Cloudera Docs

Migrating Ranger policies [Technical Preview]

Scan Apache Ranger policies, display them in Discovery, and group them into collections to evaluate HDFS and Hive access controls before planning your cluster migration.

Ranger policy scanning exports every access, masking, and row-filter policy from the source cluster Ranger Admin. After the scan, the Discovery tab groups policies by Ranger service, such as HDFS, Hive, HBase, or Knox, and decorates HDFS and Hive browsers with indicators that show authorization coverage.

Label policies with collections to stage phased migrations.

  • You must install and configure Cloudera Migration Assistant. For instructions, see Deployment.

  • The cluster must be displayed on the Clusters page. For instructions, see Registering clusters.

  • You must run Cloudera Base with Ranger deployed on the source cluster.

  • You must operate a Kerberized source cluster. Technical preview scanning supports Kerberos SPNEGO only.

  • You must ensure that the Ranger feature flag remains enabled throughout the workflow.

Step 1 — Scan Ranger policies.

  1. On the Clusters page, select the source cluster.
  2. Click Start Scanning to display Scan Settings.
  3. Select Ranger policy scan.
  4. Select Scan selected and wait for Ranger services to finish synchronizing.

Step 2 — Browse Ranger policies in Discovery.

Finished scans displays policies inside Discovery.

  1. Go to the cluster’s Discovery tab.
  2. Select Ranger Policies in the navigator.

    • Root — Lists discovered Ranger services.

    • Service — Displays service metadata and policy totals.

    • Policy — Renders individual rows in the policy table.

    Figure 1. Ranger Discovery tree

    Ranger Discovery browser showing discovered services
  3. Expand tree nodes for your Ranger service to view their associated policies.
    Figure 2. Policies for one Ranger service

    Ranger Discovery browser showing policies for a service
  4. Review the default columns in the policy grid to evaluate your policy configurations.
    Table 1. Default policy grid columns
    Column Description
    Name The Ranger-defined policy title.
    Service Type The Ranger service type, for example, HDFS, Hive, or HBase.
    Policy Type The operational category of the policy, which is access, masking, or row filtering.
    Enabled The activation state of the policy that is Yes or No.
    Resources The matched paths or tables, including recursive and exclusion directives.
    Permissions The granted privileges.
    Allow Users The users who are granted access by the policy rules.
    Allow Groups The user groups who are granted access by the policy rules.
    Collections The applied collection badges.

    To view additional Ranger metadata, such as policy ID, deny rules, delegate admin, Ranger labels, add the corresponding columns to the grid using the column picker.

Step 3 — Review Ranger policy indicators.

Completed scans populate indicators on filesystem and relational assets.

  1. Go to HDFS Locations or Hive Tables within Discovery.
  2. Inspect the Ranger Policies column for the Ranger badge.
  3. Open the badge to reveal matching policy titles.
    Figure 3. Ranger policy indicator on HDFS

    Filesystem row showing Ranger policy indicator
  4. Understand matching logic when reconciling badges with policies.

    • Exact match: The policy resource matches the HDFS path or Hive table name verbatim.

    • Recursive match: The policy automatically includes all descendant files and subdirectories .

    • Wildcard match: The policy evaluates Ranger patterns, such as *, or ? against the resource path.

Step 4 — Organize policies into collections.

  1. In Ranger Policies, select the policies to group.
  2. Click Add to collection for the Default label.
  3. Optional: Click +, enter a unique label and color, then click Create.
  4. Apply collection filters whenever you narrow remediation workstreams.

You now have searchable Ranger inventories, enrichment on HDFS and Hive assets, and collection labels framing migration waves.

Groom collections, reconcile dependencies, then fold policies into downstream migration executions. For more information, see Scanning clusters, Creating collections for migration, and Registering clusters.