You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@polaris.apache.org by "ayushtkn (via GitHub)" <gi...@apache.org> on 2026/09/23 05:23:02 UTC
[PR] Fix Ranger resource names for entities under a nested namespace [polaris]
ayushtkn opened a new pull request, #5588:
URL: https://github.com/apache/polaris/pull/5588
The Ranger resource hierarchy has a single namespace level, while a Polaris path carries
one entity per namespace level:
```
root -> catalog -> namespace -> table|policy
```
`RangerUtils.toResourcePath` joined every entity in the resolved path with the resource
separator, so each namespace level became a resource of its own. A table in `ns1.ns2`
produced
```
table:POLARIS/catalog/ns1/ns2/table
```
which reads back as `namespace=ns1`, `table=ns2/table`. The table is evaluated against the
wrong namespace: a policy written for `ns1.ns2` does not match it. Policies under a nested namespace are affected the same way.
Namespace levels now collapse into a single namespace value, and the name is built with
`RangerResourceNameParser.toResourceName` against a template per leaf resource type, so the
separator inside that value is escaped exactly the way Ranger escapes it:
```
table:POLARIS/catalog/ns1\/ns2/table -> namespace=ns1/ns2, table=table
```
## Checklist
- [ ] ๐ก๏ธ Don't disclose security issues! (contact security@apache.org)
- [ ] ๐ Clearly explained why the changes are needed, or linked related issues: Fixes #
- [ ] ๐งช Added/updated tests with good coverage, or manually tested (and explained how)
- [ ] ๐ก Added comments for complex logic
- [ ] ๐งพ Updated `CHANGELOG.md` (if needed)
- [ ] ๐ Updated documentation in `site/content/in-dev/unreleased` (if needed)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix Ranger resource names for entities under a nested namespace [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #5588:
URL: https://github.com/apache/polaris/pull/5588#discussion_r4124004029
##########
CHANGELOG.md:
##########
@@ -145,6 +145,9 @@ request adding CHANGELOG notes for breaking (!) changes and possibly other secti
- A list request whose `pageSize` is not a number now returns `400 Bad Request` naming the
parameter, instead of `404 Not Found`. The status is now the same on every API that accepts
`pageSize`.
+- Ranger authorizer: a table or policy under a nested namespace is no longer mapped to the wrong
+ Ranger resource. Namespace levels now occupy a single namespace resource instead of one each,
+ so a policy written for the nested namespace matches.
Review Comment:
This is a fix to previous incorrect behaviour. Changing it to correct behaviour is not a breaking change... IMHO, existing CHANGELOG notice is sufficient.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix Ranger resource names for entities under a nested namespace [polaris]
Posted by "harryc3139 (via GitHub)" <gi...@apache.org>.
harryc3139 commented on code in PR #5588:
URL: https://github.com/apache/polaris/pull/5588#discussion_r4097136665
##########
CHANGELOG.md:
##########
@@ -145,6 +145,9 @@ request adding CHANGELOG notes for breaking (!) changes and possibly other secti
- A list request whose `pageSize` is not a number now returns `400 Bad Request` naming the
parameter, instead of `404 Not Found`. The status is now the same on every API that accepts
`pageSize`.
+- Ranger authorizer: a table or policy under a nested namespace is no longer mapped to the wrong
+ Ranger resource. Namespace levels now occupy a single namespace resource instead of one each,
+ so a policy written for the nested namespace matches.
Review Comment:
This changes which Ranger policies match tables and policies in nested namespaces. A policy on a parent namespace used to cover everything under it and no longer does. Since the Ranger authorizer shipped in 1.5.0 with the old behaviour, could we also add a note under _Breaking changes_ (like the existing OPA entry), so operators know to update their policies before upgrading?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix Ranger resource names for entities under a nested namespace [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b merged PR #5588:
URL: https://github.com/apache/polaris/pull/5588
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix Ranger resource names for entities under a nested namespace [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #5588:
URL: https://github.com/apache/polaris/pull/5588#discussion_r4124004029
##########
CHANGELOG.md:
##########
@@ -145,6 +145,9 @@ request adding CHANGELOG notes for breaking (!) changes and possibly other secti
- A list request whose `pageSize` is not a number now returns `400 Bad Request` naming the
parameter, instead of `404 Not Found`. The status is now the same on every API that accepts
`pageSize`.
+- Ranger authorizer: a table or policy under a nested namespace is no longer mapped to the wrong
+ Ranger resource. Namespace levels now occupy a single namespace resource instead of one each,
+ so a policy written for the nested namespace matches.
Review Comment:
This is a fix to a previous incorrect behaviour. Changing it to correct behaviour is not a breaking change... IMHO, existing CHANGELOG notice is sufficient.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix Ranger resource names for entities under a nested namespace [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on PR #5588:
URL: https://github.com/apache/polaris/pull/5588#issuecomment-5841387223
FYI: @sneethiraj @mneethiraj
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix Ranger resource names for entities under a nested namespace [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on PR #5588:
URL: https://github.com/apache/polaris/pull/5588#issuecomment-5873419065
Merging. If there are any remaining concerns, let's address them in follow-up PRs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org