kumaab opened a new pull request, #1297:
URL: https://github.com/apache/ranger/pull/1297
## What changes were proposed in this pull request?
Ranger's Kafka clients (audit-ingestor, audit-dispatchers, tagsync) each
assemble their own SASL settings and only support Kerberos keytabs. Kafka's
bundled OAUTHBEARER handler reads a file:// token once and caches it, so
rotated platform tokens, such as Kubernetes projected service-account tokens,
leave the client presenting an expired token.
- New module agents-audit/kafka-client-auth (ranger-kafka-client-auth):
- RangerKafkaClientSecurityConfig builds security.protocol / sasl.* client
properties from <prefix>.kafka.* for producers, consumers and admin clients;
<prefix>.kafka.sasl.* and <prefix>.kafka.ssl.* pass through and override.
- RangerKafkaOAuthBearerLoginCallbackHandler presents a JWT read from a
file:// URL. It re-reads the file on every login and refresh, so the client
always presents the current token after rotation. http(s):// endpoints use
Kafka's own client-credentials handler.
- RangerOAuthBearerToken, a reusable OAuthBearerToken built from parsed
claims.
- audit-ingestor, all audit-dispatcher backends and the audit topic
bootstrap call the helper instead of building a Kerberos-only JAAS string each;
audit-ingestor also loads the site XML given by -Daudit.config after the
packaged default.
- tagsync: TAG_SOURCE_ATLAS_KAFKA_SASL_MECHANISM and
TAG_SOURCE_ATLAS_KAFKA_OAUTH_TOKEN_URL rendered into
atlas-application.properties; module added to the tagsync distribution.
- ranger-docker: broker accepts GSSAPI and OAUTHBEARER; ranger-kafka mints
and rotates dev tokens into a shared volume; KAFKA_SASL_MECHANISM in .env
selects OAUTHBEARER (default) or GSSAPI; the ingestor renders its site XML from
YAML plus env like the admin container.
**Behaviour change**: with SASL_PLAINTEXT or SASL_SSL the default
sasl.mechanism is now OAUTHBEARER and GSSAPI must be set explicitly; no sasl.*
keys are set for PLAINTEXT or SSL.
## How was this patch tested?
Pending
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
