{"componentChunkName":"component---src-templates-acg-portal-new-template-tsx","path":"/Qmt8gadal","result":{"data":{"markdownRemark":{"html":"

概述

\n

本文为您介绍ranger权限策略迁移方案，分为3个部分：

\n
    \n
  1. 用户组、用户的迁移
    2. \n
  2. role 迁移
    3. \n
  3. 用户组、用户的权限策略迁移
    4. \n
\n

前提条件

\n\n

1.用户组、用户迁移

\n

使用附件中的工具，可以批量添加用户、用户组

\n

迁移工具见附件

\n\n
\n
\n
\n Bash\n \n
\n
\n 
1使用样例\n2./add_user_group.sh \\\n3    -f /user_group.txt \\\n4    -b https://bmr.bj.baidubce.com \\\n5    -c cluster-id \\\n6    -p 'password' \\\n7    -k '<AK>' \\\n8    -s '<SK>'
\n
\n
\n
\n \n

参数

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
参数必填说明
-f, --file✅关系文件，每行 用户名 用户组（空白分隔，# 为注释）
-b, --base-url✅服务域名，如 https://bmr.bj.baidubce.com
-c, --cluster-id✅集群 ID
-p, --password✅明文密码
-k, --access-key✅AK
-s, --secret-key✅SK
--dry-run否只打印请求不执行
-h, --help否帮助
\n

关系文件格式

\n\n
\n
\n
\n Plain Text\n \n
\n
\n 
1# 每行：用户名 用户组（空白分隔，# 为注释，空行忽略）\n2alice developers\n3bob developers\n4carol ops
\n
\n
\n
\n \n

依赖

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
命令用途
curl发请求
jq构造/解析 JSON
openssl密码 AES 加密
xxdhex 编解码
python3生成签名
\n

2.role迁移

\n

使用附件中的脚本，role迁移包含两个脚本，分为导入、导出

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
参数含义默认值
--url <url>目标 Ranger Admin 地址http://localhost:6080
--auth <u:p>目标管理员 user:passwordadmin:admin
--in <file>输入 JSONL 文件roles_full.jsonl
\n

导出role

\n\n
\n
\n
\n Bash\n \n
\n
\n 
1#从源集群导出role信息\n2sh ranger-role-export.sh \\\n3  --url http://localhost:6080 \\\n4  --auth admin:admin \\\n5  --out roles_full.jsonl
\n
\n
\n
\n \n

导入role

\n

1.SSH 登录bmr集群Master 节点，参考SSH连接到集群

\n

2.把上一步的导出结果上传到节点上，执行导入脚本

\n\n
\n
\n
\n Bash\n \n
\n
\n 
1 #role信息导入目标集群\n2 sh ranger-role-import.sh \\\n3  --url http://localhost:6080 \\\n4  --auth admin:admin \\\n5  --in roles_full.jsonl
\n
\n
\n
\n \n

导入后即可在ranger页面查看role信息

\n

3.权限策略迁移

\n

导出策略

\n

从原集群ranger中导出要迁移的服务策略（以hive为例）

\n

\"b1.png\"

\n

\"b2.png\"\n导出的文件格式为json,格式类似 Ranger_Policies_20260821_062940.json

\n

改写文件

\n

如果迁移对象存储的权限策略，需要改写以下两项：

\n
    \n
  1. 导出的json文件中serviceType的值改为bos
    2. \n
\n\n
\n
\n
\n Bash\n \n
\n
\n 
1\"rowFilterPolicyItems\": [],\n2\"serviceType\": \"cos\",   改为 bos\n3\"options\": {}
\n
\n
\n
\n \n
    \n
  1. 导出的json文件中的path参数需要改为带有 / 前缀
    2. \n
\n\n
\n
\n
\n Bash\n \n
\n
\n 
1\"path\": {\n2    \"values\": [\n3    \"tmp\"  改为\"/tmp\" \n4    ],
\n
\n
\n
\n \n

导入策略

\n

把上一步导出的结果导入到目标集群ranger

\n

\"b3.png\"

\n

\"b4.png\"\n选取上一步导出的文件\n\"b5.png\"

\n

\"b6.png\"

\n

附件

\n

迁移工具：

\n

https://bmr-bj-public-read.bj.bcebos.com/bce-bmr/doc/ranger%E8%BF%81%E7%A7%BB%E5%B7%A5%E5%85%B7.zip

","fields":{"slug":"Qmt8gadal","title":"权限策略迁移方案","date":"2026-08-25","extractedHeadings":[]},"headings":[{"value":"概述","depth":2},{"value":"前提条件","depth":2},{"value":"1.用户组、用户迁移","depth":2},{"value":"参数","depth":4},{"value":"关系文件格式","depth":4},{"value":"依赖","depth":4},{"value":"2.role迁移","depth":2},{"value":"导出role","depth":4},{"value":"导入role","depth":4},{"value":"3.权限策略迁移","depth":2},{"value":"导出策略","depth":4},{"value":"改写文件","depth":4},{"value":"导入策略","depth":4},{"value":"附件","depth":2}]}},"pageContext":{"isCreatedByStatefulCreatePages":false,"slug":"Qmt8gadal","prev":{"id":"Cm6981x9p","name":"权限策略配置","path":"Cm6981x9p","filePath":"开源组件介绍/Ranger/权限策略配置.md","seo":null,"parentIds":["ejwvxvcqb","9m697v3af"],"parents":[{"id":"ejwvxvcqb","documentId":null,"name":"开源组件介绍","repoName":"BMR","filePath":"开源组件介绍","disabled":false,"path":"ejwvxvcqb","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":null},{"id":"9m697v3af","documentId":"ccfc9e54-d10c-423a-afb6-70413669529d","name":"Ranger","repoName":"BMR","filePath":"开源组件介绍/Ranger","disabled":false,"path":"9m697v3af","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":null}]},"next":{"id":"1m65wc1lv","name":"Kerberos","path":"1m65wc1lv","filePath":"开源组件介绍/Kerberos/概述.md","seo":null,"parentIds":["ejwvxvcqb","Om65wbmvs"],"parents":[{"id":"ejwvxvcqb","documentId":null,"name":"开源组件介绍","repoName":"BMR","filePath":"开源组件介绍","disabled":false,"path":"ejwvxvcqb","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":null},{"id":"Om65wbmvs","documentId":"11120054-c3eb-41b2-bf1a-aa49a2d6dd35","name":"Kerberos","repoName":"BMR","filePath":"开源组件介绍/Kerberos","disabled":false,"path":"Om65wbmvs","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":null}]},"parents":[{"id":"ejwvxvcqb","documentId":null,"name":"开源组件介绍","repoName":"BMR","filePath":"开源组件介绍","disabled":false,"path":"ejwvxvcqb","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":null},{"id":"9m697v3af","documentId":"ccfc9e54-d10c-423a-afb6-70413669529d","name":"Ranger","repoName":"BMR","filePath":"开源组件介绍/Ranger","disabled":false,"path":"9m697v3af","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":null}],"specificSeo":null}}}