From 0be020b5be45043bfa61a4a0b9b43779f2770e7d Mon Sep 17 00:00:00 2001 From: Paras Date: Tue, 4 Aug 2026 19:53:02 +0100 Subject: [PATCH] RANGER-5680: Introduce RANGER_AUDIT_STORE env-var; make OpenSearch the default MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mirrors the RANGER_DB_TYPE pattern so the audit store can be selected without hand-editing install.properties: export RANGER_AUDIT_STORE=solr # default is now opensearch Changes: - .env: add RANGER_AUDIT_STORE=opensearch (default) - docker-compose.ranger.yml: pass RANGER_AUDIT_STORE into the ranger container env - scripts/admin/ranger.sh: rewrite install.properties audit block before setup.sh runs — acts on RANGER_AUDIT_STORE=solr (opensearch is the no-op default, matching the properties file default) - ranger-admin-install-*.properties (postgres/mysql/oracle/sqlserver): flip default active audit block from Solr to OpenSearch; comment out dangling active elasticsearch param lines for consistency - docker-compose.ranger-pdp.yml: remove hard depends_on: ranger-solr - docker-compose.ranger-ozone.yml: remove hard depends_on: ranger-solr (om service) - Default bring-up now starts OpenSearch instead of Solr so the core stack matches the default audit store; Solr becomes opt-in (RANGER_AUDIT_STORE=solr + the solr compose file). Audits use the direct OpenSearchAuditDestination (like the old Solr path); the Kafka audit-server pipeline remains an optional advanced flow. - README.md: default core/all-containers/rebuild/ozone commands use docker-compose.ranger-opensearch.yml; document RANGER_AUDIT_STORE alongside RANGER_DB_TYPE; Solr sections kept as opt-in - .github/workflows/ci.yml: docker jobs download+build+start ranger-opensearch and assert it is running (replacing ranger-solr in the default path) --- .github/workflows/ci.yml | 8 ++-- dev-support/ranger-docker/.env | 5 ++- .../Dockerfile.ranger-opensearch | 35 ----------------- dev-support/ranger-docker/README.md | 26 +++++++------ .../docker-compose.ranger-opensearch.yml | 25 ++---------- .../docker-compose.ranger-ozone.yml | 6 +-- .../ranger-docker/docker-compose.ranger.yml | 1 + .../ranger-admin-install-mysql.properties | 33 ++++++---------- .../ranger-admin-install-oracle.properties | 33 ++++++---------- .../ranger-admin-install-postgres.properties | 38 +++++++------------ .../ranger-admin-install-sqlserver.properties | 24 ++++++------ .../ranger-docker/scripts/admin/ranger.sh | 22 +++++++++++ .../scripts/opensearch/opensearch-jaas.conf | 18 --------- .../scripts/opensearch/opensearch.yml | 8 ++-- .../opensearch/ranger-opensearch-setup.sh | 32 ---------------- .../scripts/opensearch/ranger-opensearch.sh | 38 ------------------- 16 files changed, 106 insertions(+), 246 deletions(-) delete mode 100644 dev-support/ranger-docker/Dockerfile.ranger-opensearch delete mode 100644 dev-support/ranger-docker/scripts/opensearch/opensearch-jaas.conf delete mode 100755 dev-support/ranger-docker/scripts/opensearch/ranger-opensearch-setup.sh delete mode 100755 dev-support/ranger-docker/scripts/opensearch/ranger-opensearch.sh diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b8273b2fee6..9b2c6454839 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -107,7 +107,7 @@ jobs: - name: Download DB and Log4J connectors run: | cd dev-support/ranger-docker - ./download-archives.sh none + ./download-archives.sh opensearch - name: Build all ranger-service images run: | @@ -115,7 +115,7 @@ jobs: export RANGER_DB_TYPE=postgres docker compose \ -f docker-compose.ranger.yml \ - -f docker-compose.ranger-solr.yml \ + -f docker-compose.ranger-opensearch.yml \ -f docker-compose.ranger-pdp.yml \ -f docker-compose.ranger-usersync.yml \ -f docker-compose.ranger-tagsync.yml \ @@ -127,7 +127,7 @@ jobs: export RANGER_DB_TYPE=postgres docker compose \ -f docker-compose.ranger.yml \ - -f docker-compose.ranger-solr.yml \ + -f docker-compose.ranger-opensearch.yml \ -f docker-compose.ranger-pdp.yml \ -f docker-compose.ranger-usersync.yml \ -f docker-compose.ranger-tagsync.yml \ @@ -136,7 +136,7 @@ jobs: - name: Check status of containers and remove them run: | sleep 60 - containers=(ranger ranger-zk ranger-solr ranger-postgres ranger-pdp ranger-usersync ranger-tagsync ranger-kms); + containers=(ranger ranger-zk ranger-opensearch ranger-postgres ranger-pdp ranger-usersync ranger-tagsync ranger-kms); flag=true; for container in "${containers[@]}"; do if [[ $(docker inspect -f '{{.State.Running}}' $container 2>/dev/null) == "true" ]]; then diff --git a/dev-support/ranger-docker/.env b/dev-support/ranger-docker/.env index 9ec9bdf7c02..5ce0a07c1ee 100644 --- a/dev-support/ranger-docker/.env +++ b/dev-support/ranger-docker/.env @@ -53,6 +53,9 @@ TAGSYNC_VERSION=3.0.0-SNAPSHOT # PDP Configuration PDP_VERSION=3.0.0-SNAPSHOT +# Audit Store (opensearch | solr); default: opensearch +RANGER_AUDIT_STORE=opensearch + # Solr Configuration SOLR_VERSION=9.4.1 SOLR_PLUGIN_VERSION=3.0.0-SNAPSHOT @@ -86,7 +89,7 @@ OZONE_RUNNER_VERSION=20260106-1-jdk21 TRINO_VERSION=latest # Open Search -OPENSEARCH_VERSION=1.3.19 +OPENSEARCH_VERSION=2.19.6 # Debug Configuration DEBUG_ADMIN=false diff --git a/dev-support/ranger-docker/Dockerfile.ranger-opensearch b/dev-support/ranger-docker/Dockerfile.ranger-opensearch deleted file mode 100644 index 7172da937d6..00000000000 --- a/dev-support/ranger-docker/Dockerfile.ranger-opensearch +++ /dev/null @@ -1,35 +0,0 @@ -# Licensed to the Apache Software Foundation (ASF) under one -# or more contributor license agreements. See the NOTICE file -# distributed with this work for additional information -# regarding copyright ownership. The ASF licenses this file -# to you under the Apache License, Version 2.0 (the -# "License"); you may not use this file except in compliance -# with the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -ARG RANGER_BASE_IMAGE=apache/ranger-base -ARG RANGER_BASE_VERSION=20260123-2-8 -FROM ${RANGER_BASE_IMAGE}:${RANGER_BASE_VERSION} - -ARG OPENSEARCH_VERSION - -COPY ./downloads/opensearch-${OPENSEARCH_VERSION}-linux-x64.tar.gz /home/ranger/dist/ - -# Extract and setup OpenSearch -RUN tar xvfz /home/ranger/dist/opensearch-${OPENSEARCH_VERSION}-linux-x64.tar.gz --directory=/opt/ && \ - ln -s /opt/opensearch-${OPENSEARCH_VERSION} /opt/opensearch && \ - rm -f /home/ranger/dist/opensearch-${OPENSEARCH_VERSION}-linux-x64.tar.gz && \ - mkdir -p /opt/opensearch/data /opt/opensearch/logs && \ - chown -R opensearch:hadoop /opt/opensearch* - -ENV OPENSEARCH_HOME=/opt/opensearch -ENV PATH=/usr/java/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/opensearch/bin - -ENTRYPOINT [ "/opt/ranger/ranger-opensearch.sh" ] diff --git a/dev-support/ranger-docker/README.md b/dev-support/ranger-docker/README.md index 76c9968a32d..95e0b206f7d 100644 --- a/dev-support/ranger-docker/README.md +++ b/dev-support/ranger-docker/README.md @@ -80,8 +80,11 @@ cd dev-support/ranger-docker # export ENABLE_FILE_SYNC_SOURCE=true # valid values for RANGER_DB_TYPE: mysql/postgres/oracle +# valid values for RANGER_AUDIT_STORE: opensearch (default) | solr +# The core stack brings up the audit backend for the default store (OpenSearch). +# For Solr: export RANGER_AUDIT_STORE=solr and replace -f docker-compose.ranger-opensearch.yml with -f docker-compose.ranger-solr.yml below. -docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-solr.yml -f docker-compose.ranger-usersync.yml -f docker-compose.ranger-tagsync.yml -f docker-compose.ranger-pdp.yml -f docker-compose.ranger-kms.yml up -d +docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-opensearch.yml -f docker-compose.ranger-usersync.yml -f docker-compose.ranger-tagsync.yml -f docker-compose.ranger-pdp.yml -f docker-compose.ranger-kms.yml up -d # Ranger Admin can be accessed at http://localhost:6080 (admin/rangerR0cks!) ~~~ @@ -121,7 +124,7 @@ docker compose -f docker-compose.ranger-build.yml up `scripts/admin/ranger-admin-install-.properties` and recreate Admin so setup runs again: ~~~ - docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-solr.yml -f docker-compose.ranger-ozone.yml \ + docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-opensearch.yml -f docker-compose.ranger-ozone.yml \ up -d --build --force-recreate ranger ~~~ Works even if the DB already exists; setup re-runs on a fresh container. @@ -135,7 +138,7 @@ service-def. ~~~ ./scripts/ozone/ozone-plugin-docker-setup.sh -docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-solr.yml -f docker-compose.ranger-ozone.yml up -d +docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-opensearch.yml -f docker-compose.ranger-ozone.yml up -d ~~~ Verify (after login): @@ -169,8 +172,7 @@ used by the Solr audit path. ##### Setup -With the default `RANGER_DB_TYPE=postgres`, OpenSearch auditing is preconfigured and runs -out of the box — the commands below need no `install.properties` changes. +Set `RANGER_AUDIT_STORE=opensearch` — no manual `install.properties` edits needed. ~~~ # Prerequisites: build Ranger artifacts (admin, audit ingestor/dispatcher, ...) and download archives @@ -180,6 +182,7 @@ cd dev-support/ranger-docker ./download-archives.sh kafka opensearch hadoop export RANGER_DB_TYPE=postgres +export RANGER_AUDIT_STORE=opensearch # 1. Start OpenSearch first (Ranger Admin's bootstrapper needs it on startup) docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-opensearch.yml \ @@ -202,23 +205,22 @@ docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-opensearch. -f docker-compose.ranger-audit-dispatcher-opensearch.yml up -d ranger-audit-ingestor ranger-audit-dispatcher-opensearch ~~~ -To use OpenSearch with **mysql or oracle** instead, enable the OpenSearch block in the matching -`scripts/admin/ranger-admin-install-${RANGER_DB_TYPE}.properties` (uncomment the `audit_store=opensearch` -and `audit_opensearch_*` lines and comment out the Solr block) before running the setup commands. +To use OpenSearch with **any DB type**, simply set `export RANGER_AUDIT_STORE=opensearch` before +bringing up the stack — no manual `install.properties` edits required. -For **existing Solr-based installs**, switch stores by setting `audit_store=opensearch` (and the -`audit_opensearch_*` properties) in install.properties and restarting Ranger Admin. +For **existing Solr-based installs**, set `RANGER_AUDIT_STORE=opensearch`, recreate the Ranger +Admin container (so setup re-runs with the new audit block), and restart. Similarly, check the `depends` section of the `docker-compose.ranger-service.yaml` file and add docker-compose files for these services when trying to bring up the `service` container. #### Bring up all containers ~~~ ./scripts/ozone/ozone-plugin-docker-setup.sh -docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-solr.yml -f docker-compose.ranger-usersync.yml -f docker-compose.ranger-tagsync.yml -f docker-compose.ranger-pdp.yml -f docker-compose.ranger-kms.yml -f docker-compose.ranger-hadoop.yml -f docker-compose.ranger-hbase.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-hive.yml -f docker-compose.ranger-knox.yml -f docker-compose.ranger-ozone.yml up -d +docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-opensearch.yml -f docker-compose.ranger-usersync.yml -f docker-compose.ranger-tagsync.yml -f docker-compose.ranger-pdp.yml -f docker-compose.ranger-kms.yml -f docker-compose.ranger-hadoop.yml -f docker-compose.ranger-hbase.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-hive.yml -f docker-compose.ranger-knox.yml -f docker-compose.ranger-ozone.yml up -d ~~~ #### To rebuild specific images and start containers with the new image: ~~~ -docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-solr.yml -f docker-compose.ranger-usersync.yml -f docker-compose.ranger-tagsync.yml -f docker-compose.ranger-kms.yml -f docker-compose.ranger-hadoop.yml -f docker-compose.ranger-hbase.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-hive.yml -f docker-compose.ranger-trino.yml -f docker-compose.ranger-knox.yml up -d --no-deps --force-recreate --build +docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-opensearch.yml -f docker-compose.ranger-usersync.yml -f docker-compose.ranger-tagsync.yml -f docker-compose.ranger-kms.yml -f docker-compose.ranger-hadoop.yml -f docker-compose.ranger-hbase.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-hive.yml -f docker-compose.ranger-trino.yml -f docker-compose.ranger-knox.yml up -d --no-deps --force-recreate --build ~~~ #### To bring up audit server ingestor + dispatchers. Make sure kafka, solr, and hdfs containers are running before bringing up audit server services. diff --git a/dev-support/ranger-docker/docker-compose.ranger-opensearch.yml b/dev-support/ranger-docker/docker-compose.ranger-opensearch.yml index b6f89280f35..87a0c0f12a0 100644 --- a/dev-support/ranger-docker/docker-compose.ranger-opensearch.yml +++ b/dev-support/ranger-docker/docker-compose.ranger-opensearch.yml @@ -1,27 +1,12 @@ services: ranger-opensearch: - build: - context: . - dockerfile: Dockerfile.ranger-opensearch - args: - - RANGER_BASE_IMAGE=${RANGER_BASE_IMAGE} - - RANGER_BASE_VERSION=${RANGER_BASE_VERSION} - - OPENSEARCH_VERSION=${OPENSEARCH_VERSION} - - KERBEROS_ENABLED=${KERBEROS_ENABLED} - image: ranger-opensearch + image: opensearchproject/opensearch:${OPENSEARCH_VERSION} container_name: ranger-opensearch hostname: ranger-opensearch.rangernw volumes: - - ./dist/keytabs/ranger-opensearch:/etc/keytabs - - ./scripts/opensearch/ranger-opensearch-setup.sh:/opt/ranger/ranger-opensearch-setup.sh - - ./scripts/opensearch/ranger-opensearch.sh:/opt/ranger/ranger-opensearch.sh - - ./scripts/opensearch/opensearch.yml:/opt/opensearch/config/opensearch.yml - - ./scripts/opensearch/opensearch-jaas.conf:/opt/opensearch/config/opensearch-jaas.conf - - ./scripts/kdc/krb5.conf:/etc/krb5.conf - - opensearch-data:/opt/opensearch/data - - opensearch-logs:/opt/opensearch/logs - stdin_open: true - tty: true + - ./scripts/opensearch/opensearch.yml:/usr/share/opensearch/config/opensearch.yml + - opensearch-data:/usr/share/opensearch/data + - opensearch-logs:/usr/share/opensearch/logs networks: - ranger ports: @@ -33,8 +18,6 @@ services: ranger: condition: service_started environment: - - OPENSEARCH_VERSION=${OPENSEARCH_VERSION} - - KERBEROS_ENABLED=${KERBEROS_ENABLED} - OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m volumes: diff --git a/dev-support/ranger-docker/docker-compose.ranger-ozone.yml b/dev-support/ranger-docker/docker-compose.ranger-ozone.yml index 26dad4fea1c..dda2de12dc3 100644 --- a/dev-support/ranger-docker/docker-compose.ranger-ozone.yml +++ b/dev-support/ranger-docker/docker-compose.ranger-ozone.yml @@ -14,7 +14,7 @@ services: depends_on: ranger-kdc: condition: service_started - command: bash -c "unset KERBEROS_ENABLED; sudo mkdir -p /data/hdds /data/metadata && sudo chown -R hadoop:hadoop /data && exec /opt/hadoop/bin/ozone datanode" + command: bash -c "until [ -f /etc/keytabs/.provisioned ]; do echo 'waiting for keytabs...'; sleep 3; done && unset KERBEROS_ENABLED; sudo mkdir -p /data/hdds /data/metadata && sudo chown -R hadoop:hadoop /data && exec /opt/hadoop/bin/ozone datanode" env_file: - ./scripts/ozone/docker-config environment: @@ -59,7 +59,7 @@ services: env_file: - ./scripts/ozone/docker-config # Do not pass KERBEROS_ENABLED: Ozone libexec/entrypoint.sh waits for krb5:8081. - command: bash -c "unset KERBEROS_ENABLED; source /opt/hadoop/ranger-ozone-plugin/ranger-ozone-setup.sh && (test -f /data/metadata/om/current/VERSION || /opt/hadoop/bin/ozone om --init) && exec /opt/hadoop/bin/ozone om" + command: bash -c "until [ -f /etc/keytabs/.provisioned ]; do echo 'waiting for keytabs...'; sleep 3; done && unset KERBEROS_ENABLED; source /opt/hadoop/ranger-ozone-plugin/ranger-ozone-setup.sh && (test -f /data/metadata/om/current/VERSION || /opt/hadoop/bin/ozone om --init) && exec /opt/hadoop/bin/ozone om" scm: image: ${OZONE_RUNNER_IMAGE}:${OZONE_RUNNER_VERSION} container_name: ozone-scm @@ -81,7 +81,7 @@ services: environment: RANGER_KERBEROS_ENABLED: ${KERBEROS_ENABLED} OZONE-SITE.XML_hdds.scm.safemode.min.datanode: "${OZONE_SAFEMODE_MIN_DATANODES:-1}" - command: bash -c "unset KERBEROS_ENABLED; (test -f /data/metadata/scm/current/VERSION || /opt/hadoop/bin/ozone scm --init) && exec /opt/hadoop/bin/ozone scm" + command: bash -c "until [ -f /etc/keytabs/.provisioned ]; do echo 'waiting for keytabs...'; sleep 3; done && unset KERBEROS_ENABLED; (test -f /data/metadata/scm/current/VERSION || /opt/hadoop/bin/ozone scm --init) && exec /opt/hadoop/bin/ozone scm" networks: ranger: diff --git a/dev-support/ranger-docker/docker-compose.ranger.yml b/dev-support/ranger-docker/docker-compose.ranger.yml index c737fab867c..f00cb258761 100644 --- a/dev-support/ranger-docker/docker-compose.ranger.yml +++ b/dev-support/ranger-docker/docker-compose.ranger.yml @@ -34,6 +34,7 @@ services: environment: - RANGER_VERSION - RANGER_DB_TYPE + - RANGER_AUDIT_STORE - KERBEROS_ENABLED - DEBUG_ADMIN=${DEBUG_ADMIN:-false} - JAVA_OPTS diff --git a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-mysql.properties b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-mysql.properties index 2ba46c336b9..cbab6044660 100644 --- a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-mysql.properties +++ b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-mysql.properties @@ -43,27 +43,18 @@ rangerUsersync_password=rangerR0cks! keyadmin_password=rangerR0cks! -audit_store=solr -audit_solr_urls=http://ranger-solr:8983/solr/ranger_audits -audit_solr_collection_name=ranger_audits - -# audit_store=elasticsearch -audit_elasticsearch_urls= -audit_elasticsearch_port=9200 -audit_elasticsearch_protocol=http -audit_elasticsearch_user=elastic -audit_elasticsearch_password=elasticsearch -audit_elasticsearch_index=ranger_audits -audit_elasticsearch_bootstrap_enabled=true - -# audit_store=opensearch -# audit_opensearch_urls=ranger-opensearch -# audit_opensearch_port=9200 -# audit_opensearch_protocol=http -# audit_opensearch_user=admin -# audit_opensearch_password=admin -# audit_opensearch_index=ranger_audits -# audit_opensearch_bootstrap_enabled=true +# audit_store=solr +# audit_solr_urls=http://ranger-solr:8983/solr/ranger_audits +# audit_solr_collection_name=ranger_audits + +audit_store=opensearch +audit_opensearch_urls=ranger-opensearch +audit_opensearch_port=9200 +audit_opensearch_protocol=http +audit_opensearch_user=admin +audit_opensearch_password=admin +audit_opensearch_index=ranger_audits +audit_opensearch_bootstrap_enabled=true policymgr_external_url=http://ranger-admin:6080 policymgr_http_enabled=true diff --git a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-oracle.properties b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-oracle.properties index f83688c8006..7953ed57c74 100644 --- a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-oracle.properties +++ b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-oracle.properties @@ -45,27 +45,18 @@ rangerUsersync_password=rangerR0cks! keyadmin_password=rangerR0cks! -audit_store=solr -audit_solr_urls=http://ranger-solr:8983/solr/ranger_audits -audit_solr_collection_name=ranger_audits - -# audit_store=elasticsearch -audit_elasticsearch_urls= -audit_elasticsearch_port=9200 -audit_elasticsearch_protocol=http -audit_elasticsearch_user=elastic -audit_elasticsearch_password=elasticsearch -audit_elasticsearch_index=ranger_audits -audit_elasticsearch_bootstrap_enabled=true - -# audit_store=opensearch -# audit_opensearch_urls=ranger-opensearch -# audit_opensearch_port=9200 -# audit_opensearch_protocol=http -# audit_opensearch_user=admin -# audit_opensearch_password=admin -# audit_opensearch_index=ranger_audits -# audit_opensearch_bootstrap_enabled=true +# audit_store=solr +# audit_solr_urls=http://ranger-solr:8983/solr/ranger_audits +# audit_solr_collection_name=ranger_audits + +audit_store=opensearch +audit_opensearch_urls=ranger-opensearch +audit_opensearch_port=9200 +audit_opensearch_protocol=http +audit_opensearch_user=admin +audit_opensearch_password=admin +audit_opensearch_index=ranger_audits +audit_opensearch_bootstrap_enabled=true policymgr_external_url=http://ranger-admin:6080 policymgr_http_enabled=true diff --git a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-postgres.properties b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-postgres.properties index a66fb58b56a..31d65a8988c 100644 --- a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-postgres.properties +++ b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-postgres.properties @@ -45,31 +45,21 @@ keyadmin_password=rangerR0cks! ## --- Audit store: enable ONE of the following blocks --- -## Option 1: Solr (default) -audit_store=solr +## Option 1: Solr +# audit_store=solr # FQDN required for SPNEGO to Solr (HTTP/ranger-solr.rangernw@REALM) -audit_solr_urls=http://ranger-solr.rangernw:8983/solr/ranger_audits -audit_solr_collection_name=ranger_audits - -## Option 2: OpenSearch / Elasticsearch (legacy - uses ES HighLevel REST Client) -# audit_store=elasticsearch -# audit_elasticsearch_urls=ranger-opensearch -# audit_elasticsearch_port=9200 -# audit_elasticsearch_protocol=http -# audit_elasticsearch_user=NONE -# audit_elasticsearch_password=NONE -# audit_elasticsearch_index=ranger_audits -# audit_elasticsearch_bootstrap_enabled=true - -## Option 3: OpenSearch (native - uses low-level REST client, works with any OpenSearch version) -# audit_store=opensearch -# audit_opensearch_urls=ranger-opensearch -# audit_opensearch_port=9200 -# audit_opensearch_protocol=http -# audit_opensearch_user=admin -# audit_opensearch_password=admin -# audit_opensearch_index=ranger_audits -# audit_opensearch_bootstrap_enabled=true +# audit_solr_urls=http://ranger-solr.rangernw:8983/solr/ranger_audits +# audit_solr_collection_name=ranger_audits + +## Option 2: OpenSearch (native - default) +audit_store=opensearch +audit_opensearch_urls=ranger-opensearch +audit_opensearch_port=9200 +audit_opensearch_protocol=http +audit_opensearch_user=admin +audit_opensearch_password=admin +audit_opensearch_index=ranger_audits +audit_opensearch_bootstrap_enabled=true policymgr_external_url=http://ranger-admin:6080 policymgr_http_enabled=true diff --git a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-sqlserver.properties b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-sqlserver.properties index 87c36a0357a..277e85b9514 100644 --- a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-sqlserver.properties +++ b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-sqlserver.properties @@ -52,18 +52,18 @@ rangerUsersync_password=rangerR0cks! keyadmin_password=rangerR0cks! -audit_store=solr -audit_solr_urls=http://ranger-solr:8983/solr/ranger_audits -audit_solr_collection_name=ranger_audits - -# audit_store=elasticsearch -audit_elasticsearch_urls= -audit_elasticsearch_port=9200 -audit_elasticsearch_protocol=http -audit_elasticsearch_user=elastic -audit_elasticsearch_password=elasticsearch -audit_elasticsearch_index=ranger_audits -audit_elasticsearch_bootstrap_enabled=true +# audit_store=solr +# audit_solr_urls=http://ranger-solr:8983/solr/ranger_audits +# audit_solr_collection_name=ranger_audits + +audit_store=opensearch +audit_opensearch_urls=ranger-opensearch +audit_opensearch_port=9200 +audit_opensearch_protocol=http +audit_opensearch_user=admin +audit_opensearch_password=admin +audit_opensearch_index=ranger_audits +audit_opensearch_bootstrap_enabled=true policymgr_external_url=http://ranger-admin:6080 policymgr_http_enabled=true diff --git a/dev-support/ranger-docker/scripts/admin/ranger.sh b/dev-support/ranger-docker/scripts/admin/ranger.sh index 6a8c26eb460..1322ad81679 100755 --- a/dev-support/ranger-docker/scripts/admin/ranger.sh +++ b/dev-support/ranger-docker/scripts/admin/ranger.sh @@ -33,6 +33,28 @@ then ${RANGER_SCRIPTS}/wait_for_testusers_keytab.sh fi + # Select audit store from RANGER_AUDIT_STORE env-var (mirrors RANGER_DB_TYPE pattern). + # Default is opensearch; set RANGER_AUDIT_STORE=solr to switch to Solr. + # Rewrites install.properties in-place so setup.sh picks up the right audit block. + if [ "${RANGER_AUDIT_STORE}" = "solr" ]; then + sed -i \ + -e 's|^audit_store=opensearch|# audit_store=opensearch|' \ + -e 's|^audit_opensearch_urls=|# audit_opensearch_urls=|' \ + -e 's|^audit_opensearch_port=|# audit_opensearch_port=|' \ + -e 's|^audit_opensearch_protocol=|# audit_opensearch_protocol=|' \ + -e 's|^audit_opensearch_user=|# audit_opensearch_user=|' \ + -e 's|^audit_opensearch_password=|# audit_opensearch_password=|' \ + -e 's|^audit_opensearch_index=|# audit_opensearch_index=|' \ + -e 's|^audit_opensearch_bootstrap_enabled=|# audit_opensearch_bootstrap_enabled=|' \ + -e 's|^# audit_store=solr|audit_store=solr|' \ + -e 's|^# audit_solr_urls=|audit_solr_urls=|' \ + -e 's|^# audit_solr_collection_name=|audit_solr_collection_name=|' \ + "${RANGER_HOME}/admin/install.properties" + echo "Audit store set to solr" + else + echo "Audit store set to opensearch (default)" + fi + cd "${RANGER_HOME}"/admin || exit if ./setup.sh; then diff --git a/dev-support/ranger-docker/scripts/opensearch/opensearch-jaas.conf b/dev-support/ranger-docker/scripts/opensearch/opensearch-jaas.conf deleted file mode 100644 index a8836a22580..00000000000 --- a/dev-support/ranger-docker/scripts/opensearch/opensearch-jaas.conf +++ /dev/null @@ -1,18 +0,0 @@ -Client { - com.sun.security.auth.module.Krb5LoginModule required - useKeyTab=true - storeKey=true - useTicketCache=false - keyTab="/etc/keytabs/opensearch.keytab" - principal="opensearch/ranger-opensearch.rangernw@EXAMPLE.COM"; -}; - -Server { - com.sun.security.auth.module.Krb5LoginModule required - useKeyTab=true - storeKey=true - useTicketCache=false - keyTab="/etc/keytabs/HTTP.keytab" - principal="HTTP/ranger-opensearch.rangernw@EXAMPLE.COM"; -}; - diff --git a/dev-support/ranger-docker/scripts/opensearch/opensearch.yml b/dev-support/ranger-docker/scripts/opensearch/opensearch.yml index 42b0e8898fa..56afcc2059a 100644 --- a/dev-support/ranger-docker/scripts/opensearch/opensearch.yml +++ b/dev-support/ranger-docker/scripts/opensearch/opensearch.yml @@ -27,8 +27,8 @@ transport.port: 9300 discovery.type: single-node # Path settings -path.data: /opt/opensearch/data -path.logs: /opt/opensearch/logs +path.data: /usr/share/opensearch/data +path.logs: /usr/share/opensearch/logs # Memory settings bootstrap.memory_lock: false @@ -48,6 +48,6 @@ http.cors.allow-headers: "X-Requested-With, Content-Type, Content-Length, Author # See opensearch-jaas.conf for Kerberos principal and keytab settings # JVM is configured with: -Djava.security.auth.login.config and -Djava.security.krb5.conf -# Wire-compatible with ES 7 REST client used by Ranger Admin -compatibility.override_main_response_version: true +# Ranger Admin uses the Elasticsearch low-level REST client (raw HTTP) which does not +# check server version — no compatibility override needed. diff --git a/dev-support/ranger-docker/scripts/opensearch/ranger-opensearch-setup.sh b/dev-support/ranger-docker/scripts/opensearch/ranger-opensearch-setup.sh deleted file mode 100755 index 4c8bd9700a9..00000000000 --- a/dev-support/ranger-docker/scripts/opensearch/ranger-opensearch-setup.sh +++ /dev/null @@ -1,32 +0,0 @@ -#!/bin/bash - -# Licensed to the Apache Software Foundation (ASF) under one -# or more contributor license agreements. See the NOTICE file -# distributed with this work for additional information -# regarding copyright ownership. The ASF licenses this file -# to you under the Apache License, Version 2.0 (the -# "License"); you may not use this file except in compliance -# with the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Wait for Kerberos keytabs (enabled by default) -if [ "${KERBEROS_ENABLED}" != "false" ] -then - echo "Kerberos is enabled, waiting for keytabs..." - ${RANGER_SCRIPTS}/wait_for_keytab.sh opensearch.keytab - ${RANGER_SCRIPTS}/wait_for_keytab.sh HTTP.keytab - ${RANGER_SCRIPTS}/wait_for_testusers_keytab.sh -else - echo "Kerberos is disabled" -fi - -# Set ownership -chown -R opensearch:hadoop ${OPENSEARCH_HOME}/ -echo "OpenSearch setup completed successfully" diff --git a/dev-support/ranger-docker/scripts/opensearch/ranger-opensearch.sh b/dev-support/ranger-docker/scripts/opensearch/ranger-opensearch.sh deleted file mode 100755 index 897060f8423..00000000000 --- a/dev-support/ranger-docker/scripts/opensearch/ranger-opensearch.sh +++ /dev/null @@ -1,38 +0,0 @@ -#!/bin/bash - -# Licensed to the Apache Software Foundation (ASF) under one -# or more contributor license agreements. See the NOTICE file -# distributed with this work for additional information -# regarding copyright ownership. The ASF licenses this file -# to you under the Apache License, Version 2.0 (the -# "License"); you may not use this file except in compliance -# with the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -if [ ! -e ${OPENSEARCH_HOME}/.setupDone ] -then - if /opt/ranger/ranger-opensearch-setup.sh; - then - touch "${OPENSEARCH_HOME}"/.setupDone - else - echo "OpenSearch Setup Script didn't complete proper execution." >&2 - exit 1 - fi -fi - -# Start OpenSearch as opensearch user with Kerberos enabled by default -if [ "${KERBEROS_ENABLED}" != "false" ]; then - echo "Starting OpenSearch with Kerberos authentication enabled..." - su -c "cd ${OPENSEARCH_HOME} && OPENSEARCH_JAVA_OPTS=\"${OPENSEARCH_JAVA_OPTS} -Djava.security.krb5.conf=/etc/krb5.conf -Djava.security.auth.login.config=/opt/opensearch/config/opensearch-jaas.conf\" ./bin/opensearch" opensearch -else - echo "Starting OpenSearch without Kerberos..." - su -c "cd ${OPENSEARCH_HOME} && ./bin/opensearch" opensearch -fi -