[HDDS-6909] [Multi-Tenant] Use RangerClient for Ranger operations

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.3.0
• Labels: pull-request-available
• Assignee: Siyao Meng
• Reporter: Siyao Meng
• Created: 17/Jun/22 17:28
• Updated: 03/Feb/24 07:24
• Resolved: 13/Jul/22 18:35

Description

HDDS-5836 is merged. But we have yet to switch the actual logic to RangerClient.

1. Use RangerClientMultiTenantAccessController instead of RangerRestMultiTenantAccessController.
2. Get rid of MultiTenantAccessAuthorizer and MultiTenantAccessAuthorizerRangerPlugin – use MultiTenantAccessController instead.
3. work around RangerClient's missing getServiceVersion() API Use rangerClient.getService(serviceName).getPolicyVersion() to implement RangerClientMultiTenantAccessController#getRangerServiceVersion()

RangerClient allows the use of Kerberos principal and ticket as login credential (preferred than username and password).

Issue Links

• Dependent: HDDS-5836 [Multi-Tenant] Use Ranger Java client
• incorporates: HDDS-6755 [Multi-Tenant] Work around Ranger client not supporting service version call
• relates to: HDDS-10274 Remove unused AccessPolicy
• links to: GitHub Pull Request #3576