zhangxinyao88 commented on code in PR #7437:
URL: https://github.com/apache/kyuubi/pull/7437#discussion_r4129303748
##########
docs/security/authorization/spark/build.md:
##########
@@ -74,24 +74,16 @@ The available `spark.version`s are shown in the following
table.
The maven option `ranger.version` is used for specifying Ranger version to
compile with and generate corresponding transitive dependencies.
By default, it is always built with the latest `ranger.version` defined in
kyuubi project main pom file.
-Sometimes, it may be incompatible with other Ranger Admins, then you may need
to build the plugin on your own targeting the Ranger Admin version you connect
with.
```shell
-build/mvn clean package -pl :kyuubi-spark-authz_2.12 -am -DskipTests
-Dranger.version=2.4.0
+build/mvn clean package -pl :kyuubi-spark-authz_2.12 -am -DskipTests
-Dranger.version=2.9.0
```
-The available `ranger.version`s are shown in the following table.
+The plugin is built on the Ranger 2.9 authorization API (`ranger-authz-api` and
+`authz-remote`), which was introduced in Ranger 2.9.0, so only Ranger 2.9.0
and above
+are supported.
-| Ranger Version | Supported | Remark |
-|:--------------:|:---------:|:------:|
-| 2.6.x | √ | - |
-| 2.5.x | √ | - |
-| 2.4.x | √ | - |
-| 2.3.x | √ | - |
-| 2.2.x | √ | - |
-| 2.1.x | √ | - |
-
-Currently, all ranger releases are supported.
+Please use branch-1.12 or prior to build against Ranger versions prior to
2.9.0.
Review Comment:
Do we want to specify the Ranger versions supported for branch-1.12 and
prior?
##########
docs/security/authorization/spark/install.md:
##########
@@ -37,8 +37,75 @@ Use either the shaded jar `kyuubi-spark-authz-shaded_*.jar`
or the `kyuubi-spark
## Configure
+### Authorizer Modes
+
+The plugin supports two authorizer modes, selected by
`ranger.authorizer.impl.class`:
+
+- `org.apache.ranger.authz.remote.RangerRemoteAuthorizer` (default) — Ranger
PDP mode.
+ Authorization requests are sent to the Ranger PDP server via REST APIs. The
plugin is a thin
+ client: policies are not downloaded to the client side, and access audits
are recorded by
+ the PDP server.
+- `org.apache.ranger.authz.embedded.RangerEmbeddedAuthorizer` — embedded mode,
working as the
+ previous Ranger plugin did: policies are pulled from the Ranger admin server
and access
+ requests are evaluated locally on the Spark driver side.
+
+:::{warning}
+The security-critical configurations — the authorizer implementation
+(`ranger.authorizer.impl.class`), the Ranger PDP server address
+(`ranger.authz.remote.pdp.url`), the Ranger service name
+(`ranger.plugin.spark.service.name`) and the Ranger PDP client authentication
and
+encryption settings (`ranger.authz.remote.authn.*`,
`ranger.authz.remote.ssl.*`,
+`ranger.authz.remote.header.*`) — are read from `ranger-spark-security.xml`
only:
+JVM system properties can neither set nor override them, and the plugin fails
to
+initialize when the Ranger PDP server address is missing for the Ranger PDP
mode.
+Other configurations with the `ranger.` or `xasecure.` prefix can still be
overridden
+by JVM system properties, so make sure tenant users cannot control the JVM
options of
+the engine process (e.g. `spark.driver.extraJavaOptions`).
+:::
+
+#### Ranger PDP mode (default)
+
+- Create `ranger-spark-security.xml` in `$SPARK_HOME/conf` and add the
following configurations
+ for pointing to the right Ranger PDP server.
+
+```xml
+<configuration>
+ <property>
+ <name>ranger.plugin.spark.service.name</name>
+ <value>a ranger service name, e.g. a ranger hive service name</value>
+ </property>
+
+ <property>
+ <name>ranger.authz.remote.pdp.url</name>
+ <value>ranger pdp server address like
https://ranger-pdp.org:8585</value>
+ </property>
+
+</configuration>
+```
+
+The PDP client supports authentication and encryption settings, configured with
+`ranger.authz.remote.authn.type` (`header`, `jwt` or `kerberos`),
+`ranger.authz.remote.authn.*`, `ranger.authz.remote.ssl.*` and
+`ranger.authz.remote.header.*` properties. Refer to the
+[Ranger client
libraries](https://cwiki.apache.org/confluence/display/RANGER/Ranger+Client+Libraries)
+for the full list.
+
+#### Embedded mode
+
+Set the authorizer implementation to the embedded one in
`ranger-spark-security.xml`:
+
+```xml
+<property>
+ <name>ranger.authorizer.impl.class</name>
+ <value>org.apache.ranger.authz.embedded.RangerEmbeddedAuthorizer</value>
+</property>
+```
+
### Settings for Connecting Ranger Admin
+The settings below apply to the embedded mode, where the plugin pulls policies
from
Review Comment:
below meaning everything below this line?
##########
extensions/spark/kyuubi-spark-authz/pom.xml:
##########
@@ -32,8 +32,7 @@
<url>https://kyuubi.apache.org/</url>
<properties>
- <ranger.version>2.6.0</ranger.version>
- <jersey.client.version>1.19.4</jersey.client.version>
Review Comment:
why is this not needed?
##########
docs/security/authorization/spark/install.md:
##########
@@ -37,8 +37,75 @@ Use either the shaded jar `kyuubi-spark-authz-shaded_*.jar`
or the `kyuubi-spark
## Configure
+### Authorizer Modes
+
+The plugin supports two authorizer modes, selected by
`ranger.authorizer.impl.class`:
+
+- `org.apache.ranger.authz.remote.RangerRemoteAuthorizer` (default) — Ranger
PDP mode.
+ Authorization requests are sent to the Ranger PDP server via REST APIs. The
plugin is a thin
+ client: policies are not downloaded to the client side, and access audits
are recorded by
+ the PDP server.
+- `org.apache.ranger.authz.embedded.RangerEmbeddedAuthorizer` — embedded mode,
working as the
+ previous Ranger plugin did: policies are pulled from the Ranger admin server
and access
+ requests are evaluated locally on the Spark driver side.
+
+:::{warning}
Review Comment:
nit: this is not rendering here, expected?
##########
docs/security/authorization/spark/install.md:
##########
@@ -21,12 +21,12 @@
- [Apache Ranger](https://ranger.apache.org/)
- This plugin works as a ranger rest client with Apache Ranger Admin server to
do privilege check.
- Thus, a ranger server need to be installed ahead and available to use.
+ The plugin talks to a Ranger PDP server (default) or Ranger Admin server to
do privilege check.
Review Comment:
nit: do you want to specify what PDP is?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
