Skip to content

Commit 579e2cb

Browse files
mneethirajmneethiraj
authored
RANGER-5451: Docker setup update to configure Ranger authorization in Solr (#810)
1 parent 12fd37e commit 579e2cb

16 files changed

Lines changed: 168 additions & 21 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,7 @@ jobs:
119119
mv ranger-*-usersync.tar.gz dev-support/ranger-docker/dist
120120
mv ranger-*-tagsync.tar.gz dev-support/ranger-docker/dist
121121
mv ranger-*-kms.tar.gz dev-support/ranger-docker/dist
122+
mv ranger-*-solr-plugin.tar.gz dev-support/ranger-docker/dist
122123
mv version dev-support/ranger-docker/dist
123124
rm -f ranger-*.tar.gz # clean up workspace
124125

‎dev-support/ranger-docker/.dockerignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,5 +13,6 @@
1313
!dist/ranger-*-knox-plugin.tar.gz
1414
!dist/ranger-*-trino-plugin.tar.gz
1515
!dist/ranger-*-ozone-plugin.tar.gz
16+
!dist/ranger-*-solr-plugin.tar.gz
1617
!downloads/*
1718
!scripts/*

‎dev-support/ranger-docker/.env‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,8 @@ USERSYNC_VERSION=3.0.0-SNAPSHOT
4848
TAGSYNC_VERSION=3.0.0-SNAPSHOT
4949

5050
# Solr Configuration
51-
SOLR_VERSION=8.11.2
51+
SOLR_VERSION=8.11.3
52+
SOLR_PLUGIN_VERSION=3.0.0-SNAPSHOT
5253

5354
# Zookeeper Configuration
5455
ZK_VERSION=3.9.2

‎dev-support/ranger-docker/Dockerfile.ranger-solr‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,15 @@
1717
ARG SOLR_VERSION
1818
FROM solr:${SOLR_VERSION}
1919

20+
ARG SOLR_PLUGIN_VERSION
21+
2022
VOLUME /etc/keytabs
2123

22-
# Copy audit config set
2324
USER 0
2425

2526
RUN apt update && DEBIAN_FRONTEND="noninteractive" apt-get install -y krb5-user
2627

28+
# Copy audit config set
2729
RUN mkdir -p /opt/solr/server/solr/configsets/ranger_audits/conf /home/ranger/scripts
2830

2931
COPY ./scripts/solr/solr-ranger_audits/* /opt/solr/server/solr/configsets/ranger_audits/conf/
@@ -37,5 +39,18 @@ COPY ./scripts/kdc/krb5.conf /etc/krb5.conf
3739
RUN chown -R solr:solr /opt/solr/server/solr/configsets/ranger_audits/
3840
RUN chmod +x /home/ranger/scripts/ranger-solr.sh /home/ranger/scripts/wait_for_keytab.sh /home/ranger/scripts/wait_for_testusers_keytab.sh
3941

42+
# Copy Ranger plugin
43+
RUN mkdir -p /opt/ranger /home/ranger/dist /home/ranger/scripts
44+
45+
COPY ./dist/ranger-${SOLR_PLUGIN_VERSION}-solr-plugin.tar.gz /home/ranger/dist/
46+
COPY ./scripts/solr/core-site.xml /home/ranger/scripts/
47+
COPY ./scripts/solr/ranger-solr-plugin-install.properties /home/ranger/scripts/
48+
49+
RUN tar xvfz /home/ranger/dist/ranger-${SOLR_PLUGIN_VERSION}-solr-plugin.tar.gz --directory=/opt/ranger && \
50+
ln -s /opt/ranger/ranger-${SOLR_PLUGIN_VERSION}-solr-plugin /opt/ranger/ranger-solr-plugin && \
51+
rm -f /home/ranger/dist/ranger-${SOLR_PLUGIN_VERSION}-solr-plugin.tar.gz && \
52+
cp -f /home/ranger/scripts/ranger-solr-plugin-install.properties /opt/ranger/ranger-solr-plugin/install.properties && \
53+
chown -R solr:solr /opt/ranger
54+
4055
ENTRYPOINT [ "/home/ranger/scripts/ranger-solr.sh" ]
4156
CMD ["solr-foreground"]

‎dev-support/ranger-docker/docker-compose.ranger.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,7 @@ services:
9898
dockerfile: Dockerfile.ranger-solr
9999
args:
100100
- SOLR_VERSION=${SOLR_VERSION}
101+
- SOLR_PLUGIN_VERSION=${SOLR_PLUGIN_VERSION}
101102
- KERBEROS_ENABLED=${KERBEROS_ENABLED}
102103
image: ranger-solr
103104
container_name: ranger-solr

‎dev-support/ranger-docker/scripts/admin/create-ranger-services.py‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,16 @@ def service_not_exists(service):
117117
'userstore.download.auth.users': 'ozone',
118118
'ranger.plugin.ozone.policy.refresh.synchronous':'true'}})
119119

120-
services = [hdfs, yarn, hive, hbase, kafka, knox, kms, trino, ozone]
120+
solr = RangerService({'name': 'dev_solr', 'type': 'solr',
121+
'configs': {'username': 'solr', 'password': 'rangerR0cks!',
122+
'solr.url': 'http://ranger-solr.rangernw:8983',
123+
'policy.download.auth.users': 'solr',
124+
'tag.download.auth.users': 'solr',
125+
'userstore.download.auth.users': 'solr',
126+
'ranger.plugin.super.users': 'solr',
127+
'ranger.plugin.solr.policy.refresh.synchronous':'true'}})
128+
129+
services = [hdfs, yarn, hive, hbase, kafka, knox, kms, trino, ozone, solr]
121130
for service in services:
122131
try:
123132
if service_not_exists(service):

‎dev-support/ranger-docker/scripts/kdc/entrypoint.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@ function create_keytabs() {
9999

100100
create_principal_and_keytab knox ranger-knox
101101

102+
create_principal_and_keytab solr ranger-solr
102103
create_principal_and_keytab HTTP ranger-solr
103104

104105
create_principal_and_keytab zookeeper ranger-zk

‎dev-support/ranger-docker/scripts/solr/core-site.xml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<configuration>
3+
<property>
4+
<name>hadoop.security.authentication</name>
5+
<value>kerberos</value>
6+
</property>
7+
</configuration>

‎dev-support/ranger-docker/scripts/solr/ranger-solr-plugin-install.properties‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one or more
2+
# contributor license agreements. See the NOTICE file distributed with
3+
# this work for additional information regarding copyright ownership.
4+
# The ASF licenses this file to You under the Apache License, Version 2.0
5+
# (the "License"); you may not use this file except in compliance with
6+
# the License. You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
POLICY_MGR_URL=http://ranger:6080
17+
REPOSITORY_NAME=dev_solr
18+
COMPONENT_INSTALL_DIR_NAME=/opt/solr/server
19+
UGI_INITIALIZE=true
20+
UGI_LOGIN_TYPE=jaas
21+
UGI_JAAS_APPCONFIG=Client
22+
23+
XAAUDIT.SOLR.IS_ENABLED=true
24+
XAAUDIT.SOLR.MAX_QUEUE_SIZE=1
25+
XAAUDIT.SOLR.MAX_FLUSH_INTERVAL_MS=1000
26+
XAAUDIT.SOLR.SOLR_URL=http://ranger-solr:8983/solr/ranger_audits
27+
28+
# Following properties are needed to get past installation script! Please don't remove
29+
XAAUDIT.HDFS.IS_ENABLED=false
30+
XAAUDIT.HDFS.DESTINATION_DIRECTORY=/ranger/audit
31+
XAAUDIT.HDFS.DESTINTATION_FILE=solr
32+
XAAUDIT.HDFS.DESTINTATION_FLUSH_INTERVAL_SECONDS=900
33+
XAAUDIT.HDFS.DESTINTATION_ROLLOVER_INTERVAL_SECONDS=86400
34+
XAAUDIT.HDFS.DESTINTATION_OPEN_RETRY_INTERVAL_SECONDS=60
35+
XAAUDIT.HDFS.LOCAL_BUFFER_DIRECTORY=/var/log/solr/audit
36+
XAAUDIT.HDFS.LOCAL_ARCHIVE_DIRECTORY=/var/log/solr/audit/archive
37+
XAAUDIT.HDFS.LOCAL_BUFFER_FILE=%time:yyyyMMdd-HHmm.ss%.log
38+
XAAUDIT.HDFS.LOCAL_BUFFER_FLUSH_INTERVAL_SECONDS=60
39+
XAAUDIT.HDFS.LOCAL_BUFFER_ROLLOVER_INTERVAL_SECONDS=600
40+
XAAUDIT.HDFS.LOCAL_ARCHIVE_MAX_FILE_COUNT=10
41+
42+
XAAUDIT.SOLR.ENABLE=true
43+
XAAUDIT.SOLR.URL=http://ranger-solr:8983/solr/ranger_audits
44+
XAAUDIT.SOLR.USER=NONE
45+
XAAUDIT.SOLR.PASSWORD=NONE
46+
XAAUDIT.SOLR.ZOOKEEPER=NONE
47+
XAAUDIT.SOLR.FILE_SPOOL_DIR=/var/log/solr/audit/solr/spool
48+
XAAUDIT.SOLR.USE_INMEMORY_JAAS_CFG=true
49+
50+
XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_NAME=com.sun.security.auth.module.Krb5LoginModule
51+
XAAUDIT.JAAS.CLIENT.LOGIN_MODULE_CONTROL_FLAG=required
52+
XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=true
53+
XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=true
54+
XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=true
55+
XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=solr
56+
XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/etc/keytabs/solr.keytab
57+
XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=solr/ranger-solr.rangernw@EXAMPLE.COM
58+
59+
XAAUDIT.ELASTICSEARCH.ENABLE=false
60+
XAAUDIT.ELASTICSEARCH.URL=NONE
61+
XAAUDIT.ELASTICSEARCH.USER=NONE
62+
XAAUDIT.ELASTICSEARCH.PASSWORD=NONE
63+
XAAUDIT.ELASTICSEARCH.INDEX=NONE
64+
XAAUDIT.ELASTICSEARCH.PORT=NONE
65+
XAAUDIT.ELASTICSEARCH.PROTOCOL=NONE
66+
67+
XAAUDIT.HDFS.ENABLE=true
68+
XAAUDIT.HDFS.HDFS_DIR=hdfs://ranger-hadoop:9000/ranger/audit
69+
XAAUDIT.HDFS.FILE_SPOOL_DIR=/var/log/solr/audit/hdfs/spool
70+
71+
XAAUDIT.HDFS.AZURE_ACCOUNTNAME=__REPLACE_AZURE_ACCOUNT_NAME
72+
XAAUDIT.HDFS.AZURE_ACCOUNTKEY=__REPLACE_AZURE_ACCOUNT_KEY
73+
XAAUDIT.HDFS.AZURE_SHELL_KEY_PROVIDER=__REPLACE_AZURE_SHELL_KEY_PROVIDER
74+
XAAUDIT.HDFS.AZURE_ACCOUNTKEY_PROVIDER=__REPLACE_AZURE_ACCOUNT_KEY_PROVIDER
75+
76+
XAAUDIT.LOG4J.ENABLE=false
77+
XAAUDIT.LOG4J.IS_ASYNC=false
78+
XAAUDIT.LOG4J.ASYNC.MAX.QUEUE.SIZE=10240
79+
XAAUDIT.LOG4J.ASYNC.MAX.FLUSH.INTERVAL.MS=30000
80+
XAAUDIT.LOG4J.DESTINATION.LOG4J=false
81+
XAAUDIT.LOG4J.DESTINATION.LOG4J.LOGGER=xaaudit
82+
83+
XAAUDIT.AMAZON_CLOUDWATCH.ENABLE=false
84+
XAAUDIT.AMAZON_CLOUDWATCH.LOG_GROUP=NONE
85+
XAAUDIT.AMAZON_CLOUDWATCH.LOG_STREAM_PREFIX=NONE
86+
XAAUDIT.AMAZON_CLOUDWATCH.FILE_SPOOL_DIR=NONE
87+
XAAUDIT.AMAZON_CLOUDWATCH.REGION=NONE
88+
89+
SSL_KEYSTORE_FILE_PATH=/etc/solr/conf/ranger-plugin-keystore.jks
90+
SSL_KEYSTORE_PASSWORD=myKeyFilePassword
91+
SSL_TRUSTSTORE_FILE_PATH=/etc/solr/conf/ranger-plugin-truststore.jks
92+
SSL_TRUSTSTORE_PASSWORD=changeit

‎dev-support/ranger-docker/scripts/solr/ranger-solr.sh‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -18,19 +18,12 @@
1818

1919
SOLR_INSTALL_DIR=/opt/solr
2020

21-
if [ ! -e ${SOLR_INSTALL_DIR}/.setupDone ]
22-
then
23-
if [ "${KERBEROS_ENABLED}" == "true" ]
24-
then
25-
${RANGER_SCRIPTS}/wait_for_keytab.sh HTTP.keytab
26-
${RANGER_SCRIPTS}/wait_for_testusers_keytab.sh
27-
fi
28-
29-
touch "${SOLR_INSTALL_DIR}"/.setupDone
30-
fi
31-
3221
if [ "${KERBEROS_ENABLED}" == "true" ]
3322
then
23+
/home/ranger/scripts/wait_for_keytab.sh HTTP.keytab
24+
/home/ranger/scripts/wait_for_keytab.sh solr.keytab
25+
/home/ranger/scripts/wait_for_testusers_keytab.sh
26+
3427
JAAS_CONFIG="-Djava.security.auth.login.config=/opt/solr/server/etc/jaas.conf"
3528
JAAS_APPNAME="-Dsolr.kerberos.jaas.appname=Client"
3629
KRB5_CONF="-Djava.security.krb5.conf=/etc/krb5.conf"
@@ -45,4 +38,14 @@ DEFAULT"
4538
export SOLR_AUTHENTICATION_OPTS="${JAAS_CONFIG} ${JAAS_APPNAME} ${KRB5_CONF} ${KERBEROS_KEYTAB} ${KERBEROS_PRINCIPAL} ${COOKIE_DOMAIN} ${KERBEROS_NAME_RULES}"
4639
fi
4740

41+
if [ ! -e ${SOLR_INSTALL_DIR}/.setupDone ]
42+
then
43+
cd /opt/ranger/ranger-solr-plugin
44+
./enable-solr-plugin.sh
45+
46+
cp /home/ranger/scripts/core-site.xml /opt/solr/server/resources/
47+
48+
touch "${SOLR_INSTALL_DIR}"/.setupDone
49+
fi
50+
4851
su -p -c "export PATH=${PATH} && /opt/docker-solr/scripts/docker-entrypoint.sh $*" solr

0 commit comments

Comments
 (0)