How to Replicate policies across cluster?

[#1]

Guys,

I have two HDP 2.4.0 clusters. On both the we have setup Ranger and integrated with different ADs. More or less users are same. I read on one of the HCC questions that we can use DB replication to keep both policy DB in sync.

What I want to achieve is : From Cluster-A, want to take up Ranger DB, replace environment specific values and restore it on another cluster, restart Ambari and I should be good to go. But more I study schema and spend more time analyzing the situation, it doesn't look practical to me.

Has anyone actually replaced DB for Ranger?

I was trying to check the Ranger DB and both these environments I found lot of differences in the table contents. Mostly because of the users and groups, as we are pointing to different Active Directories.

I've three questions here :

(1) If we backup ranger db from cluster-1, drop db of cluster-2, stop user sync in Ambari on cluster-2, restore db of cluster-1 and restart Ambari (keep user sync) off and restart the Ranger admin. Will it work? ( I am happy to have imported users/groups of Cluster-1 - which are imported from AD1 and OK to delete imported users of Cluster-2 Ranger DB, Will this create problem? )

(2) Any better suggestions to make db replication work?

(3) What is better way around syncing policies across clusters?

Thanks.

[#2]

It sounds like there are two conflicting goals you might want to achieve. Is the intention to migrate cluster-B/2 to use the same AD as cluster-A/1? Or do all users have accounts in both ADs, and you want to translate the policies from A to B but keep them on different ADs?

[#3]

@Alex Miller All the users have accounts in both the A/Ds. Except from Cluster-2 's Ranger DB contains users who are no longer in company and in A/D-1, so I am OK scrapping DB of cluster-2. And want to translate policies of A to B and still point to different A/Ds. Of course on the target cluster-2, will stop the user sync module once database is restored from Cluster-A.

[#4]

Sagar's answer is the best solution if both clusters will use the same AD. If each cluster has its own AD with unique users and groups, then you should clarify what you are hoping to gain by duplicating the policies. Keeping in mind that you'll need to sync them on an ongoing basis, it seems like "updating" every policy for a new set of users/groups would be more work than manually adding the policies on each cluster.

[#5]

@Alex Miller Well in our scenario both the A/D are more or less replicas. Anyway I got this fixed.

[#6 · Accepted solution]

@Smart Solutions

You can try policy replicate across cluster using ranger API. You can check this HCC questions -

https://community.hortonworks.com/questions/11369/is-there-a-way-to-export-ranger-policies-from-clus...

[#7]

Thanks @Sagar Shimpi . Will check this. Meanwhile wanted to know if HWX has plan to have a centralized Ranger (single instance) to define policies for multiple clusters? This could be a great value and help keeping the policies in central location 🙂

[#8]

@Smart Solutions

I see a good discussion on this. Pls check - https://community.hortonworks.com/questions/6922/is-it-possible-to-manage-multiple-clusters-using-o....

[#9]

Well I fixed this using REST APIs. Thanks.