2026.2.0

2026.2.0 extends the external system permissions of 2026.1.0 to Apache Hive, Apache Kafka, Apache HBase, Trino and Apache Hadoop YARN, with agents that enforce them. The complete list of changes is in the GitHub comparison.

Apache Hive

• A Hive service plug-in: databases, tables, columns, UDFs, URLs, the HiveServer2 service and replication, with Hive's access types as Apache Ranger defines them; see Apache Hive.
• A HiveServer2 agent that checks every statement, filters SHOW results, masks columns and filters rows; see the Hive agent.
• Temporary UDFs are granted at the global scope only to tempudfadmin, as Apache Ranger does, since they run code of the user's choosing.

Apache Kafka

• A Kafka service plug-in: topics, groups, transactional IDs, the cluster, delegation tokens and SCRAM users, with Kafka's own access types and implications; see Apache Kafka.
• A broker and controller authorizer that checks every request; see the Kafka agent.

Apache HBase

• An HBase service plug-in: namespaces, tables, column families and columns, plus the global scope for operations on the whole cluster; see Apache HBase.
• A master and region server coprocessor that checks operations, returns only the columns a user may read and hides what a user may not see; see the HBase agent.

Trino

• A Trino service plug-in: catalogs, schemas, tables, columns, functions, procedures and session properties; see Trino.
• Two system access controls, one for Trino 470 to 478 and one for Trino 479 and later, that check queries and filter rows and mask columns; see the Trino agents.

Apache Hadoop YARN

• A YARN service plug-in: queues and applications, with YARN's submit_app and admin_queue access types; see Apache Hadoop YARN.
• An authorization provider in the ResourceManager that decides submission, queue and cluster administration by policy, with client-address conditions; see the YARN agent.

Policy engine and agents

• Policies decide access to what lies below a resource: listing a database counts a user's table policies, and a new _any access type is allowed when any access on the resource or below it is allowed.
• Policies answer whether a user may do something to some resource of a level, as Kafka asks before idempotent producers write.
• Agents fold identical allowed accesses of a time window into one audit event with a count and the moment of the last one; refusals are recorded at once.
• Agents can show their access policies in the system's own terms.
• The plug-in API 1.2.0 provides the Kerberos realms once to every plug-in, so plug-ins with Kerberos no longer overwrite each other's krb5.conf.

Documentation and release

• The YARN, Hive, Kafka, HBase and Trino plug-ins and agents are documented in all eleven languages.
• The README lists the supported components and the versions the integration tests verify.
• Release tags run the complete CI and the release waits for that run; the distribution builds in parallel; npm publishes through trusted publishing.
• Releases are refused without their release log, and CI runs only the jobs a change needs after one Java gate.

Fixes

• PostgreSQL indexes are prepared after seeding, so timed API calls run on analyzed tables.
• The ZooKeeper agent's jar tests run after packaging.
• Maven deploys skip the integration tests, which a forked JVM timeout on the HDFS 3.2 agent had made fail the GitHub Packages deploy.
• The npm package declares its repository, so npm can verify its provenance.