Adding a Ranger Access Permission Policy for YARN

Scenarios

As the core resource scheduling framework, YARN allocates cluster compute resources and schedules tasks. The platform includes YARN users with multiple roles (for example, developers submit computing tasks, O&M personnel manage cluster resources, and users from different departments compete for queue resources). Without fine-grained YARN permission control, standard users can occupy excessive cluster resources and delay core task scheduling. Unauthorized users might accidentally modify YARN cluster configurations, risking service stability. When different departments share queues, frequent resource contention disrupts normal operations. Ranger provides a targeted permission configuration solution. Administrators can use Ranger to directly configure administrator and queue resource management permissions for YARN users.

This document guides Ranger administrators through configuring permissions to enable fine-grained control of YARN resources, meet business requirements, and ensure cluster security.

The permissions on Ranger Yarn are independent of each other. There is inclusion relationship among the permissions. Currently, the following permissions are supported:

• submit-app: permission to submit queue tasks
• admin-queue: permission to manage queue tasks

Although the admin-queue has the permission to submit tasks, it does not have the inclusion relationship with the submit-app permission.

Prerequisites

• The Ranger service has been installed and is running properly in the cluster.
• The users, user groups, or roles requiring permissions must already be created in the cluster. For newly created users, you can configure permission policies only after the users are automatically synchronized to Ranger.

Procedure

1. Log in to FusionInsight Manager and choose Cluster > Services > Yarn.
2. On the page that is displayed, click the Configuration tab then the All Configurations sub-tab. On this sub-tab page, search for the yarn.acl.enable parameter, and change its value to true. If the value is true, no further action is required.
   Figure 1 Configuring yarn.acl.enable
   

3. Log in to the Ranger web UI as the Ranger administrator. For details, see Logging In to the Ranger Web UI.
4. On the home page, click the component plug-in name in the YARN area, for example, Yarn.
5. Click Add New Policy to add a YARN permission control policy.
6. Configure the parameters listed in the table below based on the service demands.

   Table 1 Yarn permission parameters

   Parameter	Description
   Policy Name	Policy name, which can be customized and must be unique in the service.
   Policy Conditions	IP address filtering policy, which can be customized. You can enter one or more IP addresses or IP address segments. An IP address can contain the wildcard character (*), for example, 192.168.1.10,192.168.1.20 or 192.168.1.*.
   Policy Label	A label specified for the current policy. You can search for reports and filter policies based on labels.
   Queue	Queue name. The wildcard (*) is supported. To enable a sub-queue to inherit the permission of its upper-level queue, enable the recursion function. Non-recursive: recursion disabled Recursive: recursion enabled
   Description	Policy description.
   Audit Logging	Whether to generate an audit log when a request matches the policy. Yes: An audit log is generated whenever an access request matches the policy, regardless of whether the result is Allow or Deny. No: No audit log is generated when an access request matches the policy.
   Allow Conditions	Policy allow conditions, which define the permissions and exceptions authorized by this policy. In the Select Role, Select Group, and Select User columns, select the role, user group, or user to which the permission is to be granted, click Add Conditions, add the IP address range to which the policy applies, and click Add Permissions to add the corresponding permission. submit-app: permission to submit queue tasks admin-queue: permission to manage queue tasks Select/Deselect All: permission to select or deselect all If users or user groups in the current condition need to manage this policy, select Delegate Admin. These users will become the agent administrators. The agent administrators can update and delete this policy and create sub-policies based on the original policy. To add multiple permission control rules, click . To delete a permission control rule, click . Exclude from Allow Conditions: policy exception conditions
   Deny All Other Accesses	Whether to reject all other access requests. True: All other access requests are rejected. False: Deny Conditions can be configured.
   Deny Conditions	Policy deny conditions, which define the permissions and exceptions that must be rejected by the policy. The configuration method is identical to that of Allow Conditions. The priority of Deny Conditions is higher than that of allowed conditions configured in Allow Conditions. Exclude from Deny Conditions: exception rules excluded from the denied conditions

   Table 2 Common permission configuration scenarios

   Task	Role Authorization
   Setting the YARN administrator permission	On the home page, click the component plug-in name in the YARN area, for example, Yarn. Select the policy whose Policy Name is all - queue and click to edit the policy. In the Allow Conditions area, select a user from the Select User drop-down list.
   Setting the permission for a user to submit tasks in a specified Yarn queue	In Queue, specify a queue name. In the Allow Conditions area, select a user from the Select User drop-down list. Click Add Permissions and select submit-app.
   Setting the permission for a user to manage tasks in a specified Yarn queue	In Queue, specify a queue name. In the Allow Conditions area, select a user from the Select User drop-down list. Click Add Permissions and select admin-queue.

7. (Optional) Configure the policy validity period. Click Add Validity period in the upper right corner of the page, set Start Time and End Time, and select Time Zone. Click Save. To add multiple policy validity periods, click . To delete a policy validity period, click .
8. Click Add to view basic information about the policy in the policy list. After the policy takes effect, check whether the related permissions are normal.

   To disable a policy, click and set the policy to Disabled.

   If a policy is no longer used, click to delete it.

Helpful Links

• For details about the priorities of different Ranger policies, see Condition Priorities of the Ranger Permission Policy.
• To view information about permission objects in Ranger, such as users, user groups, and roles, see Viewing Ranger User Permission Synchronization Information.
• You can create new users for an MRS cluster in MRS Manager. For details, see Creating an MRS Cluster User.