Integrations — NiFi

ChartVersion3.0.1TypeapplicationAppVersion1.28.0

CompatibilityKubernetes1.32+OpenShift4.19+Rancher2.10.x+

Integration overview

Apache NiFi can be integrated with Apache Ranger for centralized access control over flows and components. This integration is configured via the tdp-ranger chart (not tdp-nifi): Ranger installs a plugin in NiFi and becomes the authority for all access decisions.

This page describes the Ranger-side registration and integration configuration. To configure NiFi to use Ranger as the authorization mechanism (nifiCluster.security.authorization.mode: "ranger"), see Security — NiFi.

Integration with Apache Ranger

How it works

The Ranger plugin for NiFi intercepts access requests to NiFi components (ProcessGroups, Processors, input/output ports) and validates them against policies defined in Ranger Admin. Default policies are created automatically by the configJob of the tdp-ranger chart when the integration is enabled.

Enabling the integration

Configuration is done in the tdp-ranger chart, not in tdp-nifi. The Ranger chart must be installed with rangerIntegrations.nifi.enabled=true and must know where NiFi is running:

rangerIntegrations:
  configJob:
    enabled: true
  nifi:
    enabled: true
    serviceName: "<NIFI_SERVICE>"
    serviceDisplayName: "NiFi TDP"
    connection:
      nifiUrl: "http://<NIFI_SERVICE>.<NAMESPACE>.svc.cluster.local:8080"
      authenticationType: "none"
    credentials:
      username: "<USERNAME>"
      password: "<PASSWORD>"

Prerequisite

NiFi must be deployed and reachable from the Ranger namespace before enabling this integration. The configJob waits for Ranger to become ready, but NiFi must be running when the job executes the registration.

Installation or upgrade with the integration

Terminal input

helm upgrade --install <RANGER_RELEASE> \
  oci://registry.tecnisys.com.br/tdp/charts/tdp-ranger \
  -n <NAMESPACE> \
  -f <BASE_VALUES_FILE> \
  -f <VALUES_FILE>

Or via --set:

Terminal input

helm upgrade --install <RANGER_RELEASE> \
  oci://registry.tecnisys.com.br/tdp/charts/tdp-ranger \
  -n <NAMESPACE> \
  --set rangerIntegrations.nifi.enabled=true \
  --set rangerIntegrations.nifi.connection.nifiUrl=http://<NIFI_SERVICE>.<NAMESPACE>.svc.cluster.local:8080

Verification

After the integration, verify in Ranger Admin that the NiFi service appears under Service Manager:

Terminal input

kubectl -n <NAMESPACE> get jobs
kubectl -n <NAMESPACE> logs job/<RANGER_RELEASE>-ranger-integrations

In Ranger Admin, go to NiFi → Policies to see the automatically created policies.

Key parameters

Parameter	Description
rangerIntegrations.nifi.enabled	Enable the NiFi integration in Ranger
rangerIntegrations.nifi.serviceName	Service name in Ranger
rangerIntegrations.nifi.connection.nifiUrl	NiFi URL accessible from the cluster
rangerIntegrations.nifi.connection.authenticationType	Authentication type (none for credential-free access)
rangerIntegrations.nifi.credentials.username	NiFi admin username
rangerIntegrations.nifi.credentials.password	NiFi admin password

See helm show values oci://registry.tecnisys.com.br/tdp/charts/tdp-ranger for the complete list of NiFi integration parameters.