ramackri commented on code in PR #1120:
URL: https://github.com/apache/ranger/pull/1120#discussion_r3696209137
##########
security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql:
##########
@@ -1997,6 +1997,11 @@ INSERT INTO
x_portal_user(CREATE_TIME,UPDATE_TIME,FIRST_NAME,LAST_NAME,PUB_SCR_N
INSERT INTO
x_portal_user_role(CREATE_TIME,UPDATE_TIME,USER_ID,USER_ROLE,STATUS)VALUES(current_timestamp,current_timestamp,getXportalUIdByLoginId('rangertagsync'),'ROLE_SYS_ADMIN',1);
INSERT INTO
x_user(CREATE_TIME,UPDATE_TIME,user_name,status,descr)VALUES(current_timestamp,current_timestamp,'rangertagsync',0,'rangertagsync');
+-- Built-in health-check user for the /service/actuator/health/readiness
endpoint. It authenticates via trusted header (Istio/trusted proxy) only; no
usable password is set, so password login is effectively disabled. It is
granted read access only.
+INSERT INTO
x_portal_user(CREATE_TIME,UPDATE_TIME,FIRST_NAME,LAST_NAME,PUB_SCR_NAME,LOGIN_ID,PASSWORD,EMAIL,STATUS)VALUES(current_timestamp,current_timestamp,'healthcheck','','healthcheck','healthcheck','*disabled-header-auth-only*','healthcheck',1);
Review Comment:
Readiness fetches all service-def names every time
Readiness calls getServiceDefNames() →:
SELECT obj.name FROM XXServiceDef obj ORDER BY obj.name
Readiness only needs “any service def exists?” — not the full sorted list
returned in the JSON body.
Impact: Unnecessary DB work + larger response on every probe (30+ service
types in many deployments).
Fix: Use SELECT COUNT(*) or SELECT 1 ... LIMIT 1. Return { "status": "UP" }
only — omit the full service-defs list from probe responses.
##########
security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql:
##########
@@ -1997,6 +1997,11 @@ INSERT INTO
x_portal_user(CREATE_TIME,UPDATE_TIME,FIRST_NAME,LAST_NAME,PUB_SCR_N
INSERT INTO
x_portal_user_role(CREATE_TIME,UPDATE_TIME,USER_ID,USER_ROLE,STATUS)VALUES(current_timestamp,current_timestamp,getXportalUIdByLoginId('rangertagsync'),'ROLE_SYS_ADMIN',1);
INSERT INTO
x_user(CREATE_TIME,UPDATE_TIME,user_name,status,descr)VALUES(current_timestamp,current_timestamp,'rangertagsync',0,'rangertagsync');
+-- Built-in health-check user for the /service/actuator/health/readiness
endpoint. It authenticates via trusted header (Istio/trusted proxy) only; no
usable password is set, so password login is effectively disabled. It is
granted read access only.
+INSERT INTO
x_portal_user(CREATE_TIME,UPDATE_TIME,FIRST_NAME,LAST_NAME,PUB_SCR_NAME,LOGIN_ID,PASSWORD,EMAIL,STATUS)VALUES(current_timestamp,current_timestamp,'healthcheck','','healthcheck','healthcheck','*disabled-header-auth-only*','healthcheck',1);
Review Comment:
Readiness reuses heavy ServiceREST authorization
getServiceDefNames() is wired like a normal API:
@PreAuthorize(... GET_SERVICE_DEFS ...)
hasModuleAccess(MODULE_RESOURCE_BASED_POLICIES)
refreshPermissionsIfNeeded() inside isAPIAccessible() (can re-hit DB on
interval)
Impact: Health probe pays the same authorization cost as GET
/service/definitions.
Fix: Use a dedicated DAO method on the readiness path without @PreAuthorize
/ module checks (auth already handled at the edge, or use unauthenticated
internal check).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
