AMBARI-26056: Add ranger kms support

[JiaLiangC]

What changes were proposed in this pull request?

Add ranger kms support to ambari
(Please fill in changes proposed in this fix)

How was this patch tested?

Manual test

(Please explain how this patch was tested. Ex: unit tests, manual tests)
(If this patch involves UI changes, please attach a screen-shot; otherwise, remove this)

Please review Ambari Contributing Guide before opening a pull request.

[JiaLiangC]

@virajjasani Could you help review this pr?

[virajjasani]

+1, skimmed through the changes. Unless there is any objection, can merge in 24 hr

[JiaLiangC]

@virajjasani CI/CD failures for all Ambari PRs, attributed to a recent merge that removed PhantomJS in PR #3760. In order to ensure the smooth execution of CI for future PRs, could you help check and considering a revert of this PR.

Here is the link to the problematic PR: PR #3760

The detailed discussion on the failure reasons can be found here: PR #3751 - Comment

[virajjasani]

@arshadmohammad are you fine with reverting #3760?

[virajjasani]

The commit has been reverted 35fbf98

[virajjasani]

Let's re-trigger the build?

[JiaLiangC]

@virajjasani
The CI failure has nothing to do with this PR. According to the logs, it's still a UI failure, unable to find Chrome. It seems that besides the PhantomJS PR, there was an impact on CI/CD. It appears that the CI/CD scripts were also modified, causing the failure. I don't have permission to view the CI/CD configuration files. Can you compare the recent changes in the CI/CD configuration files to see if Chrome installation has been removed?

[virajjasani]

@brahmareddybattula @arshadmohammad are you aware of this by any chance?

[virajjasani]

@JiaLiangC I do see this in the configs

        stage('Parallel Unit Tests') {
            parallel {
                stage('Ambari WebUI Tests') {
                    steps {
                        sh 'lsb_release -a'
                        sh 'ls /usr/bin'
                        sh 'find / -name "chromium-browser"'
                        sh 'export CHROME_BIN=/usr/bin/chromium-browser'
                        sh 'mvn -X -T 2C -am test -pl ambari-web,ambari-admin -Dmaven.artifact.threads=10 -Drat.skip'
                    }
                }

                stage('Ambari Agent Tests') {
                    steps {
                        sh 'pip3 install distro'
                        sh 'mvn -Dmaven.test.failure.ignore=true -am test -pl ambari-agent -Dmaven.artifact.threads=10 -Drat.skip'
                    }
                }

[JiaLiangC]

@virajjasani thanks for your effort
In Ubuntu, the installation location of chromium-browser can vary depending on the method used for installation, such as directly from the Ubuntu repositories or through a snap package. Common installation locations include:

1. Installed via apt (Ubuntu repositories):

   • /usr/bin/chromium-browser

2. Installed via snap:

   • /snap/bin/chromium

For modifying the Jenkins script, there are two suggested approaches:

Approach 1: Limit the Search Scope

Since chromium-browser is most likely installed in /usr/bin/ or /snap/bin/ for snap installations, you can directly check these locations instead of the entire filesystem to avoid unnecessary permission issues. The modified Jenkins script could look like this:

stage('Parallel Unit Tests') {
    parallel {
        stage('Ambari WebUI Tests') {
            steps {
                sh 'lsb_release -a'
                sh 'ls /usr/bin'
                // Directly check possible installation locations
                sh 'if [ -f /usr/bin/chromium-browser ]; then export CHROME_BIN=/usr/bin/chromium-browser; fi'
                sh 'if [ -f /snap/bin/chromium ]; then export CHROME_BIN=/snap/bin/chromium; fi'
                sh 'mvn -X -T 2C -am test -pl ambari-web,ambari-admin -Dmaven.artifact.threads=10 -Drat.skip'
            }
        }
        // Other test stages...
    }
}

Approach 2: Using sudo

If you need to search the entire filesystem for chromium-browser and you have permissions to use sudo in Jenkins scripts, you can run the find command with sudo. However, this is generally not recommended for security reasons, as it could expose sensitive parts of the system or unnecessarily elevate script permissions. If you decide to use sudo, ensure the Jenkins user has appropriate sudo privileges and the sudoers configuration is correct. The modified command might look like:

sh 'sudo find / -name "chromium-browser" 2>/dev/null'

Here, 2>/dev/null is used to ignore error output, such as permission denied messages.

Security Tip: In production environments, avoid using sudo for commands that could affect system security and stability. Approach 1 is a safer, more focused method and should be considered first.

[virajjasani]

Sure we can try these options. I wonder if we strictly need the jenkins build to pass for this PR though. Perhaps we can fix the build separately. For Ranger support, is there any additional testing you would like to do?

[JiaLiangC]

@virajjasani agree, the CI/CD can be fixed separately. This PR itself has passed all the unit tests, and the failure of the CI/CD is solely due to the chromium-browser. As for the support for Ranger KMS services, there are no additional tests needed, and it can be merged.

[virajjasani]

Thanks @JiaLiangC
For chromium-browser plugin, please feel free to create separate Jira as per your convenience.

[JiaLiangC]

@virajjasani Thanks for your patient review.
Of course, I can create a Jira, but I don't have the permissions to modify or view Jenkins, so this issue can only be resolved by a committer.

[JiaLiangC]

@virajjasani
hello, i created a separate Jira fir CI/CD failed issue : https://issues.apache.org/jira/browse/AMBARI-26064
could you help try fix this issue, I would like to try solving this issue, but I am not a committer and do not have access to view the CI/CD.

[virajjasani]

Thanks @JiaLiangC, let me see if i can make changes