Release 9.2.31.1¶

Updated Inactive Agent Warning Banner¶

The inactive Runtime Agent warning banner in the portal now includes copyable kubectl commands to check pod status before scaling, view Runtime Agent logs, and restart the agent.

Internal Pod TLS for Runtime Planes¶

Runtime planes now support internal pod TLS. Certificates for in-cluster service communication are issued and managed automatically, so runtime applications can communicate securely.

Automatic DNS Management for Runtime Plane Load Balancer Services [AKS and GKE]¶

The runtime agent now supports automatic DNS management for runtime plane load balancer services on Azure Kubernetes Service (AKS) and Google Kubernetes Engine (GKE). When enabled, DNS records are automatically created and maintained in Azure DNS and GCP Cloud DNS for load balancer services within the runtime plane namespace.

Policy Authoring — Author Policies from Reusable Identifiers¶

Data Governance now includes Policy Authoring, a guided Create Policy wizard (Policy Intent → Who → What Data → Action → Review) for Access, Masking, and Row Filter policies. Policies are composed from reusable Identifiers (User, Record, Column) and applied to a resource, data tag, or data product. Identifiers and policies can also be managed via REST APIs.

See Policy Authoring in the product documentation.

Parallel Resource Loading for On-Demand and Offline Tasks (Lakeformation, Databricks Unity Catalog, Databricks SQL Analytics)¶

Resource loading for on-demand and offline (scheduled) tasks can now run in parallel through a dedicated on-demand queue and worker, so a long-running scheduled offline sync no longer delays on-demand resource loading.

The feature is controlled by the property policysync.resource.load.dual.queue.enabled (default false); when disabled, the existing behavior is preserved. Concurrent offline and on-demand updates to the same resource are processed safely and remain consistent, and the upgrade is backward compatible with existing data.

Available for the Lakeformation, Databricks Unity Catalog, and Databricks SQL Analytics connectors.

Snowflake - Fix Access Audit Sync Returns Zero Logs Due to Incorrect Schema Filter Generation¶

Fixed a Snowflake connector issue where Simple audit sync could complete successfully but return no access audits when managed schemas were configured. The connector was building the schema filter using full database.schema names, but Snowflake's query history stores only the schema name in SCHEMA_NAME, so the filter never matched. The connector now generates the schema filter with the correct schema-only names, so audit sync queries Snowflake over the intended managed scope and matching access events are retrieved and forwarded to the Audit Server on each sync cycle.

Snowflake Connector Silently Drops Access Audits for Context-less Queries in Simple Audit Mode¶

Fixed an issue in the Snowflake connector where access audits for fully qualified SQL queries run without USE DATABASE or USE SCHEMA were silently excluded in Simple audit mode. The connector now retains these queries from QUERY_HISTORY and resolves the managed database and schema from the query text, so access audits appear correctly in Privacera.

Added Extra Debug Logging in PolicySync Base and Snowflake¶

Added extra debug logs in PolicySync Base and the Snowflake connector to improve troubleshooting during connector operations.

Snowflake Fix Repeated CREATE OR REPLACE MASKING POLICY Operations¶

Resolved an issue where the connector repeatedly executed CREATE OR REPLACE MASKING POLICY for custom masking, even when no changes were required. The connector now avoids unnecessary masking policy operations.

Added Fix for Implicit Grant on Volume for Unity Catalog Connector¶

Added support for implicit USE CATALOG and USE SCHEMA permissions when evaluating volume access in the Unity Catalog connector. This ensures volume permissions are processed correctly without requiring these implicit grants to be explicitly configured.

MSSQL Parallel Resource Loading¶

Added an optional parallel resource loading feature for MSSQL connectors. When enabled, PolicySync loads resources from multiple databases concurrently using a configurable thread pool, reducing resource synchronization time.

MSSQL and Unity Catalog - Prevent Accidental Tag Deletion When Purview Sync Fails¶

Fixed an issue where a Purview sync failure caused the connector to incorrectly delete tag definitions and resource mappings in MDS. A new property purview.skip.delete.tags (default: true) has been added to suppress tag deletions during tag sync for the MSSQL and Unity Catalog connectors.

Scheme Server Base Image Upgraded¶

Updated the Scheme Server base image to a newer version to address known security vulnerabilities identified in CVE report.

Improved Diagnostics for TAG ServiceDef DataMask Registration¶

Ranger Admin now logs a warning when a DataMask type cannot be added to the TAG ServiceDef because its computed item ID conflicts with an existing entry. This helps administrators identify ServiceDef collisions during startup.

Login Session Audit Logs Added to S3 Archival¶

Login session audit logs are now archived to S3 along with existing access audit and admin audit logs. This enhancement provides centralized storage and retention of all major Ranger audit events in S3, enabling improved audit visibility, compliance, and forensic analysis.

Fixed Tag Cache Inconsistencies During Tag Delta Processing¶

Resolved an issue in tag delta processing where duplicate or stale service resource entries could remain in plugin tag caches after certain update sequences. This could result in inconsistent in-memory tag mappings until the next full refresh. The fix also improves resilience when duplicate resource IDs are encountered in cached data.

Fixed Principal Macro Detection for Row Filters and Data Masking¶

Ranger now correctly recognizes group- and role-membership macros (such as IS_IN_GROUP() and IS_IN_ROLE()) as principal-scoped expressions when evaluating row filter and data masking policies. This ensures policy updates are correctly generated and applied for policies that use these macros.