Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Is it possible to assign (to appropriate) resource groups in Yarn through user/group in Ranger ?

Is it possible to assign (to appropriate) resource groups in Yarn through user/group in Ranger ?

Contributor
 
3 REPLIES 3

Re: Is it possible to assign (to appropriate) resource groups in Yarn through user/group in Ranger ?

@Dmitro Vasilenko

Check this: https://community.hortonworks.com/articles/10797/apache-ranger-and-yarn-setup-security.html

This mapping is not automatically, but you can use the same users and groups and either the approach presented in the link above or use Yarn Queue Manager view (this is available with the latest HDP versions, HDP 2.5.x). Select the desired queue, then go to Access Control and Status section of that view and map the queue to the desired users and groups. This could be eventually automated via Yarn REST API.

+++

If this helped, please vote/accept best answer.

Re: Is it possible to assign (to appropriate) resource groups in Yarn through user/group in Ranger ?

Contributor

Hi!

Thanks you very match, answer where helped!

Highlighted

Re: Is it possible to assign (to appropriate) resource groups in Yarn through user/group in Ranger ?

Contributor

@Dmitro Vasilenko: Ranger has a Yarn plugin, and what it means is that after the plugin is enabled, you can assign valid queue related permission(s) to users and groups for selected yarn resources through Ranger UI (or Ranger restful APIs) and Ranger ACL will take over from there on.

However, what you would need to check is: ‘yarn.acl.enable’ property under Resource Manager properties (Ambari UI). By default when we enable Ranger Yarn plugin, this property is set to true.

If this is set to true, then: in case Ranger does not find a policy for a user or the policy does not grant access to the user on the resource its trying to access, we will fall back on Yarn ACL for the result of that operation.

Hope this helps.