jojochuang commented on PR #11053: URL: https://github.com/apache/ozone/pull/11053#issuecomment-5785984461
## Apache Ranger coordination (required) Object Lock v1 is **Ranger-centric** for lock administration and governance bypass. This is **not** a new Ranger Admin REST API, but it **does require Ranger release / servicedef work** in addition to Ozone changes. Worth calling out explicitly in the OEP (Compatibility or Plan) so operators know minimum Ranger version and cross-repo ordering. **Required in Apache Ranger (typical paths):** 1. **`security-admin/.../actionRequirements/ozone.json`** — Register the 7 S3 Object Lock actions (`GetBucketObjectLockConfiguration`, `PutBucketObjectLockConfiguration`, `GetObjectRetention`, `PutObjectRetention`, `GetObjectLegalHold`, `PutObjectLegalHold`, `BypassGovernanceRetention`) with required primitive permissions (READ/WRITE/DELETE) at bucket vs key scope. Enables UI validation when authoring policies. 2. **STS / action-matcher prerequisite** — Policies rely on existing **`action-matches`** support (see [ozone-sts.md](ozone-sts.md)), enabled in Ozone via `ranger.servicedef.ozone.enableActionMatcherInPoliciesCondition=true`. Object Lock does **not** add new Ranger access types; it constrains READ/WRITE/DELETE by S3 action name. 3. **Ozone cluster config** — Operators must enable the action matcher condition before Object Lock policies behave as designed. **Optional but described in Phase 2 (still Ranger plugin/servicedef):** 4. **`ranger-servicedef-ozone.json`** — Register a policy condition (e.g. `RangerOzoneValueMatcher`) for value-level rules on `s3:object-lock-legal-hold`, `s3:object-lock-mode`, `s3:x-amz-bypass-governance-retention`. 5. **Ranger ozone plugin Java** — Implement the condition evaluator; ensure **`RangerOzoneAuthorizer`** receives S3G-injected context on `RangerAccessRequest`. **Ozone-side (for completeness):** `S3GActionIamMapper`, `IamSessionPolicyResolver`, propagate `RequestContext.s3Action` (and bypass header) to OM for dual-gate checks. **Non-Ranger:** Native authorizer is out of scope for lock admin in this OEP — clusters without Ranger need an explicit gap statement. Suggest adding a short **“Dependencies / Ranger release”** subsection with Jira or release tracking link once Ranger work is filed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
