You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "kumaab (via GitHub)" <gi...@apache.org> on 2025/03/10 03:58:09 UTC
[PR] HDDS-11454: Ozone Ranger Integration in docker [ozone]
kumaab opened a new pull request, #8037:
URL: https://github.com/apache/ozone/pull/8037
## What changes were proposed in this pull request?
- Adds support for ozone integration with ranger in the `compose/ozone` subpath. (Support in `compose/ozonesecure` to follow soon)
- Enables OM container to come up with ranger plugin enabled and authorizer class set to: `org.apache.ranger.authorization.ozone.authorizer.RangerOzoneAuthorizer`
- Adds support for ranger containers to come up along with ozone containers sharing a common network.
## What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-11454
## How was this patch tested?
In docker containers on local machine with published binaries for ozone using version 1.4.1 and ranger version 2.6.0
The changes in the PR were copied over to `ozone-1.4.1/compose/ozone` and the following commands were run:
```
chmod +x ranger-ozone-plugin-setup.sh
./ranger-ozone-plugin-setup.sh
docker compose -f docker-compose.yaml -f docker-compose.ranger.yaml up -d
```
The following were verified:
- Verified all ranger and ozone containers come up with docker compose.
- Ranger plugin for Ozone is enabled once OM container starts. (attached logs to jira)
- Verified restart of `ozone-om-1` container, plugin installation is skipped!
- Policies are synced to the plugin.<img width="2461" alt="policies_synced_to_plugin" src="https://github.com/user-attachments/assets/de93392d-2628-4548-a8f3-823af253ba52" />
- The plugin is able to download policies, tags and roles to `etc/ranger/dev_ozone/policycache` 
- Verified authorization for `hadoop` and `om` user, attaching audits seen in Ranger UI: <img width="2025" alt="audits" src="https://github.com/user-attachments/assets/dfa0a837-c593-4521-bb6d-9abdf7abc2b3" />
- No relevant errors are seen in `ozone-om-1` container.
- Running `chmod +x test-ranger.sh && ./test-ranger.sh` also brings up all the required containers.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-11454. Ozone Ranger Integration in docker [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on code in PR #8037:
URL: https://github.com/apache/ozone/pull/8037#discussion_r1988426189
##########
hadoop-ozone/dist/src/main/compose/ozone/.env:
##########
@@ -19,3 +19,4 @@ HADOOP_IMAGE=apache/hadoop
OZONE_RUNNER_VERSION=${docker.ozone-runner.version}
OZONE_RUNNER_IMAGE=apache/ozone-runner
OZONE_OPTS=
+RANGER_VERSION=2.6.0
Review Comment:
I'll change this to use the property `ranger.version` in HDDS-12461.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-11454. Ozone Ranger Integration in docker [ozone]
Posted by "kumaab (via GitHub)" <gi...@apache.org>.
kumaab commented on code in PR #8037:
URL: https://github.com/apache/ozone/pull/8037#discussion_r1988082098
##########
hadoop-ozone/dist/src/main/compose/ozone/docker-compose.ranger.yaml:
##########
@@ -0,0 +1,92 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+services:
+ om:
+ volumes:
+ - ../..:/opt/hadoop
+ - ./../../share/ranger-${RANGER_VERSION}-ozone-plugin:/opt/hadoop/ranger-ozone-plugin
+ env_file:
+ - docker-config
+ - ranger-plugin/ranger-config
+ environment:
+ - ENSURE_OM_INITIALIZED=/data/metadata/om/current/VERSION
+ - OZONE-SITE.XML_ozone.server.default.replication=${OZONE_REPLICATION_FACTOR:-1}
+ - OZONE_MANAGER_CLASSPATH=/opt/hadoop/ranger-ozone-plugin/lib/libext/*:/opt/hadoop/ranger-ozone-plugin/conf
+ networks:
+ - ozone
+ command: bash -c "/opt/hadoop/ranger-ozone-plugin/ranger-plugin-install.sh && /opt/hadoop/bin/ozone om"
+ ranger:
+ image: apache/ranger:${RANGER_VERSION}
+ container_name: ranger
+ hostname: ranger.example.com
+ stdin_open: true
+ tty: true
+ networks:
+ - ozone
+ ports:
+ - "6080:6080"
+ depends_on:
+ ranger-zk:
+ condition: service_started
+ ranger-db:
+ condition: service_healthy
+ ranger-solr:
+ condition: service_started
+ environment:
+ - RANGER_VERSION=${RANGER_VERSION}
+ - RANGER_DB_TYPE=postgres
+ - DEBUG_ADMIN=${DEBUG_ADMIN:-false}
+ command:
+ - /home/ranger/scripts/ranger.sh
+
+ ranger-zk:
+ image: apache/ranger-zk:${RANGER_VERSION}
+ container_name: ranger-zk
+ hostname: ranger-zk.example.com
+ networks:
+ - ozone
+ ports:
+ - "2181:2181"
+
+ ranger-solr:
+ image: apache/ranger-solr:${RANGER_VERSION}
+ container_name: ranger-solr
+ hostname: ranger-solr.example.com
+ networks:
+ - ozone
+ ports:
+ - "8983:8983"
+ command:
+ - solr-precreate
+ - ranger_audits
+ - /opt/solr/server/solr/configsets/ranger_audits/
+
+ ranger-db:
+ image: apache/ranger-db:${RANGER_VERSION}
+ container_name: ranger-postgres
+ hostname: ranger-db.example.com
+ networks:
+ - ozone
+ healthcheck:
+ test: 'su -c "pg_isready -q" postgres'
+ interval: 10s
+ timeout: 2s
+ retries: 30
+
+networks:
+ ozone:
+ name: ozone_nw
Review Comment:
Sure, a follow-up task sounds good, created a jira here: [HDDS-12540](https://issues.apache.org/jira/browse/HDDS-12540) to address this. I've updated the PR to exclude such changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-11454. Ozone Ranger Integration in docker [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on code in PR #8037:
URL: https://github.com/apache/ozone/pull/8037#discussion_r1987915474
##########
hadoop-ozone/dist/src/main/compose/ozone/docker-compose.ranger.yaml:
##########
@@ -0,0 +1,92 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+services:
+ om:
+ volumes:
+ - ../..:/opt/hadoop
+ - ./../../share/ranger-${RANGER_VERSION}-ozone-plugin:/opt/hadoop/ranger-ozone-plugin
+ env_file:
+ - docker-config
+ - ranger-plugin/ranger-config
+ environment:
+ - ENSURE_OM_INITIALIZED=/data/metadata/om/current/VERSION
+ - OZONE-SITE.XML_ozone.server.default.replication=${OZONE_REPLICATION_FACTOR:-1}
+ - OZONE_MANAGER_CLASSPATH=/opt/hadoop/ranger-ozone-plugin/lib/libext/*:/opt/hadoop/ranger-ozone-plugin/conf
+ networks:
+ - ozone
+ command: bash -c "/opt/hadoop/ranger-ozone-plugin/ranger-plugin-install.sh && /opt/hadoop/bin/ozone om"
+ ranger:
+ image: apache/ranger:${RANGER_VERSION}
+ container_name: ranger
+ hostname: ranger.example.com
+ stdin_open: true
+ tty: true
+ networks:
+ - ozone
+ ports:
+ - "6080:6080"
+ depends_on:
+ ranger-zk:
+ condition: service_started
+ ranger-db:
+ condition: service_healthy
+ ranger-solr:
+ condition: service_started
+ environment:
+ - RANGER_VERSION=${RANGER_VERSION}
+ - RANGER_DB_TYPE=postgres
+ - DEBUG_ADMIN=${DEBUG_ADMIN:-false}
+ command:
+ - /home/ranger/scripts/ranger.sh
+
+ ranger-zk:
+ image: apache/ranger-zk:${RANGER_VERSION}
+ container_name: ranger-zk
+ hostname: ranger-zk.example.com
+ networks:
+ - ozone
+ ports:
+ - "2181:2181"
+
+ ranger-solr:
+ image: apache/ranger-solr:${RANGER_VERSION}
+ container_name: ranger-solr
+ hostname: ranger-solr.example.com
+ networks:
+ - ozone
+ ports:
+ - "8983:8983"
+ command:
+ - solr-precreate
+ - ranger_audits
+ - /opt/solr/server/solr/configsets/ranger_audits/
+
+ ranger-db:
+ image: apache/ranger-db:${RANGER_VERSION}
+ container_name: ranger-postgres
+ hostname: ranger-db.example.com
+ networks:
+ - ozone
+ healthcheck:
+ test: 'su -c "pg_isready -q" postgres'
+ interval: 10s
+ timeout: 2s
+ retries: 30
+
+networks:
+ ozone:
+ name: ozone_nw
Review Comment:
Ozone has several other add-on compose files, similar to how `docker-compose.ranger.yaml` is added. Some of them are used only in `ozone/`, some are in `common/` and used with multiple environments. We would need to add the network in all of those. I think this kind of improvement is unrelated to the integration with Ranger.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-11454. Ozone Ranger Integration in docker [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on PR #8037:
URL: https://github.com/apache/ozone/pull/8037#issuecomment-3065540621
Thanks again @kumaab for the patch. I suggest closing this, and filing follow-up if you have any improvement ideas over the existing implementation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-11454. Ozone Ranger Integration in docker [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on PR #8037:
URL: https://github.com/apache/ozone/pull/8037#issuecomment-2742481381
> It looks to me `ozone-dist` is misbehaving during `mvn clean install -Pdist -DskipTests -e -Dmaven.javadoc.skip=true`.
>
> It looks to be interpreting some variables in `enable-ozone-plugin.sh` to an unwanted hard-coded path. The following is found in the script under `target/`
Nice catch @smengcl.
This is intentional (`filtering=true`), but sometimes surprising. We use `maven-resources-plugin` to replace properties while copying these files. Unfortunately `file` is also a built-in property, so `${file}` needs to be used as `$file`, or renamed to something else, like `${f}` or `${arg}`.
https://github.com/apache/ozone/blob/e805c15c744471506a21656792b43c3bf70369ce/hadoop-ozone/dist/pom.xml#L154-L172
BTW, some of these files look like are copied from Ranger as is. In the long run we should get them from Ranger, instead of duplicating them in Ozone. That would also avoid this problem.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-11454. Ozone Ranger Integration in docker [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on code in PR #8037:
URL: https://github.com/apache/ozone/pull/8037#discussion_r1986706627
##########
hadoop-ozone/dist/src/main/compose/ozone/ranger-plugin-setup.sh:
##########
@@ -0,0 +1,51 @@
+#!/bin/bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+source .env
+
+downloadIfNotPresent() {
+ local fileName=$1
+ local urlBase=$2
+
+ if [ ! -f "./../../share/${fileName}" ]
+ then
+ echo "downloading ${urlBase}/${fileName}.."
+
+ curl -L ${urlBase}/${fileName} --output ./../../share/${fileName}
Review Comment:
To handle URL with `?`:
```suggestion
curl -L "${urlBase}/${fileName}" --output ./../../share/${fileName}
```
##########
hadoop-ozone/dist/src/main/compose/ozone/docker-compose.ranger.yaml:
##########
@@ -0,0 +1,92 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+services:
+ om:
+ volumes:
+ - ../..:/opt/hadoop
+ - ./../../share/ranger-${RANGER_VERSION}-ozone-plugin:/opt/hadoop/ranger-ozone-plugin
+ env_file:
+ - docker-config
+ - ranger-plugin/ranger-config
+ environment:
+ - ENSURE_OM_INITIALIZED=/data/metadata/om/current/VERSION
+ - OZONE-SITE.XML_ozone.server.default.replication=${OZONE_REPLICATION_FACTOR:-1}
+ - OZONE_MANAGER_CLASSPATH=/opt/hadoop/ranger-ozone-plugin/lib/libext/*:/opt/hadoop/ranger-ozone-plugin/conf
+ networks:
+ - ozone
+ command: bash -c "/opt/hadoop/ranger-ozone-plugin/ranger-plugin-install.sh && /opt/hadoop/bin/ozone om"
+ ranger:
+ image: apache/ranger:${RANGER_VERSION}
+ container_name: ranger
+ hostname: ranger.example.com
+ stdin_open: true
+ tty: true
+ networks:
+ - ozone
+ ports:
+ - "6080:6080"
+ depends_on:
+ ranger-zk:
+ condition: service_started
+ ranger-db:
+ condition: service_healthy
+ ranger-solr:
+ condition: service_started
+ environment:
+ - RANGER_VERSION=${RANGER_VERSION}
+ - RANGER_DB_TYPE=postgres
+ - DEBUG_ADMIN=${DEBUG_ADMIN:-false}
+ command:
+ - /home/ranger/scripts/ranger.sh
+
+ ranger-zk:
+ image: apache/ranger-zk:${RANGER_VERSION}
+ container_name: ranger-zk
+ hostname: ranger-zk.example.com
+ networks:
+ - ozone
+ ports:
+ - "2181:2181"
+
+ ranger-solr:
+ image: apache/ranger-solr:${RANGER_VERSION}
+ container_name: ranger-solr
+ hostname: ranger-solr.example.com
+ networks:
+ - ozone
+ ports:
+ - "8983:8983"
+ command:
+ - solr-precreate
+ - ranger_audits
+ - /opt/solr/server/solr/configsets/ranger_audits/
+
+ ranger-db:
+ image: apache/ranger-db:${RANGER_VERSION}
+ container_name: ranger-postgres
+ hostname: ranger-db.example.com
+ networks:
+ - ozone
+ healthcheck:
+ test: 'su -c "pg_isready -q" postgres'
+ interval: 10s
+ timeout: 2s
+ retries: 30
+
+networks:
+ ozone:
+ name: ozone_nw
Review Comment:
Referencing this network in `docker-compose.yaml` when not running with `docker-compose.ranger.yaml` causes the following error:
```
service "om" refers to undefined network ozone: invalid compose project
```
https://github.com/apache/ozone/actions/runs/13756531509/job/38465186827?pr=8037#step:7:23
Most existing compose files rely on the default network, so I think this should be removed.
##########
hadoop-ozone/dist/src/main/compose/ozone/ranger-plugin-setup.sh:
##########
@@ -0,0 +1,51 @@
+#!/bin/bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+source .env
+
+downloadIfNotPresent() {
+ local fileName=$1
+ local urlBase=$2
+
+ if [ ! -f "./../../share/${fileName}" ]
+ then
+ echo "downloading ${urlBase}/${fileName}.."
+
+ curl -L ${urlBase}/${fileName} --output ./../../share/${fileName}
+ else
+ echo "file already in cache: ${fileName}"
+ fi
+}
+
+downloadIfNotPresent ranger-${RANGER_VERSION}-ozone-plugin.tar.gz https://dist.apache.org/repos/dist/release/ranger/${RANGER_VERSION}/plugins/ozone
Review Comment:
We should use mirrors where possible:
```suggestion
downloadIfNotPresent ranger-${RANGER_VERSION}-ozone-plugin.tar.gz "https://www.apache.org/dyn/closer.lua?action=download&filename=ranger/${RANGER_VERSION}/plugins/ozone"
```
##########
hadoop-ozone/dist/src/main/compose/ozone/test-ranger.sh:
##########
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#suite:misc
Review Comment:
Adding the script to the `failing` suite makes CI skip it. This way we can commit the patch before amd64 images are available, and let developers using Mac try it locally.
```suggestion
#suite:failing
```
Alternatively we can rename the script to `disabled-test-ranger.sh`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-11454. Ozone Ranger Integration in docker [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on code in PR #8037:
URL: https://github.com/apache/ozone/pull/8037#discussion_r1987915474
##########
hadoop-ozone/dist/src/main/compose/ozone/docker-compose.ranger.yaml:
##########
@@ -0,0 +1,92 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+services:
+ om:
+ volumes:
+ - ../..:/opt/hadoop
+ - ./../../share/ranger-${RANGER_VERSION}-ozone-plugin:/opt/hadoop/ranger-ozone-plugin
+ env_file:
+ - docker-config
+ - ranger-plugin/ranger-config
+ environment:
+ - ENSURE_OM_INITIALIZED=/data/metadata/om/current/VERSION
+ - OZONE-SITE.XML_ozone.server.default.replication=${OZONE_REPLICATION_FACTOR:-1}
+ - OZONE_MANAGER_CLASSPATH=/opt/hadoop/ranger-ozone-plugin/lib/libext/*:/opt/hadoop/ranger-ozone-plugin/conf
+ networks:
+ - ozone
+ command: bash -c "/opt/hadoop/ranger-ozone-plugin/ranger-plugin-install.sh && /opt/hadoop/bin/ozone om"
+ ranger:
+ image: apache/ranger:${RANGER_VERSION}
+ container_name: ranger
+ hostname: ranger.example.com
+ stdin_open: true
+ tty: true
+ networks:
+ - ozone
+ ports:
+ - "6080:6080"
+ depends_on:
+ ranger-zk:
+ condition: service_started
+ ranger-db:
+ condition: service_healthy
+ ranger-solr:
+ condition: service_started
+ environment:
+ - RANGER_VERSION=${RANGER_VERSION}
+ - RANGER_DB_TYPE=postgres
+ - DEBUG_ADMIN=${DEBUG_ADMIN:-false}
+ command:
+ - /home/ranger/scripts/ranger.sh
+
+ ranger-zk:
+ image: apache/ranger-zk:${RANGER_VERSION}
+ container_name: ranger-zk
+ hostname: ranger-zk.example.com
+ networks:
+ - ozone
+ ports:
+ - "2181:2181"
+
+ ranger-solr:
+ image: apache/ranger-solr:${RANGER_VERSION}
+ container_name: ranger-solr
+ hostname: ranger-solr.example.com
+ networks:
+ - ozone
+ ports:
+ - "8983:8983"
+ command:
+ - solr-precreate
+ - ranger_audits
+ - /opt/solr/server/solr/configsets/ranger_audits/
+
+ ranger-db:
+ image: apache/ranger-db:${RANGER_VERSION}
+ container_name: ranger-postgres
+ hostname: ranger-db.example.com
+ networks:
+ - ozone
+ healthcheck:
+ test: 'su -c "pg_isready -q" postgres'
+ interval: 10s
+ timeout: 2s
+ retries: 30
+
+networks:
+ ozone:
+ name: ozone_nw
Review Comment:
Ozone has several other add-on compose files, similar to how `docker-compose.ranger.yaml` is added. Some of them are used only in `ozone/`, some are in `common/` and used with multiple environments. We would need to add the network in all of those. I think this kind of improvement is unrelated to the integration with Ranger. We can do it in either follow-up or pre-task.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-11454. Ozone Ranger Integration in docker [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on PR #8037:
URL: https://github.com/apache/ozone/pull/8037#issuecomment-2741882511
It looks to me `ozone-dist` is misbehaving during `mvn clean install -Pdist -DskipTests -e -Dmaven.javadoc.skip=true`.
It looks to be interpreting some variables in `enable-ozone-plugin.sh` to an unwanted hard-coded path:
```bash
$ rg "/Users/smeng/repo/ozone-pr/hadoop-ozone/dist"
compose/ozone/ranger-plugin/enable-ozone-plugin.sh
24: if [ -f "/Users/smeng/repo/ozone-pr/hadoop-ozone/dist/pom.xml" ]
26: propertyValue=`grep "^${propertyName}[ \t]*=" /Users/smeng/repo/ozone-pr/hadoop-ozone/dist/pom.xml | awk -F= '{ sub("^[ \t]*", "", $2); sub("[ \t]*$", "", $2); print $2 }'`
64:if [ "/Users/smeng/repo/ozone-pr/hadoop-ozone/dist" = "." ]
67:elif [ "/Users/smeng/repo/ozone-pr/hadoop-ozone/dist" = ".." ]
113:PROJ_INSTALL_DIR=`(cd /Users/smeng/repo/ozone-pr/hadoop-ozone/dist ; pwd)`
```
Take line 24 for example, in the source code it should be:
```bash
if [ -f "${file}" ]
```
My question: Why would this bash script file even be changed during `dist` copy? Is there some maven plugin accidentally changing this? Do you happen to have any clue @adoroszlai ?
---
My steps for verification:
1. Switch to PR branch, launch maven build
2. Switch to `compose/ozone/`, install plugin and start Docker compose cluster
```bash
./ranger-plugin-setup.sh
docker compose -f docker-compose.yaml -f docker-compose.ranger.yaml up -d
```
3. Log in to Ranger Web UI with credentials: `admin`/`rangerR0cks!`
4. Attempt to use CLI:
```
ozone fs -ls ofs://om/
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-11454. Ozone Ranger Integration in docker [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on PR #8037:
URL: https://github.com/apache/ozone/pull/8037#issuecomment-2745190256
Good point @smengcl, probably better to add exclusion for all files coming from Ranger. This will make it easier to update them later e.g. from Ranger 2.7 or 3.0. (Until we use it from Ranger directly.)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-11454. Ozone Ranger Integration in docker [ozone]
Posted by "kumaab (via GitHub)" <gi...@apache.org>.
kumaab closed pull request #8037: HDDS-11454. Ozone Ranger Integration in docker
URL: https://github.com/apache/ozone/pull/8037
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-11454. Ozone Ranger Integration in docker [ozone]
Posted by "kumaab (via GitHub)" <gi...@apache.org>.
kumaab commented on PR #8037:
URL: https://github.com/apache/ozone/pull/8037#issuecomment-2744452763
Thanks @smengcl and @adoroszlai for the above analysis.
I introduced `enable-ozone-plugin.sh` to override the `enable-ozone-plugin.sh` that comes pre-packaged with the plugin, as the former is simpler and a relatively minified version compared to the latter for unsecure docker dev. I'll try to see if I can use the original and not do an override to help with this issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-11454. Ozone Ranger Integration in docker [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on PR #8037:
URL: https://github.com/apache/ozone/pull/8037#issuecomment-2744723182
> Nice catch @smengcl.
>
> This is intentional, but sometimes surprising. We use `maven-resources-plugin` to replace properties (`filtering=true`) while copying these files. Unfortunately `file` is also a built-in property, so `${file}` needs to be used as `$file`, or renamed to something else, like `${f}` or `${arg}`.
>
> https://github.com/apache/ozone/blob/e805c15c744471506a21656792b43c3bf70369ce/hadoop-ozone/dist/pom.xml#L154-L172
>
> BTW, some of these files look like are copied from Ranger as is. In the long run we should get them from Ranger, instead of duplicating them in Ozone. That would also avoid this problem.
Thanks @adoroszlai for confirming my suspicion. `${file}` and `${basedir}` fell into the built-in properties that are unintentionally replaced.
ref: https://maven.apache.org/plugins/maven-resources-plugin/examples/filter.html
Another possible workaround would be to specifically exclude this file from `filtering`, like this (diff attached below):
```diff
diff --git i/hadoop-ozone/dist/pom.xml w/hadoop-ozone/dist/pom.xml
index d02d5f8d48..0b37794d18 100644
--- i/hadoop-ozone/dist/pom.xml
+++ w/hadoop-ozone/dist/pom.xml
@@ -165,8 +165,15 @@
<resources>
<resource>
<directory>src/main/compose</directory>
+ <excludes>
+ <exclude>src/main/compose/ozone/ranger-plugin/enable-ozone-plugin.sh</exclude>
+ </excludes>
<filtering>true</filtering>
</resource>
+ <resource>
+ <directory>src/main/compose/ozone/ranger-plugin/enable-ozone-plugin.sh</directory>
+ <filtering>false</filtering>
+ </resource>
</resources>
</configuration>
</execution>
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-11454. Ozone Ranger Integration in docker [ozone]
Posted by "kumaab (via GitHub)" <gi...@apache.org>.
kumaab commented on code in PR #8037:
URL: https://github.com/apache/ozone/pull/8037#discussion_r1987898174
##########
hadoop-ozone/dist/src/main/compose/ozone/docker-compose.ranger.yaml:
##########
@@ -0,0 +1,92 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+services:
+ om:
+ volumes:
+ - ../..:/opt/hadoop
+ - ./../../share/ranger-${RANGER_VERSION}-ozone-plugin:/opt/hadoop/ranger-ozone-plugin
+ env_file:
+ - docker-config
+ - ranger-plugin/ranger-config
+ environment:
+ - ENSURE_OM_INITIALIZED=/data/metadata/om/current/VERSION
+ - OZONE-SITE.XML_ozone.server.default.replication=${OZONE_REPLICATION_FACTOR:-1}
+ - OZONE_MANAGER_CLASSPATH=/opt/hadoop/ranger-ozone-plugin/lib/libext/*:/opt/hadoop/ranger-ozone-plugin/conf
+ networks:
+ - ozone
+ command: bash -c "/opt/hadoop/ranger-ozone-plugin/ranger-plugin-install.sh && /opt/hadoop/bin/ozone om"
+ ranger:
+ image: apache/ranger:${RANGER_VERSION}
+ container_name: ranger
+ hostname: ranger.example.com
+ stdin_open: true
+ tty: true
+ networks:
+ - ozone
+ ports:
+ - "6080:6080"
+ depends_on:
+ ranger-zk:
+ condition: service_started
+ ranger-db:
+ condition: service_healthy
+ ranger-solr:
+ condition: service_started
+ environment:
+ - RANGER_VERSION=${RANGER_VERSION}
+ - RANGER_DB_TYPE=postgres
+ - DEBUG_ADMIN=${DEBUG_ADMIN:-false}
+ command:
+ - /home/ranger/scripts/ranger.sh
+
+ ranger-zk:
+ image: apache/ranger-zk:${RANGER_VERSION}
+ container_name: ranger-zk
+ hostname: ranger-zk.example.com
+ networks:
+ - ozone
+ ports:
+ - "2181:2181"
+
+ ranger-solr:
+ image: apache/ranger-solr:${RANGER_VERSION}
+ container_name: ranger-solr
+ hostname: ranger-solr.example.com
+ networks:
+ - ozone
+ ports:
+ - "8983:8983"
+ command:
+ - solr-precreate
+ - ranger_audits
+ - /opt/solr/server/solr/configsets/ranger_audits/
+
+ ranger-db:
+ image: apache/ranger-db:${RANGER_VERSION}
+ container_name: ranger-postgres
+ hostname: ranger-db.example.com
+ networks:
+ - ozone
+ healthcheck:
+ test: 'su -c "pg_isready -q" postgres'
+ interval: 10s
+ timeout: 2s
+ retries: 30
+
+networks:
+ ozone:
+ name: ozone_nw
Review Comment:
I've updated both these files, this should not happen now. Using default network might be troublesome in certain scenarios, for ex: [RANGER-3607](https://issues.apache.org/jira/browse/RANGER-3607), please let me know if this is okay.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-11454. Ozone Ranger Integration in docker [ozone]
Posted by "kumaab (via GitHub)" <gi...@apache.org>.
kumaab commented on code in PR #8037:
URL: https://github.com/apache/ozone/pull/8037#discussion_r1987887155
##########
hadoop-ozone/dist/src/main/compose/ozone/test-ranger.sh:
##########
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#suite:misc
Review Comment:
Sure, makes sense.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-11454. Ozone Ranger Integration in docker [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on PR #8037:
URL: https://github.com/apache/ozone/pull/8037#issuecomment-2712692693
Thanks @kumaab for updating the patch.
@smengcl can you please review and test this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org