ramackri opened a new pull request, #1135: URL: https://github.com/apache/ranger/pull/1135
## Summary Foundation for [RANGER-5655](https://issues.apache.org/jira/browse/RANGER-5655) — Admin-managed Kafka audit partition plan and SPIFFE workload identity. This PR combines the first three merge slices (PR1 + PR2 + PR5 from the feature split); Admin REST (PR3) and Ingestor routing/inbound SPIFFE (PR4) follow in separate PRs. **Parent:** [RANGER-5655](https://issues.apache.org/jira/browse/RANGER-5655) — Ranger Admin-Managed Kafka Audit Partition Plan & SPIFFE Auth **Sub-tasks covered in this PR:** - [RANGER-5719](https://issues.apache.org/jira/browse/RANGER-5719) — Shared partition-plan library and SPIFFE header auth utilities - [RANGER-5720](https://issues.apache.org/jira/browse/RANGER-5720) — DB patch 078 for audit partition plan global state - [RANGER-5723](https://issues.apache.org/jira/browse/RANGER-5723) — Plugin SPIFFE outbound auth for audit-server destination **Sub-tasks deferred to follow-on PRs:** - [RANGER-5721](https://issues.apache.org/jira/browse/RANGER-5721) — Admin-managed audit partition plan REST and lifecycle hooks - [RANGER-5722](https://issues.apache.org/jira/browse/RANGER-5722) — Ingestor dynamic routing, SPIFFE inbound auth, and Admin plan poller ### PR1 — Shared foundation (21 files) - Partition plan library in `agents-common/.../audit/partition/` (`PartitionPlan`, `PartitionPlanAllocator`, `PartitionPlanValidator`, routing utils, allow-list parsing from `policy.download.auth.users`) - SPIFFE utilities in `common-utils`: `PluginHeaderAuthConfig`, `SpiffeIdentityResolver` - `RangerRESTClient.setTrustedAuthHeaders()` for outbound trusted headers - Unit tests for partition plan and SPIFFE config (47 tests in partition package) ### PR2 — DB patch 078 (10 files) - Patch `078-audit-partition-plan-global-state.sql` for MySQL, PostgreSQL, Oracle, SQL Server, SQL Anywhere - Widen `x_ranger_global_state.app_data` for large JSON plan - Bootstrap `rangerauditserver` user + `ROLE_ADMIN_AUDITOR` + seed empty partition plan - Matching updates to optimized SQL for fresh installs ### PR5 — Plugin SPIFFE outbound auth (51 files) - `RangerAuditServerDestination` wires `PluginHeaderAuthConfig.buildSpiffeAuthHeaders()` + `setTrustedAuthHeaders()` when enabled - `RangerAuditServerDestinationTest` for prefix resolution - All plugin `install.properties`, `*-security-changes.cfg`, `*-audit-changes.cfg` with SPIFFE props **defaulting to disabled** (`XAAUDIT.AUDITSERVER.AUTHN.SPIFFE.ENABLED=false`) **82 files changed** (+2,892 / −15 lines) ## Design notes - SPIFFE is **opt-in** everywhere in this PR — safe to merge before PR4 (ingestor inbound auth) lands - Per-service audit allow-list comes from `policy.download.auth.users` in the partition plan (not static ingestor XML) - `AuditPluginIdResolver` intentionally omitted here; deferred to PR3 with `AuditPartitionPlanMgr` ## Test plan - [x] `mvn -pl agents-common -am test` — partition plan + SPIFFE unit tests pass - [x] `mvn -pl agents-audit/dest-auditserver -am test -Dtest=RangerAuditServerDestinationTest` — 3/3 pass - [ ] `mvn -pl security-admin -am compile` — DB patch SQL validates on upgrade path - [ ] Plugin enable-script: verify `ranger-*-audit.xml` / `ranger-*-security.xml` get SPIFFE props when `ENABLED=true` - [ ] End-to-end SPIFFE audit POST requires follow-on PR4 (ingestor `AuditHeaderAuthFilter`) Made with [Cursor](https://cursor.com) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
