[HDDS-6576] [Multi-Tenant] Update documentation around Ranger policy creation on bucket sharing

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: HDDS-4944
• Labels: pull-request-available
• Assignee: Siyao Meng
• Reporter: Siyao Meng
• Created: 12/Apr/22 18:00
• Updated: 20/Apr/22 18:08
• Resolved: 20/Apr/22 18:08

Description

If a cluster admin or tenant admin wants the bucket owner (who is a regular tenant user without superuser privileges) to be able to edit their own bucket's policy, an admin needs to manually create a new Ozone policy in Ranger for that bucket, explicitly granting the bucket owner ALL permission on the bucket and making the bucket owner a "delegated admin" for that policy. (Note: the flexible OWNER tag cannot be used in this policy.)
With this new policy, as long as the bucket owner can log in to the Ranger Web UI, he/she could edit this bucket policy on his own, for example, to share the bucket with others without an admin's manual intervention.

We are not providing a dedicated multi-tenancy CLI for that.

CC ppogde

Issue Links

• links to: GitHub Pull Request #3303