RANGER-5687: Add feature flag to artifacts for RANGER-5628 by fmorg-git · Pull Request #1073 · apache/ranger

fmorg-git · 2026-07-14T22:38:21Z

What changes were proposed in this pull request?

It was requested to add a feature flag for the work in RANGER-5628. This ticket adds it.

The flag is configured as follows in ranger-admin-site.xml:

<property>
<name>ranger.servicedef.ozone.enableActionMatcherInPoliciesCondition</name>
<value>true</value>
</property>

This code is mostly generated with Cursor with some manual edits by me.

https://issues.apache.org/jira/browse/RANGER-5687

How was this patch tested?

smoke test locally with ozone and ranger with ranger flag off and on

… on resource policy, then flag is off, ui hangs (cherry picked from commit e25cdb00df8ca54a75bb998863ede76e8d52148f)

Use ranger.servicedef.enableOzoneActionPolicy as the sole feature flag, propagated via service-def option to Admin UI, plugin, inline/STS paths, and J10065 patch filtering. Matches master PR #1073 approach for ranger-2.9. Co-authored-by: Cursor <cursoragent@cursor.com>

Use ranger.servicedef.enableOzoneActionPolicy as the sole feature flag, propagated via service-def option to Admin UI, plugin, inline/STS paths, and J10065 patch filtering. Matches master PR #1073 approach for ranger-2.9.

(cherry picked from commit d06e4049a352ee3caad45a561098a7031ada557f)

Move enableOzoneActionPolicy handling out of RangerInlinePolicyEvaluator into RangerOzoneAuthorizer, including legacy session-policy sanitization and a unit test for flag-off behavior with embedded grant actions.

…ges. Use ServiceDefUtil.getBooleanValue in plugin-ozone and security-admin per PR review, and revert agents-common ozone-specific additions.

fmorg-git · 2026-07-15T22:09:46Z

hi @ramackri - thanks for helping address the comments by @mneethiraj. I tested these changes locally with Ozone and Ranger smoke tests and they look good to me. So if they look good to Ranger team and there are no more outstanding comments, please go ahead. Thanks!

Use ranger.servicedef.enableOzoneActionPolicy as the sole feature flag, propagated via service-def option to Admin UI, plugin, inline/STS paths, and J10065 patch filtering. Matches master PR #1073 approach for ranger-2.9.

…ges. Rebase onto ranger-2.9 and use ServiceDefUtil.getBooleanValue in plugin-ozone and security-admin per PR #1073 review (615d632).

Rename enableOzoneActionPolicy to enableActionMatcherInPoliciesCondition and admin config to ranger.servicedef.ozone.enableActionMatcherInPoliciesCondition. Non-ozone service defs always get false; ozone reads site config. Addresses PR review from fimugdha.

kumaab · 2026-07-16T20:18:56Z

@fmorg-git, please ensure to add the feature flag in dev-support/ranger-docker and test it in docker based environments.

… comments

On upgrade, sync enableActionMatcherInPoliciesCondition from admin config into ozone def_options only, alongside existing policyConditions updates for action-matches.

Wire RANGER_OZONE_ENABLE_ACTION_MATCHER into ranger-docker so admin setup reads the flag before J10065 runs, fix the def_options constant, and update patch unit tests after E2E validation on Mac with fresh Postgres installs.

ramackri · 2026-07-17T05:17:44Z

@fmorg-git, please ensure to add the feature flag in dev-support/ranger-docker and test it in docker based environments.

@kumaab Addressed this

fmorg-git · 2026-07-17T07:05:28Z

hi all, something appears to be wrong. I just tried my Ozone/Ranger smoke tests with the feature flag set to true, but it is not working now (this used to work before). So something with the changes between the last time I said it was working and now seems to be different. I updated with the new name ranger.servicedef.ozone.enableActionMatcherInPoliciesCondition but it still doesn't work.

Stale def_options from an earlier J10065 run or the pre-rename enableOzoneActionPolicy option could override ranger.servicedef.ozone.enableActionMatcherInPoliciesCondition, hiding action-matches in Admin UI and ozone authorizer even when the flag was set true. Admin config is now authoritative when serving the ozone service-def, and action-matches is restored from the embedded def when enabled but missing from DB.

mneethiraj · 2026-07-17T09:08:04Z

            }

-            dbOzoneServiceDef.setPolicyConditions(embeddedPolicyConditions);
+            final boolean enableActionMatcherInPoliciesCondition = RangerAdminConfig.getInstance().getBoolean(RangerServiceDefService.PROP_ENABLE_ACTION_MATCHER_IN_POLICIES_CONDITION, false);


Are changes in PatchForOzoneServiceDefPolicyConditionUpdate_J10065.java necessary, given RangerServiceDefService.java handles service-def updates based on feature-flag while retrieving the service-def from the database? If no additional cases are handled here, I suggest reverting changes in PatchForOzoneServiceDefPolicyConditionUpdate_J10065.java.

updated to revert - e220c42. Also updated the README.md accordingly.

The renamed enableActionMatcherInPoliciesCondition option and admin runtime overlay make enableOzoneActionPolicy obsolete for 3.0.

ramackri · 2026-07-17T11:10:16Z

@fmorg-git, please ensure to add the feature flag in dev-support/ranger-docker and test it in docker based environments.

Done

ramackri · 2026-07-17T11:15:37Z

hi all, something appears to be wrong. I just tried my Ozone/Ranger smoke tests with the feature flag set to true, but it is not working now (this used to work before). So something with the changes between the last time I said it was working and now seems to be different. I updated with the new name ranger.servicedef.ozone.enableActionMatcherInPoliciesCondition but it still doesn't work.
@fmorg-git
You this issue got fixed (admin config wins over stale DB),

ramackri · 2026-07-17T11:16:58Z

hi all, something appears to be wrong. I just tried my Ozone/Ranger smoke tests with the feature flag set to true, but it is not working now (this used to work before). So something with the changes between the last time I said it was working and now seems to be different. I updated with the new name ranger.servicedef.ozone.enableActionMatcherInPoliciesCondition but it still doesn't work.

Fixed

…-matches for non-Ozone service definition

…IN_POLICIES_CONDITION to PROP_ENABLE_ACTION_MATCHER_IN_POLICIES_CONDITION_FOR_OZONE

mneethiraj

I suggest replacing changes in dev-support/ranger-docker with an update in Ranger admin setup processing of install.properties, to support configuration
FF_ENAB_OZONE_ACTION_MATCHES_CONDITION mapped to ranger.servicedef.ozone.enableActionMatcherInPoliciesCondition in the generated ranger-admin-site.xml.

fmorg-git · 2026-07-19T09:18:15Z

I suggest replacing changes in dev-support/ranger-docker with an update in Ranger admin setup processing of install.properties, to support configuration
FF_ENAB_OZONE_ACTION_MATCHES_CONDITION mapped to ranger.servicedef.ozone.enableActionMatcherInPoliciesCondition in the generated ranger-admin-site.xml.

updated - d4343e5

…ION_MATCHES_CONDITION

fimugdha

LGTM. Lets wait to get a review vote from @mneethiraj.

fimugdha · 2026-07-20T05:21:49Z

LGTM. Lets wait to get a review vote from @mneethiraj.

PR was not refreshed, we already have a vote from him.

fmorg-git · 2026-07-20T16:09:51Z

Thanks all for the review and merge.

add feature flag to artifacts for RANGER-5628

501da92

fmorg-git mentioned this pull request Jul 14, 2026

RANGER-5628: Gate Ozone action-matches policy behind feature flags #1072

Closed

10 tasks

vperiasamy requested review from dineshkumar-yadav, fimugdha, mneethiraj and pradeepagrawal8184 July 14, 2026 23:34

bug fixes - missing flag on patch and if flag is on and condition set…

de98b96

… on resource policy, then flag is off, ui hangs (cherry picked from commit e25cdb00df8ca54a75bb998863ede76e8d52148f)

fix checkstyle issue

b16cd54

(cherry picked from commit d06e4049a352ee3caad45a561098a7031ada557f)

ramackri self-requested a review July 15, 2026 05:56

ramackri approved these changes Jul 15, 2026

View reviewed changes

mneethiraj reviewed Jul 15, 2026

View reviewed changes

Comment thread ...mmon/src/main/java/org/apache/ranger/plugin/policyevaluator/RangerInlinePolicyEvaluator.java Outdated

Confine Ozone action-policy gating to plugin-ozone module.

16d7fb3

Move enableOzoneActionPolicy handling out of RangerInlinePolicyEvaluator into RangerOzoneAuthorizer, including legacy session-policy sanitization and a unit test for flag-off behavior with embedded grant actions.

mneethiraj reviewed Jul 15, 2026

View reviewed changes

Comment thread agents-common/src/main/java/org/apache/ranger/plugin/model/RangerServiceDef.java Outdated

RANGER-5687: read ozone action-policy flag without agents-common chan…

615d632

…ges. Use ServiceDefUtil.getBooleanValue in plugin-ozone and security-admin per PR review, and revert agents-common ozone-specific additions.

ramackri pushed a commit that referenced this pull request Jul 16, 2026

RANGER-5687: read ozone action-policy flag without agents-common chan…

dead2d5

…ges. Rebase onto ranger-2.9 and use ServiceDefUtil.getBooleanValue in plugin-ozone and security-admin per PR #1073 review (615d632).

fimugdha reviewed Jul 16, 2026

View reviewed changes

Comment thread security-admin/src/main/java/org/apache/ranger/service/RangerServiceDefService.java Outdated

fimugdha reviewed Jul 16, 2026

View reviewed changes

Comment thread ...c/main/java/org/apache/ranger/patch/PatchForOzoneServiceDefPolicyConditionUpdate_J10065.java

fimugdha requested a review from rameeshm July 16, 2026 08:11

ramackri force-pushed the RANGER-5687 branch from 943bf08 to 74f1899 Compare July 16, 2026 18:35

Fabian Morgan and others added 4 commits July 16, 2026 16:15

fix checkstyle issues

2e94c64

remove agents-common modification per mneethiraj and address fimugdha…

6e774f6

… comments

Persist ozone action-matcher flag in J10065 def_options upgrade.

01c8a3e

On upgrade, sync enableActionMatcherInPoliciesCondition from admin config into ozone def_options only, alongside existing policyConditions updates for action-matches.

ramk added 2 commits July 17, 2026 12:56

Fix ImportOrder checkstyle violation in J10065 patch.

bedba9d

mneethiraj reviewed Jul 17, 2026

View reviewed changes

Remove legacy enableOzoneActionPolicy handling.

e2cc69f

The renamed enableActionMatcherInPoliciesCondition option and admin runtime overlay make enableOzoneActionPolicy obsolete for 3.0.

Fabian Morgan added 3 commits July 17, 2026 16:48

pr review comment for mneethiraj - don't automatically disable action…

3fc1b15

…-matches for non-Ozone service definition

pr review comments for mneethiraj - don't reference feature flag in ui

3b0d85c

pr review comment for mneethiraj - revert updates to patch

e220c42

fmorg-git force-pushed the RANGER-5687 branch from c7d1a06 to e220c42 Compare July 18, 2026 01:36

Fabian Morgan added 2 commits July 17, 2026 18:42

pr review comment for mneethiraj - rename PROP_ENABLE_ACTION_MATCHER_…

a375754

…IN_POLICIES_CONDITION to PROP_ENABLE_ACTION_MATCHER_IN_POLICIES_CONDITION_FOR_OZONE

add clarification statement for docker

ff0a084

fmorg-git force-pushed the RANGER-5687 branch from a7dbef0 to ff0a084 Compare July 18, 2026 02:36

fmorg-git requested a review from mneethiraj July 18, 2026 02:38

Update RangerOzoneAuthorizer.java

6cc3597

mneethiraj reviewed Jul 18, 2026

View reviewed changes

Comment thread ...ne/src/main/java/org/apache/ranger/authorization/ozone/authorizer/RangerOzoneAuthorizer.java

pr review update for mneethiraj - revamp Docker handling

d4343e5

remove no longer valid unit test

434ad95

fmorg-git requested a review from mneethiraj July 19, 2026 21:42

renamed FF_ENAB_OZONE_ACTION_MATCHES_CONDITION to FF_ENABLE_OZONE_ACT…

b2407bb

…ION_MATCHES_CONDITION

mneethiraj approved these changes Jul 20, 2026

View reviewed changes

fimugdha approved these changes Jul 20, 2026

View reviewed changes

dineshkumar-yadav merged commit 37b6e02 into apache:master Jul 20, 2026
4 checks passed

ramackri mentioned this pull request Jul 20, 2026

RANGER-5687: Backport ozone action-matcher feature flag to ranger-2.9 #1094

Open

1 task

Uh oh!

Conversation

fmorg-git commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changes were proposed in this pull request?

How was this patch tested?

Uh oh!

Uh oh!

Uh oh!

fmorg-git commented Jul 15, 2026

Uh oh!

Uh oh!

Uh oh!

kumaab commented Jul 16, 2026

Uh oh!

ramackri commented Jul 17, 2026

Uh oh!

fmorg-git commented Jul 17, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mneethiraj Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

fmorg-git Jul 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ramackri commented Jul 17, 2026

Uh oh!

ramackri commented Jul 17, 2026

Uh oh!

ramackri commented Jul 17, 2026

Uh oh!

mneethiraj left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

fmorg-git commented Jul 19, 2026

Uh oh!

fimugdha left a comment

Choose a reason for hiding this comment

Uh oh!

fimugdha commented Jul 20, 2026

Uh oh!

Uh oh!

fmorg-git commented Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

fmorg-git commented Jul 14, 2026 •

edited

Loading