如何通过Rest API在Apache Ranger的hdfs-plugin中创建服务及验证curl请求

Let's break down why your curl command isn't working and walk through the correct way to create an HDFS service in Ranger using the REST API.

Issues in Your Original Command #

Your current command has a few key problems that are likely causing the silent failure:

1. Incorrect Service Type: The type field is set to test, but for HDFS plugin services, you need to use the fixed value hdfs (Ranger uses predefined service types for each supported component).
2. Wrong API Endpoint: The path /service/public/v2/api/service is intended for unauthenticated endpoints, but creating a service requires admin authentication. The correct v2 API path is /service/v2/api/service.
3. Missing Authentication: You included username and password in the request body's configs section, but these are for the HDFS service credentials, not for authenticating with the Ranger Admin API itself. Ranger requires Basic Auth or a bearer token for admin actions.
4. Incomplete HDFS Configs: The configs section lacks critical HDFS-specific settings like the NameNode address, which is required for Ranger to connect to your HDFS cluster.

Correct Curl Command Example #

Here's a working command tailored for creating an HDFS service (adjust credentials and cluster details to match your environment):

curl -u admin:your_ranger_admin_password -H "Content-Type: application/json" -X POST -d '{
  "name": "hadoopdev",
  "type": "hdfs",
  "description": "hdfsservice",
  "isEnabled": true,
  "configs": {
    "username": "hdfs",
    "password": "your_hdfs_user_password",
    "hadoop.security.authentication": "simple",
    "fs.defaultFS": "hdfs://your_namenode_host:8020"
  }
}' http://localhost:6080/service/v2/api/service

Key Details Explained: #

• -u admin:your_ranger_admin_password: This adds Basic Auth using your Ranger admin credentials, which is mandatory for modifying services.
• type: "hdfs": Ensures Ranger recognizes this as an HDFS plugin service.
• configs Fields:
  • username/password: Credentials for Ranger to connect to HDFS (use an HDFS user with appropriate permissions).
  • fs.defaultFS: Your HDFS NameNode's address and port (default is 8020).
  • hadoop.security.authentication: Set to simple for non-Kerberos clusters; use kerberos and add additional Kerberos configs (like kerberos.principal) if your cluster uses Kerberos.

How to Diagnose Silent Failures #

If you still get no response, use these steps to debug:

1. Test API Reachability: First, verify you can connect to Ranger's API with a simple GET request to list existing services:

   curl -u admin:your_ranger_admin_password http://localhost:6080/service/v2/api/service
   

   If this fails, check if the Ranger Admin service is running, and confirm the port (6080 is default) is accessible.
2. Enable Verbose Mode: Add the -v flag to your curl command to see detailed request/response logs. This will show you if the request is being sent, what status code is returned (e.g., 401 for auth failure, 400 for bad JSON), and any error messages:

   curl -v -u admin:your_ranger_admin_password -H "Content-Type: application/json" -X POST -d '{...}' http://localhost:6080/service/v2/api/service
   

3. Check Ranger Logs: Look at the Ranger Admin logs (typically in /var/log/ranger/admin/) for error messages related to authentication, invalid request parameters, or connection issues to HDFS.

内容的提问来源于stack exchange，提问作者user5431918