-
Notifications
You must be signed in to change notification settings - Fork 1k
RANGER-5373: Docker setup updated to run KDC and create keytabs for service accounts #704
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR introduces Kerberos support to the Ranger Docker setup by adding a KDC container and integrating Kerberos principal/keytab creation across all Ranger services.
Key changes:
- Added a new Kerberos KDC service with Docker support and configuration files
- Integrated Kerberos client tools and keytab creation capability into all service containers
- Updated configuration files to include Kerberos settings for Ranger admin across different database backends
Reviewed Changes
Copilot reviewed 41 out of 41 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| Dockerfile.ranger-kdc | New Dockerfile defining the Kerberos KDC container |
| config/kdc/* | KDC configuration files (krb5.conf, kdc.conf, kadm5.acl) and scripts (entrypoint.sh, create_keytab.sh) |
| docker-compose.ranger-kdc.yml | New compose file to deploy the KDC service |
| scripts/ranger*.sh | Updated service startup scripts to create Kerberos principals and keytabs when Kerberos is enabled |
| Dockerfile.ranger* | Modified to install krb5-user package and copy Kerberos configuration files |
| docker-compose.ranger*.yml | Updated to pass KERBEROS_ENABLED environment variable and build argument |
| scripts/ranger-admin-install-*.properties | Added Kerberos configuration properties for different database backends |
| .env | Added Kerberos-related environment variables |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| ADMIN_PRINCIPAL=admin/admin | ||
| ADMIN_PASSWORD=rangerR0cks! |
Copilot
AI
Oct 19, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hard-coded credentials in the script create a security vulnerability. These credentials should be passed as environment variables or parameters instead of being embedded in the script.
Copilot uses AI. Check for mistakes.
dev-support/ranger-docker/scripts/ranger-admin-install-sqlserver.properties
Outdated
Show resolved
Hide resolved
dev-support/ranger-docker/scripts/ranger-admin-install-sqlserver.properties
Outdated
Show resolved
Hide resolved
dev-support/ranger-docker/scripts/ranger-admin-install-sqlserver.properties
Outdated
Show resolved
Hide resolved
dev-support/ranger-docker/scripts/ranger-admin-install-postgres.properties
Outdated
Show resolved
Hide resolved
dev-support/ranger-docker/scripts/ranger-admin-install-oracle.properties
Outdated
Show resolved
Hide resolved
dev-support/ranger-docker/scripts/ranger-admin-install-mysql.properties
Outdated
Show resolved
Hide resolved
…ion in admin, usersync and tagsync services
What changes were proposed in this pull request?
Introduced
Dockerfile.ranger-kdcto deploy a Kerberos KDC; introduced scriptcreate_keytab.shwhich can be used by services to create Kerberos principals and keytabs for their use.How was this patch tested?
Brought up Ranger container using
docker composealong with-f docker-compose.ranger-kdc.ymland confirmed that each service created service principals and keytabs need for the service.