From b6e70ac97453f9050357e782ea40203b8b246c7b Mon Sep 17 00:00:00 2001 From: MLikeWater Date: Fri, 29 Apr 2022 11:56:56 +0800 Subject: [PATCH 1/2] Add ranger-ozone-plugin jars to OZONE_CLASSPAT --- hadoop-hdds/docs/content/security/SecurityWithRanger.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hadoop-hdds/docs/content/security/SecurityWithRanger.md b/hadoop-hdds/docs/content/security/SecurityWithRanger.md index ee86a115930b..9428f93ec06f 100644 --- a/hadoop-hdds/docs/content/security/SecurityWithRanger.md +++ b/hadoop-hdds/docs/content/security/SecurityWithRanger.md @@ -46,6 +46,13 @@ Property|Value ozone.acl.enabled | true ozone.acl.authorizer.class| org.apache.ranger.authorization.ozone.authorizer.RangerOzoneAuthorizer +To use the RangerOzoneAuthorizer, you also need to add the following environment variables to ozone-env.sh: +``` +export OZONE_CLASSPATH="${OZONE_HOME}/share/ozone/lib/libext/*" +``` +* The location of the ranger-ozone-plugin jars depends on where the Ranger Plugin is installed. +* If the ranger-ozone-plugin jars is installed on another node, copy it to the Ozone installation directory. + The Ranger permissions corresponding to the Ozone operations are as follows: | operation&permission | Volume permission | Bucket permission | Key permission | From 28e1ad093e05d36bf5e0d148d4111d26e7b12db5 Mon Sep 17 00:00:00 2001 From: MLikeWater Date: Fri, 29 Apr 2022 12:02:28 +0800 Subject: [PATCH 2/2] Add ranger-ozone-plugin jars to OZONE_CLASSPAT --- .../docs/content/security/SecurityWithRanger.zh.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/hadoop-hdds/docs/content/security/SecurityWithRanger.zh.md b/hadoop-hdds/docs/content/security/SecurityWithRanger.zh.md index e7ff33e9268f..9fd0d033ecf6 100644 --- a/hadoop-hdds/docs/content/security/SecurityWithRanger.zh.md +++ b/hadoop-hdds/docs/content/security/SecurityWithRanger.zh.md @@ -37,6 +37,13 @@ Apache Ranger™ 是一个用于管理和监控 Hadoop 平台复杂数据权限 ozone.acl.enabled | true ozone.acl.authorizer.class| org.apache.ranger.authorization.ozone.authorizer.RangerOzoneAuthorizer +为了使用 RangerOzoneAuthorizer，还需要在 ozone-env.sh 中增加下面环境变量： +``` +export OZONE_CLASSPATH="${OZONE_HOME}/share/ozone/lib/libext/*" +``` +* ranger-ozone-plugin jars 具体路径取决于 Ranger Ozone plugin 安装配置。 +* 如果 ranger-ozone-plugin jars 安装在其他节点，需要拷贝到 Ozone 安装目录。 + Ozone各类操作对应Ranger权限如下： | operation&permission | Volume permission | Bucket permission | Key permission | @@ -51,4 +58,4 @@ Ozone各类操作对应Ranger权限如下： | Delete bucket | READ | DELETE | | | List key | READ | LIST, READ | | | Write key | READ | READ | CREATE, WRITE | -| Read key | READ | READ | READ | \ No newline at end of file +| Read key | READ | READ | READ |