You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by GitBox <gi...@apache.org> on 2021/12/08 02:12:10 UTC
[GitHub] [airflow] mandicLuka opened a new issue #19226: DAG permission setting per owner and/or per tag
mandicLuka opened a new issue #19226:
URL: https://github.com/apache/airflow/issues/19226
### Description
Access Control feature where one can limit a DAG permissions (read, write, etc.) for a group of DAGs, namely, the ones where owner is set or the tag is set to the desired value.
### Use case/motivation
Restrict access for user to DAG read/write for all new DAGs created by the another user
### Related issues
_No response_
### Are you willing to submit a PR?
- [X] Yes I am willing to submit a PR!
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] easontm commented on issue #19226: DAG permission setting per owner and/or per tag
Posted by GitBox <gi...@apache.org>.
easontm commented on issue #19226:
URL: https://github.com/apache/airflow/issues/19226#issuecomment-961725715
See also #9342
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk closed issue #19226: DAG permission setting per owner and/or per tag
Posted by GitBox <gi...@apache.org>.
potiuk closed issue #19226:
URL: https://github.com/apache/airflow/issues/19226
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] easontm commented on issue #19226: DAG permission setting per owner and/or per tag
Posted by GitBox <gi...@apache.org>.
easontm commented on issue #19226:
URL: https://github.com/apache/airflow/issues/19226#issuecomment-961725715
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] MM-Lehmann commented on issue #19226: DAG permission setting per owner and/or per tag
Posted by GitBox <gi...@apache.org>.
MM-Lehmann commented on issue #19226:
URL: https://github.com/apache/airflow/issues/19226#issuecomment-952652826
I think this is what the `dag.access_control` attribute is meant to do.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] isaac-florence edited a comment on issue #19226: DAG permission setting per owner and/or per tag
Posted by GitBox <gi...@apache.org>.
isaac-florence edited a comment on issue #19226:
URL: https://github.com/apache/airflow/issues/19226#issuecomment-988324455
Agreeing with @potiuk's comment on #9342, airflow can't do multi-tenancy at the moment. However we have setup an instance which only uses the kubernetesPodOperator, and so can have multiple tenants coexisting where each tenant has their own k8s namespace/openshift project.
This model does require a central technician "approve" DAGs and merge requests to a dag repo to ensure that each tenant's dags only refer to their own namespace/project.
A further improvement of that model would be the implementation of this issue so that dags can be added to roles/groups based on their tag (or something else similar, like the owner), rather than the central technician adding dags to the tenant's role!
This does create literal security at the cost of staff time in reviewing dags/dag changes and time-to-deployment of new dags to be approved!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on issue #19226: DAG permission setting per owner and/or per tag
Posted by GitBox <gi...@apache.org>.
potiuk commented on issue #19226:
URL: https://github.com/apache/airflow/issues/19226#issuecomment-988432370
Or actually let me re-open it and add multi-tenancy label to group similar stuff together and refer to it when we will be implementing it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] boring-cyborg[bot] commented on issue #19226: DAG permission setting per owner and/or per tag
Posted by GitBox <gi...@apache.org>.
boring-cyborg[bot] commented on issue #19226:
URL: https://github.com/apache/airflow/issues/19226#issuecomment-951987190
Thanks for opening your first issue here! Be sure to follow the issue template!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on issue #19226: DAG permission setting per owner and/or per tag
Posted by GitBox <gi...@apache.org>.
potiuk commented on issue #19226:
URL: https://github.com/apache/airflow/issues/19226#issuecomment-988429690
Note that we have now Multi-tenancy effort in progress which I am leading. And while the first two AIPs that are very draft (but will soon be updated) do not address this final granularity yet, they pave the way for the third AIP that is going to address also this use case. Since this is in on the roadmap and planned and part of the bigger multi-tenancy effort, I am closing this one. @mandicLuka if you are interested in joining the effort, please join Airlfow Devlist and possibly #sig-multitenancy slack channel and take part in the discussions:
You can find last meeting mintues and even recording of the meeting where we discussed the plans for Multitenancy. https://cwiki.apache.org/confluence/display/AIRFLOW/AIP-1%3A+Improve+Airflow+Security
Note that this is for a long haul - full implementation of the multitenancy (and even discussion on the AIPs) will take quite some time (several months/half a year at the least as this is a really big set of features to make it possible).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] mandicLuka commented on issue #19226: DAG permission setting per owner and/or per tag
Posted by GitBox <gi...@apache.org>.
mandicLuka commented on issue #19226:
URL: https://github.com/apache/airflow/issues/19226#issuecomment-952688923
Based on the [documentation](https://airflow.apache.org/docs/apache-airflow/stable/_api/airflow/models/dag/index.html) `dag.access_control` lets you set the permissions only for roles, not for individual users or owners.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] isaac-florence commented on issue #19226: DAG permission setting per owner and/or per tag
Posted by GitBox <gi...@apache.org>.
isaac-florence commented on issue #19226:
URL: https://github.com/apache/airflow/issues/19226#issuecomment-988324455
Agreeing with @potiuk's comment on #9342, airflow can't do multi-tenancy at the moment. However we have setup an instance which only uses the kubernetesPodOperator, and so can have multiple tenants coexisting where each tenant has their own k8s namespace/openshift project.
This model does require a central technician "approve" DAGs and merge requests to a dag repo to ensure that each tenant's dags only refer to their own project.
A further improvement of that model would be the implementation of this issue so that dags can be added to roles/groups based on their tag (or something else similar, like the owner), rather than the central technician adding dags to the tenant's role!
This does create literal security at the cost of staff time in reviewing dags/dag changes and time-to-deployment of new dags to be approved!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk edited a comment on issue #19226: DAG permission setting per owner and/or per tag
Posted by GitBox <gi...@apache.org>.
potiuk edited a comment on issue #19226:
URL: https://github.com/apache/airflow/issues/19226#issuecomment-988429690
Note that we have now Multi-tenancy effort in progress which I am leading. And while the first two AIPs that are very draft (but will soon be updated) do not address this final granularity yet, they pave the way for the third AIP that is going to address also this use case. Since this is in on the roadmap and planned and part of the bigger multi-tenancy effort, I am closing this one. @mandicLuka @easontm @isaac-florence if you are interested in joining the effort, please join Airlfow Devlist and possibly #sig-multitenancy slack channel and take part in the discussions:
You can find last meeting mintues and even recording of the meeting where we discussed the plans for Multitenancy. https://cwiki.apache.org/confluence/display/AIRFLOW/AIP-1%3A+Improve+Airflow+Security
Note that this is for a long haul - full implementation of the multitenancy (and even discussion on the AIPs) will take quite some time (several months/half a year at the least as this is a really big set of features to make it possible).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org