Skip to content

RANGER-5728: Update stress_kms script to run against Keberos enabled . #1143

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vikaskr22 wants to merge 1 commit into
base: master
Choose a base branch
from
+36 −5
Open

RANGER-5728: Update stress_kms script to run against Keberos enabled . #1143

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 36 additions & 5 deletions ranger-tools/src/main/python/stress/stress_kms.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,21 +29,37 @@
# This script requires Python package apache_ranger to be present.
# The package can be installed using following command:
# pip3 install --upgrade apache_ranger
#
# If KMS is running with Kerberos, then 'requests-kerberos' package is required and can be installed using following command:
# pip3 install requests-kerberos

##
## This script calls KMS APIs from multiple-threads
##
## parameters:
## kms_url: URL to Apache Ranger admin server
## kms_auth: authentication to connect to Apache Ranger admin server
## kms_auth_type: authentication mode used to connect to Ranger KMS
## 'simple' - Hadoop simple auth; identity is taken
## from `kms_user`.
## 'kerberos' - SPNEGO/Kerberos auth; identity is taken
## from the caller's Kerberos ticket cache
## (run `kinit` before starting the script).
## Requires the `requests-kerberos` package.
## kms_user: user name to pass when kms_auth_type == 'simple'.
## Ignored in kerberos mode.
## key_count number of keys to create
## rollover_key_count: number of times each key to be rolled over
## encrypted_key_count: number of encrypted keys to generate per key
## thread_count: number of threads to call Apache Ranger APIs from
##
kms_url = 'http://localhost:9292'
kms_auth = HadoopSimpleAuth('keyadmin')
kms_auth_type = 'kerberos' # 'simple' | 'kerberos'

@mneethiraj mneethiraj Aug 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is use of kms_auth_type necessary? To keep this script simple, I suggest directly setting kms_auth in line 81 below:

# use Hadoop simple authentication
kms_auth = HadoopSimpleAuth(kms_user)

# uncomment following 2 lines to use Kerberos authentication
# from requests_kerberos import HTTPKerberosAuth, DISABLED
# kms_auth = HTTPKerberosAuth(mutual_authentication=DISABLED)

@vikaskr22 vikaskr22 Aug 10, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for the review @mneethiraj .

Actually I simply tried to keep all the parameters that can be modified at one place, this way it remains consistent with other params like kms_user, kms_url etc.
With explicit kms_auth_type along with description , it would be clear for the new user that this part is configurable. Making inline changes is also fine, but to me it seems making changes in the execution logic.

It's only about convention, please let me know your thoughts, I will change it.

@mneethiraj mneethiraj Aug 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@vikaskr22 - the comments have become too noisy, hence my suggestion to keeps the code simple for humans to read. I would suggest only the following 2 changes:

  1. add following at the top of the file (not much value in "optimizing" to import only when using Kerbeors
from requests_kerberos import HTTPKerberosAuth, DISABLED
  1. Change kms_auth initialization to following:
kms_auth = HadoopSimpleAuth(kms_user)
# for kerberos:
# kms_auth = HTTPKerberosAuth(mutual_authentication=DISABLED)

kms_user = 'keyadmin' # used only when kms_auth_type == 'simple'

## Following instructions may be useful when KMS is running in Docker and auth_type is Kerberos :
## Use Docker network hostname in URL instead of localhost, like, 'http://ranger-kms.rangernw:9292'
## Docker network hostname should be resolved to an IP.
## On local system, update '/etc/hosts' to contain following entry:
## 127.0.0.1 ranger-kms.rangernw ranger-kdc.rangernw ranger.rangernw
kms_url = 'http://ranger-kms.rangernw:9292'
key_count = 320
rollover_key_count = 10
encrypted_key_count = 6
Expand All @@ -52,6 +68,19 @@
key_prefix = 'test_'


def _build_kms_auth(auth_type):
if auth_type == 'simple':
return HadoopSimpleAuth(kms_user)
if auth_type == 'kerberos':
# Imported lazily so simple-mode users don't need requests-kerberos installed.
from requests_kerberos import HTTPKerberosAuth, DISABLED
return HTTPKerberosAuth(mutual_authentication=DISABLED)
raise ValueError('unsupported kms_auth_type: %s (expected "simple" or "kerberos")' % auth_type)


kms_auth = _build_kms_auth(kms_auth_type)


##
## Setup logging
## following configuration writes logs to console and file stress_kms.log
Expand Down Expand Up @@ -141,7 +170,9 @@ def run_client(idxClient, t):
LOG.info("*******************************")
LOG.info("")
LOG.info("PARAM: kms_url = %s", kms_url)
LOG.info("PARAM: kms_auth = %s", kms_auth)
LOG.info("PARAM: kms_auth_type = %s", kms_auth_type)
if kms_auth_type == 'simple':
LOG.info("PARAM: kms_user = %s", kms_user)
LOG.info("PARAM: key_count = %s", key_count)
LOG.info("PARAM: rollover_key_count = %s", rollover_key_count)
LOG.info("PARAM: encrypted_key_count = %s", encrypted_key_count)
Expand Down
Loading