RANGER-5373: update HBase container for Kerberos authentication - apache#5

mneethiraj · mneethiraj · commit ae9f814eeac7 · 2025-10-20T21:54:36.000-07:00
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-hadoop b/dev-support/ranger-docker/Dockerfile.ranger-hadoop
@@ -31,6 +31,7 @@ COPY ./downloads/hadoop-${HADOOP_VERSION}.tar.gz             /home/ranger/dist/
 COPY ./scripts/ranger-hadoop-setup.sh                   /home/ranger/scripts/
 COPY ./scripts/ranger-hadoop.sh                         /home/ranger/scripts/
 COPY ./scripts/ranger-hadoop-mkdir.sh                   /home/ranger/scripts/
+COPY ./scripts/ranger-hadoop-healthcheck.sh             /home/ranger/scripts/
 COPY ./scripts/ranger-hdfs-plugin-install.properties    /home/ranger/scripts/
 COPY ./scripts/ranger-yarn-plugin-install.properties    /home/ranger/scripts/
 COPY ./scripts/core-site.xml                            /home/ranger/scripts/
@@ -49,6 +50,9 @@ RUN tar xvfz /home/ranger/dist/hadoop-${HADOOP_VERSION}.tar.gz --directory=/opt/
     rm -f /home/ranger/dist/ranger-${YARN_PLUGIN_VERSION}-yarn-plugin.tar.gz && \
     cp -f /home/ranger/scripts/ranger-yarn-plugin-install.properties /opt/ranger/ranger-yarn-plugin/install.properties && \
     chmod 744 ${RANGER_SCRIPTS}/ranger-hadoop-setup.sh ${RANGER_SCRIPTS}/ranger-hadoop.sh ${RANGER_SCRIPTS}/ranger-hadoop-mkdir.sh && \
+    useradd -g hadoop -ms /bin/bash healthcheck && \
+    chmod 744 ${RANGER_SCRIPTS}/ranger-hadoop-healthcheck.sh && \
+    chown healthcheck:hadoop ${RANGER_SCRIPTS}/ranger-hadoop-healthcheck.sh && \
     apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get install -y krb5-user && mkdir -p /etc/keytabs && \
     chown hdfs:hadoop ${RANGER_SCRIPTS}/ranger-hadoop-mkdir.sh
 
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-hbase b/dev-support/ranger-docker/Dockerfile.ranger-hbase
@@ -30,6 +30,7 @@ COPY ./scripts/ranger-hbase-setup.sh                     /home/ranger/scripts/
 COPY ./scripts/ranger-hbase.sh                           /home/ranger/scripts/
 COPY ./scripts/ranger-hbase-plugin-install.properties    /home/ranger/scripts/
 COPY ./scripts/hbase-site.xml                            /home/ranger/scripts/
+COPY ./scripts/core-site.xml                             /home/ranger/scripts/
 
 RUN tar xvfz /home/ranger/dist/hbase-${HBASE_VERSION}-bin.tar.gz --directory=/opt/ && \
     ln -s /opt/hbase-${HBASE_VERSION} /opt/hbase && \
diff --git a/dev-support/ranger-docker/config/kdc/krb5.conf b/dev-support/ranger-docker/config/kdc/krb5.conf
@@ -1,5 +1,6 @@
 [libdefaults]
  default_realm = EXAMPLE.COM
+ dns_canonicalize_hostname = false
  dns_lookup_kdc = false
  dns_lookup_realm = false
  ticket_lifetime = 24h
diff --git a/dev-support/ranger-docker/docker-compose.ranger-hadoop.yml b/dev-support/ranger-docker/docker-compose.ranger-hadoop.yml
@@ -24,11 +24,11 @@ services:
       ranger:
         condition: service_started
     healthcheck:
-      test: ["CMD-SHELL", "kinit -kt /opt/hadoop/keytabs/healthcheck.keytab healthcheck/ranger-hadoop.rangernw@EXAMPLE.COM && hdfs dfs -ls /hbase > /dev/null"]
-      interval: 1m30s
+      test: 'su -c "/home/ranger/scripts/ranger-hadoop-healthcheck.sh" healthcheck'
+      interval: 15s
       timeout: 10s
       retries: 30
-      start_period: 40s
+      start_period: 1m30s
     environment:
       - HADOOP_VERSION
       - HDFS_PLUGIN_VERSION
diff --git a/dev-support/ranger-docker/docker-compose.ranger-kdc.yml b/dev-support/ranger-docker/docker-compose.ranger-kdc.yml
diff --git a/dev-support/ranger-docker/docker-compose.ranger-ozone.yml b/dev-support/ranger-docker/docker-compose.ranger-ozone.yml
@@ -2,6 +2,7 @@ services:
   datanode:
     image: ${OZONE_RUNNER_IMAGE}:${OZONE_RUNNER_VERSION}
     container_name: ozone-datanode
+    hostname: datanode.rangernw
     volumes:
       - ./downloads/ozone-${OZONE_VERSION}:/opt/hadoop
     networks:
@@ -24,7 +25,7 @@ services:
         - OZONE_PLUGIN_VERSION=${OZONE_PLUGIN_VERSION}
     image: ranger-ozone:latest
     container_name: ozone-om
-    hostname: om
+    hostname: om.rangernw
     volumes:
       - ./downloads/ozone-${OZONE_VERSION}:/opt/hadoop
       - ./dist/ranger-${OZONE_PLUGIN_VERSION}-ozone-plugin:/opt/hadoop/ranger-ozone-plugin
@@ -50,7 +51,7 @@ services:
   scm:
     image: ${OZONE_RUNNER_IMAGE}:${OZONE_RUNNER_VERSION}
     container_name: ozone-scm
-    hostname: scm
+    hostname: scm.rangernw
     volumes:
       - ./downloads/ozone-${OZONE_VERSION}:/opt/hadoop
     networks:
diff --git a/dev-support/ranger-docker/docker-compose.ranger.yml b/dev-support/ranger-docker/docker-compose.ranger.yml
@@ -19,6 +19,8 @@ services:
     ports:
       - "6080:6080"
     depends_on:
+      ranger-kdc:
+        condition: service_started
       ranger-zk:
         condition: service_started
       ranger-db:
@@ -33,6 +35,26 @@ services:
     command:
       - /home/ranger/scripts/ranger.sh
 
+  ranger-kdc:
+    build:
+      context: .
+      dockerfile: Dockerfile.ranger-kdc
+      args:
+        - REALM=${KERBEROS_REALM}
+        - KDC_HOST=${KERBEROS_KDC_HOST}
+        - MASTER_PASSWORD=${KERBEROS_MASTER_PASSWORD}
+        - ADMIN_PRINCIPAL=${KERBEROS_ADMIN_PRINCIPAL}
+        - ADMIN_PASSWORD=${KERBEROS_ADMIN_PASSWORD}
+    image: ranger-kdc:latest
+    container_name: ranger-kdc
+    hostname: ranger-kdc.rangernw
+    networks:
+      - ranger
+    ports:
+      - "88:88"
+      - "88:88/udp"
+      - "749:749"
+
   ranger-db:
     extends:
       service: ${RANGER_DB_TYPE}
@@ -48,8 +70,6 @@ services:
     image: ranger-zk
     container_name: ranger-zk
     hostname: ranger-zk.rangernw
-    volumes:
-      - ./config/kdc/keytabs:/etc/keytabs
     networks:
       - ranger
     ports:
@@ -67,8 +87,6 @@ services:
     image: ranger-solr
     container_name: ranger-solr
     hostname: ranger-solr.rangernw
-    volumes:
-      - ./config/kdc/keytabs:/etc/keytabs
     networks:
       - ranger
     ports:
diff --git a/dev-support/ranger-docker/scripts/core-site.xml b/dev-support/ranger-docker/scripts/core-site.xml
@@ -2,7 +2,7 @@
 <configuration>
   <property>
     <name>fs.defaultFS</name>
-    <value>hdfs://ranger-hadoop:9000</value>
+    <value>hdfs://ranger-hadoop.rangernw:9000</value>
   </property>
   <property>
     <name>hadoop.security.authentication</name>
diff --git a/dev-support/ranger-docker/scripts/create-ranger-services.py b/dev-support/ranger-docker/scripts/create-ranger-services.py
@@ -15,7 +15,7 @@ def service_not_exists(service):
 
 hdfs = RangerService({'name': 'dev_hdfs', 'type': 'hdfs',
                       'configs': {'username': 'hdfs', 'password': 'hdfs',
-                                  'fs.default.name': 'hdfs://ranger-hadoop:9000',
+                                  'fs.default.name': 'hdfs://ranger-hadoop.rangernw:9000',
                                   'hadoop.security.authentication': 'simple',
                                   'hadoop.security.authorization': 'true',
                                   'policy.download.auth.users': 'hdfs',
@@ -26,7 +26,7 @@ def service_not_exists(service):
 hive = RangerService({'name': 'dev_hive', 'type': 'hive',
                       'configs': {'username': 'hive', 'password': 'hive',
                                   'jdbc.driverClassName': 'org.apache.hive.jdbc.HiveDriver',
-                                  'jdbc.url': 'jdbc:hive2://ranger-hive:10000',
+                                  'jdbc.url': 'jdbc:hive2://ranger-hive.rangernw:10000',
                                   'hadoop.security.authorization': 'true',
                                   'policy.download.auth.users': 'hive',
                                   'tag.download.auth.users': 'hive',
@@ -42,15 +42,15 @@ def service_not_exists(service):
                                    'ranger.plugin.kafka.policy.refresh.synchronous':'true'}})
 
 knox = RangerService({'name': 'dev_knox', 'type': 'knox',
-                      'configs': {'username': 'knox', 'password': 'knox', 'knox.url': 'https://ranger-knox:8443',
+                      'configs': {'username': 'knox', 'password': 'knox', 'knox.url': 'https://ranger-knox.rangernw:8443',
                       'policy.download.auth.users': 'knox',
                       'tag.download.auth.users': 'knox',
                       'userstore.download.auth.users': 'knox',
                       'ranger.plugin.knox.policy.refresh.synchronous':'true'}})
 
 yarn = RangerService({'name': 'dev_yarn', 'type': 'yarn',
                       'configs': {'username': 'yarn', 'password': 'yarn',
-                                  'yarn.url': 'http://ranger-hadoop:8088',
+                                  'yarn.url': 'http://ranger-hadoop.rangernw:8088',
                                   'policy.download.auth.users': 'yarn',
                                   'tag.download.auth.users': 'yarn',
                                   'userstore.download.auth.users': 'yarn',
@@ -62,7 +62,7 @@ def service_not_exists(service):
                                    'hbase.security.authentication': 'simple',
                                    'hadoop.security.authorization': 'true',
                                    'hbase.zookeeper.property.clientPort': '2181',
-                                   'hbase.zookeeper.quorum': 'ranger-zk',
+                                   'hbase.zookeeper.quorum': 'ranger-zk.rangernw',
                                    'zookeeper.znode.parent': '/hbase',
                                    'policy.download.auth.users': 'hbase',
                                    'tag.download.auth.users': 'hbase',
@@ -71,7 +71,7 @@ def service_not_exists(service):
 
 kms = RangerService({'name': 'dev_kms', 'type': 'kms',
                      'configs': {'username': 'keyadmin', 'password': 'rangerR0cks!',
-                                 'provider': 'http://ranger-kms:9292',
+                                 'provider': 'http://ranger-kms.rangernw:9292',
                                  'policy.download.auth.users': 'rangerkms',
                                  'tag.download.auth.users': 'rangerkms',
                                  'userstore.download.auth.users': 'rangerkms',
@@ -83,7 +83,7 @@ def service_not_exists(service):
                            'username': 'trino',
                            'password': 'trino',
                            'jdbc.driverClassName': 'io.trino.jdbc.TrinoDriver',
-                           'jdbc.url': 'jdbc:trino://ranger-trino:8080',
+                           'jdbc.url': 'jdbc:trino://ranger-trino.rangernw:8080',
                            'policy.download.auth.users': 'trino',
                            'tag.download.auth.users': 'trino',
                            'userstore.download.auth.users': 'trino',
diff --git a/dev-support/ranger-docker/scripts/hbase-site.xml b/dev-support/ranger-docker/scripts/hbase-site.xml
@@ -49,4 +49,32 @@
     <name>hbase.zookeeper.quorum</name>
     <value>ranger-zk.rangernw</value>
   </property>
+  <property>
+    <name>hbase.security.authentication</name>
+    <value>kerberos</value>
+  </property>
+  <property>
+    <name>hbase.security.authorization</name>
+    <value>true</value>
+  </property>
+  <property>
+    <name>hbase.master.kerberos.principal</name>
+    <value>hbase/ranger-hbase.rangernw@EXAMPLE.COM</value>
+  </property>
+  <property>
+    <name>hbase.master.keytab.file</name>
+    <value>/opt/hbase/keytabs/hbase.keytab</value>
+  </property>
+  <property>
+    <name>hbase.regionserver.kerberos.principal</name>
+    <value>hbase/ranger-hbase.rangernw@EXAMPLE.COM</value>
+  </property>
+  <property>
+    <name>hbase.regionserver.keytab.file</name>
+    <value>/opt/hbase/keytabs/hbase.keytab</value>
+  </property>
+  <property>
+    <name>hbase.coprocessor.region.classes</name>
+    <value>org.apache.hadoop.hbase.security.token.TokenProvider</value>
+  </property>
 </configuration>
diff --git a/dev-support/ranger-docker/scripts/hive-site-mysql.xml b/dev-support/ranger-docker/scripts/hive-site-mysql.xml
@@ -21,7 +21,7 @@
 <configuration>
     <property>
         <name>javax.jdo.option.ConnectionURL</name>
-        <value>jdbc:mysql://ranger-db/hive</value>
+        <value>jdbc:mysql://ranger-db.rangernw/hive</value>
     </property>
     <property>
         <name>javax.jdo.option.ConnectionDriverName</name>
diff --git a/dev-support/ranger-docker/scripts/hive-site-oracle.xml b/dev-support/ranger-docker/scripts/hive-site-oracle.xml
@@ -21,7 +21,7 @@
 <configuration>
     <property>
         <name>javax.jdo.option.ConnectionURL</name>
-        <value>jdbc:oracle:thin:@//ranger-db:1521/FREEPDB1</value>
+        <value>jdbc:oracle:thin:@//ranger-db.rangernw:1521/FREEPDB1</value>
     </property>
     <property>
         <name>javax.jdo.option.ConnectionDriverName</name>
diff --git a/dev-support/ranger-docker/scripts/hive-site-postgres.xml b/dev-support/ranger-docker/scripts/hive-site-postgres.xml
@@ -21,7 +21,7 @@
 <configuration>
     <property>
         <name>javax.jdo.option.ConnectionURL</name>
-        <value>jdbc:postgresql://ranger-db/hive</value>
+        <value>jdbc:postgresql://ranger-db.rangernw/hive</value>
     </property>
     <property>
         <name>javax.jdo.option.ConnectionDriverName</name>
diff --git a/dev-support/ranger-docker/scripts/hive-site-sqlserver.xml b/dev-support/ranger-docker/scripts/hive-site-sqlserver.xml
@@ -21,7 +21,7 @@
 <configuration>
     <property>
         <name>javax.jdo.option.ConnectionURL</name>
-        <value>jdbc:sqlserver://ranger-db/hive</value>
+        <value>jdbc:sqlserver://ranger-db.rangernw/hive</value>
     </property>
     <property>
         <name>javax.jdo.option.ConnectionDriverName</name>
diff --git a/dev-support/ranger-docker/scripts/ranger-hadoop-healthcheck.sh b/dev-support/ranger-docker/scripts/ranger-hadoop-healthcheck.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if [ "${KERBEROS_ENABLED}" == "true" ]
+then
+  kinit -kt /opt/hadoop/keytabs/nn.keytab nn/`hostname -f`@EXAMPLE.COM
+fi
+
+${HADOOP_HOME}/bin/hdfs dfs -stat /hbase
+ret=$?
+
+if [ "${KERBEROS_ENABLED}" == "true" ]
+then
+  kdestroy
+fi
+
+exit ${ret}
diff --git a/dev-support/ranger-docker/scripts/ranger-hadoop-mkdir.sh b/dev-support/ranger-docker/scripts/ranger-hadoop-mkdir.sh
@@ -18,7 +18,10 @@
 
 # setup directories for Ranger audits
 
-kinit -kt /opt/hadoop/keytabs/nn.keytab nn/ranger-hadoop.rangernw@EXAMPLE.COM
+if [ "${KERBEROS_ENABLED}" == "true" ]
+then
+  kinit -kt /opt/hadoop/keytabs/nn.keytab nn/`hostname -f`@EXAMPLE.COM
+fi
 
 ${HADOOP_HOME}/bin/hdfs dfs -mkdir -p /ranger/audit/hdfs
 ${HADOOP_HOME}/bin/hdfs dfs -mkdir -p /ranger/audit/yarn
@@ -46,4 +49,7 @@ ${HADOOP_HOME}/bin/hdfs dfs -mkdir -p /tmp/hive
 ${HADOOP_HOME}/bin/hdfs dfs -chown -R hive:hadoop /tmp/hive /user/hive
 ${HADOOP_HOME}/bin/hdfs dfs -chmod 777 /tmp/hive
 
-kdestroy
+if [ "${KERBEROS_ENABLED}" == "true" ]
+then
+  kdestroy
+fi
diff --git a/dev-support/ranger-docker/scripts/ranger-hbase-setup.sh b/dev-support/ranger-docker/scripts/ranger-hbase-setup.sh
@@ -25,6 +25,7 @@ Host *
 EOF
 
 cp ${RANGER_SCRIPTS}/hbase-site.xml /opt/hbase/conf/hbase-site.xml
+cp ${RANGER_SCRIPTS}/core-site.xml  /opt/hbase/conf/core-site.xml
 chown -R hbase:hadoop /opt/hbase/
 
 cd ${RANGER_HOME}/ranger-hbase-plugin
diff --git a/dev-support/ranger-docker/scripts/ranger-kms-install-mysql.properties b/dev-support/ranger-docker/scripts/ranger-kms-install-mysql.properties
@@ -23,7 +23,7 @@ SQL_CONNECTOR_JAR=/usr/share/java/mysql-connector-java.jar
 
 db_root_user=root
 db_root_password=rangerR0cks!
-db_host=ranger-db
+db_host=ranger-db.rangernw
 
 db_name=rangerkms
 db_user=rangerkms
@@ -140,7 +140,7 @@ REPOSITORY_NAME=dev_kms
 XAAUDIT.SOLR.IS_ENABLED=true
 XAAUDIT.SOLR.MAX_QUEUE_SIZE=1
 XAAUDIT.SOLR.MAX_FLUSH_INTERVAL_MS=1000
-XAAUDIT.SOLR.SOLR_URL=http://ranger-solr:8983/solr/ranger_audits
+XAAUDIT.SOLR.SOLR_URL=http://ranger-solr.rangernw:8983/solr/ranger_audits
 XAAUDIT.SUMMARY.ENABLE=true
 
 # Following properties are needed to get past installation script! Please don't remove
@@ -158,7 +158,7 @@ XAAUDIT.HDFS.LOCAL_BUFFER_ROLLOVER_INTERVAL_SECONDS=600
 XAAUDIT.HDFS.LOCAL_ARCHIVE_MAX_FILE_COUNT=10
 
 XAAUDIT.SOLR.ENABLE=true
-XAAUDIT.SOLR.URL=http://ranger-solr:8983/solr/ranger_audits
+XAAUDIT.SOLR.URL=http://ranger-solr.rangernw:8983/solr/ranger_audits
 XAAUDIT.SOLR.USER=NONE
 XAAUDIT.SOLR.PASSWORD=NONE
 XAAUDIT.SOLR.ZOOKEEPER=NONE
@@ -173,7 +173,7 @@ XAAUDIT.ELASTICSEARCH.PORT=NONE
 XAAUDIT.ELASTICSEARCH.PROTOCOL=NONE
 
 XAAUDIT.HDFS.ENABLE=true
-XAAUDIT.HDFS.HDFS_DIR=hdfs://ranger-hadoop:9000/ranger/audit
+XAAUDIT.HDFS.HDFS_DIR=hdfs://ranger-hadoop.rangernw:9000/ranger/audit
 XAAUDIT.HDFS.FILE_SPOOL_DIR=/var/log/hive/audit/hdfs/spool
 
 XAAUDIT.HDFS.AZURE_ACCOUNTNAME=__REPLACE_AZURE_ACCOUNT_NAME
diff --git a/dev-support/ranger-docker/scripts/ranger-kms-install-oracle.properties b/dev-support/ranger-docker/scripts/ranger-kms-install-oracle.properties
diff --git a/dev-support/ranger-docker/scripts/ranger-kms-install-postgres.properties b/dev-support/ranger-docker/scripts/ranger-kms-install-postgres.properties
diff --git a/dev-support/ranger-docker/scripts/ranger-kms-install-sqlserver.properties b/dev-support/ranger-docker/scripts/ranger-kms-install-sqlserver.properties
