You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "rawwar (via GitHub)" <gi...@apache.org> on 2024/11/13 12:14:33 UTC
[I] Add ability to disable SSL in Snowflake provider [airflow]
rawwar opened a new issue, #43963:
URL: https://github.com/apache/airflow/issues/43963
### Description
Currently snowflake provider uses `requests` library in non-deferrable mode and `aiohttp` library in deferrable mode to make requests to snowflake URL. It does not have the config to disable SSL
### Use case/motivation
Ability to disable ssl verification can help when connecting to Snowflake hosted via AWS private link. Often, in deferrable mode it causes following failure `certificate verify failed: Hostname mismatch, certificate is not valid`. While this works in non-deferrable mode. Disabling SSL verification can help when connecting to Snowflake hosted via an AWS private link. Often, in deferrable mode, it causes the following failure: `certificate verify failed: Hostname mismatch, certificate is not valid`, while
### Related issues
NA
### Are you willing to submit a PR?
- [X] Yes I am willing to submit a PR!
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Add ability to disable SSL in Snowflake provider [airflow]
Posted by "eladkal (via GitHub)" <gi...@apache.org>.
eladkal commented on issue #43963:
URL: https://github.com/apache/airflow/issues/43963#issuecomment-2474176200
This is not unique to Snowflake... other providers connection can have similar request.
My prespective is: No insecure features unless the provider owner is asking for it and involved in the provider maintenance. Specificly but not limited to security concerns/questions/feedback.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Add ability to disable SSL in Snowflake provider [airflow]
Posted by "rawwar (via GitHub)" <gi...@apache.org>.
rawwar closed issue #43963: Add ability to disable SSL in Snowflake provider
URL: https://github.com/apache/airflow/issues/43963
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Add ability to disable SSL in Snowflake provider [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #43963:
URL: https://github.com/apache/airflow/issues/43963#issuecomment-2473484283
It's a bit problematic, I woudl very much prefer to have an easy way to configure private certificates for it. I think accessing Snowflake without SSL is REALLY bad idea - especially that almost by definition it is "somwhere else" (Yeah I understand it can be in a private network, but it is not really super secure either in this case). I'd only limit no-SSL connections to internal communication on the same node or proxy -> webapp where their network is truly internal and not accessible by any "human" in the company (which I hardly imagine possible when you communicate with Snowflake).
It might sound excessive but it had already costed Snowflake a lot of reputation damage when their MFA was not enforced earlier this year: https://www.informationweek.com/cyber-resilience/snowflake-s-lack-of-mfa-control-leaves-companies-vulnerable-experts-say - and we can safely assume that "disabling security" should not be easy.
Maybe - if you attempt to do it, you should make sure there is big FAT warning generated when any such non-secured connection is attempted - like "THIS IS NOT SECURE, MAKE SURE THAT YOU ARE NOT CONNECTING TO PRODUCTION INSTANCE" or smth.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Add ability to disable SSL in Snowflake provider [airflow]
Posted by "rawwar (via GitHub)" <gi...@apache.org>.
rawwar commented on issue #43963:
URL: https://github.com/apache/airflow/issues/43963#issuecomment-2473565425
@potiuk , that totally makes sense. I'll probably leave this open until someone else requests this. If more people request this, I'll go ahead and implement this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org