Known Issues in Apache Ranger
Learn about the known issues in Ranger, the impact or changes to the functionality, and the workaround.
- Ranger default service cm_solr for Ranger solr plugin fails.
- Workaround: You must create it manually from Ranger Admin UI.
- CDPD-21577: Changes made from one user, persists for other users as well.
- None
- When you mask a table through Ranger, you can run the query from Hive, but when you run the same from Impala, the following error is displayed: "ERROR: "AnalysisException: No matching function with signature: mask(FLOAT)" when Impala jobs fail with No matching function with signature: mask(FLOAT)"
- Do not use Redact (MASK) on float/ double/ decimal types since Hive always returns NULL for them (so it is not Redact actually). Use Nullify policy (MASK_NULL) for the same purpose and it is more efficient. For more information, see this KB article.
- CDPD-23666: cm_hbase service create fails intermittently due to deadlock.
- None.
- CDPD-3296: Audit files for Ranger plugin components do not appear immediately in S3 after cluster creation
- For Ranger plugin components (Atlas, Hive, HBase, etc.), audit data is updated when the applicable audit file is rolled over. The default Ranger audit rollover time is 24 hours, so audit data appears 24 hours after cluster creation.
- CDPD-12644: Ranger Key Names cannot be reused with the Ranger KMS KTS service
- Key names cannot be reused with the Ranger KMS KTS service. If the key name of a delete key is reused, the new key can be successfully created and used to create an encryption zone, but data cannot be written to that encryption zone.
- CDPD-17962: Ranger roles do not work when you upgrade from any CDP Private Cloud Base to CDP Private cloud base. Roles which are created prior to upgrade work as expected, issue is only for new roles created post upgrade and authorization enforced via ranger policies wont work for these new roles. This behavior is only observed with the upgraded cluster; a newly installed cluster does not show this behavior.
- There are two possible workarounds to resolve this issue:
- Update database entries (Recommended):
- select * from x_ranger_global_state where state_name='RangerRole';
- update x_ranger_global_state set app_data='{"Version":"2"}' where state_name='RangerRole';
- Add a property in safety valve under ranger-admin-site which will bypass the getAppDataVersion method:
- Update database entries (Recommended):