From 0a27ef11e562d73c62501d74806efc72753df9b0 Mon Sep 17 00:00:00 2001 From: Paras Date: Thu, 9 Jul 2026 15:45:07 +0100 Subject: [PATCH] RANGER-5679: Document OpenSearch audit setup in docker README and per-DB install.properties - Append a commented native OpenSearch audit block (audit_store=opensearch + audit_opensearch_*) to mysql, oracle and sqlserver install.properties so the README's 'enable the OpenSearch block' step is actionable; Solr and Elasticsearch lines are left unchanged - Note that the default RANGER_DB_TYPE=postgres ships audit_store=opensearch preconfigured, so the OpenSearch setup commands auto-run with no install.properties edits; manual enablement is only needed for mysql/oracle/sqlserver - Add OpenSearch audit dispatcher one-liner to the 'audit server services individually' list in the docker README --- dev-support/ranger-docker/README.md | 15 +++++++++++---- .../admin/ranger-admin-install-mysql.properties | 9 +++++++++ .../admin/ranger-admin-install-oracle.properties | 9 +++++++++ .../ranger-admin-install-sqlserver.properties | 9 +++++++++ 4 files changed, 38 insertions(+), 4 deletions(-) diff --git a/dev-support/ranger-docker/README.md b/dev-support/ranger-docker/README.md index 1ddd9c3fdba..ec3a737b1a8 100644 --- a/dev-support/ranger-docker/README.md +++ b/dev-support/ranger-docker/README.md @@ -119,6 +119,9 @@ used by the Solr audit path. ##### Setup +With the default `RANGER_DB_TYPE=postgres`, OpenSearch auditing is preconfigured and runs +out of the box — the commands below need no `install.properties` changes. + ~~~ # Prerequisites: build the audit-dispatcher tarball and download archives mvn clean package -DskipTests -pl distro -am @@ -149,11 +152,12 @@ docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-opensearch. -f docker-compose.ranger-audit-dispatcher-opensearch.yml up -d ranger-audit-ingestor ranger-audit-dispatcher-opensearch ~~~ -For **fresh Ranger installs** using OpenSearch for audits, set `audit_store=opensearch` in -`scripts/admin/ranger-admin-install-postgres.properties` and configure the `audit_opensearch_*` properties. +To use OpenSearch with **mysql, oracle or sqlserver** instead, enable the OpenSearch block in the matching +`scripts/admin/ranger-admin-install-${RANGER_DB_TYPE}.properties` (uncomment the `audit_store=opensearch` +and `audit_opensearch_*` lines and comment out the Solr block) before running the setup commands. -For **existing Solr-based installs**, switching stores requires updating `audit_store=opensearch` -in install.properties, configuring the `audit_opensearch_*` properties, and restarting Ranger Admin. +For **existing Solr-based installs**, switch stores by setting `audit_store=opensearch` (and the +`audit_opensearch_*` properties) in install.properties and restarting Ranger Admin. Similarly, check the `depends` section of the `docker-compose.ranger-service.yaml` file and add docker-compose files for these services when trying to bring up the `service` container. #### Bring up all containers @@ -180,6 +184,9 @@ docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-kafka.yml - # Solr dispatcher docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-audit-dispatcher-solr.yml up -d +# OpenSearch dispatcher (requires the ranger-opensearch container; see "OpenSearch audit flow" above) +docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-opensearch.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-audit-dispatcher-opensearch.yml up -d + # HDFS dispatcher docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-hadoop.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-audit-dispatcher-hdfs.yml up -d ~~~ diff --git a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-mysql.properties b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-mysql.properties index 18a4c8da7fd..622abd89563 100644 --- a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-mysql.properties +++ b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-mysql.properties @@ -56,6 +56,15 @@ audit_elasticsearch_password=elasticsearch audit_elasticsearch_index=ranger_audits audit_elasticsearch_bootstrap_enabled=true +# audit_store=opensearch +# audit_opensearch_urls=ranger-opensearch +# audit_opensearch_port=9200 +# audit_opensearch_protocol=http +# audit_opensearch_user=admin +# audit_opensearch_password=admin +# audit_opensearch_index=ranger_audits +# audit_opensearch_bootstrap_enabled=true + policymgr_external_url=http://ranger-admin:6080 policymgr_http_enabled=true diff --git a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-oracle.properties b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-oracle.properties index 22b177c0274..79a546fb7d9 100644 --- a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-oracle.properties +++ b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-oracle.properties @@ -58,6 +58,15 @@ audit_elasticsearch_password=elasticsearch audit_elasticsearch_index=ranger_audits audit_elasticsearch_bootstrap_enabled=true +# audit_store=opensearch +# audit_opensearch_urls=ranger-opensearch +# audit_opensearch_port=9200 +# audit_opensearch_protocol=http +# audit_opensearch_user=admin +# audit_opensearch_password=admin +# audit_opensearch_index=ranger_audits +# audit_opensearch_bootstrap_enabled=true + policymgr_external_url=http://ranger-admin:6080 policymgr_http_enabled=true diff --git a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-sqlserver.properties b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-sqlserver.properties index 8a1919374e9..80f90e90bfb 100644 --- a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-sqlserver.properties +++ b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-sqlserver.properties @@ -65,6 +65,15 @@ audit_elasticsearch_password=elasticsearch audit_elasticsearch_index=ranger_audits audit_elasticsearch_bootstrap_enabled=true +# audit_store=opensearch +# audit_opensearch_urls=ranger-opensearch +# audit_opensearch_port=9200 +# audit_opensearch_protocol=http +# audit_opensearch_user=admin +# audit_opensearch_password=admin +# audit_opensearch_index=ranger_audits +# audit_opensearch_bootstrap_enabled=true + policymgr_external_url=http://ranger-admin:6080 policymgr_http_enabled=true