You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by GitBox <gi...@apache.org> on 2020/11/23 15:19:05 UTC
[GitHub] [airflow] AXington opened a new issue #12563: KubernetesExecutor: Permission Error: User for security context changed, highlighting odd code choice to run at every pod start.
AXington opened a new issue #12563:
URL: https://github.com/apache/airflow/issues/12563
<!--
Welcome to Apache Airflow! For a smooth issue process, try to answer the following questions.
Don't worry if they're not all applicable; just try to include what you can :-)
If you need to include code snippets or logs, please put them in fenced code
blocks. If they're super-long, please use the details tag like
<details><summary>super-long log</summary> lots of stuff </details>
Please delete these comment blocks before submitting the issue.
-->
<!--
IMPORTANT!!!
PLEASE CHECK "SIMILAR TO X EXISTING ISSUES" OPTION IF VISIBLE
NEXT TO "SUBMIT NEW ISSUE" BUTTON!!!
PLEASE CHECK IF THIS ISSUE HAS BEEN REPORTED PREVIOUSLY USING SEARCH!!!
Please complete the next sections or the issue will be closed.
These questions are the first thing we need to know to understand the context.
-->
**Apache Airflow version**: 1.10.12
**Kubernetes version (if you are using kubernetes)** (use `kubectl version`): 1.17.XX (EKS)
**Environment**:
- **Cloud provider or hardware configuration**: AWS + EKS + Container
Other useful info:
Using Airflow with Kubernetes Executor as stated in title.
Have been using a custom container for quite a while and cannot switch to official container at the moment because of the work involved with doing so.
**What happened**:
After upgrading to 1.10.12 we get this error message when a task pod
```kubectl -n airflow logs -f hourlyjobv11keyerrortierstriggerdagandviewlogtoseefullstacktrace-a4883c55bd4247f38a895ee95200dda8
Traceback (most recent call last):
File "/usr/local/bin/airflow", line 25, in <module>
from airflow.configuration import conf
File "/usr/local/lib/python3.7/site-packages/airflow/__init__.py", line 31, in <module>
from airflow.utils.log.logging_mixin import LoggingMixin
File "/usr/local/lib/python3.7/site-packages/airflow/utils/__init__.py", line 24, in <module>
from .decorators import apply_defaults as _apply_defaults
File "/usr/local/lib/python3.7/site-packages/airflow/utils/decorators.py", line 36, in <module>
from airflow import settings
File "/usr/local/lib/python3.7/site-packages/airflow/settings.py", line 37, in <module>
from airflow.configuration import conf, AIRFLOW_HOME, WEBSERVER_CONFIG # NOQA F401
File "/usr/local/lib/python3.7/site-packages/airflow/configuration.py", line 712, in <module>
with open(TEST_CONFIG_FILE, 'w') as f:
PermissionError: [Errno 13] Permission denied: '/usr/local/airflow/unittests.cfg'```
This is because now Airflow is injecting code to run as user ID 50000 in the `securityContext` section of the pod yaml. Our airflow user is 1000. Same with fsGroup. This causes the above error, which also highlights that airflow creates a unittest.cfg every time it loads config, which really shouldn't be happening in production code.
**What you expected to happen**:
Not to have to force a user ID change and/or the above to happen at all, and/or it to run as always... and/or any important thing like airflow defaulting to use a new UID to be documented in breaking changes.
Not to have airflow writing to the FS of a container anyways so I can set the container FS to be RO as is considered best practice (both not writing to a container FS and setting the FS to be RO)
**How to reproduce it**:
Run an airflow container with either a read-only FS or where the airflow user isn't 50000
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] nixjdm commented on issue #12563: KubernetesExecutor: Permission Error: User for security context changed, highlighting odd code choice to run at every pod start.
Posted by GitBox <gi...@apache.org>.
nixjdm commented on issue #12563:
URL: https://github.com/apache/airflow/issues/12563#issuecomment-732236556
There's two noteworthy parts of this to me.
1. This user 50000 is coming from https://github.com/apache/airflow/blob/6416d898060706787861ff8ecbc4363152a35f45/tests/test_local_settings/test_local_settings.py#L76. Given that file path, I would not expect this code to run unless we're actually running a test. Or is `50000` set somewhere else that's relevant? Grepping, this seems like that's the only place relevant to users/groups. This seems fixed (or at least different) in master at least.
2. It seems that airflow ensures the creation of the test config file https://github.com/apache/airflow/blob/master/airflow/configuration.py#L776-L781 IMO, if it's possible to move this to code that is run only when running a test, then it should live there. If I never run a test, I wouldn't think I need a test config. This ticket seems like a side-effect of that choice. This bit is in master too.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] kaxil commented on issue #12563: KubernetesExecutor: Permission Error: User for security context changed, highlighting odd code choice to run at every pod start.
Posted by GitBox <gi...@apache.org>.
kaxil commented on issue #12563:
URL: https://github.com/apache/airflow/issues/12563#issuecomment-785366100
@AXington You can change it to 100 for alpine users -- this won't be needed after https://github.com/apache/airflow/pull/14420 is merged
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] nixjdm edited a comment on issue #12563: KubernetesExecutor: Permission Error: User for security context changed, highlighting odd code choice to run at every pod start.
Posted by GitBox <gi...@apache.org>.
nixjdm edited a comment on issue #12563:
URL: https://github.com/apache/airflow/issues/12563#issuecomment-732236556
There's two noteworthy parts of this to me.
1. This user 50000 is coming from https://github.com/apache/airflow/blob/6416d898060706787861ff8ecbc4363152a35f45/tests/test_local_settings/test_local_settings.py#L76. Given that file path, I would not expect this code to run unless we're actually running a test. Or is `50000` set somewhere else that's relevant? Grepping, this seems like that's the only place relevant to users/groups. This seems fixed (or at least different) in master at least.
2. It seems that airflow ensures the creation of the test config file https://github.com/apache/airflow/blob/master/airflow/configuration.py#L776-L781 IMO, if it's possible to move this to code that is run only when running a test, then it should live there. If I never run a test, I wouldn't think I need a test config. This ticket seems like a side-effect of that choice. This bit is in master, too.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] boring-cyborg[bot] commented on issue #12563: KubernetesExecutor: Permission Error: User for security context changed, highlighting odd code choice to run at every pod start.
Posted by GitBox <gi...@apache.org>.
boring-cyborg[bot] commented on issue #12563:
URL: https://github.com/apache/airflow/issues/12563#issuecomment-732227199
Thanks for opening your first issue here! Be sure to follow the issue template!
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] AXington commented on issue #12563: KubernetesExecutor: Permission Error: User for security context changed, highlighting odd code choice to run at every pod start.
Posted by GitBox <gi...@apache.org>.
AXington commented on issue #12563:
URL: https://github.com/apache/airflow/issues/12563#issuecomment-783562424
@Amirilw I honestly don't remember what workaround we did to get past this other than changing the airflow user to 50000. The issue with a read only file system is not resolved. This is a significant security and compliance issue that we have been waiting on being fixed for quite a while.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] Amirilw commented on issue #12563: KubernetesExecutor: Permission Error: User for security context changed, highlighting odd code choice to run at every pod start.
Posted by GitBox <gi...@apache.org>.
Amirilw commented on issue #12563:
URL: https://github.com/apache/airflow/issues/12563#issuecomment-783489324
we have the same issue, we running with 10.14.
setting the AIRFLOW__KUBERNETES__RUN_AS_USER to run with a different user will not overwrite that value.
Any temp fix of using a different user ID ?
Thanks,
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org