This is an automated email from the ASF dual-hosted git repository. ramackri pushed a commit to branch RANGER-5712 in repository https://gitbox.apache.org/repos/asf/ranger.git
commit 45d8bddf4819bb9c7ffd3b21f16d6f1347b7dbb6 Author: ramk <[email protected]> AuthorDate: Thu Jul 30 11:16:06 2026 +0530 RANGER-5712: Avoid Ozone krb5:8081 wait; use Ranger KDC keytabs Do not pass KERBEROS_ENABLED into Ozone containers because Ozone libexec/entrypoint.sh waits for its own mini-KDC at krb5:8081. Ranger already provisions om/scm/dn keytabs via ranger-kdc; use RANGER_KERBEROS_ENABLED for setup-script keytab wait and keep Kerberos enabled via ozone-site.xml plus mounted keytabs. Co-authored-by: Cursor <[email protected]> --- dev-support/ranger-docker/Dockerfile.ranger-ozone | 2 -- dev-support/ranger-docker/docker-compose.ranger-ozone.yml | 15 +++++++-------- dev-support/ranger-docker/scripts/ozone/docker-config | 2 +- .../ranger-docker/scripts/ozone/ranger-ozone-setup.sh | 6 +++++- 4 files changed, 13 insertions(+), 12 deletions(-) diff --git a/dev-support/ranger-docker/Dockerfile.ranger-ozone b/dev-support/ranger-docker/Dockerfile.ranger-ozone index 189d4c70a..0e435e1f5 100644 --- a/dev-support/ranger-docker/Dockerfile.ranger-ozone +++ b/dev-support/ranger-docker/Dockerfile.ranger-ozone @@ -17,7 +17,6 @@ ARG OZONE_RUNNER_IMAGE=apache/ozone-runner # Keep in sync with .env; Ozone 2.0+ needs jdk21 runner (20260106-1-jdk21 is multi-arch arm64+amd64). ARG OZONE_RUNNER_VERSION=20260106-1-jdk21 -ARG KERBEROS_ENABLED=false FROM ${OZONE_RUNNER_IMAGE}:${OZONE_RUNNER_VERSION} ARG OZONE_HOME @@ -30,4 +29,3 @@ RUN mkdir -p -m 755 /var/log/ozone # Required to locate the plugin jars and the config files ENV OZONE_MANAGER_CLASSPATH="${OZONE_HOME}/ranger-ozone-plugin/lib/libext/*:${OZONE_HOME}/ranger-ozone-plugin/conf" -ENV KERBEROS_ENABLED=${KERBEROS_ENABLED} diff --git a/dev-support/ranger-docker/docker-compose.ranger-ozone.yml b/dev-support/ranger-docker/docker-compose.ranger-ozone.yml index aee79075d..80cca8127 100644 --- a/dev-support/ranger-docker/docker-compose.ranger-ozone.yml +++ b/dev-support/ranger-docker/docker-compose.ranger-ozone.yml @@ -14,11 +14,11 @@ services: depends_on: ranger-kdc: condition: service_started - command: bash -c "sudo mkdir -p /data/hdds /data/metadata && sudo chown -R hadoop:hadoop /data && exec /opt/hadoop/bin/ozone datanode" + command: bash -c "unset KERBEROS_ENABLED; sudo mkdir -p /data/hdds /data/metadata && sudo chown -R hadoop:hadoop /data && exec /opt/hadoop/bin/ozone datanode" env_file: - ./scripts/ozone/docker-config environment: - KERBEROS_ENABLED: ${KERBEROS_ENABLED} + RANGER_KERBEROS_ENABLED: ${KERBEROS_ENABLED} om: build: context: . @@ -28,7 +28,6 @@ services: - OZONE_RUNNER_VERSION=${OZONE_RUNNER_VERSION} - OZONE_HOME=/opt/hadoop - OZONE_PLUGIN_VERSION=${OZONE_PLUGIN_VERSION} - - KERBEROS_ENABLED=${KERBEROS_ENABLED} image: ranger-ozone:latest container_name: ozone-om hostname: om.rangernw @@ -58,11 +57,11 @@ services: OZONE_HOME: /opt/hadoop OZONE_PLUGIN_VERSION: ${OZONE_PLUGIN_VERSION} OZONE_VERSION: ${OZONE_VERSION} - KERBEROS_ENABLED: ${KERBEROS_ENABLED} + RANGER_KERBEROS_ENABLED: ${KERBEROS_ENABLED} env_file: - ./scripts/ozone/docker-config - # Ozone 2.1 entrypoint init uses obsolete -createObjectStore fallback; use --init explicitly. - command: bash -c "/opt/hadoop/ranger-ozone-plugin/ranger-ozone-setup.sh && (test -f /data/metadata/om/current/VERSION || /opt/hadoop/bin/ozone om --init) && exec /opt/hadoop/bin/ozone om" + # Do not pass KERBEROS_ENABLED: Ozone libexec/entrypoint.sh waits for krb5:8081. + command: bash -c "unset KERBEROS_ENABLED; /opt/hadoop/ranger-ozone-plugin/ranger-ozone-setup.sh && (test -f /data/metadata/om/current/VERSION || /opt/hadoop/bin/ozone om --init) && exec /opt/hadoop/bin/ozone om" scm: image: ${OZONE_RUNNER_IMAGE}:${OZONE_RUNNER_VERSION} container_name: ozone-scm @@ -82,9 +81,9 @@ services: env_file: - ./scripts/ozone/docker-config environment: - KERBEROS_ENABLED: ${KERBEROS_ENABLED} + RANGER_KERBEROS_ENABLED: ${KERBEROS_ENABLED} OZONE-SITE.XML_hdds.scm.safemode.min.datanode: "${OZONE_SAFEMODE_MIN_DATANODES:-1}" - command: bash -c "(test -f /data/metadata/scm/current/VERSION || /opt/hadoop/bin/ozone scm --init) && exec /opt/hadoop/bin/ozone scm" + command: bash -c "unset KERBEROS_ENABLED; (test -f /data/metadata/scm/current/VERSION || /opt/hadoop/bin/ozone scm --init) && exec /opt/hadoop/bin/ozone scm" networks: ranger: diff --git a/dev-support/ranger-docker/scripts/ozone/docker-config b/dev-support/ranger-docker/scripts/ozone/docker-config index cc20447f5..78f661e26 100644 --- a/dev-support/ranger-docker/scripts/ozone/docker-config +++ b/dev-support/ranger-docker/scripts/ozone/docker-config @@ -69,7 +69,7 @@ no_proxy=om,scm,s3g,recon,kdc,localhost,127.0.0.1 # Explicitly enable filesystem snapshot feature for this Docker compose cluster OZONE-SITE.XML_ozone.filesystem.snapshot.enabled=true -# Kerberos (required for Ranger plugin policy download when KERBEROS_ENABLED=true) +# Kerberos via Ranger KDC keytabs (do not set KERBEROS_ENABLED env; Ozone entrypoint expects krb5:8081) OZONE-SITE.XML_ozone.security.enabled=true OZONE-SITE.XML_hdds.scm.kerberos.principal=scm/[email protected] OZONE-SITE.XML_hdds.scm.kerberos.keytab.file=/etc/keytabs/scm.keytab diff --git a/dev-support/ranger-docker/scripts/ozone/ranger-ozone-setup.sh b/dev-support/ranger-docker/scripts/ozone/ranger-ozone-setup.sh index 2c9f8adc7..2583ce11d 100644 --- a/dev-support/ranger-docker/scripts/ozone/ranger-ozone-setup.sh +++ b/dev-support/ranger-docker/scripts/ozone/ranger-ozone-setup.sh @@ -20,7 +20,7 @@ cd "${OZONE_HOME}"/ranger-ozone-plugin || exit wait_for_keytab() { local keytab_name=$1 - if [ "${KERBEROS_ENABLED}" != "true" ]; then + if [ "${RANGER_KERBEROS_ENABLED}" != "true" ]; then return 0 fi local keytab_path="/etc/keytabs/${keytab_name}" @@ -64,6 +64,10 @@ if [[ ! -f "${OZONE_HOME}"/.setupDone ]]; then wait_for_keytab om.keytab + if [ -f "${OZONE_HOME}/libexec/envtoconf.py" ]; then + python3 "${OZONE_HOME}/libexec/envtoconf.py" --destination "${OZONE_CONF_DIR:-/etc/hadoop}" + fi + if [ ! -d conf ]; then mkdir -p conf echo "conf directory created!"
