RANGER-5640: Bump Docker Ozone to 2.1 and package audit-server JARs in ozone plugin

[ramackri]

What changes were proposed in this pull request?

Ranger’s Ozone plugin compiles against Ozone 2.1.0 (pom.xml, RANGER-5393 / AssumeRole), but dev-support/ranger-docker still ran Ozone 1.4.0 at runtime after RANGER-5637 (#1006). That mismatch breaks the Ozone Docker / plugins-docker-build smoke path:

• NoSuchMethodError: RequestContext.getSessionPolicy() — plugin bytecode references a 2.1 API; Ozone 1.4 OM classpath has no such method.
• Missing audit-server destination JARs — plugin-ozone.xml moduleSet must include ranger-audit-core / ranger-audit-dest-auditserver so they are packaged into lib/libext/ranger-ozone-plugin-impl/.
• Ozone 2.1 compose init — ENSURE_*_INITIALIZED triggers runner entrypoint fallback to obsolete -createObjectStore (removed in Ozone 2.1).
• javax.annotation.Priority CNFE — audit-server JAX-RS on OM needs javax.annotation-api as a runtime Maven dependency on plugin-ozone plus assembly include (assembly <include> alone is insufficient).
• /data: Operation not permitted on datanode — jdk21 ozone-runner requires pre-create/chown of /data before ozone datanode.

This PR:

1. Bumps Docker Ozone runtime to 2.1.0 — OZONE_VERSION=2.1.0 in .env, aligned with the plugin compile target.
2. Switches ozone-runner to JDK 21 — OZONE_RUNNER_VERSION=20260106-1-jdk21 (Ozone 2.0+ requires jdk21 runner; multi-arch arm64+amd64). Dockerfile.ranger-ozone default ARG kept in sync.
3. Packages audit-server JARs via moduleSet — adds ranger-audit-core, ranger-audit-dest-auditserver, and related Ranger modules to the impl moduleSet in distro/src/main/assembly/plugin-ozone.xml (same pattern as hdfs-agent.xml; redundant duplicate entries in binaries <includes> removed).
4. Fixes Ozone 2.1 Docker compose — explicit ozone scm --init / ozone om --init; datanode command pre-creates and chowns /data for jdk21 runner.
5. Adds javax.annotation-api — runtime dependency in plugin-ozone/pom.xml and version-qualified assembly include.

Commits

Commit	Summary
764b513e2	Ozone 2.1 .env, audit modules in moduleSet, compose --init
33c1bd600	javax.annotation-api assembly include
c10983219	javax.annotation-api pom runtime dep; datanode /data chown
008c88667	Drop redundant Ranger :jar lines from binaries <includes> (hdfs-agent parity)

Files changed

File	Change
dev-support/ranger-docker/.env	OZONE_VERSION 1.4.0 → 2.1.0; runner → 20260106-1-jdk21
dev-support/ranger-docker/Dockerfile.ranger-ozone	Sync default OZONE_RUNNER_VERSION
dev-support/ranger-docker/docker-compose.ranger-ozone.yml	Ozone 2.1 --init; datanode /data chown
plugin-ozone/pom.xml	javax.annotation-api runtime dependency
distro/src/main/assembly/plugin-ozone.xml	Audit modules in moduleSet; javax.annotation-api; hdfs-style binaries filter

How was this patch tested?

• GitHub Actions plugins-docker-build — pass (ozone-scm, ozone-datanode, ozone-om up with Ozone 2.1 / jdk21 runner).
• Local CI-style smoke (committed non-Kerberos docker-config) — all five containers (ranger, ranger-solr, ozone-scm, ozone-datanode, ozone-om) running; no javax.annotation.Priority / ClassNotFoundException on OM start.

Manual testing

Performed on macOS (Apple Silicon):

cd dev-support/ranger-docker
./download-archives.sh ozone
docker pull apache/ozone-runner:20260106-1-jdk21
export RANGER_DB_TYPE=postgres OZONE_VERSION=2.1.0 OZONE_RUNNER_VERSION=20260106-1-jdk21
./scripts/ozone/ozone-plugin-docker-setup.sh
docker compose -f docker-compose.ranger.yml -f docker-compose.ranger-ozone.yml up -d scm datanode om

Check	Result
ozone-scm / ozone-om	Up — Ozone 2.1.0, JDK 21
ozone-datanode	Up after /data chown fix
NoSuchMethodError: getSessionPolicy()	Not observed
ClassNotFoundException: javax.annotation.Priority	Not observed after pom + assembly fix
plugins-docker-build (CI)	Pass

Note: Export OZONE_VERSION and OZONE_RUNNER_VERSION explicitly if shell env overrides .env.

Test plan (CI / reviewers)

• GitHub Actions plugins-docker-build — ozone-scm, ozone-datanode, ozone-om start with Ozone 2.1 / jdk21
• javax.annotation-api-*.jar packaged under lib/libext/ranger-ozone-plugin-impl/ (via plugin-ozone pom + assembly)
• mvn clean verify — confirm fat ranger-*-ozone-plugin.tar.gz contains ranger-audit-core-*.jar and ranger-audit-dest-auditserver-*.jar (full reactor build; -pl distro alone produces a stub tarball)