Ramachandran Krishnan created RANGER-5719:
---------------------------------------------
Summary: Shared partition-plan library and SPIFFE header auth
utilities
Key: RANGER-5719
URL: https://issues.apache.org/jira/browse/RANGER-5719
Project: Ranger
Issue Type: Sub-task
Components: Ranger
Reporter: Ramachandran Krishnan
Assignee: Ramachandran Krishnan
Fix For: 3.0.0
h2. Summary
Introduces shared libraries in {{agents-common}} and {{common-utils}} that
Admin, the Audit Ingestor, and plugins will use in follow-up PRs. This change
adds building blocks only; no end-to-end audit routing or SPIFFE enforcement is
active until later PRs land.
h3. Audit partition plan library
Adds a reusable partition-plan module for Admin-managed dynamic Kafka routing:
* Plan model — JSON representation of the audit topic, plan version,
per-plugin partition assignments, buffer pool, and per-service allow-list
derived from {{{}policy.download.auth.users{}}}.
* Plan lifecycle helpers — allocation and validation when services are
onboarded or offboarded, including buffer promotion and version bumps.
* Routing utilities — mapping from Admin-assigned partition IDs to Kafka
producer partition indices, including safe fallbacks when topic metadata lags.
* Plugin and service resolution — mapping Ranger service types to plugin IDs
and parsing service config used for ingestor authorization.
This keeps partition-plan logic in one place so Admin, ingestor, and tests
share the same contract.
h3. SPIFFE header auth utilities
Adds shared outbound auth helpers following the RANGER-5700 trusted-header
pattern:
* Header auth config — reads enable flag and SPIFFE header name from
plugin/site configuration.
* SPIFFE identity resolution — resolves workload identity from explicit
config, identity file, or standard workload identity path.
These utilities support plugin → ingestor and ingestor → Admin SPIFFE auth in
later PRs.
h3. What this PR does not include
* Database schema or seed data
* Admin REST APIs or plan persistence
* Ingestor poller, dynamic partitioner, or inbound SPIFFE filter
* Plugin install templates or audit destination changes
* Docker or E2E smoke tests
Depends on: nothing
Blocks: DB patch, Admin, Ingestor, and Plugin PRs in the RANGER-5655 series
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
