Cloudera Docs

Ranger HDFS plugin fails post-HDFS HA migration

Policy creation failures in the cm_hdfs Ranger plugin occur after enabling HDFS High Availability because Cloudera Manager does not automatically update the NameNode URL to the HA nameservice. You can troubleshoot this issue.

When a cluster is switched to HDFS High Availability (HA) using the Cloudera Manager wizard, the Namenode URL in the cm_hdfs Ranger plugin configuration is not automatically updated.

  • It remains pointed to a single NameNode (for example, hdfs://server.example.com:8020) instead of updating to the new HA NameService (for example, hdfs://nameservice01).

  • Re-running the Setup Ranger Plugin Service process from Cloudera Manager does not fix or overwrite this value.

Once HDFS is in HA mode, attempting to create any new policy in the cm_hdfs plugin fails. The Ranger UI throws the following error because it cannot communicate with the active NameNode:

ranger org.apache.ranger.plugin.client.HadoopException: listFilesInternal: Unable to get listing of files for directory /*] from Hadoop environment [cm_hdfs]
  1. Log in to the Ranger UI with a user having a user role, for example, ROLE_SYS_ADMIN.
  2. Edit the cm_hdfs service.
    1. In the new Ranger UI, go to Dashboard > Go To Service Manager, and click the edit button for the cm_hdfs service.
    2. In the old Ranger UI, click the edit button for the cm_hdfs service on the Service Manager page.
  3. Search for the Namenode URL, which should currently be set in the hdfs://<NAMENODE_HOST>:<NAMENODE_PORT> format, and change it to the nameservice used for the HA.
    For example, hdfs://nameservice01. You can get the nameservice details from HDFS configurations in Cloudera Manager.
  4. After you update it, verify the connection by clicking Test Connection.
  5. Save and exit.
  6. Go to the Ranger cm_hdfs as admin and try to add a new policy while searching for the path.
    The resource lookup will continue to find the path in HDFS.