[PR] RANGER-5744: Harden plugins-docker-build against Ozone KDC startup race [ranger]

["ramackri (via GitHub)" <gi...@apache.org>]

ramackri opened a new pull request, #1155:
URL: https://github.com/apache/ranger/pull/1155

   ## Summary
   
   Fixes intermittent `plugins-docker-build` CI failures where `ozone-datanode` exits during Kerberos login before the Ranger KDC is fully ready in the Docker Compose smoke stack.
   
   Example failure: https://github.com/apache/ranger/actions/runs/31185432016/job/93444713551
   
   Root cause: Ozone datanode/scm started on `ranger-kdc: service_started` while Java Kerberos clients probe KDC over UDP first; the existing KDC healthcheck only validated TCP port 88. Re-running the job usually passes once the KDC is warm.
   
   ## Changes
   
   - **KDC healthcheck** (`Dockerfile.ranger-kdc`): replace TCP `nc` probe with `kinit` using the datanode keytab so healthy means Kerberos actually works
   - **Compose ordering** (`docker-compose.ranger-ozone.yml`): Ozone datanode/scm/om wait for `ranger-kdc: service_healthy` (same pattern as `ranger-zk`)
   - **krb5.conf**: set `udp_preference_limit = 0` to avoid UDP `PortUnreachableException` in Docker CI when TCP is ready first
   - **Startup script** (`ozone-service-start.sh`): wait for keytab file and KDC reachability before starting Ozone SCM/datanode
   - **Restart policy**: `restart: on-failure:3` on ozone-datanode and ozone-scm for one-shot race recovery
   - **CI workflow** (`.github/workflows/ci.yml`): explicit wait for `ranger-kdc` healthy before the container status check
   
   ## Test plan
   
   - [ ] `plugins-docker-build` passes on this PR (watch for multiple consecutive green runs)
   - [ ] Local smoke: `cd dev-support/ranger-docker && docker compose ... -f docker-compose.ranger-ozone.yml up -d` — verify `ozone-datanode`, `ozone-scm`, `ozone-om` stay running
   - [ ] Confirm `docker inspect ranger-kdc` reports `healthy` only after keytabs are provisioned
   - [ ] Verify unrelated plugin containers (Hadoop, Hive, HBase, Kafka, Knox) still start normally
   
   https://issues.apache.org/jira/browse/RANGER-5744
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] RANGER-5744: Harden plugins-docker-build against Ozone KDC startup race [ranger]

["pradeepagrawal8184 (via GitHub)" <gi...@apache.org>]

pradeepagrawal8184 merged PR #1155:
URL: https://github.com/apache/ranger/pull/1155


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org