hbase-setup.sh
similarity index 87%
copy from dev-support/ranger-docker/scripts/ranger-hbase-setup.sh
copy to dev-support/ranger-docker/scripts/hbase/ranger-hbase-setup.sh
index 95a1bdf21..d452bc211 100755
--- a/dev-support/ranger-docker/scripts/ranger-hbase-setup.sh
+++ b/dev-support/ranger-docker/scripts/hbase/ranger-hbase-setup.sh
@@ -24,7 +24,13 @@ Host *
UserKnownHostsFile=/dev/null
EOF
+if [ "${KERBEROS_ENABLED}" == "true" ]
+then
+ ${RANGER_SCRIPTS}/wait_for_keytab.sh hbase.keytab
+fi
+
cp ${RANGER_SCRIPTS}/hbase-site.xml /opt/hbase/conf/hbase-site.xml
+cp ${RANGER_SCRIPTS}/core-site.xml /opt/hbase/conf/core-site.xml
chown -R hbase:hadoop /opt/hbase/
cd ${RANGER_HOME}/ranger-hbase-plugin
diff --git a/dev-support/ranger-docker/scripts/ranger-hbase.sh b/dev-support/ranger-docker/scripts/hbase/ranger-hbase.sh
similarity index 99%
rename from dev-support/ranger-docker/scripts/ranger-hbase.sh
rename to dev-support/ranger-docker/scripts/hbase/ranger-hbase.sh
index 77b3dc0a6..8d9e989a3 100755
--- a/dev-support/ranger-docker/scripts/ranger-hbase.sh
+++ b/dev-support/ranger-docker/scripts/hbase/ranger-hbase.sh
@@ -28,7 +28,6 @@ then
# pdsh is unavailable with microdnf in rhel based image.
echo "ssh" > /etc/pdsh/rcmd_default
-
if "${RANGER_SCRIPTS}"/ranger-hbase-setup.sh;
then
touch "${HBASE_HOME}"/.setupDone
diff --git a/dev-support/ranger-docker/scripts/hive-site-mysql.xml b/dev-support/ranger-docker/scripts/hive/hive-site-mysql.xml
similarity index 65%
rename from dev-support/ranger-docker/scripts/hive-site-mysql.xml
rename to dev-support/ranger-docker/scripts/hive/hive-site-mysql.xml
index 118cdbbca..b12058781 100644
--- a/dev-support/ranger-docker/scripts/hive-site-mysql.xml
+++ b/dev-support/ranger-docker/scripts/hive/hive-site-mysql.xml
@@ -21,7 +21,7 @@
<configuration>
<property>
<name>javax.jdo.option.ConnectionURL</name>
- <value>jdbc:mysql://ranger-db/hive</value>
+ <value>jdbc:mysql://ranger-db.rangernw/hive</value>
</property>
<property>
<name>javax.jdo.option.ConnectionDriverName</name>
@@ -36,6 +36,30 @@
<value>rangerR0cks!</value>
</property>
+ <property>
+ <name>hive.server2.authentication</name>
+ <value>KERBEROS</value>
+ </property>
+ <property>
+ <name>hive.server2.authentication.kerberos.principal</name>
+ <value>hive/ranger-hive.rangernw@EXAMPLE.COM</value>
+ </property>
+ <property>
+ <name>hive.server2.authentication.kerberos.keytab</name>
+ <value>/etc/keytabs/hive.keytab</value>
+ </property>
+ <property>
+ <name>hive.metastore.sasl.enabled</name>
+ <value>true</value>
+ </property>
+ <property>
+ <name>hive.metastore.kerberos.principal</name>
+ <value>hive/ranger-hive.rangernw@EXAMPLE.COM</value>
+ </property>
+ <property>
+ <name>hive.metastore.kerberos.keytab.file</name>
+ <value>/etc/keytabs/hive.keytab</value>
+ </property>
<property>
<name>hive.server2.enable.doAs</name>
<value>false</value>
@@ -43,7 +67,7 @@
<property>
<name>hive.zookeeper.quorum</name>
- <value>ranger-zk.example.com</value>
+ <value>ranger-zk.rangernw</value>
</property>
<property>
<name>hive.zookeeper.client.port</name>
diff --git a/dev-support/ranger-docker/scripts/hive-site-oracle.xml b/dev-support/ranger-docker/scripts/hive/hive-site-oracle.xml
similarity index 64%
rename from dev-support/ranger-docker/scripts/hive-site-oracle.xml
rename to dev-support/ranger-docker/scripts/hive/hive-site-oracle.xml
index 2b8cc5e08..0b62000ad 100644
--- a/dev-support/ranger-docker/scripts/hive-site-oracle.xml
+++ b/dev-support/ranger-docker/scripts/hive/hive-site-oracle.xml
@@ -21,7 +21,7 @@
<configuration>
<property>
<name>javax.jdo.option.ConnectionURL</name>
- <value>jdbc:oracle:thin:@//ranger-db:1521/FREEPDB1</value>
+ <value>jdbc:oracle:thin:@//ranger-db.rangernw:1521/FREEPDB1</value>
</property>
<property>
<name>javax.jdo.option.ConnectionDriverName</name>
@@ -36,6 +36,30 @@
<value>rangerR0cks!</value>
</property>
+ <property>
+ <name>hive.server2.authentication</name>
+ <value>KERBEROS</value>
+ </property>
+ <property>
+ <name>hive.server2.authentication.kerberos.principal</name>
+ <value>hive/ranger-hive.rangernw@EXAMPLE.COM</value>
+ </property>
+ <property>
+ <name>hive.server2.authentication.kerberos.keytab</name>
+ <value>/etc/keytabs/hive.keytab</value>
+ </property>
+ <property>
+ <name>hive.metastore.sasl.enabled</name>
+ <value>true</value>
+ </property>
+ <property>
+ <name>hive.metastore.kerberos.principal</name>
+ <value>hive/ranger-hive.rangernw@EXAMPLE.COM</value>
+ </property>
+ <property>
+ <name>hive.metastore.kerberos.keytab.file</name>
+ <value>/etc/keytabs/hive.keytab</value>
+ </property>
<property>
<name>hive.server2.enable.doAs</name>
<value>false</value>
@@ -43,7 +67,7 @@
<property>
<name>hive.zookeeper.quorum</name>
- <value>ranger-zk.example.com</value>
+ <value>ranger-zk.rangernw</value>
</property>
<property>
<name>hive.zookeeper.client.port</name>
diff --git a/dev-support/ranger-docker/scripts/hive-site-postgres.xml b/dev-support/ranger-docker/scripts/hive/hive-site-postgres.xml
similarity index 65%
rename from dev-support/ranger-docker/scripts/hive-site-postgres.xml
rename to dev-support/ranger-docker/scripts/hive/hive-site-postgres.xml
index 55343a323..c9a89b72e 100644
--- a/dev-support/ranger-docker/scripts/hive-site-postgres.xml
+++ b/dev-support/ranger-docker/scripts/hive/hive-site-postgres.xml
@@ -21,7 +21,7 @@
<configuration>
<property>
<name>javax.jdo.option.ConnectionURL</name>
- <value>jdbc:postgresql://ranger-db/hive</value>
+ <value>jdbc:postgresql://ranger-db.rangernw/hive</value>
</property>
<property>
<name>javax.jdo.option.ConnectionDriverName</name>
@@ -36,6 +36,30 @@
<value>rangerR0cks!</value>
</property>
+ <property>
+ <name>hive.server2.authentication</name>
+ <value>KERBEROS</value>
+ </property>
+ <property>
+ <name>hive.server2.authentication.kerberos.principal</name>
+ <value>hive/ranger-hive.rangernw@EXAMPLE.COM</value>
+ </property>
+ <property>
+ <name>hive.server2.authentication.kerberos.keytab</name>
+ <value>/etc/keytabs/hive.keytab</value>
+ </property>
+ <property>
+ <name>hive.metastore.sasl.enabled</name>
+ <value>true</value>
+ </property>
+ <property>
+ <name>hive.metastore.kerberos.principal</name>
+ <value>hive/ranger-hive.rangernw@EXAMPLE.COM</value>
+ </property>
+ <property>
+ <name>hive.metastore.kerberos.keytab.file</name>
+ <value>/etc/keytabs/hive.keytab</value>
+ </property>
<property>
<name>hive.server2.enable.doAs</name>
<value>false</value>
@@ -43,7 +67,7 @@
<property>
<name>hive.zookeeper.quorum</name>
- <value>ranger-zk.example.com</value>
+ <value>ranger-zk.rangernw</value>
</property>
<property>
<name>hive.zookeeper.client.port</name>
diff --git a/dev-support/ranger-docker/scripts/hive-site-sqlserver.xml b/dev-support/ranger-docker/scripts/hive/hive-site-sqlserver.xml
similarity index 65%
rename from dev-support/ranger-docker/scripts/hive-site-sqlserver.xml
rename to dev-support/ranger-docker/scripts/hive/hive-site-sqlserver.xml
index 5bed21c2d..ad63c0ed4 100644
--- a/dev-support/ranger-docker/scripts/hive-site-sqlserver.xml
+++ b/dev-support/ranger-docker/scripts/hive/hive-site-sqlserver.xml
@@ -21,7 +21,7 @@
<configuration>
<property>
<name>javax.jdo.option.ConnectionURL</name>
- <value>jdbc:sqlserver://ranger-db/hive</value>
+ <value>jdbc:sqlserver://ranger-db.rangernw/hive</value>
</property>
<property>
<name>javax.jdo.option.ConnectionDriverName</name>
@@ -35,13 +35,37 @@
<name>javax.jdo.option.ConnectionPassword</name>
<value>rangerR0cks!</value>
</property>
+ <property>
+ <name>hive.server2.authentication</name>
+ <value>KERBEROS</value>
+ </property>
+ <property>
+ <name>hive.server2.authentication.kerberos.principal</name>
+ <value>hive/ranger-hive.rangernw@EXAMPLE.COM</value>
+ </property>
+ <property>
+ <name>hive.server2.authentication.kerberos.keytab</name>
+ <value>/etc/keytabs/hive.keytab</value>
+ </property>
+ <property>
+ <name>hive.metastore.sasl.enabled</name>
+ <value>true</value>
+ </property>
+ <property>
+ <name>hive.metastore.kerberos.principal</name>
+ <value>hive/ranger-hive.rangernw@EXAMPLE.COM</value>
+ </property>
+ <property>
+ <name>hive.metastore.kerberos.keytab.file</name>
+ <value>/etc/keytabs/hive.keytab</value>
+ </property>
<property>
<name>hive.server2.enable.doAs</name>
<value>false</value>
</property>
<property>
<name>hive.zookeeper.quorum</name>
- <value>ranger-zk.example.com</value>
+ <value>ranger-zk.rangernw</value>
</property>
<property>
<name>hive.zookeeper.client.port</name>
diff --git a/dev-support/ranger-docker/scripts/ranger-hive-plugin-install.properties b/dev-support/ranger-docker/scripts/hive/ranger-hive-plugin-install.properties
similarity index 87%
rename from dev-support/ranger-docker/scripts/ranger-hive-plugin-install.properties
rename to dev-support/ranger-docker/scripts/hive/ranger-hive-plugin-install.properties
index 70c49cd31..0dae26f43 100644
--- a/dev-support/ranger-docker/scripts/ranger-hive-plugin-install.properties
+++ b/dev-support/ranger-docker/scripts/hive/ranger-hive-plugin-install.properties
@@ -46,16 +46,16 @@ XAAUDIT.SOLR.USER=NONE
XAAUDIT.SOLR.PASSWORD=NONE
XAAUDIT.SOLR.ZOOKEEPER=NONE
XAAUDIT.SOLR.FILE_SPOOL_DIR=/var/log/hive/audit/solr/spool
-XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=false
+XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=true
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=%EMPTY%
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=com.sun.security.auth.module.Krb5LoginModule
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=required
+XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=true
+XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=true
+XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=true
+XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=hive
+XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/etc/keytabs/hive.keytab
+XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=hive/ranger-hive.rangernw@EXAMPLE.COM
XAAUDIT.ELASTICSEARCH.ENABLE=false
XAAUDIT.ELASTICSEARCH.URL=NONE
diff --git a/dev-support/ranger-docker/scripts/hive/ranger-hive-setup.sh b/dev-support/ranger-docker/scripts/hive/ranger-hive-setup.sh
new file mode 100755
index 000000000..2f38b99ba
--- /dev/null
+++ b/dev-support/ranger-docker/scripts/hive/ranger-hive-setup.sh
@@ -0,0 +1,104 @@
+#!/bin/bash
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+echo "export JAVA_HOME=${JAVA_HOME}" >> ${HADOOP_HOME}/etc/hadoop/hadoop-env.sh
+
+cat <<EOF > /etc/ssh/ssh_config
+Host *
+ StrictHostKeyChecking no
+ UserKnownHostsFile=/dev/null
+EOF
+
+if [ "${KERBEROS_ENABLED}" == "true" ]
+then
+ ${RANGER_SCRIPTS}/wait_for_keytab.sh hive.keytab
+fi
+
+cp ${RANGER_SCRIPTS}/hive-site.xml ${HIVE_HOME}/conf/hive-site.xml
+cp ${RANGER_SCRIPTS}/hive-site.xml ${HIVE_HOME}/conf/hiveserver2-site.xml
+
+mkdir -p ${HADOOP_HOME}/etc/hadoop
+
+cp ${RANGER_SCRIPTS}/core-site.xml ${HADOOP_HOME}/etc/hadoop/core-site.xml
+
+# Create mapred-site.xml for YARN integration
+cat <<EOF > ${HADOOP_HOME}/etc/hadoop/mapred-site.xml
+<configuration>
+ <property>
+ <name>mapreduce.framework.name</name>
+ <value>yarn</value>
+ </property>
+ <property>
+ <name>mapreduce.application.classpath</name>
+ <value>\$HADOOP_MAPRED_HOME/share/hadoop/mapreduce/*:\$HADOOP_MAPRED_HOME/share/hadoop/mapreduce/lib/*</value>
+ </property>
+ <property>
+ <name>yarn.app.mapreduce.am.env</name>
+ <value>HADOOP_MAPRED_HOME=/opt/hadoop</value>
+ </property>
+ <property>
+ <name>mapreduce.map.env</name>
+ <value>HADOOP_MAPRED_HOME=/opt/hadoop</value>
+ </property>
+ <property>
+ <name>mapreduce.reduce.env</name>
+ <value>HADOOP_MAPRED_HOME=/opt/hadoop</value>
+ </property>
+</configuration>
+EOF
+
+# Create yarn-site.xml for YARN ResourceManager connection
+cat <<EOF > ${HADOOP_HOME}/etc/hadoop/yarn-site.xml
+<configuration>
+ <property>
+ <name>yarn.resourcemanager.hostname</name>
+ <value>ranger-hadoop</value>
+ </property>
+ <property>
+ <name>yarn.resourcemanager.address</name>
+ <value>ranger-hadoop:8032</value>
+ </property>
+</configuration>
+EOF
+
+
+# Copy all Hadoop configurations to Hive conf directory so Hive can find them
+cp ${HADOOP_HOME}/etc/hadoop/core-site.xml ${HIVE_HOME}/conf/
+cp ${HADOOP_HOME}/etc/hadoop/mapred-site.xml ${HIVE_HOME}/conf/
+cp ${HADOOP_HOME}/etc/hadoop/yarn-site.xml ${HIVE_HOME}/conf/
+
+# Create HDFS user directory for hive
+su -c "${HADOOP_HOME}/bin/hdfs dfs -mkdir -p /user/hive" hdfs
+su -c "${HADOOP_HOME}/bin/hdfs dfs -chmod -R 777 /user/hive" hdfs
+
+# Fix /tmp directory permissions for Ranger (critical for INSERT operations)
+su -c "${HADOOP_HOME}/bin/hdfs dfs -chmod 777 /tmp" hdfs
+
+# Create /user/root directory for YARN job execution
+su -c "${HADOOP_HOME}/bin/hdfs dfs -mkdir -p /user/root" hdfs
+su -c "${HADOOP_HOME}/bin/hdfs dfs -chmod 777 /user/root" hdfs
+
+# Initialize Hive schema
+su -c "${HIVE_HOME}/bin/schematool -dbType ${RANGER_DB_TYPE} -initSchema" hive
+
+mkdir -p /opt/hive/logs
+chown -R hive:hadoop /opt/hive/
+chmod g+w /opt/hive/logs
+
+cd ${RANGER_HOME}/ranger-hive-plugin
+./enable-hive-plugin.sh
diff --git a/dev-support/ranger-docker/scripts/ranger-hive.sh b/dev-support/ranger-docker/scripts/hive/ranger-hive.sh
similarity index 99%
rename from dev-support/ranger-docker/scripts/ranger-hive.sh
rename to dev-support/ranger-docker/scripts/hive/ranger-hive.sh
index 6e8dc4f84..06660a65f 100755
--- a/dev-support/ranger-docker/scripts/ranger-hive.sh
+++ b/dev-support/ranger-docker/scripts/hive/ranger-hive.sh
@@ -38,7 +38,6 @@ then
# pdsh is unavailable with microdnf in rhel based image.
echo "ssh" > /etc/pdsh/rcmd_default
-
if "${RANGER_SCRIPTS}"/ranger-hive-setup.sh;
then
touch "${HIVE_HOME}"/.setupDone
diff --git a/dev-support/ranger-docker/scripts/kafka/kafka-server-jaas.conf b/dev-support/ranger-docker/scripts/kafka/kafka-server-jaas.conf
new file mode 100644
index 000000000..bb8a76b74
--- /dev/null
+++ b/dev-support/ranger-docker/scripts/kafka/kafka-server-jaas.conf
@@ -0,0 +1,6 @@
+KafkaServer {
+ com.sun.security.auth.module.Krb5LoginModule required
+ useKeyTab=true
+ keyTab="/etc/keytabs/kafka.keytab"
+ principal="kafka/ranger-kafka.rangernw@EXAMPLE.COM";
+};
diff --git a/dev-support/ranger-docker/scripts/ranger-kafka-plugin-install.properties b/dev-support/ranger-docker/scripts/kafka/ranger-kafka-plugin-install.properties
similarity index 82%
rename from dev-support/ranger-docker/scripts/ranger-kafka-plugin-install.properties
rename to dev-support/ranger-docker/scripts/kafka/ranger-kafka-plugin-install.properties
index 7f888151e..3daa42a2d 100644
--- a/dev-support/ranger-docker/scripts/ranger-kafka-plugin-install.properties
+++ b/dev-support/ranger-docker/scripts/kafka/ranger-kafka-plugin-install.properties
@@ -13,7 +13,7 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-POLICY_MGR_URL=http://ranger:6080
+POLICY_MGR_URL=http://ranger.rangernw:6080
REPOSITORY_NAME=dev_kafka
COMPONENT_INSTALL_DIR_NAME=/opt/kafka
@@ -26,7 +26,7 @@ UPDATE_XAPOLICIES_ON_GRANT_REVOKE=true
XAAUDIT.SOLR.IS_ENABLED=true
XAAUDIT.SOLR.MAX_QUEUE_SIZE=1
XAAUDIT.SOLR.MAX_FLUSH_INTERVAL_MS=1000
-XAAUDIT.SOLR.SOLR_URL=http://ranger-solr:8983/solr/ranger_audits
+XAAUDIT.SOLR.SOLR_URL=http://ranger-solr.rangernw:8983/solr/ranger_audits
# Following properties are needed to get past installation script! Please don't remove
XAAUDIT.HDFS.IS_ENABLED=false
@@ -48,16 +48,16 @@ XAAUDIT.SOLR.USER=NONE
XAAUDIT.SOLR.PASSWORD=NONE
XAAUDIT.SOLR.ZOOKEEPER=NONE
XAAUDIT.SOLR.FILE_SPOOL_DIR=/var/log/kafka/audit/solr/spool
-XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=false
+XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=true
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=%EMPTY%
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=com.sun.security.auth.module.Krb5LoginModule
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=required
+XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=true
+XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=true
+XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=true
+XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=kafka
+XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/etc/keytabs/kafka.keytab
+XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=kafka/ranger-kafka.rangernw@EXAMPLE.COM
XAAUDIT.ELASTICSEARCH.ENABLE=false
XAAUDIT.ELASTICSEARCH.URL=NONE
@@ -68,7 +68,7 @@ XAAUDIT.ELASTICSEARCH.PORT=NONE
XAAUDIT.ELASTICSEARCH.PROTOCOL=NONE
XAAUDIT.HDFS.ENABLE=true
-XAAUDIT.HDFS.HDFS_DIR=hdfs://ranger-hadoop:9000/ranger/audit
+XAAUDIT.HDFS.HDFS_DIR=hdfs://ranger-hadoop.rangernw:9000/ranger/audit
XAAUDIT.HDFS.FILE_SPOOL_DIR=/var/log/kafka/audit/hdfs/spool
XAAUDIT.HDFS.AZURE_ACCOUNTNAME=__REPLACE_AZURE_ACCOUNT_NAME
diff --git a/dev-support/ranger-docker/scripts/kafka/ranger-kafka-setup.sh b/dev-support/ranger-docker/scripts/kafka/ranger-kafka-setup.sh
new file mode 100755
index 000000000..195f5f580
--- /dev/null
+++ b/dev-support/ranger-docker/scripts/kafka/ranger-kafka-setup.sh
@@ -0,0 +1,61 @@
+#!/bin/bash
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+cat <<EOF > /etc/ssh/ssh_config
+Host *
+ StrictHostKeyChecking no
+ UserKnownHostsFile=/dev/null
+EOF
+
+if [ "${KERBEROS_ENABLED}" == "true" ]
+then
+ ${RANGER_SCRIPTS}/wait_for_keytab.sh kafka.keytab
+fi
+
+cp ${RANGER_SCRIPTS}/core-site.xml ${KAFKA_HOME}/config/
+cp ${RANGER_SCRIPTS}/kafka-server-jaas.conf ${KAFKA_HOME}/config/
+
+chown -R kafka:hadoop /opt/kafka/
+
+cd ${RANGER_HOME}/ranger-kafka-plugin
+./enable-kafka-plugin.sh
+
+sed -i 's/localhost:2181/ranger-zk.rangernw:2181/' ${KAFKA_HOME}/config/server.properties
+
+cat <<EOF >> ${KAFKA_HOME}/config/server.properties
+# Enable SASL/GSSAPI mechanism
+sasl.enabled.mechanisms=GSSAPI
+sasl.mechanism.inter.broker.protocol=GSSAPI
+security.inter.broker.protocol=SASL_PLAINTEXT
+
+# Listener configuration
+listeners=SASL_PLAINTEXT://:9092
+advertised.listeners=SASL_PLAINTEXT://ranger-kafka.rangernw:9092
+
+# JAAS configuration for Kerberos
+listener.name.sasl_plaintext.gssapi.sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required \
+useKeyTab=true \
+storeKey=true \
+keyTab="/etc/keytabs/kafka.keytab" \
+principal="kafka/ranger-kafka.rangernw@EXAMPLE.COM";
+
+# Kerberos service name
+sasl.kerberos.service.name=kafka
+
+authorizer.class.name=org.apache.ranger.authorization.kafka.authorizer.RangerKafkaAuthorizer
+EOF
diff --git a/dev-support/ranger-docker/scripts/ranger-kafka.sh b/dev-support/ranger-docker/scripts/kafka/ranger-kafka.sh
similarity index 85%
rename from dev-support/ranger-docker/scripts/ranger-kafka.sh
rename to dev-support/ranger-docker/scripts/kafka/ranger-kafka.sh
index c1f6139b1..cd5e93eff 100755
--- a/dev-support/ranger-docker/scripts/ranger-kafka.sh
+++ b/dev-support/ranger-docker/scripts/kafka/ranger-kafka.sh
@@ -34,7 +34,6 @@ then
# pdsh is unavailable with microdnf in rhel based image.
echo "ssh" > /etc/pdsh/rcmd_default
-
if "${RANGER_SCRIPTS}"/ranger-kafka-setup.sh;
then
touch "${KAFKA_HOME}"/.setupDone
@@ -43,4 +42,4 @@ then
fi
fi
-su -c "cd ${KAFKA_HOME} && CLASSPATH=${KAFKA_HOME}/config ./bin/kafka-server-start.sh config/server.properties" kafka
+su -c "cd ${KAFKA_HOME} && CLASSPATH=${KAFKA_HOME}/config KAFKA_OPTS='-Djava.security.krb5.conf=/etc/krb5.conf -Djava.security.auth.login.config=/opt/kafka/config/kafka-server-jaas.conf' ./bin/kafka-server-start.sh config/server.properties" kafka
diff --git a/dev-support/ranger-docker/scripts/kdc/entrypoint.sh b/dev-support/ranger-docker/scripts/kdc/entrypoint.sh
new file mode 100644
index 000000000..ffb9638a2
--- /dev/null
+++ b/dev-support/ranger-docker/scripts/kdc/entrypoint.sh
@@ -0,0 +1,138 @@
+#!/bin/bash
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -e
+
+REALM="${REALM:-EXAMPLE.COM}"
+KDC_HOST="${KDC_HOST:-ranger-kdc.rangernw}"
+MASTER_PASSWORD="${MASTER_PASSWORD:-masterpassword}"
+ADMIN_PRINC="${ADMIN_PRINCIPAL:-admin/admin}"
+ADMIN_PASSWORD="${ADMIN_PASSWORD:-adminpassword}"
+
+DB_DIR=/var/kerberos/krb5kdc
+KEYTABS_DIR=/etc/keytabs
+
+function create_principal_and_keytab() {
+ principal_name=$1
+ container_name=$2
+
+ principal=${principal_name}/${container_name}.rangernw
+ keytab=${KEYTABS_DIR}/${container_name}/${principal_name}.keytab
+
+ mkdir -p ${KEYTABS_DIR}/${container_name}
+
+ rm -f ${keytab}
+
+ echo "Creating kerberos principal ${principal} .."
+ for i in {1..5}; do
+ kadmin.local -q "addprinc -randkey ${principal}"
+
+ if [ $? -ne 0 ]; then
+ echo "[ERROR] Failed to create kerberos principal..will retry after 5 seconds"
+ sleep 5
+ else
+ echo "[INFO] created kerberos principal ${principal}"
+ break
+ fi
+ done
+
+
+ echo "Creating keytab for principal ${principal} .."
+ for i in {1..5}; do
+ kadmin.local -q "ktadd -k ${keytab} ${principal}"
+
+ if [ $? -ne 0 ]; then
+ echo "[ERROR] Failed to create keytab for principal..will retry after 5 seconds"
+ sleep 5
+ else
+ echo "[INFO] created keytab kerberos principal ${principal} in ${keytab}"
+ ls -lFa ${keytab}
+ break
+ fi
+ done
+
+ chmod 444 ${keytab}
+}
+
+function create_keytabs() {
+ create_principal_and_keytab HTTP ranger
+ create_principal_and_keytab rangeradmin ranger
+ create_principal_and_keytab rangerlookup ranger
+
+ create_principal_and_keytab rangertagsync ranger-tagsync
+
+ create_principal_and_keytab rangerusersync ranger-usersync
+
+ create_principal_and_keytab rangerkms ranger-kms
+
+ create_principal_and_keytab dn ranger-hadoop
+ create_principal_and_keytab hdfs ranger-hadoop
+ create_principal_and_keytab healthcheck ranger-hadoop
+ create_principal_and_keytab HTTP ranger-hadoop
+ create_principal_and_keytab nm ranger-hadoop
+ create_principal_and_keytab nn ranger-hadoop
+ create_principal_and_keytab rm ranger-hadoop
+ create_principal_and_keytab yarn ranger-hadoop
+
+ create_principal_and_keytab hbase ranger-hbase
+
+ create_principal_and_keytab hive ranger-hive
+
+ create_principal_and_keytab kafka ranger-kafka
+
+ create_principal_and_keytab knox ranger-knox
+
+ create_principal_and_keytab HTTP ranger-solr
+}
+
+# ensure directories
+mkdir -p $DB_DIR
+chown -R root.root /etc/krb5kdc || true
+chown -R root.root $DB_DIR || true
+
+if [ ! -f $DB_DIR/principal ]; then
+ echo "=== Creating KDC database for realm $REALM ==="
+ # create DB noninteractive
+ echo "$MASTER_PASSWORD" | kdb5_util create -s -r $REALM -P "$MASTER_PASSWORD"
+ # create admin principal
+ kadmin.local -q "addprinc -pw $ADMIN_PASSWORD $ADMIN_PRINC@${REALM}"
+ # add kadmind keytab
+ kadmin.local -q "ktadd -k /etc/krb5kdc/kadm5.keytab kadmin/admin@$REALM"
+ echo "Database initialized"
+
+ create_keytabs
+else
+ echo "KDC DB already exists; skipping create"
+fi
+
+# Ensure ownership and perms
+chown -R root:root /var/kerberos
+chmod 700 /var/kerberos/krb5kdc
+
+# start krb5kdc in foreground and then kadmind
+echo "Starting krb5kdc..."
+/usr/sbin/krb5kdc -n &
+KDC_PID=$!
+
+echo "Starting kadmind..."
+/usr/sbin/kadmind -nofork
+
+# if kadmind exits, bring down krb5kdc
+kill $KDC_PID || true
+wait $KDC_PID || true
+
diff --git a/dev-support/ranger-docker/scripts/kdc/kadm5.acl b/dev-support/ranger-docker/scripts/kdc/kadm5.acl
new file mode 100644
index 000000000..d24b163f1
--- /dev/null
+++ b/dev-support/ranger-docker/scripts/kdc/kadm5.acl
@@ -0,0 +1 @@
+*/admin@EXAMPLE.COM *
diff --git a/dev-support/ranger-docker/scripts/kdc/kdc.conf b/dev-support/ranger-docker/scripts/kdc/kdc.conf
new file mode 100644
index 000000000..0da32e22a
--- /dev/null
+++ b/dev-support/ranger-docker/scripts/kdc/kdc.conf
@@ -0,0 +1,16 @@
+[kdcdefaults]
+ kdc_ports = 88
+ kdc_tcp_ports = 88
+
+[realms]
+ EXAMPLE.COM = {
+ # where the DB will be stored
+ database_name = /var/kerberos/krb5kdc/principal
+ admin_keytab = /etc/krb5kdc/kadm5.keytab
+ acl_file = /etc/krb5kdc/kadm5.acl
+ dict_file = /usr/share/dict/words
+ key_stash_file = /var/kerberos/krb5kdc/.k5.EXAMPLE.COM
+ max_life = 24h 0m 0s
+ max_renewable_life = 7d 0h 0m 0s
+ }
+
diff --git a/dev-support/ranger-docker/scripts/kdc/krb5.conf b/dev-support/ranger-docker/scripts/kdc/krb5.conf
new file mode 100644
index 000000000..06565831f
--- /dev/null
+++ b/dev-support/ranger-docker/scripts/kdc/krb5.conf
@@ -0,0 +1,16 @@
+[libdefaults]
+ default_realm = EXAMPLE.COM
+ dns_canonicalize_hostname = false
+ dns_lookup_kdc = false
+ dns_lookup_realm = false
+ ticket_lifetime = 24h
+ forwardable = true
+
+[realms]
+ EXAMPLE.COM = {
+ kdc = ranger-kdc.rangernw
+ admin_server = ranger-kdc.rangernw
+ }
+
+[domain_realm]
+ .rangernw = EXAMPLE.COM
diff --git a/dev-support/ranger-docker/scripts/ranger-kms-install-mysql.properties b/dev-support/ranger-docker/scripts/kms/ranger-kms-install-mysql.properties
similarity index 89%
rename from dev-support/ranger-docker/scripts/ranger-kms-install-mysql.properties
rename to dev-support/ranger-docker/scripts/kms/ranger-kms-install-mysql.properties
index ae62c50e2..c2642ea48 100755
--- a/dev-support/ranger-docker/scripts/ranger-kms-install-mysql.properties
+++ b/dev-support/ranger-docker/scripts/kms/ranger-kms-install-mysql.properties
@@ -23,7 +23,7 @@ SQL_CONNECTOR_JAR=/usr/share/java/mysql-connector-java.jar
db_root_user=root
db_root_password=rangerR0cks!
-db_host=ranger-db
+db_host=ranger-db.rangernw
db_name=rangerkms
db_user=rangerkms
@@ -67,8 +67,8 @@ COMPONENT_INSTALL_DIR_NAME=/opt/ranger/kms
KMS_MASTER_KEY_PASSWD=Str0ngPassw0rd
#------------------------- Ranger KMS Kerberos Configuration ---------------------------
-kms_principal=
-kms_keytab=
+kms_principal=rangerkms/ranger-kms.rangernw@EXAMPLE.COM
+kms_keytab=/etc/keytabs/rangerkms.keytab
hadoop_conf=
#------------------------- Ranger KMS HSM CONFIG ------------------------------
@@ -140,7 +140,7 @@ REPOSITORY_NAME=dev_kms
XAAUDIT.SOLR.IS_ENABLED=true
XAAUDIT.SOLR.MAX_QUEUE_SIZE=1
XAAUDIT.SOLR.MAX_FLUSH_INTERVAL_MS=1000
-XAAUDIT.SOLR.SOLR_URL=http://ranger-solr:8983/solr/ranger_audits
+XAAUDIT.SOLR.SOLR_URL=http://ranger-solr.rangernw:8983/solr/ranger_audits
XAAUDIT.SUMMARY.ENABLE=true
# Following properties are needed to get past installation script! Please don't remove
@@ -158,21 +158,21 @@ XAAUDIT.HDFS.LOCAL_BUFFER_ROLLOVER_INTERVAL_SECONDS=600
XAAUDIT.HDFS.LOCAL_ARCHIVE_MAX_FILE_COUNT=10
XAAUDIT.SOLR.ENABLE=true
-XAAUDIT.SOLR.URL=http://ranger-solr:8983/solr/ranger_audits
+XAAUDIT.SOLR.URL=http://ranger-solr.rangernw:8983/solr/ranger_audits
XAAUDIT.SOLR.USER=NONE
XAAUDIT.SOLR.PASSWORD=NONE
XAAUDIT.SOLR.ZOOKEEPER=NONE
XAAUDIT.SOLR.FILE_SPOOL_DIR=/var/log/hive/audit/solr/spool
-XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=false
+XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=true
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=%EMPTY%
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=com.sun.security.auth.module.Krb5LoginModule
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=required
+XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=true
+XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=true
+XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=true
+XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=kms
+XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/etc/keytabs/rangerkms.keytab
+XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=rangerkms/ranger-kms.rangernw@EXAMPLE.COM
XAAUDIT.ELASTICSEARCH.ENABLE=false
XAAUDIT.ELASTICSEARCH.URL=NONE
@@ -183,7 +183,7 @@ XAAUDIT.ELASTICSEARCH.PORT=NONE
XAAUDIT.ELASTICSEARCH.PROTOCOL=NONE
XAAUDIT.HDFS.ENABLE=true
-XAAUDIT.HDFS.HDFS_DIR=hdfs://ranger-hadoop:9000/ranger/audit
+XAAUDIT.HDFS.HDFS_DIR=hdfs://ranger-hadoop.rangernw:9000/ranger/audit
XAAUDIT.HDFS.FILE_SPOOL_DIR=/var/log/hive/audit/hdfs/spool
XAAUDIT.HDFS.AZURE_ACCOUNTNAME=__REPLACE_AZURE_ACCOUNT_NAME
diff --git a/dev-support/ranger-docker/scripts/ranger-kms-install-oracle.properties b/dev-support/ranger-docker/scripts/kms/ranger-kms-install-oracle.properties
similarity index 89%
rename from dev-support/ranger-docker/scripts/ranger-kms-install-oracle.properties
rename to dev-support/ranger-docker/scripts/kms/ranger-kms-install-oracle.properties
index 84286f0f9..7effdde5a 100755
--- a/dev-support/ranger-docker/scripts/ranger-kms-install-oracle.properties
+++ b/dev-support/ranger-docker/scripts/kms/ranger-kms-install-oracle.properties
@@ -23,7 +23,7 @@ SQL_CONNECTOR_JAR=/usr/share/java/oracle.jar
db_root_user=system
db_root_password=rangerR0cks!
-db_host=ranger-db:1521/FREEPDB1
+db_host=ranger-db.rangernw:1521/FREEPDB1
db_name=rangerkms
db_user=rangerkms
@@ -68,8 +68,8 @@ COMPONENT_INSTALL_DIR_NAME=/opt/ranger/kms
KMS_MASTER_KEY_PASSWD=Str0ngPassw0rd
#------------------------- Ranger KMS Kerberos Configuration ---------------------------
-kms_principal=
-kms_keytab=
+kms_principal=rangerkms/ranger-kms.rangernw@EXAMPLE.COM
+kms_keytab=/etc/keytabs/rangerkms.keytab
hadoop_conf=
#------------------------- Ranger KMS HSM CONFIG ------------------------------
@@ -140,7 +140,7 @@ REPOSITORY_NAME=dev_kms
XAAUDIT.SOLR.IS_ENABLED=true
XAAUDIT.SOLR.MAX_QUEUE_SIZE=1
XAAUDIT.SOLR.MAX_FLUSH_INTERVAL_MS=1000
-XAAUDIT.SOLR.SOLR_URL=http://ranger-solr:8983/solr/ranger_audits
+XAAUDIT.SOLR.SOLR_URL=http://ranger-solr.rangernw:8983/solr/ranger_audits
XAAUDIT.SUMMARY.ENABLE=true
# Following properties are needed to get past installation script! Please don't remove
@@ -158,21 +158,21 @@ XAAUDIT.HDFS.LOCAL_BUFFER_ROLLOVER_INTERVAL_SECONDS=600
XAAUDIT.HDFS.LOCAL_ARCHIVE_MAX_FILE_COUNT=10
XAAUDIT.SOLR.ENABLE=true
-XAAUDIT.SOLR.URL=http://ranger-solr:8983/solr/ranger_audits
+XAAUDIT.SOLR.URL=http://ranger-solr.rangernw:8983/solr/ranger_audits
XAAUDIT.SOLR.USER=NONE
XAAUDIT.SOLR.PASSWORD=NONE
XAAUDIT.SOLR.ZOOKEEPER=NONE
XAAUDIT.SOLR.FILE_SPOOL_DIR=/var/log/hive/audit/solr/spool
-XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=false
+XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=true
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=%EMPTY%
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=com.sun.security.auth.module.Krb5LoginModule
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=required
+XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=true
+XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=true
+XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=true
+XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=kms
+XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/etc/keytabs/rangerkms.keytab
+XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=rangerkms/ranger-kms.rangernw@EXAMPLE.COM
XAAUDIT.ELASTICSEARCH.ENABLE=false
XAAUDIT.ELASTICSEARCH.URL=NONE
@@ -183,7 +183,7 @@ XAAUDIT.ELASTICSEARCH.PORT=NONE
XAAUDIT.ELASTICSEARCH.PROTOCOL=NONE
XAAUDIT.HDFS.ENABLE=true
-XAAUDIT.HDFS.HDFS_DIR=hdfs://ranger-hadoop:9000/ranger/audit
+XAAUDIT.HDFS.HDFS_DIR=hdfs://ranger-hadoop.rangernw:9000/ranger/audit
XAAUDIT.HDFS.FILE_SPOOL_DIR=/var/log/hive/audit/hdfs/spool
XAAUDIT.HDFS.AZURE_ACCOUNTNAME=__REPLACE_AZURE_ACCOUNT_NAME
diff --git a/dev-support/ranger-docker/scripts/ranger-kms-install-postgres.properties b/dev-support/ranger-docker/scripts/kms/ranger-kms-install-postgres.properties
similarity index 89%
rename from dev-support/ranger-docker/scripts/ranger-kms-install-postgres.properties
rename to dev-support/ranger-docker/scripts/kms/ranger-kms-install-postgres.properties
index d99f3ec8c..2c7fa0fd9 100755
--- a/dev-support/ranger-docker/scripts/ranger-kms-install-postgres.properties
+++ b/dev-support/ranger-docker/scripts/kms/ranger-kms-install-postgres.properties
@@ -23,7 +23,7 @@ SQL_CONNECTOR_JAR=/usr/share/java/postgresql.jar
db_root_user=postgres
db_root_password=rangerR0cks!
-db_host=ranger-db
+db_host=ranger-db.rangernw
db_name=rangerkms
db_user=rangerkms
@@ -67,8 +67,8 @@ COMPONENT_INSTALL_DIR_NAME=/opt/ranger/kms
KMS_MASTER_KEY_PASSWD=Str0ngPassw0rd
#------------------------- Ranger KMS Kerberos Configuration ---------------------------
-kms_principal=
-kms_keytab=
+kms_principal=rangerkms/ranger-kms.rangernw@EXAMPLE.COM
+kms_keytab=/etc/keytabs/rangerkms.keytab
hadoop_conf=
#------------------------- Ranger KMS HSM CONFIG ------------------------------
@@ -140,7 +140,7 @@ REPOSITORY_NAME=dev_kms
XAAUDIT.SOLR.IS_ENABLED=true
XAAUDIT.SOLR.MAX_QUEUE_SIZE=1
XAAUDIT.SOLR.MAX_FLUSH_INTERVAL_MS=1000
-XAAUDIT.SOLR.SOLR_URL=http://ranger-solr:8983/solr/ranger_audits
+XAAUDIT.SOLR.SOLR_URL=http://ranger-solr.rangernw:8983/solr/ranger_audits
XAAUDIT.SUMMARY.ENABLE=true
# Following properties are needed to get past installation script! Please don't remove
@@ -158,21 +158,21 @@ XAAUDIT.HDFS.LOCAL_BUFFER_ROLLOVER_INTERVAL_SECONDS=600
XAAUDIT.HDFS.LOCAL_ARCHIVE_MAX_FILE_COUNT=10
XAAUDIT.SOLR.ENABLE=true
-XAAUDIT.SOLR.URL=http://ranger-solr:8983/solr/ranger_audits
+XAAUDIT.SOLR.URL=http://ranger-solr.rangernw:8983/solr/ranger_audits
XAAUDIT.SOLR.USER=NONE
XAAUDIT.SOLR.PASSWORD=NONE
XAAUDIT.SOLR.ZOOKEEPER=NONE
XAAUDIT.SOLR.FILE_SPOOL_DIR=/var/log/hive/audit/solr/spool
-XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=false
+XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=true
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=%EMPTY%
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=com.sun.security.auth.module.Krb5LoginModule
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=required
+XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=true
+XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=true
+XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=true
+XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=kms
+XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/etc/keytabs/rangerkms.keytab
+XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=rangerkms/ranger-kms.rangernw@EXAMPLE.COM
XAAUDIT.ELASTICSEARCH.ENABLE=false
XAAUDIT.ELASTICSEARCH.URL=NONE
@@ -183,7 +183,7 @@ XAAUDIT.ELASTICSEARCH.PORT=NONE
XAAUDIT.ELASTICSEARCH.PROTOCOL=NONE
XAAUDIT.HDFS.ENABLE=true
-XAAUDIT.HDFS.HDFS_DIR=hdfs://ranger-hadoop:9000/ranger/audit
+XAAUDIT.HDFS.HDFS_DIR=hdfs://ranger-hadoop.rangernw:9000/ranger/audit
XAAUDIT.HDFS.FILE_SPOOL_DIR=/var/log/hive/audit/hdfs/spool
XAAUDIT.HDFS.AZURE_ACCOUNTNAME=__REPLACE_AZURE_ACCOUNT_NAME
diff --git a/dev-support/ranger-docker/scripts/ranger-kms-install-sqlserver.properties b/dev-support/ranger-docker/scripts/kms/ranger-kms-install-sqlserver.properties
similarity index 88%
rename from dev-support/ranger-docker/scripts/ranger-kms-install-sqlserver.properties
rename to dev-support/ranger-docker/scripts/kms/ranger-kms-install-sqlserver.properties
index 2fb6a8aa5..c6130dc33 100644
--- a/dev-support/ranger-docker/scripts/ranger-kms-install-sqlserver.properties
+++ b/dev-support/ranger-docker/scripts/kms/ranger-kms-install-sqlserver.properties
@@ -24,7 +24,7 @@ CONNECTION_STRING_ADDITIONAL_PARAMS="trustServerCertificate=true;"
db_root_user=sa
db_root_password=rangerR0cks!
-db_host=ranger-db
+db_host=ranger-db.rangernw
db_name=rangerkms
db_user=rangerkms
@@ -39,7 +39,7 @@ sqlanywhere_core_file=
# For over-riding the jdbc url
is_override_db_connection_string=true
-db_override_jdbc_connection_string="jdbc:sqlserver://ranger-db;databaseName=rangerkms;trustServerCertificate=true;"
+db_override_jdbc_connection_string="jdbc:sqlserver://ranger-db.rangernw;databaseName=rangerkms;trustServerCertificate=true;"
#SSL config
@@ -72,8 +72,8 @@ COMPONENT_INSTALL_DIR_NAME=/opt/ranger/kms
KMS_MASTER_KEY_PASSWD=Str0ngPassw0rd
#------------------------- Ranger KMS Kerberos Configuration ---------------------------
-kms_principal=
-kms_keytab=
+kms_principal=rangerkms/ranger-kms.rangernw@EXAMPLE.COM
+kms_keytab=/etc/keytabs/rangerkms.keytab
hadoop_conf=
#------------------------- Ranger KMS HSM CONFIG ------------------------------
@@ -139,7 +139,7 @@ REPOSITORY_NAME=dev_kms
XAAUDIT.SOLR.IS_ENABLED=true
XAAUDIT.SOLR.MAX_QUEUE_SIZE=1
XAAUDIT.SOLR.MAX_FLUSH_INTERVAL_MS=1000
-XAAUDIT.SOLR.SOLR_URL=http://ranger-solr:8983/solr/ranger_audits
+XAAUDIT.SOLR.SOLR_URL=http://ranger-solr.rangernw:8983/solr/ranger_audits
XAAUDIT.SUMMARY.ENABLE=true
# Following properties are needed to get past installation script! Please don't remove
@@ -157,21 +157,21 @@ XAAUDIT.HDFS.LOCAL_BUFFER_ROLLOVER_INTERVAL_SECONDS=600
XAAUDIT.HDFS.LOCAL_ARCHIVE_MAX_FILE_COUNT=10
XAAUDIT.SOLR.ENABLE=true
-XAAUDIT.SOLR.URL=http://ranger-solr:8983/solr/ranger_audits
+XAAUDIT.SOLR.URL=http://ranger-solr.rangernw:8983/solr/ranger_audits
XAAUDIT.SOLR.USER=NONE
XAAUDIT.SOLR.PASSWORD=NONE
XAAUDIT.SOLR.ZOOKEEPER=NONE
XAAUDIT.SOLR.FILE_SPOOL_DIR=/var/log/hive/audit/solr/spool
-XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=false
+XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=true
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=%EMPTY%
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=com.sun.security.auth.module.Krb5LoginModule
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=required
+XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=true
+XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=true
+XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=true
+XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=kms
+XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/etc/keytabs/rangerkms.keytab
+XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=rangerkms/ranger-kms.rangernw@EXAMPLE.COM
XAAUDIT.ELASTICSEARCH.ENABLE=false
XAAUDIT.ELASTICSEARCH.URL=NONE
@@ -182,7 +182,7 @@ XAAUDIT.ELASTICSEARCH.PORT=NONE
XAAUDIT.ELASTICSEARCH.PROTOCOL=NONE
XAAUDIT.HDFS.ENABLE=true
-XAAUDIT.HDFS.HDFS_DIR=hdfs://ranger-hadoop:9000/ranger/audit
+XAAUDIT.HDFS.HDFS_DIR=hdfs://ranger-hadoop.rangernw:9000/ranger/audit
XAAUDIT.HDFS.FILE_SPOOL_DIR=/var/log/hive/audit/hdfs/spool
XAAUDIT.HDFS.AZURE_ACCOUNTNAME=__REPLACE_AZURE_ACCOUNT_NAME
diff --git a/dev-support/ranger-docker/scripts/ranger-kms.sh b/dev-support/ranger-docker/scripts/kms/ranger-kms.sh
similarity index 84%
rename from dev-support/ranger-docker/scripts/ranger-kms.sh
rename to dev-support/ranger-docker/scripts/kms/ranger-kms.sh
index be5519e40..a2768b324 100755
--- a/dev-support/ranger-docker/scripts/ranger-kms.sh
+++ b/dev-support/ranger-docker/scripts/kms/ranger-kms.sh
@@ -16,7 +16,6 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-
if [ ! -e ${RANGER_HOME}/.setupDone ]
then
SETUP_RANGER=true
@@ -26,9 +25,19 @@ fi
if [ "${SETUP_RANGER}" == "true" ]
then
+ if [ "${KERBEROS_ENABLED}" == "true" ]
+ then
+ ${RANGER_SCRIPTS}/wait_for_keytab.sh rangerkms.keytab
+ fi
+
cd "${RANGER_HOME}"/kms || exit
if ./setup.sh;
then
+ if [ "${KERBEROS_ENABLED}" == "true" ]
+ then
+ cp ${RANGER_SCRIPTS}/core-site.xml ${RANGER_HOME}/kms/ews/webapp/WEB-INF/classes/conf/core-site.xml
+ fi
+
touch "${RANGER_HOME}"/.setupDone
else
echo "Ranger KMS Setup Script didn't complete proper execution."
diff --git a/dev-support/ranger-docker/scripts/ranger-knox-expect.py b/dev-support/ranger-docker/scripts/knox/ranger-knox-expect.py
similarity index 100%
rename from dev-support/ranger-docker/scripts/ranger-knox-expect.py
rename to dev-support/ranger-docker/scripts/knox/ranger-knox-expect.py
diff --git a/dev-support/ranger-docker/scripts/ranger-knox-plugin-install.properties b/dev-support/ranger-docker/scripts/knox/ranger-knox-plugin-install.properties
similarity index 87%
rename from dev-support/ranger-docker/scripts/ranger-knox-plugin-install.properties
rename to dev-support/ranger-docker/scripts/knox/ranger-knox-plugin-install.properties
index 7c6531d58..1e4a14948 100644
--- a/dev-support/ranger-docker/scripts/ranger-knox-plugin-install.properties
+++ b/dev-support/ranger-docker/scripts/knox/ranger-knox-plugin-install.properties
@@ -45,16 +45,16 @@ XAAUDIT.SOLR.USER=NONE
XAAUDIT.SOLR.PASSWORD=NONE
XAAUDIT.SOLR.ZOOKEEPER=NONE
XAAUDIT.SOLR.FILE_SPOOL_DIR=/var/log/knox/audit/solr/spool
-XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=false
+XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=true
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=%EMPTY%
-XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=%EMPTY%
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=com.sun.security.auth.module.Krb5LoginModule
+XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=required
+XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=true
+XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=true
+XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=true
+XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=knox
+XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/etc/keytabs/knox.keytab
+XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=knox/ranger-knox.rangernw@EXAMPLE.COM
XAAUDIT.ELASTICSEARCH.ENABLE=false
XAAUDIT.ELASTICSEARCH.URL=NONE
diff --git a/dev-support/ranger-docker/scripts/ranger-knox-sandbox.xml b/dev-support/ranger-docker/scripts/knox/ranger-knox-sandbox.xml
similarity index 91%
rename from dev-support/ranger-docker/scripts/ranger-knox-sandbox.xml
rename to dev-support/ranger-docker/scripts/knox/ranger-knox-sandbox.xml
index c6ae98605..0da825ff4 100644
--- a/dev-support/ranger-docker/scripts/ranger-knox-sandbox.xml
+++ b/dev-support/ranger-docker/scripts/knox/ranger-knox-sandbox.xml
@@ -88,22 +88,22 @@
<service>
<role>NAMENODE</role>
- <url>hdfs://ranger-hadoop.example.com:8020</url>
+ <url>hdfs://ranger-hadoop.rangernw:8020</url>
</service>
<service>
<role>JOBTRACKER</role>
- <url>rpc://ranger-hadoop.example.com:8050</url>
+ <url>rpc://ranger-hadoop.rangernw:8050</url>
</service>
<service>
<role>WEBHDFS</role>
- <url>http://ranger-hadoop.example.com:9870/webhdfs</url>
+ <url>http://ranger-hadoop.rangernw:9870/webhdfs</url>
</service>
<service>
<role>WEBHCAT</role>
- <url>http://ranger-hive.example.com:50111/templeton</url>
+ <url>http://ranger-hive.rangernw:50111/templeton</url>
</service>
<service>
@@ -117,7 +117,7 @@
<service>
<role>WEBHBASE</role>
- <url>http://ranger-hbase.example.com:60080</url>
+ <url>http://ranger-hbase.rangernw:60080</url>
<param>
<name>replayBufferSize</name>
<value>8</value>
@@ -126,7 +126,7 @@
<service>
<role>HIVE</role>
- <url>http://ranger-hive.example.com:10001/cliservice</url>
+ <url>http://ranger-hive.rangernw:10001/cliservice</url>
<param>
<name>replayBufferSize</name>
<value>8</value>
@@ -135,7 +135,7 @@
<service>
<role>RESOURCEMANAGER</role>
- <url>http://ranger-hadoop.example.com:8088/ws</url>
+ <url>http://ranger-hadoop.rangernw:8088/ws</url>
</service>
<service>
diff --git a/dev-support/ranger-docker/scripts/ranger-knox-setup.sh b/dev-support/ranger-docker/scripts/knox/ranger-knox-setup.sh
similarity index 91%
rename from dev-support/ranger-docker/scripts/ranger-knox-setup.sh
rename to dev-support/ranger-docker/scripts/knox/ranger-knox-setup.sh
index c5c9bcac7..290960cfc 100755
--- a/dev-support/ranger-docker/scripts/ranger-knox-setup.sh
+++ b/dev-support/ranger-docker/scripts/knox/ranger-knox-setup.sh
@@ -22,6 +22,11 @@ Host *
UserKnownHostsFile=/dev/null
EOF
+if [ "${KERBEROS_ENABLED}" == "true" ]
+then
+ ${RANGER_SCRIPTS}/wait_for_keytab.sh knox.keytab
+fi
+
chown -R knox:knox /opt/knox/
mkdir -p /opt/knox/logs
diff --git a/dev-support/ranger-docker/scripts/ranger-knox.sh b/dev-support/ranger-docker/scripts/knox/ranger-knox.sh
similarity index 99%
rename from dev-support/ranger-docker/scripts/ranger-knox.sh
rename to dev-support/ranger-docker/scripts/knox/ranger-knox.sh
index ddd04e244..47756a136 100755
--- a/dev-support/ranger-docker/scripts/ranger-knox.sh
+++ b/dev-support/ranger-docker/scripts/knox/ranger-knox.sh
@@ -34,7 +34,6 @@ then
# pdsh is unavailable with microdnf in rhel based image.
echo "ssh" > /etc/pdsh/rcmd_default
-
if "${RANGER_SCRIPTS}"/ranger-knox-setup.sh;
then
touch "${KNOX_HOME}"/.setupDone
diff --git a/dev-support/ranger-docker/config/ozone/docker-config b/dev-support/ranger-docker/scripts/ozone/docker-config
similarity index 100%
rename from dev-support/ranger-docker/config/ozone/docker-config
rename to dev-support/ranger-docker/scripts/ozone/docker-config
diff --git a/dev-support/ranger-docker/config/ozone/enable-ozone-plugin.sh b/dev-support/ranger-docker/scripts/ozone/enable-ozone-plugin.sh
similarity index 100%
rename from dev-support/ranger-docker/config/ozone/enable-ozone-plugin.sh
rename to dev-support/ranger-docker/scripts/ozone/enable-ozone-plugin.sh
diff --git a/dev-support/ranger-docker/scripts/ozone-plugin-docker-setup.sh b/dev-support/ranger-docker/scripts/ozone/ozone-plugin-docker-setup.sh
similarity index 79%
rename from dev-support/ranger-docker/scripts/ozone-plugin-docker-setup.sh
rename to dev-support/ranger-docker/scripts/ozone/ozone-plugin-docker-setup.sh
index 295fb41d7..1605769b4 100755
--- a/dev-support/ranger-docker/scripts/ozone-plugin-docker-setup.sh
+++ b/dev-support/ranger-docker/scripts/ozone/ozone-plugin-docker-setup.sh
@@ -22,7 +22,7 @@ then
tar xvfz dist/ranger-${OZONE_PLUGIN_VERSION}-ozone-plugin.tar.gz --directory=dist/
fi
-cp -f config/ozone/ranger-ozone-plugin-install.properties dist/ranger-${OZONE_PLUGIN_VERSION}-ozone-plugin/install.properties
-cp -f config/ozone/ranger-ozone-setup.sh dist/ranger-${OZONE_PLUGIN_VERSION}-ozone-plugin/
-cp -f config/ozone/enable-ozone-plugin.sh dist/ranger-${OZONE_PLUGIN_VERSION}-ozone-plugin/
+cp -f scripts/ozone/ranger-ozone-plugin-install.properties dist/ranger-${OZONE_PLUGIN_VERSION}-ozone-plugin/install.properties
+cp -f scripts/ozone/ranger-ozone-setup.sh dist/ranger-${OZONE_PLUGIN_VERSION}-ozone-plugin/
+cp -f scripts/ozone/enable-ozone-plugin.sh dist/ranger-${OZONE_PLUGIN_VERSION}-ozone-plugin/
chmod +x dist/ranger-${OZONE_PLUGIN_VERSION}-ozone-plugin/ranger-ozone-setup.sh
diff --git a/dev-support/ranger-docker/config/ozone/ranger-ozone-plugin-install.properties b/dev-support/ranger-docker/scripts/ozone/ranger-ozone-plugin-install.properties
similarity index 100%
rename from dev-support/ranger-docker/config/ozone/ranger-ozone-plugin-install.properties
rename to dev-support/ranger-docker/scripts/ozone/ranger-ozone-plugin-install.properties
diff --git a/dev-support/ranger-docker/config/ozone/ranger-ozone-setup.sh b/dev-support/ranger-docker/scripts/ozone/ranger-ozone-setup.sh
similarity index 100%
rename from dev-support/ranger-docker/config/ozone/ranger-ozone-setup.sh
rename to dev-support/ranger-docker/scripts/ozone/ranger-ozone-setup.sh
diff --git a/dev-support/ranger-docker/scripts/ranger-kafka-setup.sh b/dev-support/ranger-docker/scripts/ranger-kafka-setup.sh
deleted file mode 100755
index 51c91195f..000000000
--- a/dev-support/ranger-docker/scripts/ranger-kafka-setup.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/bin/bash
-
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements. See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership. The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-cat <<EOF > /etc/ssh/ssh_config
-Host *
- StrictHostKeyChecking no
- UserKnownHostsFile=/dev/null
-EOF
-
-chown -R kafka:hadoop /opt/kafka/
-
-cd ${RANGER_HOME}/ranger-kafka-plugin
-./enable-kafka-plugin.sh
-
-sed -i 's/localhost:2181/ranger-zk.example.com:2181/' ${KAFKA_HOME}/config/server.properties
-
-echo >> ${KAFKA_HOME}/config/server.properties
-echo "authorizer.class.name=org.apache.ranger.authorization.kafka.authorizer.RangerKafkaAuthorizer" >> ${KAFKA_HOME}/config/server.properties
diff --git a/dev-support/ranger-docker/config/init_mssql.sh b/dev-support/ranger-docker/scripts/rdbms/init_mssql.sh
similarity index 100%
rename from dev-support/ranger-docker/config/init_mssql.sh
rename to dev-support/ranger-docker/scripts/rdbms/init_mssql.sh
diff --git a/dev-support/ranger-docker/config/init_mysql.sql b/dev-support/ranger-docker/scripts/rdbms/init_mysql.sql
similarity index 100%
rename from dev-support/ranger-docker/config/init_mysql.sql
rename to dev-support/ranger-docker/scripts/rdbms/init_mysql.sql
diff --git a/dev-support/ranger-docker/config/init_oracle.sh b/dev-support/ranger-docker/scripts/rdbms/init_oracle.sh
similarity index 100%
rename from dev-support/ranger-docker/config/init_oracle.sh
rename to dev-support/ranger-docker/scripts/rdbms/init_oracle.sh
diff --git a/dev-support/ranger-docker/config/init_postgres.sh b/dev-support/ranger-docker/scripts/rdbms/init_postgres.sh
similarity index 100%
rename from dev-support/ranger-docker/config/init_postgres.sh
rename to dev-support/ranger-docker/scripts/rdbms/init_postgres.sh
diff --git a/dev-support/ranger-docker/config/my.cnf b/dev-support/ranger-docker/scripts/rdbms/my.cnf
similarity index 100%
rename from dev-support/ranger-docker/config/my.cnf
rename to dev-support/ranger-docker/scripts/rdbms/my.cnf
diff --git a/dev-support/ranger-docker/scripts/solr/ranger-solr.sh b/dev-support/ranger-docker/scripts/solr/ranger-solr.sh
new file mode 100755
index 000000000..62cda1805
--- /dev/null
+++ b/dev-support/ranger-docker/scripts/solr/ranger-solr.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+SOLR_INSTALL_DIR=/opt/solr
+
+if [ ! -e ${SOLR_INSTALL_DIR}/.setupDone ]
+then
+ if [ "${KERBEROS_ENABLED}" == "true" ]
+ then
+ /home/ranger/scripts/wait_for_keytab.sh HTTP.keytab
+ fi
+
+ touch "${SOLR_INSTALL_DIR}"/.setupDone
+fi
+
+if [ "${KERBEROS_ENABLED}" == "true" ]
+then
+ JAAS_CONFIG="-Djava.security.auth.login.config=/opt/solr/server/etc/jaas.conf"
+ JAAS_APPNAME="-Dsolr.kerberos.jaas.appname=Client"
+ KRB5_CONF="-Djava.security.krb5.conf=/etc/krb5.conf"
+ KERBEROS_KEYTAB="-Dsolr.kerberos.keytab=/etc/keytabs/HTTP.keytab"
+ KERBEROS_PRINCIPAL="-Dsolr.kerberos.principal=HTTP/ranger-solr.rangernw@EXAMPLE.COM"
+ COOKIE_DOMAIN="-Dsolr.kerberos.cookie.domain=ranger-solr"
+ KERBEROS_NAME_RULES="-Dsolr.kerberos.name.rules=RULE:[2:\$1/\$2@\$0]([ndj]n/.*@EXAMPLE\.COM)s/.*/hdfs/\
+RULE:[2:\$1/\$2@\$0]([rn]m/.*@EXAMPLE\.COM)s/.*/yarn/\
+RULE:[2:\$1/\$2@\$0](jhs/.*@EXAMPLE\.COM)s/.*/mapred/\
+DEFAULT"
+
+ export SOLR_AUTHENTICATION_OPTS="${JAAS_CONFIG} ${JAAS_APPNAME} ${KRB5_CONF} ${KERBEROS_KEYTAB} ${KERBEROS_PRINCIPAL} ${COOKIE_DOMAIN} ${KERBEROS_NAME_RULES}"
+fi
+
+su -p -c "export PATH=${PATH} && /opt/docker-solr/scripts/docker-entrypoint.sh $*" solr
diff --git a/dev-support/ranger-docker/scripts/solr/solr-jaas.conf b/dev-support/ranger-docker/scripts/solr/solr-jaas.conf
new file mode 100644
index 000000000..63cd0b4bf
--- /dev/null
+++ b/dev-support/ranger-docker/scripts/solr/solr-jaas.conf
@@ -0,0 +1,27 @@
+SolrClient {
+ com.sun.security.auth.module.Krb5LoginModule required
+ useKeyTab=true
+ keyTab="/etc/keytabs/HTTP.keytab"
+ storeKey=true
+ useTicketCache=false
+ principal="HTTP/ranger-solr.rangernw@EXAMPLE.COM";
+};
+
+SolrServer {
+ com.sun.security.auth.module.Krb5LoginModule required
+ useKeyTab=true
+ keyTab="/etc/keytabs/HTTP.keytab"
+ storeKey=true
+ useTicketCache=false
+ principal="HTTP/ranger-solr.rangernw@EXAMPLE.COM";
+};
+
+Client {
+ com.sun.security.auth.module.Krb5LoginModule required
+ useKeyTab=true
+ keyTab="/etc/keytabs/HTTP.keytab"
+ storeKey=true
+ useTicketCache=false
+ principal="HTTP/ranger-solr.rangernw@EXAMPLE.COM";
+};
+
diff --git a/dev-support/ranger-docker/config/solr-ranger_audits/managed-schema b/dev-support/ranger-docker/scripts/solr/solr-ranger_audits/managed-schema
similarity index 100%
rename from dev-support/ranger-docker/config/solr-ranger_audits/managed-schema
rename to dev-support/ranger-docker/scripts/solr/solr-ranger_audits/managed-schema
diff --git a/dev-support/ranger-docker/config/solr-ranger_audits/solrconfig.xml b/dev-support/ranger-docker/scripts/solr/solr-ranger_audits/solrconfig.xml
similarity index 100%
rename from dev-support/ranger-docker/config/solr-ranger_audits/solrconfig.xml
rename to dev-support/ranger-docker/scripts/solr/solr-ranger_audits/solrconfig.xml
diff --git a/dev-support/ranger-docker/scripts/solr/solr-security.json b/dev-support/ranger-docker/scripts/solr/solr-security.json
new file mode 100644
index 000000000..4095809c5
--- /dev/null
+++ b/dev-support/ranger-docker/scripts/solr/solr-security.json
@@ -0,0 +1,11 @@
+{
+ "authentication": {
+ "class": "solr.KerberosPlugin",
+ "kerberos.principal": "HTTP/ranger-solr.rangernw@EXAMPLE.COM",
+ "kerberos.keytab": "/etc/keytabs/HTTP.keytab",
+ "kerberos.name.rules": "RULE:[2:$1@$0](.*@EXAMPLE.COM)s/@.*//\nRULE:[1:$1@$0](.*@EXAMPLE.COM)s/@.*//\nDEFAULT",
+ "kerberos.cookie.domain": "ranger-solr",
+ "cookie.domain": "ranger-solr",
+ "token.valid": 3600
+ }
+}
diff --git a/dev-support/ranger-docker/scripts/ranger-tagsync-install.properties b/dev-support/ranger-docker/scripts/tagsync/ranger-tagsync-install.properties
similarity index 89%
rename from dev-support/ranger-docker/scripts/ranger-tagsync-install.properties
rename to dev-support/ranger-docker/scripts/tagsync/ranger-tagsync-install.properties
index 446780c98..7f0c5ecba 100644
--- a/dev-support/ranger-docker/scripts/ranger-tagsync-install.properties
+++ b/dev-support/ranger-docker/scripts/tagsync/ranger-tagsync-install.properties
@@ -29,15 +29,14 @@ TAG_SOURCE_ATLAS_ENABLED = false
# Endpoint specifications needed by Atlas
TAG_SOURCE_ATLAS_KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR = 1
-TAG_SOURCE_ATLAS_KAFKA_BOOTSTRAP_SERVERS = ranger-kafka.example.com:6667
-TAG_SOURCE_ATLAS_KAFKA_ZOOKEEPER_CONNECT = ranger-zk.example.com:2181
+TAG_SOURCE_ATLAS_KAFKA_BOOTSTRAP_SERVERS = ranger-kafka.rangernw:9092
+TAG_SOURCE_ATLAS_KAFKA_ZOOKEEPER_CONNECT = ranger-zk.rangernw:2181
TAG_SOURCE_ATLAS_KAFKA_ENTITIES_GROUP_ID = ranger_entities_consumer
TAG_SOURCE_ATLAS_KAFKA_SERVICE_NAME = kafka
-TAG_SOURCE_ATLAS_KAFKA_SECURITY_PROTOCOL = PLAINTEXTSASL
-
-TAG_SOURCE_ATLAS_KERBEROS_PRINCIPAL =
-TAG_SOURCE_ATLAS_KERBEROS_KEYTAB =
+TAG_SOURCE_ATLAS_KAFKA_SECURITY_PROTOCOL = SASL_PLAINTEXT
+TAG_SOURCE_ATLAS_KERBEROS_PRINCIPAL = rangertagsync/ranger-tagsync.rangernw@EXAMPLE.COM
+TAG_SOURCE_ATLAS_KERBEROS_KEYTAB = /etc/keytabs/rangertagsync.keytab
TAG_SOURCE_ATLASREST_ENABLED = false
@@ -103,12 +102,9 @@ logdir = /var/log/ranger/tagsync
TAGSYNC_PID_DIR_PATH=/var/run/ranger
#Set to run in kerberos environment
-is_secure = false
-tagsync_principal=
-tagsync_keytab=
-
-
-
+is_secure = true
+tagsync_principal=rangertagsync/ranger-tagsync.rangernw@EXAMPLE.COM
+tagsync_keytab=/etc/keytabs/rangertagsync.keytab
hadoop_conf=/etc/hadoop/conf
# if you want to enable or disable jvm metrics for tagsync process
diff --git a/dev-support/ranger-docker/scripts/ranger-tagsync-tags.json b/dev-support/ranger-docker/scripts/tagsync/ranger-tagsync-tags.json
similarity index 100%
rename from dev-support/ranger-docker/scripts/ranger-tagsync-tags.json
rename to dev-support/ranger-docker/scripts/tagsync/ranger-tagsync-tags.json
diff --git a/dev-support/ranger-docker/scripts/ranger-tagsync.sh b/dev-support/ranger-docker/scripts/tagsync/ranger-tagsync.sh
similarity index 85%
rename from dev-support/ranger-docker/scripts/ranger-tagsync.sh
rename to dev-support/ranger-docker/scripts/tagsync/ranger-tagsync.sh
index c676d3977..43485c9b6 100755
--- a/dev-support/ranger-docker/scripts/ranger-tagsync.sh
+++ b/dev-support/ranger-docker/scripts/tagsync/ranger-tagsync.sh
@@ -16,7 +16,6 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-
if [ ! -e ${RANGER_HOME}/.setupDone ]
then
SETUP_RANGER=true
@@ -26,9 +25,19 @@ fi
if [ "${SETUP_RANGER}" == "true" ]
then
+ if [ "${KERBEROS_ENABLED}" == "true" ]
+ then
+ ${RANGER_SCRIPTS}/wait_for_keytab.sh rangertagsync.keytab
+ fi
+
cd "${RANGER_HOME}"/tagsync || exit
if ./setup.sh;
then
+ if [ "${KERBEROS_ENABLED}" == "true" ]
+ then
+ cp ${RANGER_SCRIPTS}/core-site.xml ${RANGER_HOME}/tagsync/conf/core-site.xml
+ fi
+
touch "${RANGER_HOME}"/.setupDone
else
echo "Ranger TagSync Setup Script didn't complete proper execution."
diff --git a/dev-support/ranger-docker/config/trino/access-control.properties b/dev-support/ranger-docker/scripts/trino/access-control.properties
similarity index 100%
rename from dev-support/ranger-docker/config/trino/access-control.properties
rename to dev-support/ranger-docker/scripts/trino/access-control.properties
diff --git a/dev-support/ranger-docker/config/trino/catalog/hive.properties b/dev-support/ranger-docker/scripts/trino/catalog/hive.properties
similarity index 100%
rename from dev-support/ranger-docker/config/trino/catalog/hive.properties
rename to dev-support/ranger-docker/scripts/trino/catalog/hive.properties
diff --git a/dev-support/ranger-docker/config/trino/ranger-policymgr-ssl.xml b/dev-support/ranger-docker/scripts/trino/ranger-policymgr-ssl.xml
similarity index 100%
rename from dev-support/ranger-docker/config/trino/ranger-policymgr-ssl.xml
rename to dev-support/ranger-docker/scripts/trino/ranger-policymgr-ssl.xml
diff --git a/dev-support/ranger-docker/config/trino/ranger-trino-audit.xml b/dev-support/ranger-docker/scripts/trino/ranger-trino-audit.xml
similarity index 99%
rename from dev-support/ranger-docker/config/trino/ranger-trino-audit.xml
rename to dev-support/ranger-docker/scripts/trino/ranger-trino-audit.xml
index 9a0b234fe..029f707d8 100644
--- a/dev-support/ranger-docker/config/trino/ranger-trino-audit.xml
+++ b/dev-support/ranger-docker/scripts/trino/ranger-trino-audit.xml
@@ -57,7 +57,7 @@
<property>
<name>xasecure.audit.destination.solr.force.use.inmemory.jaas.config</name>
- <value>false</value>
+ <value>true</value>
</property>
<property>
<name>xasecure.audit.jaas.Client.loginModuleName</name>
diff --git a/dev-support/ranger-docker/config/trino/ranger-trino-security.xml b/dev-support/ranger-docker/scripts/trino/ranger-trino-security.xml
similarity index 97%
rename from dev-support/ranger-docker/config/trino/ranger-trino-security.xml
rename to dev-support/ranger-docker/scripts/trino/ranger-trino-security.xml
index ee3a18865..25fb49ba4 100644
--- a/dev-support/ranger-docker/config/trino/ranger-trino-security.xml
+++ b/dev-support/ranger-docker/scripts/trino/ranger-trino-security.xml
@@ -42,7 +42,7 @@
<property>
<name>ranger.plugin.trino.policy.rest.ssl.config.file</name>
- <value>/etc/hadoop/conf/ranger-policymgr-ssl.xml</value>
+ <value>/etc/trino/ranger-policymgr-ssl.xml</value>
<description>
Path to the file containing SSL details to contact Ranger Admin
</description>
diff --git a/dev-support/ranger-docker/scripts/ranger-usersync-install.properties b/dev-support/ranger-docker/scripts/usersync/ranger-usersync-install.properties
similarity index 98%
rename from dev-support/ranger-docker/scripts/ranger-usersync-install.properties
rename to dev-support/ranger-docker/scripts/usersync/ranger-usersync-install.properties
index 9c89fa37d..0ec2eb121 100644
--- a/dev-support/ranger-docker/scripts/ranger-usersync-install.properties
+++ b/dev-support/ranger-docker/scripts/usersync/ranger-usersync-install.properties
@@ -53,8 +53,8 @@ unix_group=ranger
rangerUsersync_password=rangerR0cks!
#Set to run in kerberos environment
-usersync_principal=
-usersync_keytab=
+usersync_principal=rangerusersync/ranger-usersync.rangernw@EXAMPLE.COM
+usersync_keytab=/etc/keytabs/rangerusersync.keytab
hadoop_conf=/etc/hadoop/conf
#
# The file where all credential is kept in cryptic format
diff --git a/dev-support/ranger-docker/scripts/ranger-usersync.sh b/dev-support/ranger-docker/scripts/usersync/ranger-usersync.sh
similarity index 85%
rename from dev-support/ranger-docker/scripts/ranger-usersync.sh
rename to dev-support/ranger-docker/scripts/usersync/ranger-usersync.sh
index 8e56ce5ff..5fdff8930 100755
--- a/dev-support/ranger-docker/scripts/ranger-usersync.sh
+++ b/dev-support/ranger-docker/scripts/usersync/ranger-usersync.sh
@@ -16,7 +16,6 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-
if [ ! -e ${RANGER_HOME}/.setupDone ]
then
SETUP_RANGER=true
@@ -26,9 +25,19 @@ fi
if [ "${SETUP_RANGER}" == "true" ]
then
+ if [ "${KERBEROS_ENABLED}" == "true" ]
+ then
+ ${RANGER_SCRIPTS}/wait_for_keytab.sh rangerusersync.keytab
+ fi
+
cd "${RANGER_HOME}"/usersync || exit
if ./setup.sh;
then
+ if [ "${KERBEROS_ENABLED}" == "true" ]
+ then
+ cp ${RANGER_SCRIPTS}/core-site.xml ${RANGER_HOME}/usersync/conf/core-site.xml
+ fi
+
touch "${RANGER_HOME}"/.setupDone
else
echo "Ranger UserSync Setup Script didn't complete proper execution."
diff --git a/dev-support/ranger-docker/scripts/ugsync-file-source.csv b/dev-support/ranger-docker/scripts/usersync/ugsync-file-source.csv
similarity index 100%
rename from dev-support/ranger-docker/scripts/ugsync-file-source.csv
rename to dev-support/ranger-docker/scripts/usersync/ugsync-file-source.csv
diff --git a/dev-support/ranger-docker/scripts/ranger-hbase-setup.sh b/dev-support/ranger-docker/scripts/wait_for_keytab.sh
similarity index 68%
rename from dev-support/ranger-docker/scripts/ranger-hbase-setup.sh
rename to dev-support/ranger-docker/scripts/wait_for_keytab.sh
index 95a1bdf21..77d0f1783 100755
--- a/dev-support/ranger-docker/scripts/ranger-hbase-setup.sh
+++ b/dev-support/ranger-docker/scripts/wait_for_keytab.sh
@@ -16,16 +16,26 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-echo "export JAVA_HOME=${JAVA_HOME}" >> ${HBASE_HOME}/conf/hbase-env.sh
+RETRY_COUNT="${KEYTAB_RETRY_COUNT:-5}"
+KEYTABS_DIR=/etc/keytabs
-cat <<EOF > /etc/ssh/ssh_config
-Host *
- StrictHostKeyChecking no
- UserKnownHostsFile=/dev/null
-EOF
+KEYTAB=${KEYTABS_DIR}/$1
-cp ${RANGER_SCRIPTS}/hbase-site.xml /opt/hbase/conf/hbase-site.xml
-chown -R hbase:hadoop /opt/hbase/
+for i in {1..RETRY_COUNT}; do
+ if [ -f ${KEYTAB} ]
+ then
+ break
+ else
+ echo [INFO] "Waiting for keytab ${KEYTAB}.."
+ sleep 5
+ fi
+done
-cd ${RANGER_HOME}/ranger-hbase-plugin
-./enable-hbase-plugin.sh
+if [ -f ${KEYTAB} ]
+then
+ echo "[INFO] Found keytab ${KEYTAB}"
+ exit 0
+else
+ echo "[ERROR] Keytab not found: ${KEYTAB}"
+ exit 1
+fi