[GitHub] [airflow] maganaluis edited a comment on issue #10836: Add RBAC policy -> namespace allowance in the KubernetesExecutor

[GitBox <gi...@apache.org>]

maganaluis edited a comment on issue #10836:
URL: https://github.com/apache/airflow/issues/10836#issuecomment-689683480


   # Description
   
   Add RBAC policy to ensure Roles can only execute DAGs against an assigned namespaces for Kubernetes Executor.
   
   # Use Case / Motivation
   
   If we have role called "ds-project-xyz" and we assign users to this project, right now users have the ability to use this role to manage the access to their DAGs via the UI. They can do so by passing a dictionary in their DAGs with the roles in the ```access_control``` parameter, this will ensure that other users that are not part of this project don't have access to this DAG. 
   
   However we also want to make sure that the tasks for this DAG run on the assigned namespace for this project "xyz" as they could have potentially sensitive data in that namespace that we don't want to get mixed up with other projects, or they also have access to sensitive credentials via Secrets. In either case we need a way for Roles to have some sort of connection to a specific namespace. 
   
   ```
   with DAG(DAG_NAME,
        schedule_interval='@daily',
        default_args=default_args,
        access_control={
            'ds-project-xyz': {'can_dag_read'},
        },
        ) as dag:
   DummyOperator(task_id='run_this_1') >> DummyOperator(
       task_id='run_this_2') >> DummyOperator(task_id='run_this_3')
   ```


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org