ramackri commented on code in PR #1073:
URL: https://github.com/apache/ranger/pull/1073#discussion_r3597971828
##########
security-admin/src/main/java/org/apache/ranger/patch/PatchForOzoneServiceDefPolicyConditionUpdate_J10065.java:
##########
@@ -18,6 +18,7 @@
package org.apache.ranger.patch;
Review Comment:
What that code does (J10065)
This runs once when you upgrade to Ranger 2.9 and admin starts up. It
updates the ozone service definition in the database.
Step 1 — Read the admin flag
final boolean enableActionMatcherInPoliciesCondition =
RangerAdminConfig.getInstance().getBoolean(
RangerServiceDefService.PROP_ENABLE_ACTION_MATCHER_IN_POLICIES_CONDITION,
false);
It reads ranger.servicedef.ozone.enableActionMatcherInPoliciesCondition from
admin config. Default is false.
Step 2 — Decide which policy conditions ozone gets
if (enableActionMatcherInPoliciesCondition) {
updatedPolicyConditions = new ArrayList<>(embeddedPolicyConditions);
} else {
// copy all conditions EXCEPT "action-matches"
}
Flag ON → ozone gets all embedded conditions, including action-matches (the
S3 Action dropdown in the UI).
Flag OFF → ozone gets everything except action-matches.
Step 3 — Save to DB
dbOzoneServiceDef.setPolicyConditions(updatedPolicyConditions);
That list is written to the DB as ozone’s policy condition definitions (what
Admin UI and plugins see as available conditions).
What this code does not do
It only touches policyConditions.
It does not update def_options — the JSON on x_service_def, e.g.:
{
"enableTagBasedPolicies": "true",
"enableDenyAndExceptionsInPolicies": "true",
"enableActionMatcherInPoliciesCondition": "false"
}
That JSON is a separate knob. The Ozone plugin reads it to know whether to
enforce S3 actions (GetObject, etc.) or only coarse read/write.
yes @fimugdha we need this logic” means: extend J10065 (or a follow-on
patch) to manage def_options on upgrade, not only policyConditions.
@fmorg-git Please add if i missed anything here
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
