You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "AVMusorin (via GitHub)" <gi...@apache.org> on 2023/04/17 23:13:30 UTC
[GitHub] [airflow] AVMusorin opened a new pull request, #30691: Added separate permission to trigger DAG
AVMusorin opened a new pull request, #30691:
URL: https://github.com/apache/airflow/pull/30691
<!--
Thank you for contributing! Please make sure that your code changes
are covered with tests. And in case of new features or big changes
remember to adjust the documentation.
Feel free to ping committers for the review!
In case of an existing issue, reference it using one of the following:
closes: #ISSUE
related: #ISSUE
How to write a good git commit message:
http://chris.beams.io/posts/git-commit/
-->
To divide editing DAG and triggering it. Ability to grant permission per a dag can make RBAC more flexible. But it's also possible to set up `can trigger on Dags`.
Also, there is a [discussion](https://github.com/apache/airflow/discussions/30121) with related topic .
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] AVMusorin commented on a diff in pull request #30691: Added separate permission to trigger DAG
Posted by "AVMusorin (via GitHub)" <gi...@apache.org>.
AVMusorin commented on code in PR #30691:
URL: https://github.com/apache/airflow/pull/30691#discussion_r1187689314
##########
airflow/migrations/versions/0125_2_6_0_added_separate_permissions_to_trigger_.py:
##########
@@ -0,0 +1,96 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""added separate permissions to trigger dag
+
+Revision ID: bc91cfaccdba
+Revises: 98ae134e6fff
+Create Date: 2023-04-25 14:38:14.382850
+
+"""
+from __future__ import annotations
+
+from airflow.security import permissions
+from airflow.www.app import cached_app
+
+# revision identifiers, used by Alembic.
+revision = "bc91cfaccdba"
+down_revision = "98ae134e6fff"
+branch_labels = None
+depends_on = None
+airflow_version = "2.6.0"
Review Comment:
Fixed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] AVMusorin commented on pull request #30691: Added separate permission to trigger DAG
Posted by "AVMusorin (via GitHub)" <gi...@apache.org>.
AVMusorin commented on PR #30691:
URL: https://github.com/apache/airflow/pull/30691#issuecomment-1531185627
Could anybody please take a look at these changes?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] AVMusorin commented on pull request #30691: Added separate permission to trigger DAG
Posted by "AVMusorin (via GitHub)" <gi...@apache.org>.
AVMusorin commented on PR #30691:
URL: https://github.com/apache/airflow/pull/30691#issuecomment-1523502838
@potiuk take a look, please on this PR.
As we have very similar changes with https://github.com/apache/airflow/pull/30581, I think both of PR's could be added as they have different permissions and together can make permission system better. I can wait for that changes are merged and rebase on them to resolve conflicts if needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] uranusjr commented on a diff in pull request #30691: Added separate permission to trigger DAG
Posted by "uranusjr (via GitHub)" <gi...@apache.org>.
uranusjr commented on code in PR #30691:
URL: https://github.com/apache/airflow/pull/30691#discussion_r1178017491
##########
docs/apache-airflow/img/airflow_erd.svg:
##########
Review Comment:
The new image is not rendering!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] boring-cyborg[bot] commented on pull request #30691: Added separate permission to trigger DAG
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #30691:
URL: https://github.com/apache/airflow/pull/30691#issuecomment-1512220085
Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contribution Guide (https://github.com/apache/airflow/blob/main/CONTRIBUTING.rst)
Here are some useful points:
- Pay attention to the quality of your code (ruff, mypy and type annotations). Our [pre-commits]( https://github.com/apache/airflow/blob/main/STATIC_CODE_CHECKS.rst#prerequisites-for-pre-commit-hooks) will help you with that.
- In case of a new feature add useful documentation (in docstrings or in `docs/` directory). Adding a new operator? Check this short [guide](https://github.com/apache/airflow/blob/main/docs/apache-airflow/howto/custom-operator.rst) Consider adding an example DAG that shows how users should use it.
- Consider using [Breeze environment](https://github.com/apache/airflow/blob/main/BREEZE.rst) for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
- Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
- Please follow [ASF Code of Conduct](https://www.apache.org/foundation/policies/conduct) for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
- Be sure to read the [Airflow Coding style]( https://github.com/apache/airflow/blob/main/CONTRIBUTING.rst#coding-style-and-best-practices).
Apache Airflow is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: dev@airflow.apache.org
Slack: https://s.apache.org/airflow-slack
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] AVMusorin commented on a diff in pull request #30691: Added separate permission to trigger DAG
Posted by "AVMusorin (via GitHub)" <gi...@apache.org>.
AVMusorin commented on code in PR #30691:
URL: https://github.com/apache/airflow/pull/30691#discussion_r1178157816
##########
docs/apache-airflow/img/airflow_erd.svg:
##########
Review Comment:
fixed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] eladkal commented on a diff in pull request #30691: Added separate permission to trigger DAG
Posted by "eladkal (via GitHub)" <gi...@apache.org>.
eladkal commented on code in PR #30691:
URL: https://github.com/apache/airflow/pull/30691#discussion_r1186645883
##########
airflow/migrations/versions/0125_2_6_0_added_separate_permissions_to_trigger_.py:
##########
@@ -0,0 +1,96 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""added separate permissions to trigger dag
+
+Revision ID: bc91cfaccdba
+Revises: 98ae134e6fff
+Create Date: 2023-04-25 14:38:14.382850
+
+"""
+from __future__ import annotations
+
+from airflow.security import permissions
+from airflow.www.app import cached_app
+
+# revision identifiers, used by Alembic.
+revision = "bc91cfaccdba"
+down_revision = "98ae134e6fff"
+branch_labels = None
+depends_on = None
+airflow_version = "2.6.0"
Review Comment:
2.6.0 is already released so this migration needs to be updated
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on pull request #30691: Added separate permission to trigger DAG
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #30691:
URL: https://github.com/apache/airflow/pull/30691#issuecomment-1518723030
Note - this is the case when users created their own roles - not relying on built-in USER/ADMIN roles, and assigned them permissions manually - whch is perfectly possible and expected and our user do that).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on pull request #30691: Added separate permission to trigger DAG
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #30691:
URL: https://github.com/apache/airflow/pull/30691#issuecomment-1518725532
Also, there is a very similar PR here : https://github.com/apache/airflow/pull/30581 - and I had the same doubts, so much that I thought that it's the same issue we are talking about .
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on pull request #30691: Added separate permission to trigger DAG
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #30691:
URL: https://github.com/apache/airflow/pull/30691#issuecomment-1546738632
conflicts to solve I am afraid.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] github-actions[bot] closed pull request #30691: Added separate permission to trigger DAG
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed pull request #30691: Added separate permission to trigger DAG
URL: https://github.com/apache/airflow/pull/30691
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] AVMusorin commented on pull request #30691: Added separate permission to trigger DAG
Posted by "AVMusorin (via GitHub)" <gi...@apache.org>.
AVMusorin commented on PR #30691:
URL: https://github.com/apache/airflow/pull/30691#issuecomment-1514387108
> I think we need a db migration to populate trigger permissions from edit permissions to roles/users? Otherwise this would cause things to break when an existing Airflow installation is upgraded.
AFAIU we don't need to create migration for roles because of they are syncing at start (managed by [AIRFLOW__WEBSERVER__UPDATE_FAB_PERMS](https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html#update-fab-perms))
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] uranusjr commented on pull request #30691: Added separate permission to trigger DAG
Posted by "uranusjr (via GitHub)" <gi...@apache.org>.
uranusjr commented on PR #30691:
URL: https://github.com/apache/airflow/pull/30691#issuecomment-1512275389
I think we need a db migration to populate trigger permissions from edit permissions to roles/users? Otherwise this would cause things to break when an existing Airflow installation is upgraded.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on pull request #30691: Added separate permission to trigger DAG
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #30691:
URL: https://github.com/apache/airflow/pull/30691#issuecomment-1518722736
> AFAIU we don't need to create migration for roles because of they are syncing at start (managed by [AIRFLOW__WEBSERVER__UPDATE_FAB_PERMS](https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html#update-fab-perms))
Does it include new roles that people create and assign them EDIT_DAG permissions ?
Are you sure of that ? (I am not - but checking if you checked this migration scenario). It's a heavily breaking change if it does not work. And I would be surprised if it did to be honest. How would the underlying know that we should replace EDIT_DAG with EDIT_DAG/TRIGGER_DAG combo ? Those seem to be two unrelated permissions now?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] AVMusorin commented on pull request #30691: Added separate permission to trigger DAG
Posted by "AVMusorin (via GitHub)" <gi...@apache.org>.
AVMusorin commented on PR #30691:
URL: https://github.com/apache/airflow/pull/30691#issuecomment-1521647906
> Also, there is a very similar PR here : #30581 - and I had the same doubts, so much that I thought that it's the same issue we are talking about .
Yes, you are right. I'll create migration.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] github-actions[bot] commented on pull request #30691: Added separate permission to trigger DAG
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #30691:
URL: https://github.com/apache/airflow/pull/30691#issuecomment-1613942068
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed in 5 days if no further activity occurs. Thank you for your contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org