From 0be5b6def373806036ee930adedd83e6c424a882 Mon Sep 17 00:00:00 2001
From: Paras <pagnihotri@cloudera.com>
Date: Thu, 9 Jul 2026 15:49:52 +0100
Subject: [PATCH] RANGER-5680: Make Solr optional in docker so Ranger can run
 without it

- Extract the ranger-solr service from docker-compose.ranger.yml into a dedicated docker-compose.ranger-solr.yml (mirrors the docker-compose.ranger-opensearch.yml pattern)
- Remove the hard 'depends_on: ranger-solr' from the ranger, ranger-pdp and ozone-om services so the core stack starts without Solr
- Update README: core services now come up without Solr; document Solr as opt-in via -f docker-compose.ranger-solr.yml, and add the Solr compose file to the all-containers and Solr audit-dispatcher commands (which still depend on ranger-solr)

Validated with 'docker compose config' across base-only (Solr-free), pdp, ozone and Solr audit-server combinations.

Note: RANGER_AUDIT_STORE env-var selector to be added as a follow-up.
---
 dev-support/ranger-docker/README.md           | 18 +++++--
 .../docker-compose.ranger-ozone.yml           |  2 -
 .../docker-compose.ranger-pdp.yml             |  2 -
 .../docker-compose.ranger-solr.yml            | 50 +++++++++++++++++++
 .../ranger-docker/docker-compose.ranger.yml   | 48 ------------------
 5 files changed, 64 insertions(+), 56 deletions(-)
 create mode 100644 dev-support/ranger-docker/docker-compose.ranger-solr.yml

diff --git a/dev-support/ranger-docker/README.md b/dev-support/ranger-docker/README.md
index 1ddd9c3fdb..1a398627ed 100644
--- a/dev-support/ranger-docker/README.md
+++ b/dev-support/ranger-docker/README.md
@@ -79,12 +79,22 @@ cd dev-support/ranger-docker
 # To enable file based sync source for usersync do:
 # export ENABLE_FILE_SYNC_SOURCE=true
 
-# valid values for RANGER_DB_TYPE: mysql/postgres/oracle
+# valid values for RANGER_DB_TYPE: mysql/postgres/oracle/sqlserver
 
 docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-usersync.yml -f docker-compose.ranger-tagsync.yml -f docker-compose.ranger-pdp.yml -f docker-compose.ranger-kms.yml up -d
 
 # Ranger Admin can be accessed at http://localhost:6080 (admin/rangerR0cks!)
 ~~~
+
+Solr is no longer part of the core stack, so the command above brings up Ranger **without Solr**.
+Choose an audit store explicitly:
+- For **Solr** audits, add `-f docker-compose.ranger-solr.yml` to any command below and set `audit_store=solr` in the relevant `scripts/admin/ranger-admin-install-${RANGER_DB_TYPE}.properties`.
+- For **OpenSearch** audits, add `-f docker-compose.ranger-opensearch.yml` and set `audit_store=opensearch` (see "OpenSearch audit flow" below).
+
+~~~
+# Example: core services with Solr audits
+docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-solr.yml -f docker-compose.ranger-usersync.yml -f docker-compose.ranger-tagsync.yml -f docker-compose.ranger-pdp.yml -f docker-compose.ranger-kms.yml up -d
+~~~
 #### Bring up hive container
 ~~~
 docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-hadoop.yml -f docker-compose.ranger-hive.yml up -d
@@ -159,7 +169,7 @@ Similarly, check the `depends` section of the `docker-compose.ranger-service.yam
 #### Bring up all containers
 ~~~
 ./scripts/ozone/ozone-plugin-docker-setup.sh
-docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-usersync.yml -f docker-compose.ranger-tagsync.yml -f docker-compose.ranger-pdp.yml -f docker-compose.ranger-kms.yml -f docker-compose.ranger-hadoop.yml -f docker-compose.ranger-hbase.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-hive.yml -f docker-compose.ranger-knox.yml -f docker-compose.ranger-ozone.yml up -d
+docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-solr.yml -f docker-compose.ranger-usersync.yml -f docker-compose.ranger-tagsync.yml -f docker-compose.ranger-pdp.yml -f docker-compose.ranger-kms.yml -f docker-compose.ranger-hadoop.yml -f docker-compose.ranger-hbase.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-hive.yml -f docker-compose.ranger-knox.yml -f docker-compose.ranger-ozone.yml up -d
 ~~~
           
 #### To rebuild specific images and start containers with the new image:
@@ -169,7 +179,7 @@ docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-usersync.ym
 
 #### To bring up audit server ingestor + dispatchers. Make sure kafka, solr, and hdfs containers are running before bringing up audit server services.
 ~~~
-docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-hadoop.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-audit-server.yml up -d
+docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-solr.yml -f docker-compose.ranger-hadoop.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-audit-server.yml up -d
 ~~~
 
 #### To bring up audit server services individually:
@@ -178,7 +188,7 @@ docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-hadoop.yml
 docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-audit-ingestor.yml up -d
 
 # Solr dispatcher
-docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-audit-dispatcher-solr.yml up -d
+docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-solr.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-audit-dispatcher-solr.yml up -d
 
 # HDFS dispatcher
 docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-hadoop.yml -f docker-compose.ranger-kafka.yml -f docker-compose.ranger-audit-dispatcher-hdfs.yml up -d
diff --git a/dev-support/ranger-docker/docker-compose.ranger-ozone.yml b/dev-support/ranger-docker/docker-compose.ranger-ozone.yml
index 3de2916748..21a5850102 100644
--- a/dev-support/ranger-docker/docker-compose.ranger-ozone.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger-ozone.yml
@@ -39,8 +39,6 @@ services:
         condition: service_started
       ranger:
         condition: service_started
-      ranger-solr:
-        condition: service_started
     environment:
       OZONE_OPTS: -XX:-UseContainerSupport -Dcom.sun.net.ssl.checkRevocation=false
       OZONE_HOME: /opt/hadoop
diff --git a/dev-support/ranger-docker/docker-compose.ranger-pdp.yml b/dev-support/ranger-docker/docker-compose.ranger-pdp.yml
index 0f3c970fc3..195f997e9f 100644
--- a/dev-support/ranger-docker/docker-compose.ranger-pdp.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger-pdp.yml
@@ -48,8 +48,6 @@ services:
     depends_on:
       ranger:
         condition: service_started
-      ranger-solr:
-        condition: service_started
     environment:
       - PDP_VERSION
       - KERBEROS_ENABLED
diff --git a/dev-support/ranger-docker/docker-compose.ranger-solr.yml b/dev-support/ranger-docker/docker-compose.ranger-solr.yml
new file mode 100644
index 0000000000..3f36cedd79
--- /dev/null
+++ b/dev-support/ranger-docker/docker-compose.ranger-solr.yml
@@ -0,0 +1,50 @@
+services:
+  ranger-solr:
+    build:
+      context: .
+      dockerfile: Dockerfile.ranger-solr
+      args:
+        - RANGER_BASE_IMAGE=${RANGER_BASE_IMAGE}
+        - RANGER_BASE_VERSION=${RANGER_BASE_VERSION}
+        - SOLR_VERSION=${SOLR_VERSION}
+        - SOLR_PLUGIN_VERSION=${SOLR_PLUGIN_VERSION}
+        - KERBEROS_ENABLED=${KERBEROS_ENABLED}
+    image: ranger-solr
+    container_name: ranger-solr
+    hostname: ranger-solr.rangernw
+    volumes:
+      - ./dist/keytabs/ranger-solr:/etc/keytabs
+      - ./scripts/solr/solr-ranger_audits:/opt/solr/server/solr/configsets/ranger_audits/conf
+      # Core conf is copied once by solr-precreate; mount so Solr 9 cache updates apply without recreating the core
+      - ./scripts/solr/solr-ranger_audits:/var/solr/data/ranger_audits/conf
+      - ./scripts/solr/ranger_audits/core.properties:/var/solr/data/ranger_audits/core.properties
+      - ./scripts/solr/ranger-solr-plugin-install.properties:/opt/ranger/ranger-solr-plugin/install.properties
+      # Keep enable templates in sync with repo (image tarball may be stale)
+      - ../../plugin-solr/conf/ranger-solr-security-changes.cfg:/opt/ranger/ranger-solr-plugin/install/conf.templates/enable/ranger-solr-security-changes.cfg:ro
+      - ./scripts/solr/core-site.xml:/opt/solr/server/resources/core-site.xml
+      - ./scripts/solr/solr-jaas.conf:/var/solr/data/jaas.conf
+      - ./scripts/solr/solr-security.json:/var/solr/data/security.json
+      - ./scripts/solr/ranger-solr.sh:/opt/ranger/ranger-solr.sh
+      - ./scripts/kdc/krb5.conf:/etc/krb5.conf
+    networks:
+      - ranger
+    ports:
+      - "8983:8983"
+    depends_on:
+      ranger-kdc:
+        condition: service_started
+      ranger-zk:
+        condition: service_started
+    environment:
+      - KERBEROS_ENABLED
+      - KRB5_CONFIG=/etc/krb5.conf
+      # Solr 9 enables Java SecurityManager by default; Ranger keytab login and policy cache need broader access
+      - SOLR_SECURITY_MANAGER_ENABLED=false
+    command:
+      - solr-precreate
+      - ranger_audits
+      - /opt/solr/server/solr/configsets/ranger_audits/
+
+networks:
+  ranger:
+    name: rangernw
diff --git a/dev-support/ranger-docker/docker-compose.ranger.yml b/dev-support/ranger-docker/docker-compose.ranger.yml
index a75de14247..c737fab867 100644
--- a/dev-support/ranger-docker/docker-compose.ranger.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger.yml
@@ -31,8 +31,6 @@ services:
         condition: service_started
       ranger-db:
         condition: service_healthy
-      ranger-solr:
-        condition: service_started
     environment:
       - RANGER_VERSION
       - RANGER_DB_TYPE
@@ -97,52 +95,6 @@ services:
     environment:
       - KERBEROS_ENABLED
 
-  ranger-solr:
-    build:
-      context: .
-      dockerfile: Dockerfile.ranger-solr
-      args:
-        - RANGER_BASE_IMAGE=${RANGER_BASE_IMAGE}
-        - RANGER_BASE_VERSION=${RANGER_BASE_VERSION}
-        - SOLR_VERSION=${SOLR_VERSION}
-        - SOLR_PLUGIN_VERSION=${SOLR_PLUGIN_VERSION}
-        - KERBEROS_ENABLED=${KERBEROS_ENABLED}
-    image: ranger-solr
-    container_name: ranger-solr
-    hostname: ranger-solr.rangernw
-    volumes:
-      - ./dist/keytabs/ranger-solr:/etc/keytabs
-      - ./scripts/solr/solr-ranger_audits:/opt/solr/server/solr/configsets/ranger_audits/conf
-      # Core conf is copied once by solr-precreate; mount so Solr 9 cache updates apply without recreating the core
-      - ./scripts/solr/solr-ranger_audits:/var/solr/data/ranger_audits/conf
-      - ./scripts/solr/ranger_audits/core.properties:/var/solr/data/ranger_audits/core.properties
-      - ./scripts/solr/ranger-solr-plugin-install.properties:/opt/ranger/ranger-solr-plugin/install.properties
-      # Keep enable templates in sync with repo (image tarball may be stale)
-      - ../../plugin-solr/conf/ranger-solr-security-changes.cfg:/opt/ranger/ranger-solr-plugin/install/conf.templates/enable/ranger-solr-security-changes.cfg:ro
-      - ./scripts/solr/core-site.xml:/opt/solr/server/resources/core-site.xml
-      - ./scripts/solr/solr-jaas.conf:/var/solr/data/jaas.conf
-      - ./scripts/solr/solr-security.json:/var/solr/data/security.json
-      - ./scripts/solr/ranger-solr.sh:/opt/ranger/ranger-solr.sh
-      - ./scripts/kdc/krb5.conf:/etc/krb5.conf
-    networks:
-      - ranger
-    ports:
-      - "8983:8983"
-    depends_on:
-      ranger-kdc:
-        condition: service_started
-      ranger-zk:
-        condition: service_started
-    environment:
-      - KERBEROS_ENABLED
-      - KRB5_CONFIG=/etc/krb5.conf
-      # Solr 9 enables Java SecurityManager by default; Ranger keytab login and policy cache need broader access
-      - SOLR_SECURITY_MANAGER_ENABLED=false
-    command:
-      - solr-precreate
-      - ranger_audits
-      - /opt/solr/server/solr/configsets/ranger_audits/
-
 networks:
   ranger:
     name: rangernw