Return-Path: X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183]) by cust-asf2.ponee.io (Postfix) with ESMTP id 5687D200CAA for ; Fri, 12 May 2017 21:11:49 +0200 (CEST) Received: by cust-asf.ponee.io (Postfix) id 55115160BC8; Fri, 12 May 2017 19:11:49 +0000 (UTC) Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by cust-asf.ponee.io (Postfix) with SMTP id 26E9C160BD2 for ; Fri, 12 May 2017 21:11:46 +0200 (CEST) Received: (qmail 12739 invoked by uid 500); 12 May 2017 19:11:46 -0000 Mailing-List: contact commits-help@ambari.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: ambari-dev@ambari.apache.org Delivered-To: mailing list commits@ambari.apache.org Received: (qmail 12252 invoked by uid 99); 12 May 2017 19:11:45 -0000 Received: from git1-us-west.apache.org (HELO git1-us-west.apache.org) (140.211.11.23) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 12 May 2017 19:11:45 +0000 Received: by git1-us-west.apache.org (ASF Mail Server at git1-us-west.apache.org, from userid 33) id 8F829EF9A9; Fri, 12 May 2017 19:11:45 +0000 (UTC) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: jluniya@apache.org To: commits@ambari.apache.org Date: Fri, 12 May 2017 19:11:55 -0000 Message-Id: In-Reply-To: References: X-Mailer: ASF-Git Admin Mailer Subject: [11/16] ambari git commit: AMBARI-20985. HDP 3.0 TP - create service definition for Ranger with configs, kerberos, widgets, etc.(vbrodetskyi) archived-at: Fri, 12 May 2017 19:11:49 -0000 AMBARI-20985. HDP 3.0 TP - create service definition for Ranger with configs, kerberos, widgets, etc.(vbrodetskyi) Project: http://git-wip-us.apache.org/repos/asf/ambari/repo Commit: http://git-wip-us.apache.org/repos/asf/ambari/commit/260ee2ef Tree: http://git-wip-us.apache.org/repos/asf/ambari/tree/260ee2ef Diff: http://git-wip-us.apache.org/repos/asf/ambari/diff/260ee2ef Branch: refs/heads/branch-feature-AMBARI-14714 Commit: 260ee2efc131c8dd0d5e4d9aa960eafb6b3d62ce Parents: 4e6babd Author: Vitaly Brodetskyi Authored: Fri May 12 13:47:33 2017 +0300 Committer: Vitaly Brodetskyi Committed: Fri May 12 13:47:33 2017 +0300 ---------------------------------------------------------------------- .../RANGER/0.7.0.3.0/alerts.json | 76 + .../0.7.0.3.0/configuration/admin-log4j.xml | 132 ++ .../configuration/admin-properties.xml | 163 ++ .../configuration/atlas-tagsync-ssl.xml | 72 + .../configuration/ranger-admin-site.xml | 785 ++++++++ .../0.7.0.3.0/configuration/ranger-env.xml | 513 +++++ .../0.7.0.3.0/configuration/ranger-site.xml | 30 + .../configuration/ranger-solr-configuration.xml | 59 + .../ranger-tagsync-policymgr-ssl.xml | 72 + .../configuration/ranger-tagsync-site.xml | 206 ++ .../configuration/ranger-ugsync-site.xml | 574 ++++++ .../tagsync-application-properties.xml | 62 + .../0.7.0.3.0/configuration/tagsync-log4j.xml | 90 + .../0.7.0.3.0/configuration/usersync-log4j.xml | 89 + .../configuration/usersync-properties.xml | 32 + .../RANGER/0.7.0.3.0/kerberos.json | 153 ++ .../RANGER/0.7.0.3.0/metainfo.xml | 189 ++ .../alerts/alert_ranger_admin_passwd_check.py | 195 ++ .../RANGER/0.7.0.3.0/package/scripts/params.py | 448 +++++ .../0.7.0.3.0/package/scripts/ranger_admin.py | 217 ++ .../0.7.0.3.0/package/scripts/ranger_service.py | 69 + .../0.7.0.3.0/package/scripts/ranger_tagsync.py | 139 ++ .../package/scripts/ranger_usersync.py | 124 ++ .../0.7.0.3.0/package/scripts/service_check.py | 49 + .../0.7.0.3.0/package/scripts/setup_ranger.py | 153 ++ .../package/scripts/setup_ranger_xml.py | 853 ++++++++ .../0.7.0.3.0/package/scripts/status_params.py | 39 + .../RANGER/0.7.0.3.0/package/scripts/upgrade.py | 31 + .../templates/input.config-ranger.json.j2 | 79 + .../package/templates/ranger_admin_pam.j2 | 22 + .../package/templates/ranger_remote_pam.j2 | 22 + .../package/templates/ranger_solr_jaas_conf.j2 | 26 + .../properties/ranger-solrconfig.xml.j2 | 1874 ++++++++++++++++++ .../RANGER/0.7.0.3.0/quicklinks/quicklinks.json | 41 + .../RANGER/0.7.0.3.0/role_command_order.json | 9 + .../0.7.0.3.0/themes/theme_version_1.json | 722 +++++++ .../0.7.0.3.0/themes/theme_version_2.json | 1470 ++++++++++++++ .../0.7.0.3.0/themes/theme_version_3.json | 692 +++++++ .../0.7.0.3.0/themes/theme_version_5.json | 48 + .../stacks/HDP/3.0/services/RANGER/metainfo.xml | 27 + 40 files changed, 10646 insertions(+) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/ambari/blob/260ee2ef/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/alerts.json ---------------------------------------------------------------------- diff --git a/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/alerts.json b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/alerts.json new file mode 100644 index 0000000..ab473a8 --- /dev/null +++ b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/alerts.json @@ -0,0 +1,76 @@ +{ + "RANGER": { + "service": [], + "RANGER_ADMIN": [ + { + "name": "ranger_admin_process", + "label": "Ranger Admin Process", + "description": "This host-level alert is triggered if the Ranger Admin Web UI is unreachable.", + "interval": 1, + "scope": "ANY", + "source": { + "type": "WEB", + "uri": { + "http": "{{admin-properties/policymgr_external_url}}/login.jsp", + "https": "{{admin-properties/policymgr_external_url}}/login.jsp", + "kerberos_keytab": "{{cluster-env/smokeuser_keytab}}", + "kerberos_principal": "{{cluster-env/smokeuser_principal_name}}", + "https_property": "{{ranger-admin-site/ranger.service.https.attrib.ssl.enabled}}", + "https_property_value": "true", + "connection_timeout": 5.0 + }, + "reporting": { + "ok": { + "text": "HTTP {0} response in {2:.3f}s" + }, + "warning": { + "text": "HTTP {0} response from {1} in {2:.3f}s ({3})" + }, + "critical": { + "text": "Connection failed to {1} ({3})" + } + } + } + }, + { + "name": "ranger_admin_password_check", + "label": "Ranger Admin password check", + "description": "This alert is used to ensure that the Ranger Admin password in Ambari is correct.", + "interval": 30, + "scope": "ANY", + "source": { + "type": "SCRIPT", + "path": "RANGER/0.4.0/package/alerts/alert_ranger_admin_passwd_check.py", + "parameters": [] + } + } + ], + "RANGER_USERSYNC": [ + { + "name": "ranger_usersync_process", + "label": "Ranger Usersync Process", + "description": "This host-level alert is triggered if the Ranger Usersync cannot be determined to be up.", + "interval": 1, + "scope": "HOST", + "source": { + "type": "PORT", + "uri": "{{ranger-ugsync-site/ranger.usersync.port}}", + "default_port": 5151, + "reporting": { + "ok": { + "text": "TCP OK - {0:.3f}s response on port {1}" + }, + "warning": { + "text": "TCP OK - {0:.3f}s response on port {1}", + "value": 1.5 + }, + "critical": { + "text": "Connection failed: {0} to {1}:{2}", + "value": 5.0 + } + } + } + } + ] + } +} \ No newline at end of file http://git-wip-us.apache.org/repos/asf/ambari/blob/260ee2ef/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/admin-log4j.xml ---------------------------------------------------------------------- diff --git a/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/admin-log4j.xml b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/admin-log4j.xml new file mode 100644 index 0000000..fbbfac7 --- /dev/null +++ b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/admin-log4j.xml @@ -0,0 +1,132 @@ + + + + + ranger_xa_log_maxfilesize + 256 + The maximum size of backup file before the log is rotated + Ranger Log: backup file size + + MB + + + + + ranger_xa_log_maxbackupindex + 20 + The number of backup files + Ranger Log: # of backup files + + int + 0 + + + + + content + admin-log4j template + admin-log4j.properties + +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + + +log4j.rootLogger = warn,xa_log_appender + + +# xa_logger +log4j.appender.xa_log_appender=org.apache.log4j.DailyRollingFileAppender +log4j.appender.xa_log_appender.file=${logdir}/xa_portal.log +log4j.appender.xa_log_appender.datePattern='.'yyyy-MM-dd +log4j.appender.xa_log_appender.append=true +log4j.appender.xa_log_appender.layout=org.apache.log4j.PatternLayout +log4j.appender.xa_log_appender.layout.ConversionPattern=%d [%t] %-5p %C{6} (%F:%L) - %m%n +log4j.appender.xa_log_appender.MaxFileSize={{ranger_xa_log_maxfilesize}}MB +log4j.appender.xa_log_appender.MaxBackupIndex={{ranger_xa_log_maxbackupindex}} + +# xa_log_appender : category and additivity +log4j.category.org.springframework=warn,xa_log_appender +log4j.additivity.org.springframework=false + +log4j.category.org.apache.ranger=info,xa_log_appender +log4j.additivity.org.apache.ranger=false + +log4j.category.xa=info,xa_log_appender +log4j.additivity.xa=false + +# perf_logger +log4j.appender.perf_appender=org.apache.log4j.DailyRollingFileAppender +log4j.appender.perf_appender.file=${logdir}/ranger_admin_perf.log +log4j.appender.perf_appender.datePattern='.'yyyy-MM-dd +log4j.appender.perf_appender.append=true +log4j.appender.perf_appender.layout=org.apache.log4j.PatternLayout +log4j.appender.perf_appender.layout.ConversionPattern=%d [%t] %m%n + + +# sql_appender +log4j.appender.sql_appender=org.apache.log4j.DailyRollingFileAppender +log4j.appender.sql_appender.file=${logdir}/xa_portal_sql.log +log4j.appender.sql_appender.datePattern='.'yyyy-MM-dd +log4j.appender.sql_appender.append=true +log4j.appender.sql_appender.layout=org.apache.log4j.PatternLayout +log4j.appender.sql_appender.layout.ConversionPattern=%d [%t] %-5p %C{6} (%F:%L) - %m%n + +# sql_appender : category and additivity +log4j.category.org.hibernate.SQL=warn,sql_appender +log4j.additivity.org.hibernate.SQL=false + +log4j.category.jdbc.sqlonly=fatal,sql_appender +log4j.additivity.jdbc.sqlonly=false + +log4j.category.jdbc.sqltiming=warn,sql_appender +log4j.additivity.jdbc.sqltiming=false + +log4j.category.jdbc.audit=fatal,sql_appender +log4j.additivity.jdbc.audit=false + +log4j.category.jdbc.resultset=fatal,sql_appender +log4j.additivity.jdbc.resultset=false + +log4j.category.jdbc.connection=fatal,sql_appender +log4j.additivity.jdbc.connection=false + + + content + false + + + + http://git-wip-us.apache.org/repos/asf/ambari/blob/260ee2ef/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/admin-properties.xml ---------------------------------------------------------------------- diff --git a/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/admin-properties.xml b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/admin-properties.xml new file mode 100644 index 0000000..1d73087 --- /dev/null +++ b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/admin-properties.xml @@ -0,0 +1,163 @@ + + + + + + + + SQL_CONNECTOR_JAR + {{driver_curl_target}} + Location of Sql Connector Jar + Location of DB client library (please check the location of the jar file) + + false + + + + admin-properties + DB_FLAVOR + + + + + + db_root_user + root + Database Administrator (DBA) username + Database admin user. This user should have DBA permission to create the Ranger Database and Ranger Database User + + false + + + + + db_root_password + + PASSWORD + Database Administrator (DBA) password + Database password for the database admin username + + password + false + + + + + db_host + + Ranger DB host + Database host + + false + + + + + db_name + ranger + Ranger DB name + Database name + + false + + + + + db_user + rangeradmin + Ranger DB username + Database username used for the Ranger schema + + false + + + + + db_password + + PASSWORD + Ranger DB password + Database password for the Ranger schema + + password + false + + + + + DB_FLAVOR + MYSQL + DB FLAVOR + The database type to be used (mysql/oracle) + + false + value-list + + + MYSQL + + + + ORACLE + + + + POSTGRES + + + + MSSQL + + + + SQLA + + + + 1 + + + + + policymgr_external_url + + External URL + Policy Manager external url eg: http://RANGER_HOST:6080 + + false + + + + ranger-admin-site + ranger.service.http.enabled + + + ranger-admin-site + ranger.service.http.port + + + ranger-admin-site + ranger.service.https.port + + + + + http://git-wip-us.apache.org/repos/asf/ambari/blob/260ee2ef/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/atlas-tagsync-ssl.xml ---------------------------------------------------------------------- diff --git a/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/atlas-tagsync-ssl.xml b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/atlas-tagsync-ssl.xml new file mode 100644 index 0000000..d43c010 --- /dev/null +++ b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/atlas-tagsync-ssl.xml @@ -0,0 +1,72 @@ + + + + + xasecure.policymgr.clientssl.keystore + /etc/security/serverKeys/atlas-tagsync-keystore.jks + Java Keystore files + + + + + xasecure.policymgr.clientssl.keystore.password + myKeyFilePassword + PASSWORD + password for keystore + + password + + + + + + xasecure.policymgr.clientssl.truststore + /etc/security/serverKeys/atlas-tagsync-mytruststore.jks + java truststore file + + + + + xasecure.policymgr.clientssl.truststore.password + changeit + PASSWORD + java truststore password + + password + + + + + + xasecure.policymgr.clientssl.keystore.credential.file + jceks://file{{atlas_tagsync_credential_file}} + java keystore credential file + + + + + xasecure.policymgr.clientssl.truststore.credential.file + jceks://file{{atlas_tagsync_credential_file}} + java truststore credential file + + + + http://git-wip-us.apache.org/repos/asf/ambari/blob/260ee2ef/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-admin-site.xml ---------------------------------------------------------------------- diff --git a/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-admin-site.xml b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-admin-site.xml new file mode 100644 index 0000000..a9153f8 --- /dev/null +++ b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-admin-site.xml @@ -0,0 +1,785 @@ + + + + + ranger.service.host + {{ranger_host}} + Host where ranger service to be installed + + + + ranger.service.http.enabled + true + HTTP enabled + Enable HTTP + + false + boolean + + + + + ranger.service.http.port + 6080 + HTTP port + + + + ranger.service.https.port + 6182 + HTTPS port (if SSL is enabled) + + + + ranger.service.https.attrib.ssl.enabled + false + true/false, set to true if using SSL + + + + ranger.service.https.attrib.clientAuth + want + Needs to be set to want for two way SSL + + + + ranger.service.https.attrib.keystore.keyalias + rangeradmin + Alias for Ranger Admin key in keystore + + + + ranger.service.https.attrib.keystore.pass + xasecure + PASSWORD + Password for keystore + + password + + + + + ranger.https.attrib.keystore.file + /etc/ranger/admin/conf/ranger-admin-keystore.jks + Ranger admin keystore (specify full path) + + + + ranger.externalurl + {{ranger_external_url}} + External URL + URL to be used by clients to access ranger admin + + false + false + + + + + ranger.jpa.jdbc.driver + com.mysql.jdbc.Driver + Driver class name for a JDBC Ranger database + JDBC driver class name. Example: For MySQL / MariaDB: com.mysql.jdbc.Driver, For Oracle: oracle.jdbc.OracleDriver + + false + + + + admin-properties + DB_FLAVOR + + + + + + ranger.jpa.jdbc.url + jdbc:mysql://localhost + JDBC connect string for a Ranger database + JDBC connect string + + false + + + + admin-properties + DB_FLAVOR + + + admin-properties + db_host + + + admin-properties + db_name + + + + + + ranger.jpa.jdbc.user + {{ranger_db_user}} + JDBC user + + + + ranger.jpa.jdbc.password + _ + PASSWORD + JDBC password + + password + + + + + ranger.jpa.jdbc.credential.alias + rangeradmin + Alias name for storing JDBC password + + + + ranger.credential.provider.path + /etc/ranger/admin/rangeradmin.jceks + File for credential store, provide full file path + + + + ranger.audit.source.type + solr + db or solr, based on the audit destination used + + + ranger-env + xasecure.audit.destination.solr + + + ranger-env + xasecure.audit.destination.db + + + + + + ranger.audit.solr.urls + + Solr url for audit. Example: http://solr_host:6083/solr/ranger_audits + + + + ranger.authentication.method + UNIX + Authentication method + Ranger admin Authentication - UNIX/PAM/LDAP/AD/NONE + + false + + + + ranger-ugsync-site + ranger.usersync.source.impl.class + + + + + + ranger.ldap.url + ​LDAP URL + {{ranger_ug_ldap_url}} + LDAP Server URL, only used if Authentication method is LDAP + + false + + + + + ranger.ldap.user.dnpattern + uid={0},ou=users,dc=xasecure,dc=net + LDAP user DN, only used if Authentication method is LDAP + + false + + + + + ranger.ldap.group.searchbase + Group Search Base + {{ranger_ug_ldap_group_searchbase}} + LDAP group searchbase, only used if Authentication method is LDAP + + + + ranger.ldap.group.searchfilter + Group Search Filter + {{ranger_ug_ldap_group_searchfilter}} + LDAP group search filter, only used if Authentication method is LDAP + + + + + ranger.ldap.group.roleattribute + cn + LDAP group role attribute, only used if Authentication method is LDAP + + false + + + + + ranger.ldap.base.dn + dc=example,dc=com + The Distinguished Name (DN) of the starting point for directory server searches. + + false + + + + + ranger.ldap.bind.dn + Bind User + {{ranger_ug_ldap_bind_dn}} + Full distinguished name (DN), including common name (CN), of an LDAP user account that has privileges to search for users. + + false + + + + + ranger.ldap.bind.password + ​Bind User Password + {{ranger_usersync_ldap_ldapbindpassword}} + PASSWORD + Password for the account that can search for users + + password + false + + + + + ranger.ldap.referral + ignore + Set to follow if multiple LDAP servers are configured to return continuation references for results. Set to ignore (default) if no referrals should be followed. Possible values are follow|throw|ignore + + false + + + + + ranger.ldap.ad.domain + Domain Name (Only for AD) + + AD domain, only used if Authentication method is AD + + false + + + + + ranger.ldap.ad.url + {{ranger_ug_ldap_url}} + AD URL, only used if Authentication method is AD + + false + + + + + ranger.ldap.ad.base.dn + dc=example,dc=com + The Distinguished Name (DN) of the starting point for directory server searches. + + false + + + + + ranger.ldap.ad.bind.dn + {{ranger_ug_ldap_bind_dn}} + Full distinguished name (DN), including common name (CN), of an LDAP user account that has privileges to search for users. + + false + + + + + ranger.ldap.ad.bind.password + {{ranger_usersync_ldap_ldapbindpassword}} + PASSWORD + Password for the account that can search for users + + password + false + + + + + + ranger.ldap.ad.referral + ignore + Set to follow if multiple LDAP servers are configured to return continuation references for results. Set to ignore (default) if no referrals should be followed. Possible values are follow|throw|ignore + + false + + + + + + + + + + ranger.unixauth.remote.login.enabled + true + Allow remote Login + Remote login enabled? - only used if Authentication method is UNIX + + true + value-list + false + + + true + + + + false + + + + 1 + + + + + ranger.unixauth.service.hostname + {{ugsync_host}} + Host where unix authentication service is running - only used if Authentication method is UNIX + + false + + + + + ranger.unixauth.service.port + 5151 + Port for unix authentication service - only used if Authentication method is UNIX + + int + false + + + + + ranger.jpa.jdbc.dialect + {{jdbc_dialect}} + JDBC dialect used for policy DB + + + + + + ranger.audit.solr.username + ranger_solr + Solr username + + + + ranger.audit.solr.password + NONE + PASSWORD + Solr password + + password + + + + + ranger.sso.providerurl + + SSO provider url + Example: https://KNOX_HOST:KNOX_PORT/gateway/TOPOLOGY_NAME/knoxsso/api/v1/websso + + true + + + + gateway-site + gateway.port + + + + + + ranger.sso.publicKey + + SSO public key + Public key for SSO cookie verification + + multiLine + true + + + + + + ranger.sso.enabled + false + Enable Ranger SSO + + + false + boolean + + + + + + ranger.sso.browser.useragent + Mozilla,chrome + SSO browser useragent + Comma seperated browser agent + + true + + + + + ranger.ldap.binddn.credential.alias + ranger.ldap.bind.password + + + + + ranger.ldap.ad.binddn.credential.alias + ranger.ldap.ad.bind.password + + + + + + + + + + + + + + + + ranger.admin.kerberos.token.valid.seconds + 30 + + + + + ranger.admin.kerberos.cookie.domain + {{ranger_host}} + + + true + + + + + ranger.admin.kerberos.cookie.path + / + + + + + ranger.spnego.kerberos.principal + * + + KERBEROS_PRINCIPAL + + true + + + + + ranger.spnego.kerberos.keytab + + + + true + + + + + ranger.admin.kerberos.principal + + + KERBEROS_PRINCIPAL + + true + + + + + ranger.admin.kerberos.keytab + + + + true + + + + + ranger.lookup.kerberos.principal + + + KERBEROS_PRINCIPAL + + true + + + + + ranger.lookup.kerberos.keytab + + + + true + + + + + ranger.truststore.file + /etc/ranger/admin/conf/ranger-admin-keystore.jks + ranger.truststore.file + Ranger trust-store file-path + + + + ranger.truststore.password + changeit + PASSWORD + + password + + ranger.truststore.password + Ranger trust-store password + + + + ranger.audit.solr.zookeepers + NONE + Solr Zookeeper string + + + infra-solr-env + infra_solr_znode + + + ranger-env + is_solrCloud_enabled + + + ranger-env + is_external_solrCloud_enabled + + + + + + + + + ranger.ldap.ad.user.searchfilter + (sAMAccountName={0}) + Search filter used for Bind Authentication + + false + + + + + ranger.ldap.user.searchfilter + User Search Filter + (uid={0}) + Search filter used for Bind Authentication + + false + + + + + ranger.kms.service.user.hdfs + + + + true + + + + hadoop-env + hdfs_user + + + + + + ranger.kms.service.user.hive + + + + true + + + + hive-env + hive_user + + + + + + + ranger.plugins.hdfs.serviceuser + hdfs + + + hadoop-env + hdfs_user + + + + + + + ranger.plugins.hive.serviceuser + hive + + + hive-env + hive_user + + + + + + + ranger.plugins.hbase.serviceuser + hbase + + + hbase-env + hbase_user + + + + + + + ranger.plugins.yarn.serviceuser + yarn + + + yarn-env + yarn_user + + + + + + + ranger.plugins.knox.serviceuser + knox + + + knox-env + knox_user + + + + + + + ranger.plugins.storm.serviceuser + storm + + + storm-env + storm_user + + + + + + + ranger.plugins.kafka.serviceuser + kafka + + + kafka-env + kafka_user + + + + + + + ranger.plugins.atlas.serviceuser + atlas + + + atlas-env + metadata_user + + + + + + + ranger.plugins.kms.serviceuser + kms + + + kms-env + kms_user + + + + + + + ranger.is.solr.kerberised + {{ranger_is_solr_kerberised}} + + false + + + + + + + + + ranger.truststore.alias + trustStoreAlias + + + + + ranger.service.https.attrib.keystore.credential.alias + keyStoreCredentialAlias + + + + http://git-wip-us.apache.org/repos/asf/ambari/blob/260ee2ef/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-env.xml ---------------------------------------------------------------------- diff --git a/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-env.xml b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-env.xml new file mode 100644 index 0000000..3e25470 --- /dev/null +++ b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-env.xml @@ -0,0 +1,513 @@ + + + + + ranger_user + ranger + USER + Ranger User + Ranger username + + user + false + + + + + ranger_group + ranger + GROUP + Ranger Group + Ranger group + + user + false + + + + + ranger_admin_log_dir + /var/log/ranger/admin + + + directory + false + true + + + + + ranger_usersync_log_dir + /var/log/ranger/usersync + + + directory + false + true + + + + + ranger_admin_username + amb_ranger_admin + TEXT + Ranger Admin username for Ambari + This is the ambari user created for creating repositories and policies in Ranger Admin for each plugin + + + + ranger_admin_password + + PASSWORD + Ranger Admin user's password for Ambari + This is the ambari user password created for creating repositories and policies in Ranger Admin for each plugin + + password + false + + + + + admin_username + admin + This is the username for default admin user that is used for creating ambari user in Ranger Admin + + + + admin_password + admin + PASSWORD + This is the password for default admin user that is used for creating ambari user in Ranger Admin + + password + + + + + + + ranger_pid_dir + /var/run/ranger + + + directory + false + true + + + + + ranger-hdfs-plugin-enabled + No + HDFS Ranger Plugin + Enable HDFS Ranger plugin + + false + value-list + + + Yes + + + + No + + + + 1 + + + + + ranger-hive-plugin-enabled + No + Hive Ranger Plugin + Enable Hive Ranger plugin + + false + value-list + + + Yes + + + + No + + + + 1 + + + + + ranger-hbase-plugin-enabled + No + Hbase Ranger Plugin + Enable HBase Ranger plugin + + false + value-list + + + Yes + + + + No + + + + 1 + + + + + ranger-storm-plugin-enabled + No + Storm Ranger Plugin + Enable Storm Ranger plugin + + false + value-list + + + Yes + + + + No + + + + 1 + + + + + ranger-knox-plugin-enabled + No + Knox Ranger Plugin + Enable Knox Ranger plugin + + false + value-list + + + Yes + + + + No + + + + 1 + + + + + + + xml_configurations_supported + true + + + + + create_db_dbuser + true + Setup Database and Database User + If set to Yes, Ambari will create and setup Ranger Database and Database User. This will require to specify Database Admin user and password + + value-list + false + + + true + + + + false + + + + 1 + + + + + + ranger_privelege_user_jdbc_url + JDBC connect string for root user + JDBC connect string - auto populated based on other values. This is to be used by root user + jdbc:mysql://localhost + + false + + + + admin-properties + DB_FLAVOR + + + admin-properties + db_host + + + + + + ranger-yarn-plugin-enabled + No + YARN Ranger Plugin + Enable YARN Ranger plugin + + false + value-list + + + Yes + + + + No + + + + 1 + + + + + ranger-kafka-plugin-enabled + No + Kafka Ranger Plugin + Enable Kafka Ranger plugin + + false + value-list + + + Yes + + + + No + + + + 1 + + + + + xasecure.audit.destination.solr + true + Audit to Solr + Enable Audit to Solr for all ranger supported services. This property is overridable at service level + + false + value-list + + + true + + + + false + + + + 1 + + + + + is_solrCloud_enabled + SolrCloud + SolrCloud uses zookeeper for distributed search and indexing + false + + value-list + false + + + true + + + + false + + + + 1 + true + + + + + xasecure.audit.destination.hdfs + true + Audit to HDFS + Enable Audit to HDFS for all ranger supported services. This property is overridable at service level + + false + value-list + + + true + + + + false + + + + 1 + + + + + xasecure.audit.destination.hdfs.dir + hdfs://localhost:8020 + Destination HDFS Directory + HDFS folder to write audit to, make sure all service user has required permissions. This property is overridable at service level + + + core-site + fs.defaultFS + + + + + + ranger_solr_config_set + ranger_audits + + + + ranger_solr_collection_name + ranger_audits + + + + ranger_solr_shards + 1 + + + + ranger_solr_replication_factor + 1 + + + + ranger-atlas-plugin-enabled + No + Atlas Ranger Plugin + Enable Atlas Ranger plugin + + false + value-list + + + Yes + + + + No + + + + 1 + + + + + + is_external_solrCloud_enabled + External SolrCloud + false + Using Externally managed solr cloud ? + + false + value-list + + + true + + + + false + + + + 1 + + + + + + is_external_solrCloud_kerberos + External SolrCloud kerberos + false + Is Externally managed solr cloud kerberos ? + + false + value-list + + + true + + + + false + + + + 1 + + + + + + ranger-nifi-plugin-enabled + No + NIFI Ranger Plugin + Enable NIFI Ranger plugin + + false + value-list + + + Yes + + + + No + + + + 1 + + + + http://git-wip-us.apache.org/repos/asf/ambari/blob/260ee2ef/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-site.xml ---------------------------------------------------------------------- diff --git a/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-site.xml b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-site.xml new file mode 100644 index 0000000..c70e222 --- /dev/null +++ b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-site.xml @@ -0,0 +1,30 @@ + + + + + + + + + + + + http://git-wip-us.apache.org/repos/asf/ambari/blob/260ee2ef/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-solr-configuration.xml ---------------------------------------------------------------------- diff --git a/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-solr-configuration.xml b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-solr-configuration.xml new file mode 100644 index 0000000..550ce0d --- /dev/null +++ b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-solr-configuration.xml @@ -0,0 +1,59 @@ + + + + + + ranger_audit_max_retention_days + Max Retention Days + Days to retain audit logs in Solr + 90 + + int + + + + + ranger_audit_logs_merge_factor + Merge Factor + + The mergeFactor value tells Lucene how many segments of equal size to build before merging them into a + single segment. High value merge factor (e.g. 25) improves indexing speed, but slows down searching. Low value + (e.g. 5) improves searching, but slows down indexing. + + 5 + + int + + + + + content + solr-config template + the jinja template for solrconfig.xml file used for ranger audit logs + + VALUE_FROM_PROPERTY_FILE + + ranger-solrconfig.xml.j2 + xml + + + + http://git-wip-us.apache.org/repos/asf/ambari/blob/260ee2ef/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-tagsync-policymgr-ssl.xml ---------------------------------------------------------------------- diff --git a/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-tagsync-policymgr-ssl.xml b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-tagsync-policymgr-ssl.xml new file mode 100644 index 0000000..a4c9441 --- /dev/null +++ b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-tagsync-policymgr-ssl.xml @@ -0,0 +1,72 @@ + + + + + xasecure.policymgr.clientssl.keystore + /etc/security/serverKeys/ranger-tagsync-keystore.jks + Java Keystore files + + + + + xasecure.policymgr.clientssl.keystore.password + myKeyFilePassword + PASSWORD + password for keystore + + password + + + + + + xasecure.policymgr.clientssl.truststore + /etc/security/serverKeys/ranger-tagsync-mytruststore.jks + java truststore file + + + + + xasecure.policymgr.clientssl.truststore.password + changeit + PASSWORD + java truststore password + + password + + + + + + xasecure.policymgr.clientssl.keystore.credential.file + jceks://file{{ranger_tagsync_credential_file}} + java keystore credential file + + + + + xasecure.policymgr.clientssl.truststore.credential.file + jceks://file{{ranger_tagsync_credential_file}} + java truststore credential file + + + + http://git-wip-us.apache.org/repos/asf/ambari/blob/260ee2ef/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-tagsync-site.xml ---------------------------------------------------------------------- diff --git a/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-tagsync-site.xml b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-tagsync-site.xml new file mode 100644 index 0000000..5e60c06 --- /dev/null +++ b/ambari-server/src/main/resources/common-services/RANGER/0.7.0.3.0/configuration/ranger-tagsync-site.xml @@ -0,0 +1,206 @@ + + + + + ranger.tagsync.logdir + /var/log/ranger/tagsync + Ranger Log dir + + directory + false + true + + + + + ranger.tagsync.dest.ranger.endpoint + {{ranger_external_url}} + Ranger TagAdmin REST URL + + true + + + + + ranger.tagsync.source.atlas + Enable Atlas Tag Source + false + + + boolean + + + + application-properties + atlas.server.bind.address + + + + + + ranger.tagsync.source.atlasrest + Enable AtlasRest Tag Source + false + + + boolean + + + + + ranger.tagsync.source.file + Enable File Tag Source + false + + + boolean + + + + + ranger.tagsync.source.file.check.interval.millis + File Source: File update polling interval + + + + true + + + + + ranger.tagsync.source.atlasrest.download.interval.millis + AtlasREST Source: Atlas source download interval + 60000 + + true + + + + + + ranger.tagsync.source.file.filename + File Source: Filename + + File Source Filename + + true + + + + + + ranger.tagsync.source.atlasrest.endpoint + AtlasREST Source: Atlas endpoint + + + + true + + + + + application-properties + atlas.server.http.port + + + application-properties + atlas.server.https.port + + + application-properties + atlas.enableTLS + + + + + ranger.tagsync.kerberos.principal + + + KERBEROS_PRINCIPAL + + true + + + + + ranger.tagsync.kerberos.keytab + + + + true + + + + + ranger.tagsync.dest.ranger.username + rangertagsync + + + + + + ranger.tagsync.source.atlasrest.username + admin + + + + + + ranger.tagsync.atlas.default.cluster.name + {{cluster_name}} + Capture cluster name + + true + + + + + + ranger.tagsync.keystore.filename + /usr/hdp/current/ranger-tagsync/conf/rangertagsync.jceks + Keystore file + + true + + + + + ranger.tagsync.source.atlasrest.keystore.filename + /usr/hdp/current/ranger-tagsync/conf/atlasuser.jceks + Tagsync atlasrest keystore file + + true + + + + + ranger.tagsync.dest.ranger.ssl.config.filename + {{stack_root}}/current/ranger-tagsync/conf/ranger-policymgr-ssl.xml + Keystore and truststore information used for tagsync, required if tagsync -> ranger admin communication is SSL enabled + + + + ranger.tagsync.source.atlasrest.ssl.config.filename + {{stack_root}}/current/ranger-tagsync/conf/atlas-tagsync-ssl.xml + Keystore and truststore information used for tagsync, required if tagsync to atlas communication is SSL enabled + + +