You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "nava-datavid (via GitHub)" <gi...@apache.org> on 2025/08/04 13:42:25 UTC
[D] Airflow Web Password Configuration [airflow]
GitHub user nava-datavid created a discussion: Airflow Web Password Configuration
### Official Helm Chart version
1.18.0 (latest released)
### Apache Airflow version
3.0.2
### Kubernetes Version
1.31
### Helm Chart configuration
_No response_
### Docker Image customizations
_No response_
### What happened
the web server password is getting generated every time i deploy airflow chart. Is there a way i can statically provide the password for web?
The admin password is printed in the log and stored in a text file /opt/airflow/simple_auth_manager_passwords.json.generated , even i tried mounting the file as secret but i'm getting permission denied error
Earlier in version 2.8+, airflow users command was present and job was sufficent to create the user. In 3.0.x i' not sure how this can be managed.
### What you think should happen instead
_No response_
### How to reproduce
Just deploy the chart with simple auth enabled.
### Anything else
_No response_
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
GitHub link: https://github.com/apache/airflow/discussions/54094
----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org
Re: [D] Airflow Web Password Configuration [airflow]
Posted by "prakass1 (via GitHub)" <gi...@apache.org>.
GitHub user prakass1 edited a comment on the discussion: Airflow Web Password Configuration
Currently, the defaultUser is under webserver. However, I think that it would be better to move this section out from webserver in the values.yaml in general. This way, the deaultUser would then not be required to be tied to webserver component.
The impact of this would be to values.schema.json, values.yaml, and create-user-job.
@jedcunningham @potiuk what do you think about it?
GitHub link: https://github.com/apache/airflow/discussions/54094#discussioncomment-13989561
----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org
Re: [D] Airflow Web Password Configuration [airflow]
Posted by "prakass1 (via GitHub)" <gi...@apache.org>.
GitHub user prakass1 added a comment to the discussion: Airflow Web Password Configuration
Currently, the defaultUser is under webserver. However, I think that it would be better to move this section out in the values.yaml in general. This way, the deaultUser will not be required to be tied to webserver component.
The impact of this would be to values.schema.json, values.yaml, and create-user-job.
@jedcunningham @potiuk what do you think about it?
GitHub link: https://github.com/apache/airflow/discussions/54094#discussioncomment-13989561
----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org
Re: [D] Airflow Web Password Configuration [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
GitHub user potiuk added a comment to the discussion: Airflow Web Password Configuration
> airflow cli has no more users option
Because you are using SimpleAuthManager by default. That was a change in Airflow 3 clearly documented in changelog. If you want to use FABAuthManager and "create users" command you need to configure FABAuthManager as auth manager you use.
> The admin password is printed in the log and stored in a text file /opt/airflow/simple_auth_manager_passwords.json.generated , even i tried mounting the file as secret but i'm getting permission denied error
Correct - that is the change in Airlfow 3 with SimpleAuthManager being default (yet only useful for development and testing). If you wish to use "production" ready Auth Manager - you can switch to FabAuthManager (to preserve Airflow 2 compatibility of users management) and in Airflow 3.1 you will also be able to also use KeyCloakAuthManager which will allow to delegate RBAC control out to KeyCloak where you will be able to map your "enterprise" users to Airflow users and their permissions.
Nothing extraordinary here. Everything communicated and described in Airflow 3 Release Notes including links to appropriate documentation.
Yes. It's a change vs default Airflow 2 behaviour and you have no other choice but to adapt.
GitHub link: https://github.com/apache/airflow/discussions/54094#discussioncomment-13989603
----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org
Re: [D] Airflow Web Password Configuration [airflow]
Posted by "prakass1 (via GitHub)" <gi...@apache.org>.
GitHub user prakass1 added a comment to the discussion: Airflow Web Password Configuration
On another note, do you think considering https://github.com/apache/airflow/discussions/54094#discussioncomment-13989561 would be beneficial to not tie up defaultUser with webserver ?
GitHub link: https://github.com/apache/airflow/discussions/54094#discussioncomment-13991323
----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org
Re: [D] Airflow Web Password Configuration [airflow]
Posted by "prakass1 (via GitHub)" <gi...@apache.org>.
GitHub user prakass1 added a comment to the discussion: Airflow Web Password Configuration
I am using helm chart 1.18.0, which has airflow image version 3.0.2, and that works all fine for me. This is the stable released version.
GitHub link: https://github.com/apache/airflow/discussions/54094#discussioncomment-13989563
----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org
Re: [D] Airflow Web Password Configuration [airflow]
Posted by "nava-datavid (via GitHub)" <gi...@apache.org>.
GitHub user nava-datavid added a comment to the discussion: Airflow Web Password Configuration
sorry the version of helm chart is 1.19.0-dev
GitHub link: https://github.com/apache/airflow/discussions/54094#discussioncomment-13989559
----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org
Re: [D] Airflow Web Password Configuration [airflow]
Posted by "nava-datavid (via GitHub)" <gi...@apache.org>.
GitHub user nava-datavid added a comment to the discussion: Airflow Web Password Configuration
your suggestion works well with old charts (airflow version < 3.X.X , but in the latest airflow `airflow users create` command is not there
```
createUserJob:
# Limit the lifetime of the job object after it finished execution.
ttlSecondsAfterFinished: 300
# Command to use when running the create user job (templated).
command: ~
# Args to use when running the create user job (templated).
args:
- "bash"
- "-c"
# The format below is necessary to get `helm lint` happy
- |-
exec \
airflow {{ semverCompare ">=2.0.0" .Values.airflowVersion | ternary "users create" "create_user" }} "$@"
- --
- "-r"
- "{{ .Values.webserver.defaultUser.role }}"
- "-u"
- "{{ .Values.webserver.defaultUser.username }}"
- "-e"
- "{{ .Values.webserver.defaultUser.email }}"
- "-f"
- "{{ .Values.webserver.defaultUser.firstName }}"
- "-l"
- "{{ .Values.webserver.defaultUser.lastName }}"
- "-p"
- "{{ .Values.webserver.defaultUser.password }}"
```
the job which creates the default user will not work
airflow cli has no more users option
```
airflow@rover-airflow-webserver-5fc9fb7964-25x6b:/opt/airflow$ airflow
Usage: airflow [-h] GROUP_OR_COMMAND ...
Positional Arguments:
GROUP_OR_COMMAND
Groups
assets Manage assets
backfill Manage backfills
celery Celery components
config View configuration
connections Manage connections
dags Manage DAGs
db Database operations
jobs Manage jobs
pools Manage pools
providers Display providers
tasks Manage tasks
variables Manage variables
Commands:
api-server Start an Airflow API server instance
cheat-sheet Display cheat sheet
dag-processor Start a dag processor instance
info Show information about current Airflow and environment
kerberos Start a kerberos ticket renewer
plugins Dump information about loaded plugins
rotate-fernet-key
Rotate encrypted connection credentials and variables
scheduler Start a scheduler instance
standalone Run an all-in-one copy of Airflow
triggerer Start a triggerer instance
version Show the version
```
GitHub link: https://github.com/apache/airflow/discussions/54094#discussioncomment-13989562
----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org
Re: [D] Airflow Web Password Configuration [airflow]
Posted by "prakass1 (via GitHub)" <gi...@apache.org>.
GitHub user prakass1 added a comment to the discussion: Airflow Web Password Configuration
Maybe you meant the airflow UI username and password being generated every time you spin up helm chart. If you are deploying the helm chart and would like to keep the password constant, you can do the following:
One of the option that can be done is to override the values.yaml with custom setting for the following under webserver section:
override.yaml
```
webserver:
# Create initial user.
defaultUser:
enabled: true
role: Admin
username: admin
email: admin@example.com
firstName: admin
lastName: user
password: test123! # You can provide this to be coming externally part of your pipeline from some secrets
```
Then you would deploy helm chart with `helm install airflow apache-airflow/airflow -f override.yaml --namespace <your_ns>` This then will take the password you specify. Note that, if you are using postgres container part of the helm chart then remove the persistence volume and claim and retry.
For a production setup, you can get the value for the secret from some service like AWS Secrets Manager, populate it to the override.yaml part of the deployment.
GitHub link: https://github.com/apache/airflow/discussions/54094#discussioncomment-13989560
----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org
Re: [D] Airflow Web Password Configuration [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
GitHub user boring-cyborg[bot] added a comment to the discussion: Airflow Web Password Configuration
Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.
GitHub link: https://github.com/apache/airflow/discussions/54094#discussioncomment-13989558
----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org
Re: [D] Airflow Web Password Configuration [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
GitHub user potiuk added a comment to the discussion: Airflow Web Password Configuration
Converted to discussion if more discussion is needed.
GitHub link: https://github.com/apache/airflow/discussions/54094#discussioncomment-13989612
----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org