You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@airflow.apache.org by "glick1 (via GitHub)" <gi...@apache.org> on 2025/05/17 13:30:12 UTC

[D] Airflow 3.0.1 with Docker and Self-Signed certificate [airflow]

GitHub user glick1 created a discussion: Airflow 3.0.1 with Docker and Self-Signed certificate

Is it possible to run the new version of Airflow 3.0.1 with a self-signed SSL certificate in Docker locally?

I updated docker compose for five lines below:
(https://airflow.apache.org/docs/apache-airflow/3.0.1/docker-compose.yaml)
(https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html#config-api-ssl-cert)

AIRFLOW__API__EXPOSE_CONFIG: "true"
AIRFLOW__API_AUTH__JWT_SECRET: "yadayadayada"
AIRFLOW__API__SSL_CERT: "/opt/airflow/config/cert.pem"
AIRFLOW__API__SSL_KEY: "/opt/airflow/config/key.pem"
AIRFLOW__CORE__EXECUTION_API_SERVER_URL: "https://airflow-apiserver:8080/execution/"

I updated the health check for API server:

airflow-apiserver:
    <<: *airflow-common
    command: api-server
    ports:
      - "8080:8080"
    healthcheck:
      test:
        [
          "CMD",
          "curl",
          "--fail",
          "--insecure",
          "https://localhost:8080/api/v2/version",

Results:
-Health check passes with curl parameter "--insecure" to accept self-signed certificate.
-Airflow web portal comes up fine running fine under SSL, will only run only SSL and no longer HTTP.

When I try to run a simple DAG though, worker calling API server does not like the self-signed certificate. Anyone know any workarounds I am missing?

airflow-worker-1         | 2025-05-17 13:12:44.962740 [error    ] Task execute_workload[73ed6338-5c59-450c-8e6a-284d52e0cf60] raised unexpected: ConnectError('[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate (_ssl.c:1010)') [celery.app.trace] 



GitHub link: https://github.com/apache/airflow/discussions/50726

----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org

Re: [D] Airflow 3.0.1 with Docker and Self-Signed certificate [airflow]

Posted by "glick1 (via GitHub)" <gi...@apache.org>.

GitHub user glick1 added a comment to the discussion: Airflow 3.0.1 with Docker and Self-Signed certificate

Solution for testing only with a self-signed certificate in v3.01. In a Dockerfile for build, add self-signed certificate to Linux. Self-signed certificate must have "localhost" and "airflow-apiserver" included in openssl configuration to support web portal of api server and worker calls to api server.

Dockerfile:

FROM apache/airflow:3.0.1
USER root
RUN apt-get update \
  && apt-get install -y --no-install-recommends vim ca-certificates openjdk-17-jre-headless \
  && apt-get autoremove -yqq --purge \
  && apt-get clean \
  && rm -rf /var/lib/apt/lists/*
COPY cert2.pem /usr/local/share/ca-certificates/rootCA.crt
RUN update-ca-certificates
RUN cat /usr/local/share/ca-certificates/rootCA.crt >> `python -m certifi`
USER airflow
ENV JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64
COPY requirements.txt .
RUN pip install -r requirements.txt --constraint "https://raw.githubusercontent.com/apache/airflow/constraints-3.0.1/constraints-3.12.txt"


GitHub link: https://github.com/apache/airflow/discussions/50726#discussioncomment-13183779

----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org

Re: [D] Airflow 3.0.1 with Docker and Self-Signed certificate [airflow]

Posted by "glick1 (via GitHub)" <gi...@apache.org>.

GitHub user glick1 edited a discussion: Airflow 3.0.1 with Docker and Self-Signed certificate

Is it possible to run the new version of Airflow 3.0.1 with a self-signed SSL certificate in Docker locally?

I updated docker compose for five lines below:
(https://airflow.apache.org/docs/apache-airflow/3.0.1/docker-compose.yaml)
(https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html#config-api-ssl-cert)

AIRFLOW__API__EXPOSE_CONFIG: "true"
AIRFLOW__API_AUTH__JWT_SECRET: "yadayadayada"
AIRFLOW__API__SSL_CERT: "/opt/airflow/config/cert2.pem"
AIRFLOW__API__SSL_KEY: "/opt/airflow/config/key2.pem"
AIRFLOW__CORE__EXECUTION_API_SERVER_URL: "https://airflow-apiserver:8080/execution/"

I updated the health check for API server:

airflow-apiserver:
    <<: *airflow-common
    command: api-server
    ports:
      - "8080:8080"
    healthcheck:
      test:
        [
          "CMD",
          "curl",
          "--fail",
          "--insecure",
          "https://localhost:8080/api/v2/version", ]

Results:
-Health check passes with curl parameter "--insecure" to accept self-signed certificate.
-Airflow web portal comes up fine running under HTTPS, will only run only HTTPS and no longer HTTP.

When I try to run a simple DAG though, worker calling API server does not like the self-signed certificate. Anyone know any workarounds I am missing?

airflow-worker-1         | 2025-05-17 13:12:44.962740 [error    ] Task execute_workload[73ed6338-5c59-450c-8e6a-284d52e0cf60] raised unexpected: ConnectError('[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate (_ssl.c:1010)') [celery.app.trace] 



GitHub link: https://github.com/apache/airflow/discussions/50726

----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org

Re: [D] Airflow 3.0.1 with Docker and Self-Signed certificate [airflow]

Posted by "potiuk (via GitHub)" <gi...@apache.org>.

GitHub user potiuk added a comment to the discussion: Airflow 3.0.1 with Docker and Self-Signed certificate

> I think this should really also have a config parameter to turn of certificate verification. I imagine it is going to be a common issue.

Can you please open an issue for that and include all the places where "standard" instalation produces SSL verification error and how you are creating and configuring your self-signed certificate? That would help in implementing such configuration parameter - I do agree it might be useful 

GitHub link: https://github.com/apache/airflow/discussions/50726#discussioncomment-13804976

----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org

Re: [D] Airflow 3.0.1 with Docker and Self-Signed certificate [airflow]

Posted by "danieldean (via GitHub)" <gi...@apache.org>.

GitHub user danieldean added a comment to the discussion: Airflow 3.0.1 with Docker and Self-Signed certificate

Hi

I have tried to generate a certificate with localhost and airflow-apiserver as alternative subject names then add it to the container(s) but had no success with it.

Sharing your steps would be helpful please?

I think this should really also have a config parameter to turn of certificate verification. I imagine it is going to be a common issue.

Thanks

Daniel

GitHub link: https://github.com/apache/airflow/discussions/50726#discussioncomment-13804860

----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org

Re: [D] Airflow 3.0.1 with Docker and Self-Signed certificate [airflow]

Posted by "danieldean (via GitHub)" <gi...@apache.org>.

GitHub user danieldean added a comment to the discussion: Airflow 3.0.1 with Docker and Self-Signed certificate

Python HTTPX (which is used here rather than requests) only uses the environment variables when specifically enabled:

https://www.python-httpx.org/advanced/ssl/

Looking at the code there is no point where this is enabled so I am unsure why this would work.

I have submitted a fix due out in the next release either way which makes it work.

GitHub link: https://github.com/apache/airflow/discussions/50726#discussioncomment-14023001

----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org

Re: [D] Airflow 3.0.1 with Docker and Self-Signed certificate [airflow]

Posted by "mimilojevic (via GitHub)" <gi...@apache.org>.

GitHub user mimilojevic added a comment to the discussion: Airflow 3.0.1 with Docker and Self-Signed certificate

Hi,

I have a setup with custom CA. Exporting env variable SSL_CERT_FILE=/path/to/custom-ca.crt on a worker instance solved the issues with untrusted certificates.

Airflow v3.0.2

Best,
Milos

GitHub link: https://github.com/apache/airflow/discussions/50726#discussioncomment-14020610

----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org

Re: [D] Airflow 3.0.1 with Docker and Self-Signed certificate [airflow]

Posted by "ptoshniasu (via GitHub)" <gi...@apache.org>.

GitHub user ptoshniasu added a comment to the discussion: Airflow 3.0.1 with Docker and Self-Signed certificate

we are facing similar issue while using self signed certificate airflow executor pod is not able to talk to airflow webserver, can you please share your command to generate the certificate? 

also, we tried turning of verify_ssl = false, but it didn't worked for us too.


GitHub link: https://github.com/apache/airflow/discussions/50726#discussioncomment-13716216

----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org

Re: [D] Airflow 3.0.1 with Docker and Self-Signed certificate [airflow]

Posted by "glick1 (via GitHub)" <gi...@apache.org>.

GitHub user glick1 edited a discussion: Airflow 3.0.1 with Docker and Self-Signed certificate

Is it possible to run the new version of Airflow 3.0.1 with a self-signed SSL certificate in Docker locally?

I updated docker compose for five lines below:
(https://airflow.apache.org/docs/apache-airflow/3.0.1/docker-compose.yaml)
(https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html#config-api-ssl-cert)

AIRFLOW__API__EXPOSE_CONFIG: "true"
AIRFLOW__API_AUTH__JWT_SECRET: "yadayadayada"
AIRFLOW__API__SSL_CERT: "/opt/airflow/config/cert.pem"
AIRFLOW__API__SSL_KEY: "/opt/airflow/config/key.pem"
AIRFLOW__CORE__EXECUTION_API_SERVER_URL: "https://airflow-apiserver:8080/execution/"

I updated the health check for API server:

airflow-apiserver:
    <<: *airflow-common
    command: api-server
    ports:
      - "8080:8080"
    healthcheck:
      test:
        [
          "CMD",
          "curl",
          "--fail",
          "--insecure",
          "https://localhost:8080/api/v2/version", ]

Results:
-Health check passes with curl parameter "--insecure" to accept self-signed certificate.
-Airflow web portal comes up fine running under HTTPS, will only run only HTTPS and no longer HTTP.

When I try to run a simple DAG though, worker calling API server does not like the self-signed certificate. Anyone know any workarounds I am missing?

airflow-worker-1         | 2025-05-17 13:12:44.962740 [error    ] Task execute_workload[73ed6338-5c59-450c-8e6a-284d52e0cf60] raised unexpected: ConnectError('[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate (_ssl.c:1010)') [celery.app.trace] 



GitHub link: https://github.com/apache/airflow/discussions/50726

----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org

Re: [D] Airflow 3.0.1 with Docker and Self-Signed certificate [airflow]

Posted by "glick1 (via GitHub)" <gi...@apache.org>.

GitHub user glick1 edited a comment on the discussion: Airflow 3.0.1 with Docker and Self-Signed certificate

Solution for testing only with a self-signed certificate in v3.01. In a Dockerfile for build, add self-signed certificate to Linux. Self-signed certificate must have "localhost" and "airflow-apiserver" included in openssl configuration to support web portal of api server and worker calls to api server.

Dockerfile:

FROM apache/airflow:3.0.1
USER root
RUN apt-get update \
  && apt-get install -y --no-install-recommends vim ca-certificates openjdk-17-jre-headless \
  && apt-get autoremove -yqq --purge \
  && apt-get clean \
  && rm -rf /var/lib/apt/lists/*
COPY cert2.pem /usr/local/share/ca-certificates/rootCA.crt
RUN update-ca-certificates
RUN cat /usr/local/share/ca-certificates/rootCA.crt >> 'python -m certifi'
USER airflow
ENV JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64
COPY requirements.txt .
RUN pip install -r requirements.txt --constraint "https://raw.githubusercontent.com/apache/airflow/constraints-3.0.1/constraints-3.12.txt"


GitHub link: https://github.com/apache/airflow/discussions/50726#discussioncomment-13183779

----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org