Skip to main content
Version 3.0

Ranger Configuration

ChartVersion3.0.1TypeapplicationAppVersion2.7.0
CompatibilityKubernetes1.32+OpenShift4.19+Rancher2.10.x+

What is Apache Ranger in TDP?​

Apache Ranger is a centralized security framework for data platforms.
Instead of each service managing its own access rules, Ranger provides a single place to define who can do what on which resource.
Integrated services query those policies to allow or deny actions at runtime.

In TDP Kubernetes, Ranger acts as the central point for managing access policies for services that have an enabled integration.

Each integration uses the authorization mechanism compatible with the respective service to query Ranger Admin and enforce access decisions according to the configured policies.

To find out more

See Apache Ranger - Concepts for a complete overview of the tool, its plugin model, and how it works.

Helm value structure​

The tdp-ranger chart uses three main value blocks:

  • tdp-ranger: — Ranger Admin configuration: resources, credentials, database, Solr, OpenShift.
  • rangerIntegrations: — automation for registering services in Ranger Admin and declarative policies.
  • TDP-Settings: — TDP helpers for external database and HTTP/HTTPS exposure.
tdp-ranger:
  ranger:
    adminUser: admin
    database:
      host: "<POSTGRESQL_SERVICE>.<NAMESPACE>.svc.cluster.local"
      port: 5432

Architecture and components​

ComponentRole
Ranger AdminCentral UI and API for services, policies, and auditing
PostgreSQLStores Ranger metadata, such as policies, users, and configuration
SolrStores audit logs when enabled by the subchart
Plugins and integrationsAllow configured services to query Ranger for authorization
Integrations JobAutomates registration in Ranger Admin for services enabled in rangerIntegrations and for policies declared in defaultPolicies, when configured

Ranger Admin is the central administration point.
Integrated services continue running their workloads normally, but query policies registered in Ranger to decide whether an action should be allowed.

Overview​

PropertyValue
Charttdp-ranger
Ranger Version2.7.0
Chart Version3.0.1
Chart AppVersion2.7.0
Registryoci://registry.tecnisys.com.br/tdp/charts/tdp-ranger

Prerequisites​

Before installing or customizing the tdp-ranger chart, confirm:

  • Kubernetes 1.32+, Red Hat OpenShift 4.19+, or Rancher Manager 2.10.x+.
  • Helm 3.2.0+.
  • A StorageClass available for persistent volumes.
  • Tecnisys OCI registry reachable from the installation environment.
  • A strong password defined for the Ranger administrator user.
  • A previous decision about internal or external PostgreSQL for metadata.
  • When using integrations: target services deployed, reachable over the network, and configured to use the compatible authorization mechanism.

Installation​

Example
helm install <RELEASE_NAME> oci://registry.tecnisys.com.br/tdp/charts/tdp-ranger -n <NAMESPACE> --create-namespace --timeout 10m

Adjust credentials, database, Solr persistence, network exposure, and integrations through your values file.

OpenShift

On OpenShift, enable tdp-ranger.openshift.enabled=true to create the RoleBinding that binds the Ranger ServiceAccount to the anyuid SCC.
This is required because the Ranger container runs scripts that need elevated permissions.

OpenShift example
helm install <RELEASE_NAME> oci://registry.tecnisys.com.br/tdp/charts/tdp-ranger -n <NAMESPACE> --create-namespace --timeout 10m --set tdp-ranger.openshift.enabled=true

Validate the RoleBinding in the namespace:

oc get rolebinding -n <NAMESPACE> | grep anyuid
oc describe rolebinding <RELEASE_NAME>-openshift-anyuid-scc -n <NAMESPACE>