---
title: Charmhub | Deploy Ranger K8s Operator using Charmhub - The Open Operator Collection
description: Deploy the latest version of Ranger K8s Operator as a Kubernetes Operator
  on any cloud.
url: https://charmhub.io/ranger-k8s/docs/how-to-group-management
---

# Ranger K8s Operator

[Business Data](https://charmhub.io/publisher/businessdata "View all packages from Business Data")

* [Business Data](https://charmhub.io/publisher/businessdata "View all packages from Business Data")

Platform:

stable 33

```
juju deploy ranger-k8s
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

---

#### Contacts

##### Maintainers

+ [Commercial Systems](mailto:jaas-crew@lists.canonical.com)

* [Submit a bug](https://github.com/canonical/ranger-k8s-operator/issues)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

# Group management in Apache Ranger

The Charmed Ranger Operator makes use of the [Ranger API](https://ranger.apache.org/apidocs/index.html) and [apache-ranger PyPi package](https://pypi.org/project/apache-ranger/) to manage users and groups. The source of users and group memberships is a `user-group-configuration.yaml` file provided to the charm as a configuration value `user-group-configuration`.

An example of this file is here:

```
ranger-k8s:
   user-group-configuration: |
      relation_2:
         users:
            - name: user1
              firstname: One
              lastname: User
              email: user1@canonical.com
            - name: user2
              firstname: Two
              lastname: User
              email: user2@canonical.com

         groups:
            - name: developers
              description: users with developer level access.
            - name: users
              description: users with select only access.

         memberships:
            - groupname: users
              users: [user1, user2]
            - groupname: developers
              users: [user2]
```

The charm contains a RangerGroupManagement class which will on configuration change to this parameter:

* Create new groups
* Delete groups no longer required
* Create new users (please note external users cannot be deleted via the API)
* Associate users with groups
* Remove user associations with groups that are no longer required

## Group management in related application

The Ranger plugin schedules regular download of Ranger policies (every 3 minutes) storing these policies within the related application in a cache. On access request, the requesting user’s UNIX group is used when comparing to Ranger group policies to determine access.

### Get relation ID

To automatically share this user and group information with the related charm, you must ensure the `relation_id` present in the `user-group-configuration.yaml` matches the corresponding application. The user data will then be available to the related application via the relation databag.

This can be done with:

```
juju show-unit <application name>/0 --format json | jq
```

### Trino relation

The configuration of these groups is done automatically on relation with the Ranger charm in the [Trino K8s charm](https://charmhub.io/trino-k8s).

---