apache / apache/kyuubi

[FEATURE] Add Catalog-Level Permission to Kyuubi Spark AuthZ Extension

Open
#6,715 2 comments 1 reaction 0 assignees View on GitHub
help wanted kind:feature
Dominant language
Scala
Stars
2.4k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

### Search before asking

- [X] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues.

### What would you like to be improved?

Currently, both the Spark-Ranger and Hive-Ranger plugins use the same [Hive-Ranger service definition](https://github.com/apache/ranger/blob/master/agents-common/src/main/resources/service-defs/ranger-servicedef-hive.json), which supports database-table-column level permissions. However, Spark supports the concept of catalogs, such as iceberg_catalog, cassandra_catalog, and jdbc_catalog. Therefore, it is essential to update the Spark-Ranger plugin to support a new service definition based on catalog-schema-table-column level permissions, similar to the [Trino-Ranger service definition](https://github.com/apache/ranger/blob/master/agents-common/src/main/resources/service-defs/ranger-servicedef-trino.json).

### How should we improve?

_No response_

### Are you willing to submit PR?

- [ ] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to improve.
- [X] No. I cannot submit a PR at this time.

Contributor guide

Open the contributing guide

Research direction

Start by comparing the Hive-Ranger service definition and the Trino-Ranger service definition linked in the issue, then trace how the Spark-Ranger plugin uses the existing definition. Determine the design needed for catalog-schema-table-column permissions and verify that the Spark plugin and service definition support the requested catalog-level authorization.

Written by the indexing model from the issue text.

Assessment

Tech stack
scala, spark, sql
Domain
authorization, backend, databases
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.