Managing MRS Cluster Roles

Creating a Role

For MRS 3.x and later versions:

1. Log in to MRS Manager and choose System > Permission > Role.

   For details about how to log in to MRS Manager, see Accessing MRS Manager.

2. On the displayed page, click Create Role and fill in Role Name and Description.

   The role name consists of 3 to 50 characters, including digits, letters, and underscores (_). It cannot be the same as an existing role name in the system. The role name cannot start with Manager, System, or default. For example, the role name cannot be Manager_test.

   Figure 1 Creating a role
   

3. In the Configure Resource Permission area, click the cluster whose permissions are to be added and select service permissions for the role.

   When setting permissions for a component, enter a resource name in the search text box in the upper right corner and click the search icon to view the search result.

   The search result contains only directories, but not subdirectories. Search by keyword supports fuzzy match and is case-insensitive.

   • For components (except HDFS and YARN) for which Ranger authorization has been enabled, the permissions of non-default roles on MRS Manager cannot take effect. You need to configure Ranger policies to assign permissions to user groups. For details, see Adding a Ranger Permission Policy.
   • If the resource requests of HDFS and YARN are beyond the Ranger policies, the ACL rules of the components still take effect.
   • A maximum of 1000 permissions can be set for a component at a time.

4. Click OK.

   If the role name added in Step 2 is displayed in the role list, the role is successfully added.

5. After the role is created, create a user and bind the role to the user, or bind the role to an existing user. The user then has the relevant service permissions. For details, see Creating an MRS Cluster User.

For MRS 2.x and earlier:

1. Log in to MRS Manager and choose System > Manage Role.

   For details about how to log in to MRS Manager, see Accessing MRS Manager.

2. On the displayed page, click Create Role and fill in Role Name and Description.

   Role Name is mandatory and contains 3 to 30 characters. Only digits, letters, and underscores (_) are allowed. Description is optional.

3. In Permission, set role permission.
   1. Click Service Name and select a name in View Name.
   2. Select one or more permissions.
   • The Permission parameter is optional.
   • If you select View Name to set component permissions, you can enter a resource name in the Search box in the upper right corner and click . The search result is displayed.
   • The search result contains only directories, but not subdirectories. Search by keyword supports fuzzy match and is case-insensitive. Results on the next page can be searched.

4. Click OK. Return to Manage Role.

   If the role name added in 2 is displayed in the role list, the role is successfully added.

5. After the role is created, create a user and bind the role to the user, or bind the role to an existing user. The user then has the relevant service permissions. For details, see Creating an MRS Cluster User.

Managing Roles

1. Log in to FusionInsight Manager of the MRS cluster.

   For details about how to log in to FusionInsight Manager, see Accessing MRS Manager.

2. Go to the role management page.
   • For MRS 3.x and later versions, choose System > Permission > Role.
   • For MRS 2.x and earlier versions, choose System > Manage Role.

3. In the role list, perform the following operations on the role as you need:
   • View role information: Expand the expandable panel of the role to be viewed to check basic and permission information about the role.
   • To modify role information, locate the target role, and click Modify in the Operation column. Default system roles cannot be modified.
   • To export role information, click Export All in TXT or CSV format. The exported role information includes the role name and description.

     Exporting role information is available in MRS 3.x or later only.

   • To delete a role, locate the row that contains the role and click Delete. To delete multiple roles in batches, select the target roles and click Delete above the role list. A role bound to a user cannot be deleted. To delete such a role, disassociate the role from the user by modifying the user first.

Example: Creating a Manager Role (MRS 3.x and Later)

1. Choose System > Permission > Role.
2. On the displayed page, click Create Role and fill in Role Name and Description.
3. In the Configure Resource Permission area, click Manager and set permissions for the role.
   Figure 2 Setting permissions
   

   Manager permissions:

   • Cluster
     • view permission: permission to view information on the Cluster page and view alarms and events under O&M > Alarm.
     • management permission: permission for management on the Cluster and O&M pages.
   • User
     • view permission: permission to view information on pages under System > Permission.
     • management permission: permission for management on pages under System > Permission.
   • Audit

     management permission: permission for management on the Audit page.

   • Tenant
     • view permission: permission to view information on the Tenant Resources page. (Available in MRS 3.5.0 and later)
     • management permission: permission for management on the Tenant page and permission to view alarms and events under O&M > Alarm.
   • System
     • view permission: permission to view all pages except those under Permission of the System module. (Available in MRS 3.5.0 and later)
     • management permission: permission for management on all pages except those under Permission of the System module and permission to view alarms and events under O&M > Alarm.

4. Click OK.

Helpful Links

• For details about how to create a user and bind the user to a newly created role, see Creating an MRS Cluster User.
• For details about how to add Ranger permission policies, see Adding a Ranger Permission Policy.
• The permissions and policies supported by user roles vary depending on components. For details about how to create roles related to each component, see the following sections:

  Creating a ClickHouse Role

  Creating a Doris Permission Role

  Creating a FlinkServer Role

  Creating an HBase Permission Role

  Creating an HDFS Role

  Creating a HetuEngine Permission Role

  Creating a Hive Role

  Creating a Kafka Role

  Creating a Spark SQL Role

  Creating YARN Roles