Is it possible to manage multiple clusters using one ranger instance?

[#1]

Is it possible to manage multiple clusters using one ranger instance?

[#2]

No I don't think it's possible.

Admin Authentication is only for one cluster. We would need to specify when we authenticate which cluster we are authenticating for.

Security Policies and configuration is on a cluster basis in the Ranger Admin database.

[#3]

@bganesan @bdurai

[#4]

No, This is not supported.

[#5 · Accepted solution]

The primary limitation is wrt to UserSync. If there are multiple clusters, but using the same AD/LDAP, then you can use the same the Ranger instance to manage all of them.

[#6]

@bdurai What challenges do you see from the Ambari side?

[#7]

There is no native support from Ambari to do this. If you are using Ambari in all env, then the Ambari which is hosting the main Ranger instance is oblivious of the clusters Ranger is supporting. The Ambari which is hosting Ranger will automatically configure Ranger for the components within it's cluster. For the other clusters, you have to go to each component and modify Ranger properties. E.g. you will have to set ranger.plugin.hbase.policy.rest.url property and few others. You also need to add all the services/repo using Ranger Admin UI.

[#8]

@bdurai Based on this, I believe it's a good idea to have one to one relationship i,e Each cluster will have it's own ranger install.

[#9]

I agree, just because we can do it doesn't mean we should do it. From operation point of view, it is better to have one ranger per ambari cluster. This makes management very simple. Also, when it comes to upgrade, it will cause less headache.

[#10]

Do you have any reference on how to enable ranger for kafka sitting in a separate cluster in CDP?