You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by me...@apache.org on 2021/07/30 10:30:35 UTC
[ranger] branch master updated (b2406be -> 16c5145)
This is an automated email from the ASF dual-hosted git repository.
mehul pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git.
from b2406be RANGER-3349 : Handling multiple grant role command for same user
new 203cd27 RANGER-3308: Create python script to test stability of policy CRUD
new 16c5145 RANGER-3347: Add default policy for hbase user in hdfs services
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
distro/src/main/assembly/admin-web.xml | 7 +
.../ranger/services/hdfs/RangerServiceHdfs.java | 116 +++++++---
.../stability-tests/ranger-policy/app.conf | 10 +-
.../stability-tests/ranger-policy/start.sh | 98 +++++++++
.../ranger-policy/test-hdfs-policy.py | 245 +++++++++++++++++++++
5 files changed, 438 insertions(+), 38 deletions(-)
copy embeddedwebserver/scripts/stop-ranger-admin.sh => security-admin/src/test/resources/stability-tests/ranger-policy/app.conf (57%)
mode change 100755 => 100644
create mode 100755 security-admin/src/test/resources/stability-tests/ranger-policy/start.sh
create mode 100755 security-admin/src/test/resources/stability-tests/ranger-policy/test-hdfs-policy.py
[ranger] 01/02: RANGER-3308: Create python script to test stability
of policy CRUD
Posted by me...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
mehul pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
commit 203cd27e7d3fef310011b075b94f59b62cda366a
Author: Kishor Gollapalliwar <ki...@gmail.com>
AuthorDate: Mon Jul 26 19:24:03 2021 +0530
RANGER-3308: Create python script to test stability of policy CRUD
Signed-off-by: Mehul Parikh <me...@apache.org>
---
distro/src/main/assembly/admin-web.xml | 7 +
.../stability-tests/ranger-policy/app.conf | 23 ++
.../stability-tests/ranger-policy/start.sh | 98 +++++++++
.../ranger-policy/test-hdfs-policy.py | 245 +++++++++++++++++++++
4 files changed, 373 insertions(+)
diff --git a/distro/src/main/assembly/admin-web.xml b/distro/src/main/assembly/admin-web.xml
index 1df668f..3fc054d 100644
--- a/distro/src/main/assembly/admin-web.xml
+++ b/distro/src/main/assembly/admin-web.xml
@@ -603,5 +603,12 @@
<fileMode>0755</fileMode>
<directoryMode>0755</directoryMode>
</fileSet>
+
+ <fileSet>
+ <outputDirectory>stability-tests</outputDirectory>
+ <directory>${project.parent.basedir}/security-admin/src/test/resources/stability-tests</directory>
+ <fileMode>0755</fileMode>
+ <directoryMode>0755</directoryMode>
+ </fileSet>
</fileSets>
</assembly>
diff --git a/security-admin/src/test/resources/stability-tests/ranger-policy/app.conf b/security-admin/src/test/resources/stability-tests/ranger-policy/app.conf
new file mode 100644
index 0000000..fff4277
--- /dev/null
+++ b/security-admin/src/test/resources/stability-tests/ranger-policy/app.conf
@@ -0,0 +1,23 @@
+#!/bin/bash
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+MAX_ITERATION=10 # Max number of iteration performed by each python client
+ADM_HOST="http://localhost:6080" # Ranger ADMIN URL
+USERNAME="admin" # Ranger administrator user, as we should be able to create/update/delete policies/users/groups/roles
+PASSWORD="admin123" # Ranger administrator password
+SERVICE_NAME="test_hdfs" # Ranger service name, against which policies will be created
+MAX_CLIENT=5 # Max number of python clients
+LOG_DIR=log # The default log directory
\ No newline at end of file
diff --git a/security-admin/src/test/resources/stability-tests/ranger-policy/start.sh b/security-admin/src/test/resources/stability-tests/ranger-policy/start.sh
new file mode 100755
index 0000000..fd00387
--- /dev/null
+++ b/security-admin/src/test/resources/stability-tests/ranger-policy/start.sh
@@ -0,0 +1,98 @@
+#!/bin/bash
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+# chmod 755 ./start.sh
+#.bash start.sh MAX_ITERATION http(s)://RANGER_ADMIN_HOST:PORT ADMIN_USERNAME ADMIN_PASSWORD SERVICE_NAME MAX_CLIENT
+# bash start.sh 1000 "http://localhost:6081/" "admin" "admin123" "test_hdfs" 5
+
+# Read config
+source app.conf
+
+WARN="[\e[1;33mWARN\e[0m]"
+ERROR="[\e[1;31mERROR\e[0m]"
+INFO="[\e[1;34mINFO\e[0m]"
+
+function LOG () {
+ echo -e "$1 $2"
+}
+
+LOG $INFO "Evaluating script parameter provided"
+## Check if max iteration by each client is provided
+if [ -z "$1" ]
+ then
+ LOG $WARN "Max script iteration by each client not supplied using default ($MAX_ITERATION)"
+ else
+ MAX_ITERATION=$1
+fi
+
+# Check if host is provided
+if [ -z "$2" ]
+ then
+ LOG $WARN "Ranger Admin Host not supplied using default ($ADM_HOST)"
+ else
+ ADM_HOST=$2
+fi
+
+## Check if username is provided
+if [ -z "$3" ]
+ then
+ LOG $WARN "UserName not supplied using default ($USERNAME)"
+ else
+ USERNAME=$3
+fi
+
+# Check if password is provided
+if [ -z "$4" ]
+ then
+ LOG $WARN "Password not supplied using default ($PASSWORD)"
+ else
+ PASSWORD=$4
+fi
+
+# Check if service-name is provided
+if [ -z "$5" ]
+ then
+ LOG $WARN "Ranger Admin ServiceName not supplied using default ($SERVICE_NAME)"
+ else
+ SERVICE_NAME=$5
+fi
+
+# Check if max clients config value is provided
+if [ -z "$6" ]
+ then
+ LOG $WARN "Max python clients not supplied using default ($MAX_CLIENT)"
+ else
+ MAX_CLIENT=$6
+fi
+
+# Remove / from end of $LOG_DIR
+SCRIPT_LOG_DIR="${LOG_DIR%/}"
+
+# Create log directory if not exist
+mkdir -p $LOG_DIR
+
+LOG $INFO "Initiating $MAX_CLIENT concurrent python clients"
+
+idx=1
+while [ $idx -le $MAX_CLIENT ]
+do
+ LOG $INFO "Initiating: 'python ./test-hdfs-policy.py --startIndex $idx --maxIteration $MAX_ITERATION --incrementBy $MAX_CLIENT --host $ADM_HOST --username $USERNAME --password $PASSWORD --serviceName $SERVICE_NAME > $SCRIPT_LOG_DIR/script-$idx.log 2>&1 &'"
+ python ./test-hdfs-policy.py --startIndex $idx --maxIteration $MAX_ITERATION --incrementBy $MAX_CLIENT --host $ADM_HOST --username $USERNAME --password $PASSWORD --serviceName $SERVICE_NAME > $SCRIPT_LOG_DIR/script-$idx.log 2>&1 &
+ idx=`expr $idx + 1`
+done
+
+LOG $INFO "$MAX_CLIENT concurrent python clients are initiated successfully."
diff --git a/security-admin/src/test/resources/stability-tests/ranger-policy/test-hdfs-policy.py b/security-admin/src/test/resources/stability-tests/ranger-policy/test-hdfs-policy.py
new file mode 100755
index 0000000..8c2ac1d
--- /dev/null
+++ b/security-admin/src/test/resources/stability-tests/ranger-policy/test-hdfs-policy.py
@@ -0,0 +1,245 @@
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License. See accompanying LICENSE file.
+#
+
+#!/usr/bin/env python
+
+#Make sure script has sufficient privileges
+# chmod 755 ./test-hdfs-policy.py
+
+#Run the script
+# python ./test-hdfs-policy.py --startIndex START_IDX --maxIteration MAX_ITERATION --incrementBy IDX_INCREMENT_BY --host ADMIN_HOST --username USERNAME --password PASSWORD --serviceName SERVICE_NAME
+# python ./test-hdfs-policy.py --startIndex 1 --maxIteration 10 --incrementBy 5 --host "http://localhost:6080" --username "admin" --password "admin123" --serviceName "test_hdfs"
+
+import sys
+import time
+import argparse
+import json
+import requests
+from requests.packages.urllib3.exceptions import InsecureRequestWarning
+from datetime import datetime
+
+requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
+
+# Create the parser
+my_parser = argparse.ArgumentParser(description='Create, Fetch & Delete Ranger Policies')
+
+# Add the arguments
+my_parser.add_argument('--host', metavar='ranger-admin-host-with-port', type=str, help='Host (including port) of ranger admin', required=True)
+my_parser.add_argument('--maxIteration', metavar='maximum-script-iterations', type=int, help='Maximum number of iterations', required=True)
+my_parser.add_argument('--startIndex', metavar='starting-index-of-script', type=int, help='Starting index of first iteration', required=True)
+my_parser.add_argument('--incrementBy', metavar='increment-by', type=int, help='After each iteration, increment by', required=True)
+
+my_parser.add_argument('--username', metavar='login-username', type=str, help='UserName of user used to perform test', required=True)
+my_parser.add_argument('--password', metavar='login-password', type=str, help='Password of user used to perform test', required=True)
+my_parser.add_argument('--serviceName', metavar='service-name', type=str, help='Name of ranger-service for which script will performs test', required=True)
+
+
+# Execute the parse_args() method
+args = my_parser.parse_args()
+
+session = requests.Session()
+session.auth = (args.username, args.password)
+session.verify = False
+
+session.headers['Accept'] = 'application/json'
+session.headers['Content-Type'] = 'application/json'
+
+admin_create_url = "{}/service/plugins/policies".format(args.host.rstrip('/'))
+admin_create_data_template = '{"policyType":"0","name":"","isEnabled":true,"policyPriority":0,"policyLabels":[],"description":"","isAuditEnabled":true,"resources":{"path":{"values":[],"isRecursive":true}},"isDenyAllElse":false,"policyItems":[{"users":[""],"groups":[""],"roles": [""],"accesses":[{"type":"read","isAllowed":true},{"type":"write","isAllowed":true},{"type":"execute","isAllowed":true}]}],"allowExceptions":[],"denyPolicyItems":[],"denyExceptions":[],"service":""}'
+admin_delete_url_template = "{}/service/assets/resources/{}".format(args.host.rstrip('/'), "{}")
+admin_update_url_template = "{}/service/plugins/policies/{}".format(args.host.rstrip('/'), "{}")
+admin_get_url = "{}/service/public/v2/api/service/{}/policy".format(args.host.rstrip('/'), args.serviceName)
+admin_get_service_url = "{}/service/plugins/services/name/{}".format(args.host.rstrip('/'), args.serviceName)
+admin_delete_usr_url_template = "{}/service/xusers/secure/users/{}?forceDelete=true".format(args.host.rstrip('/'), "{}")
+admin_delete_grp_url_template = "{}/service/xusers/secure/groups/{}?forceDelete=true".format(args.host.rstrip('/'), "{}")
+admin_delete_rol_url_template = "{}/service/roles/roles/name/{}".format(args.host.rstrip('/'), "{}")
+
+def log(log_group, message):
+ print(str(datetime.now()) + " [" + log_group + "] " + message)
+
+def get_policy_version():
+ resp = session.get(admin_get_service_url)
+ assert resp.status_code == 200, "Failed to fetch policy version"
+
+ return resp.json()["policyVersion"]
+
+def test_create_policy(log_group, policy_json):
+ log(log_group, " Create policy URL: " + str(admin_create_url))
+ policy_version_v1 = get_policy_version()
+ resp = session.post(admin_create_url, data=json.dumps(policy_json))
+ policy_version_v2 = get_policy_version()
+
+ assert resp.status_code == 200, "Create policy request failed"
+ assert policy_version_v1 != policy_version_v2, "Policy version did not updated after create. policyVersion=" + policy_version_v2
+
+ policy_id = resp.json()["id"]
+ log(log_group, " Policy ID: " + str(policy_id))
+
+ log(log_group, " Waiting for {} milliseconds".format(wait_between_commands))
+ time.sleep(wait_between_commands/1000)
+ return policy_id
+
+def test_get_policy(log_group, policy_id, flag=True):
+ log(log_group, " Get policy URL: " + str(admin_get_url))
+ resp = session.get(admin_get_url)
+
+ assert resp.status_code == 200, "Get policy request failed"
+ resp_text = resp.text
+
+ if flag:
+ assert '"id":{}'.format(policy_id) in resp_text, resp_text
+ else:
+ assert not '"id":{}'.format(policy_id) in resp_text, resp_text
+
+def test_update_policy(log_group, policy_json, policy_id):
+ policy_json['description'] = "This is a test policy created to test policy cache functionality."
+ policy_json['id'] = policy_id
+ update_url = admin_update_url_template.format(policy_id)
+
+ log(log_group, " Update policy URL: " + str(update_url))
+ policy_version_v1 = get_policy_version()
+ resp = session.put(update_url, data=json.dumps(policy_json))
+ policy_version_v2 = get_policy_version()
+
+ assert resp.status_code == 200, "Update policy request failed"
+ assert policy_version_v1 != policy_version_v2, "Policy version did not updated after create. policyVersion=" + policy_version_v2
+
+ log(log_group, " Waiting for {} milliseconds".format(wait_between_commands))
+ time.sleep(wait_between_commands/1000)
+
+def test_delete_policy(log_group, policy_id):
+ delete_url = admin_delete_url_template.format(policy_id)
+
+ log(log_group, " Delete policy URL: " + str(delete_url))
+ policy_version_v1 = get_policy_version()
+ resp = session.delete(delete_url)
+ policy_version_v2 = get_policy_version()
+
+ assert resp.status_code == 204, "Delete policy request failed"
+ assert policy_version_v1 != policy_version_v2, "Policy version did not updated after create. policyVersion=" + policy_version_v2
+
+def test_policy(log_group, policy_json):
+ log(log_group, "[START] LastKnownPolicyVersion=" + str(get_policy_version()))
+
+ # Create Policy
+ policy_id = test_create_policy(log_group, policy_json)
+ # Get Policy
+ test_get_policy(log_group, policy_id)
+
+ # Update Policy
+ test_update_policy(log_group, policy_json, policy_id)
+ # Get Policy
+ test_get_policy(log_group, policy_id)
+
+ # Delete Policy
+ test_delete_policy(log_group, policy_id)
+ # Get Policy
+ test_get_policy(log_group, policy_id, False)
+
+ log(log_group, "[END] LastKnownPolicyVersion=" + str(get_policy_version()))
+ log(log_group, "test_policy function finished, waiting for {} milliseconds".format(wait_between_commands))
+ time.sleep(wait_between_commands/1000)
+
+def get_policy_json(in_fix=""):
+ json_data = json.loads(admin_create_data_template)
+
+ json_data['name'] = "test-{}-{}".format(in_fix, currentIndex)
+ json_data['service'] = args.serviceName
+ json_data['resources']['path']['values'] = ["/dummy-hdfs-path-{}-{}".format(in_fix, currentIndex)]
+
+ return json_data
+
+def test_delete_user(log_group, uname):
+ delete_user_url = admin_delete_usr_url_template.format(uname)
+
+ log(log_group, "Delete user URL: " + str(delete_user_url))
+ resp = session.delete(delete_user_url)
+
+ assert resp.status_code == 204, "Delete user request failed. [User=" + str(uname) + " ,, response code=" + str(resp.status_code) + "]"
+
+def test_delete_group(log_group, gname):
+ delete_group_url = admin_delete_grp_url_template.format(gname)
+
+ log(log_group, "Delete group URL: " + str(delete_group_url))
+ resp = session.delete(delete_group_url)
+
+ assert resp.status_code == 204, "Delete group request failed. [Group=" + str(gname) + " ,, response code=" + str(resp.status_code) + "]"
+
+def test_delete_role(log_group, rname):
+ delete_role_url = admin_delete_rol_url_template.format(rname)
+
+ log(log_group, "Delete role URL: " + str(delete_role_url))
+ resp = session.delete(delete_role_url)
+
+ assert resp.status_code == 204, "Delete role request failed. [Role=" + str(rname) + " ,, response code=" + str(resp.status_code) + "]"
+
+
+currentIndex = args.startIndex
+currentCycle = 1
+appStartTime = time.time()
+
+while currentCycle <= args.maxIteration:
+ log("CYCLE", "======================== Starting Iteration/ Cycle {} ========================".format(currentCycle))
+ wait_between_commands = 200
+ wait_between_cycles = 1000
+
+ # User
+ user_start_time = time.time()
+ json_data_user = get_policy_json("u")
+ user_name = "test-ra-user-{}".format(currentIndex)
+
+ for idx in range(len(json_data_user['policyItems'])):
+ if len(json_data_user['policyItems'][idx]['users']) > 0:
+ json_data_user['policyItems'][idx]['users'] = [user_name]
+
+ log("CYCLE", "##### User ==>>")
+ test_policy("USER", json_data_user)
+ test_delete_user("USER", user_name)
+ log("CYCLE", "##### User <<== consumed time = " + str(time.time() - user_start_time) + " seconds.")
+
+ # Group
+ group_start_time = time.time()
+ json_data_group = get_policy_json("g")
+ group_name = "test-ra-group-{}".format(currentIndex)
+
+ for idx in range(len(json_data_group['policyItems'])):
+ if len(json_data_group['policyItems'][idx]['groups']) > 0:
+ json_data_group['policyItems'][idx]['groups'] = [group_name]
+
+ log("CYCLE", "##### Group ==>>")
+ test_policy("GROUP", json_data_group)
+ test_delete_group("GROUP", group_name)
+ log("CYCLE", "##### Group <<== consumed time = " + str(time.time() - group_start_time) + " seconds.")
+
+ # Role
+ role_start_time = time.time()
+ json_data_role = get_policy_json("r")
+ role_name = "test-ra-role-{}".format(currentIndex)
+
+ for idx in range(len(json_data_role['policyItems'])):
+ if len(json_data_role['policyItems'][idx]['roles']) > 0:
+ json_data_role['policyItems'][idx]['roles'] = [role_name]
+
+ log("CYCLE", "##### Role ==>>")
+ test_policy("ROLE", json_data_role)
+ test_delete_role("ROLE", role_name)
+ log("CYCLE", "##### Role <<== consumed time = " + str(time.time() - role_start_time) + " seconds.")
+
+ # Final loop logistics
+ log("CYCLE", "<<=== Iteration/ Cycle {} complete. Waiting for {} milliseconds before next Iteration/ Cycle.".format(currentCycle, wait_between_cycles))
+ currentIndex = currentIndex + args.incrementBy
+ currentCycle = currentCycle + 1
+ time.sleep(wait_between_cycles/1000)
+
+log("SCRIPT", "##### Overall <<== consumed time = " + str(time.time() - appStartTime) + " seconds.")
[ranger] 02/02: RANGER-3347: Add default policy for hbase user in
hdfs services
Posted by me...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
mehul pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
commit 16c5145ebfdd92345b6f90d4e2fb3c7c88f87413
Author: Kishor Gollapalliwar <ki...@gmail.com>
AuthorDate: Mon Jul 26 19:15:55 2021 +0530
RANGER-3347: Add default policy for hbase user in hdfs services
Signed-off-by: Mehul Parikh <me...@apache.org>
---
.../ranger/services/hdfs/RangerServiceHdfs.java | 116 ++++++++++++++-------
1 file changed, 81 insertions(+), 35 deletions(-)
diff --git a/hdfs-agent/src/main/java/org/apache/ranger/services/hdfs/RangerServiceHdfs.java b/hdfs-agent/src/main/java/org/apache/ranger/services/hdfs/RangerServiceHdfs.java
index 5354636..8de142e 100644
--- a/hdfs-agent/src/main/java/org/apache/ranger/services/hdfs/RangerServiceHdfs.java
+++ b/hdfs-agent/src/main/java/org/apache/ranger/services/hdfs/RangerServiceHdfs.java
@@ -43,15 +43,19 @@ import org.apache.commons.logging.LogFactory;
public class RangerServiceHdfs extends RangerBaseService {
- private static final Log LOG = LogFactory.getLog(RangerServiceHdfs.class);
- private static final String AUDITTOHDFS_KMS_PATH = "/ranger/audit/kms";
- private static final String AUDITTOHDFS_POLICY_NAME = "kms-audit-path";
- public static final String ACCESS_TYPE_READ = "read";
-
+ private static final Log LOG = LogFactory.getLog(RangerServiceHdfs.class);
+ private static final String AUDITTOHDFS_KMS_PATH = "/ranger/audit/kms";
+ private static final String AUDITTOHDFS_POLICY_NAME = "kms-audit-path";
+ public static final String ACCESS_TYPE_READ = "read";
+
+ private static final String HBASE_ARCHIVE_POLICY_NAME = "hbase-archive";
+ private static final String HBASE_ARCHIVE_POLICY_PATH = "/hbase/archive";
+ private static final String HBASE_ARCHIVE_POLICY_DESC = "Policy for hbase archive location";
+
public RangerServiceHdfs() {
super();
}
-
+
@Override
public void init(RangerServiceDef serviceDef, RangerService service) {
super.init(serviceDef, service);
@@ -154,18 +158,24 @@ public class RangerServiceHdfs extends RangerBaseService {
}
}
- try {
- // we need to create one policy for keyadmin user for audit to HDFS
- RangerServiceDefHelper serviceDefHelper = new RangerServiceDefHelper(serviceDef);
- for (List<RangerServiceDef.RangerResourceDef> aHierarchy : serviceDefHelper.filterHierarchies_containsOnlyMandatoryResources(RangerPolicy.POLICY_TYPE_ACCESS)) {
- RangerPolicy policy = getPolicyForKMSAudit(aHierarchy);
- if (policy != null) {
- ret.add(policy);
- }
- }
- } catch (Exception e) {
- LOG.error("Error creating policy for keyadmin for audit to HDFS : " + service.getName(), e);
- }
+ try {
+ RangerServiceDefHelper serviceDefHelper = new RangerServiceDefHelper(serviceDef);
+ for (List<RangerServiceDef.RangerResourceDef> aHierarchy : serviceDefHelper.filterHierarchies_containsOnlyMandatoryResources(RangerPolicy.POLICY_TYPE_ACCESS)) {
+ // we need to create one policy for keyadmin user for audit to HDFS
+ RangerPolicy policy = getPolicyForKMSAudit(aHierarchy);
+ if (policy != null) {
+ ret.add(policy);
+ }
+
+ // default policy for hbase user to have access on archive location
+ RangerPolicy hbaseArchivePolicy = getPolicyForHBaseArchive(aHierarchy);
+ if (hbaseArchivePolicy != null) {
+ ret.add(hbaseArchivePolicy);
+ }
+ }
+ } catch (Exception e) {
+ LOG.error("Error creating policy for keyadmin for audit to HDFS : " + service.getName(), e);
+ }
if (LOG.isDebugEnabled()) {
LOG.debug("<== RangerServiceHdfs.getDefaultRangerPolicies() : " + ret);
@@ -187,7 +197,7 @@ public class RangerServiceHdfs extends RangerBaseService {
policy.setService(service.getName());
policy.setDescription("Policy for " + AUDITTOHDFS_POLICY_NAME);
policy.setIsAuditEnabled(true);
- policy.setResources(createKMSAuditResource(resourceHierarchy));
+ policy.setResources(createPathBasedResourceMap(resourceHierarchy, AUDITTOHDFS_KMS_PATH));
List<RangerPolicy.RangerPolicyItem> policyItems = new ArrayList<RangerPolicy.RangerPolicyItem>();
//Create policy item for keyadmin
@@ -208,25 +218,61 @@ public class RangerServiceHdfs extends RangerBaseService {
return policy;
}
- private Map<String, RangerPolicy.RangerPolicyResource> createKMSAuditResource(List<RangerServiceDef.RangerResourceDef> resourceHierarchy) throws Exception {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> RangerServiceHdfs.createKMSAuditResource()");
- }
- Map<String, RangerPolicy.RangerPolicyResource> resourceMap = super.createDefaultPolicyResource(resourceHierarchy);
+ private RangerPolicy getPolicyForHBaseArchive(List<RangerServiceDef.RangerResourceDef> resourceHierarchy) throws Exception {
+ if (LOG.isDebugEnabled()) {
+ LOG.debug("==> RangerServiceHdfs.getPolicyForHBaseArchive()");
+ }
- RangerPolicy.RangerPolicyResource pathResource = resourceMap.get(RangerHdfsAuthorizer.KEY_RESOURCE_PATH);
+ RangerPolicy policy = new RangerPolicy();
- if (pathResource != null) {
- pathResource.setValue(AUDITTOHDFS_KMS_PATH);
- } else {
- LOG.error("Internal error: Could not find RangerPolicyResource corresponding to " + RangerHdfsAuthorizer.KEY_RESOURCE_PATH + " in default policy-resource");
- }
+ policy.setIsEnabled(true);
+ policy.setVersion(1L);
+ policy.setName(HBASE_ARCHIVE_POLICY_NAME);
+ policy.setService(service.getName());
+ policy.setDescription(HBASE_ARCHIVE_POLICY_DESC);
+ policy.setIsAuditEnabled(true);
+ policy.setResources(createPathBasedResourceMap(resourceHierarchy, HBASE_ARCHIVE_POLICY_PATH));
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== RangerServiceHdfs.createKMSAuditResource():" + resourceMap);
- }
- return resourceMap;
- }
+ List<RangerPolicy.RangerPolicyItem> policyItems = new ArrayList<RangerPolicy.RangerPolicyItem>();
+
+ // create policy item
+ RangerPolicy.RangerPolicyItem policyItem = new RangerPolicy.RangerPolicyItem();
+ List<String> user = new ArrayList<String>();
+ user.add("hbase");
+ policyItem.setUsers(user);
+
+ policyItem.setAccesses(getAllowedAccesses(policy.getResources()));
+ policyItem.setDelegateAdmin(false);
+
+ policyItems.add(policyItem);
+ policy.setPolicyItems(policyItems);
+
+ if (LOG.isDebugEnabled()) {
+ LOG.debug("<== RangerServiceHdfs.getPolicyForHBaseArchive(): ret=" + policy);
+ }
+ return policy;
+ }
+
+ private Map<String, RangerPolicy.RangerPolicyResource> createPathBasedResourceMap(List<RangerServiceDef.RangerResourceDef> resourceHierarchy, String resourcePath) throws Exception {
+ if (LOG.isDebugEnabled()) {
+ LOG.debug("==> RangerServiceHdfs.createPathBasedResourceMap()");
+ }
+
+ Map<String, RangerPolicy.RangerPolicyResource> ret = super.createDefaultPolicyResource(resourceHierarchy);
+ RangerPolicy.RangerPolicyResource pathResource = ret.get(RangerHdfsAuthorizer.KEY_RESOURCE_PATH);
+
+ if (pathResource != null) {
+ pathResource.setValue(resourcePath);
+ } else {
+ LOG.error("Internal error: Could not find RangerPolicyResource corresponding to " + RangerHdfsAuthorizer.KEY_RESOURCE_PATH + " in default policy-resource");
+ }
+
+ if (LOG.isDebugEnabled()) {
+ LOG.debug("<== RangerServiceHdfs.createPathBasedResourceMap(): ret="+ret);
+ }
+
+ return ret;
+ }
}