Cloudera Docs

Discovering Ranger policies end to end [Technical Preview]

Deploy Cloudera Migration Assistant, register a Ranger-enabled cluster, and browse discovered policies.

This end-to-end workflow combines deployment, platform preparation, discovery, and workload steps. Detailed reference procedures are reused from the Administrator and Migration guides.

Figure 1. Migration flow

Cloudera Migration Assistant migration flow

Verify supported platforms and migration paths in Supported platforms and migration paths before you start.

Phase 1 — Deploy the CMA Master and CMA Agents

    1. Download both CSD files to the /opt/cloudera/csd/ directory on the Server host. 
      wget -P /opt/cloudera/csd/ https://archive.cloudera.com/cma/version/csd/CMA_MASTER-version-build.jar
      wget -P /opt/cloudera/csd/ https://archive.cloudera.com/cma/version/csd/CMA_AGENT-version-build.jar
      automatically detects the CSD files.
    2. Change the ownership of the CSD files. 
      chown cloudera-scm:cloudera-scm /opt/cloudera/csd/CMA_MASTER-version-build.jar /opt/cloudera/csd/CMA_AGENT-version-build.jar
    3. Restart for the changes to take effect. 
      systemctl restart cloudera-scm-server
    4. Log into .
    5. Restart the Cloudera Management Service.
    6. Go to Hosts > Parcels.
    7. Click Parcel Repositories & Network Settings.
    8. Add the Remote Parcel Repository URL for . 
      https://archive.cloudera.com/cma/version/parcels/
    9. Click Save & Verify Configuration to commit the change.
    10. Click Close.
      You are redirected to the Parcels page.
    11. Search for , and click Download to download the parcel to the local repository.
    12. After download completes, click Distribute to distribute the parcel to all clusters.
      Figure 2. Distribute the parcel

      Parcels page showing parcel distribution
    13. Click Activate to activate the parcel.
    14. Click OK when confirmation is required.
    15. Click Clusters in the left navigation pane.
    16. Select Add Service from the drop-down menu to the right of your cluster.
    17. From the list, select the service type to add, then click Continue. The single parcel provides two service types: CMA_MASTER (central control node) and CMA_AGENT (cluster-side executor).

      The Add Service wizard opens.

      Figure 3. Add service

      Add Service wizard showing service types
    18. Assign the service roles to the hosts where Python 3.11 and JDK 17+ are installed, and click Continue.
    19. Review service configurations and click Continue. At minimum, set OAuth2 client credentials (cma_client_secret, cma_agent_client_secret). If the is on a different cluster from the , also set Gateway URL (cma_gateway_url).

      The first run of the service starts. When the command finishes, the service is added to the cluster.

      Figure 4. service started

      showing service first run completed
    20. Repeat steps 16–19 to add the other service type if needed (for example, add CMA_AGENT after CMA_MASTER, or vice versa).
    21. Go back to the cluster homepage, open the service page, and click the Server UI tab to open the UI.
      Figure 5. landing page

      web UI landing page after parcel deployment
    22. Set the service dependency to none in the service configuration in Cloudera Manager because Cloudera Manager cannot discover the Master automatically across clusters.
    23. Set the Gateway URL to cma_gateway_url in the service configuration. 
      curl -sk https://<master-host>:8093/api/agent/config

    Phase 2 — Configure Cloudera Replication Manager on the target cluster

      1. Enable the HDFS to Ozone flag on the Server host.
        For HDFS to Ozone migrations, requires the CMF_FF_API_H2O_REPLICATION feature flag to be enabled. Without this flag, the API endpoints for HDFS to Ozone replication are not available.
        1. Append the following line to /etc/default/cloudera-scm-server on the Server host: 
          export CMF_FF_API_H2O_REPLICATION=true
        2. Restart the Server. 
          sudo systemctl restart cloudera-scm-server
        3. Wait for to become available again on port 7180 before proceeding with the setup.
      2. Register the instance in the UI to allow to locate and communicate with the replication service.
        1. In the Web UI, go to Settings.
        2. Go to the App Access section.
        3. Configure your connection fields using one of the following validation methods:

          • If has already detected a service on one of the registered clusters, select it from the Suggestions drop-down list to auto-fill the form.

          • Manually enter your target replication parameters in the following fields:

            • App URL — The full URL of the REST API, including protocol, host, and port, for example, https://rm-host.example.com:9011.

            • App username — The username for authenticating with the API.

            • App password — The password for authenticating with the API.

        4. Click Save and Push to Agents.

      Note

      Ranger policy discovery is technical preview and supports scan and browse only; it does not export policies to a target cluster.

      Phase 3 — Register source and target clusters

        1. In on the source cluster, select Add Service and select CMA_AGENT.
        2. Configure the required properties.
          Table 1. configuration properties
          Property Description
          cma_gateway_url URL of the Gateway, for example, https://master-host:8093. Required when the is on a different cluster than the . The agent uses this URL to discover the Master host, gRPC port, and Auth Server URI automatically through the discovery endpoint (GET /api/agent/config). When connecting from a different cluster, set the service dependency to none in .
          cm_username administrator user name.
          cm_password administrator password.
          cma_user_home Home directory for the cma-agent user, for example, /var/lib/cma-agent.
        3. Set cma_gateway_url when the is on a different cluster than the .
        4. Start the service.
        5. Wait for the agent to connect to the and finish the registration automatically.

        Phase 4 — Scan clusters

          1. Navigate to the Clusters page and click the cluster you want to scan.
            Figure 6. Clusters page

            Clusters page
          2. On the cluster detail page, find the Scanning section, which lists the available scan types for your cluster. Click the configuration icon on the right side of the scan type you want to trigger.
            Figure 7. cluster scanning

            cluster scanning
          3. In the scan configuration drawer, configure the scan parameters (for example, scan path, scan type, scan depth) and click Scan Selected.
            Figure 8. scan configuration

            scan configuration
          4. The scan starts and the status changes to Initializing. Track scan progress by clicking the Commands tab, which shows a badge with the number of active commands.
            Figure 9. scan in progress

            scan in progress
          5. On the Commands tab, expand a command to view its Output Log, Error Log, and Configuration.
            Figure 10. scan commands

            scan commands

          Phase 5 — Create collections (optional)

            1. Click the + icon next to Collections in the sidebar.
            2. In the Collection Details drawer, enter a Collection name and select a Color for identification.
              Figure 11. create collection

              create collection
            3. Click Create.

              The new collection appears in the sidebar with 0 items.

            4. Browse the data tree to find the items you want to migrate. Click folder names to navigate deeper into the hierarchy.
            5. Select items using the checkboxes next to each item.
            6. Click the collection icon that appears on the selected item row.
            7. In the Add/Remove Collections popup, check the collections you want to assign the item to.
            8. Click Apply.
              Figure 12. assign to collection

              assign to collection
            9. Click a collection name in the sidebar to view its contents. The data browser switches to show only the items assigned to that collection.
              Figure 13. view collection

              view collection

            Phase 6 — Run the migration workload

              Step 1 — Scan Ranger policies.

              1. On the Clusters page, select the source cluster.
              2. Click Start Scanning to display Scan Settings.
              3. Select Ranger policy scan.
              4. Select Scan selected and wait for Ranger services to finish synchronizing.

              Step 2 — Browse Ranger policies in Discovery.

              Finished scans displays policies inside Discovery.

              1. Go to the cluster’s Discovery tab.
              2. Select Ranger Policies in the navigator.

                • Root — Lists discovered Ranger services.

                • Service — Displays service metadata and policy totals.

                • Policy — Renders individual rows in the policy table.

                Figure 14. Ranger Discovery tree

                Ranger Discovery browser showing discovered services
              3. Expand tree nodes for your Ranger service to view their associated policies.
                Figure 15. Policies for one Ranger service

                Ranger Discovery browser showing policies for a service
              4. Review the default columns in the policy grid to evaluate your policy configurations.
                Table 2. Default policy grid columns
                Column Description
                Name The Ranger-defined policy title.
                Service Type The Ranger service type, for example, HDFS, Hive, or HBase.
                Policy Type The operational category of the policy, which is access, masking, or row filtering.
                Enabled The activation state of the policy that is Yes or No.
                Resources The matched paths or tables, including recursive and exclusion directives.
                Permissions The granted privileges.
                Allow Users The users who are granted access by the policy rules.
                Allow Groups The user groups who are granted access by the policy rules.
                Collections The applied collection badges.

                To view additional Ranger metadata, such as policy ID, deny rules, delegate admin, Ranger labels, add the corresponding columns to the grid using the column picker.

              Step 3 — Review Ranger policy indicators.

              Completed scans populate indicators on filesystem and relational assets.

              1. Go to HDFS Locations or Hive Tables within Discovery.
              2. Inspect the Ranger Policies column for the Ranger badge.
              3. Open the badge to reveal matching policy titles.
                Figure 16. Ranger policy indicator on HDFS

                Filesystem row showing Ranger policy indicator
              4. Understand matching logic when reconciling badges with policies.

                • Exact match: The policy resource matches the HDFS path or Hive table name verbatim.

                • Recursive match: The policy automatically includes all descendant files and subdirectories .

                • Wildcard match: The policy evaluates Ranger patterns, such as *, or ? against the resource path.

              Step 4 — Organize policies into collections.

              1. In Ranger Policies, select the policies to group.
              2. Click Add to collection for the Default label.
              3. Optional: Click +, enter a unique label and color, then click Create.
              4. Apply collection filters whenever you narrow remediation workstreams.