Configure optimized rename and recursive delete operations in Ranger Ozone plugin

You can enable a performance-optimized authorization approach for rename and recursive delete operations in the Ranger Ozone plugin.

Ozone introduced support for FSO (FILE_SYSTEM_OPTIMIZED) bucket layout. The FSO bucket layout is a Hierarchical FileSystem namespace view with directories and files. Similar to HDFS, with the FSO bucket layout, Ozone has an efficient directory rename and delete operations. Ranger supports not only authorization for rename and recursive delete operations but also provides an option to enable a performance-optimized solution when these operations are performed on a directory containing a large set of subpaths (directories/files) within it.

The property name is ranger.plugin.ozone.optimized.subaccesspath.enabled.

The default is set to false.

To enable authorization for rename and recursive delete operations in the Ranger Ozone plugin:

In Cloudera Manager > Ozone > Ozone Manager > Configuration > Search. type ranger-ozone-security.xml.
In Ozone Service Advanced Configuration Snippet (Safety Valve) for ranger-ozone-security.xml, click +.
1. Under Ozone, in Name, type: ranger.plugin.ozone.optimized.subaccesspath.enabled.
2. In Value, type: true.
3. Click Save Changes.
note
If the ranger.plugin.ozone.optimized.subaccesspath.enabled property is set to true, then the behavior for recursive operations (for example, command such as rm -rf ) is as follows:
- Parent-level recursive policy is mandatory for the key being accessed.
- Tag-based deny policies are not supported for subpaths.
- Multi-resource policies are not supported for subpaths.
In Ozone > Actions, click Restart.

Ranger not only authorizes rename and recursive delete operations, but also provides an option to enable a performance-optimized solution when these operations are performed on a directory containing a large set of subpaths (directories/files) within it.