Ranger K8s Operator

Learn about configurations >

• audit-max-result-window | int

  Default: 10000

  Maximum number of audits a single search of the related OpenSearch index can page through, as used by the Audit tab and the /service/assets/accessAudit API. Sets index.max_result_window on the index. Applies only to an application with charm-function=admin related to OpenSearch.

• audit-retention-days | int

  Number of days of access audits to keep in the related OpenSearch index. Set 0 to keep every audit. Applies only to an application with charm-function=admin related to OpenSearch.

• charm-function | string

  Default: admin

  The function the charm should provide, either admin or usersync.

• enforce-strict-reconciliation | boolean

  Default: True

  Exclude populated roles from newly created default policies so reconciliation does not grant access. Disabling this is an authorized security opt-out that includes default roles in default policies even if they are already populated.

• ldap-credentials | string

  Optional Juju secret ID containing LDAP bind credentials, in secret:... format. This is a secret ID, not the secret name. If set, the secret must contain sync-ldap-bind-dn and sync-ldap-bind-password and be granted to this application.

• lookup-timeout | int

  Default: 3000

  The default timeout for the resource auto-complete functionality for Ranger service in ms. Applies only to Ranger services created after the value is changed.

• policy-mgr-url | string

  Override URL for the Ranger Admin API used by policy clients and usersync. When unset, admin deployments resolve the URL automatically:

  1. Live ingress URL (if an ingress relation is active).
  2. Cluster-internal DNS: http://<app>.<model>.svc.cluster.local:6080. Usersync deployments require this option to be set explicitly. Setting this to a cluster-internal URL (e.g. http://ranger-k8s.my-model.svc.cluster.local:6080) avoids the extra ingress hop for in-cluster policy consumers.

• sync-group-member-attribute-name | string

  Default: memberUid

  The attribute in the Group which specifies members.

• sync-group-object-class | string

  Default: posixGroup

  The object class corresponding to groups for ldapsearch.

• sync-group-search-base | string

  Search base for LDAP groups. If unset, Ranger uses sync-ldap-search-base; if that is also unset, Ranger uses sync-ldap-user-search-base.

• sync-group-search-enabled | boolean

  Default: True

  Set to true to perform an ldapsearch to find groups rather than relying on user entry attributes.

• sync-group-user-map-sync-enabled | boolean

  Default: True

  Set to true to synchronize memberships of groups found through group search.

• sync-interval | int

  Default: 3600

  The interval in seconds to synchronize the users/groups from ldap. Note: this can not be less than hourly (3600) for LDAP.

• sync-ldap-deltasync | boolean

  Default: True

  Enable to incrementally sync as opposed to full sync after initial run.

• sync-ldap-group-name-case-conversion | string

  Default: none

  Case conversion for synced group names. Allowed values: none, lower and upper.

• sync-ldap-group-search-filter | string

  Optional additional filter constraining the groups selected for syncing.

• sync-ldap-group-search-scope | string

  Default: sub

  Search scope for the groups. Allowed values: base, one and sub.

• sync-ldap-referral | string

  Default: ignore

  LDAP referral handling. Allowed values: ignore and follow.

• sync-ldap-search-base | string

  Search base for LDAP users and groups.

• sync-ldap-url | string

  The URL of the LDAP server to synchronise users from, in ldap://<host>:<port> or ldaps://<host>:<port> format.

• sync-ldap-user-group-name-attribute | string

  Default: memberOf

  Attribute from user entry whose values would be treated as group values to be pushed into Policy Manager database.

• sync-ldap-user-name-attribute | string

  Default: uid

  Attribute from user entry that would be treated as user name.

• sync-ldap-user-object-class | string

  Default: person

  The object class corresponding to users for ldapsearch.

• sync-ldap-user-search-base | string

  Search base for LDAP users. Overrides sync-ldap-search-base.

• sync-ldap-user-search-filter | string

  Optional additional filter constraining the users selected for syncing.

• sync-ldap-user-search-scope | string

  Default: sub

  Search scope for the users. Allowed values: base, one and sub.

• sync-ldap-username-case-conversion | string

  Default: none

  Case conversion for synced user names. Allowed values: none, lower and upper.

• sync-paged-results-enabled | boolean

  Default: True

  Request LDAP search results in pages. Without paging, directories such as Active Directory truncate large result sets.

• sync-paged-results-size | int

  Default: 500

  Number of LDAP entries requested per results page. Must be at least 1.

• usersync-credentials | string

  The Juju secret ID containing the rangerusersync password, in secret:... format. Required by, and only valid on, an application with charm-function=usersync. The secret must contain a rangerusersync key and be granted to this application. Obtain the current value by running the get-password action on the Ranger admin application; it is the operator's responsibility to keep this secret up to date after a rotation.