You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "vincbeck (via GitHub)" <gi...@apache.org> on 2026/05/14 15:32:05 UTC
[PR] Replace `allow_producer_teams` with `access_control` on Asset [airflow]
vincbeck opened a new pull request, #66954:
URL: https://github.com/apache/airflow/pull/66954
Replace the flat `allow_producer_teams: list[str]` attribute on the Asset class with `access_control: AssetAccessControl`, which bundles producer team restrictions and a global-producer toggle into a single object.
The reason why I think it is better that way is, I also want to add an option `allow_consumer_teams` for producer tasks to limit which teams can consume their events. Because I do not want to pollute the `Asset` constructor, I think it is better to collapse everything under one attribute `access_control`.
Documentation PR: #66949
<!-- SPDX-License-Identifier: Apache-2.0
https://www.apache.org/licenses/LICENSE-2.0 -->
<!--
Thank you for contributing!
Please provide above a brief description of the changes made in this pull request.
Write a good git commit message following this guide: http://chris.beams.io/posts/git-commit/
Please make sure that your code changes are covered with tests.
And in case of new features or big changes remember to adjust the documentation.
Feel free to ping (in general) for the review if you do not see reaction for a few days
(72 Hours is the minimum reaction time you can expect from volunteers) - we sometimes miss notifications.
In case of an existing issue, reference it using one of the following:
* closes: #ISSUE
* related: #ISSUE
-->
---
##### Was generative AI tooling used to co-author this PR?
<!--
If generative AI tooling has been used in the process of authoring this PR, please
change below checkbox to `[X]` followed by the name of the tool, uncomment the "Generated-by".
-->
- [x] Yes (please specify the tool below)
Claude
<!--
Generated-by: [Tool Name] following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
-->
---
* Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
* For fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
* When adding dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
* For significant user-facing changes create newsfragment: `{pr_number}.significant.rst`, in [airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments). You can add this file in a follow-up commit after the PR is created so you know the PR number.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Replace `allow_producer_teams` with `access_control` on Asset [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on code in PR #66954:
URL: https://github.com/apache/airflow/pull/66954#discussion_r3249441681
##########
airflow-core/src/airflow/dag_processing/collection.py:
##########
@@ -891,7 +891,9 @@ def add_dag_asset_references(
if not references:
dags[dag_id].schedule_asset_references = []
continue
- referenced_assets = {assets[r.name, r.uri]: r.allow_producer_teams for r in references}
+ referenced_assets = {
+ assets[r.name, r.uri]: r.access_control.get("producer_teams", []) for r in references
Review Comment:
Yep `r.access_control` is a dict here so I cannot assume default value
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Replace `allow_producer_teams` with `access_control` on Asset [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck merged PR #66954:
URL: https://github.com/apache/airflow/pull/66954
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Replace `allow_producer_teams` with `access_control` on Asset [airflow]
Posted by "o-nikolas (via GitHub)" <gi...@apache.org>.
o-nikolas commented on code in PR #66954:
URL: https://github.com/apache/airflow/pull/66954#discussion_r3244316741
##########
airflow-core/src/airflow/dag_processing/collection.py:
##########
@@ -891,7 +891,9 @@ def add_dag_asset_references(
if not references:
dags[dag_id].schedule_asset_references = []
continue
- referenced_assets = {assets[r.name, r.uri]: r.allow_producer_teams for r in references}
+ referenced_assets = {
+ assets[r.name, r.uri]: r.access_control.get("producer_teams", []) for r in references
Review Comment:
You could make `producer_teams` a property that returns [] if there isn't any configured so that you don't have to do these guarded gets. But I also see in one of the tests that it already defaults to []? Or is this because it's a deser to a dict at this point?
##########
airflow-core/src/airflow/example_dags/example_asset_allow_teams.py:
##########
@@ -15,32 +15,34 @@
# specific language governing permissions and limitations
# under the License.
"""
-Example DAG demonstrating cross-team asset triggering with ``allow_producer_teams``.
+Example DAG demonstrating cross-team asset triggering with ``AssetAccessControl``.
When Multi-Team mode is enabled (``[core] multi_team = True``), asset events are filtered by team
membership. By default, a consuming DAG only receives events from DAGs within the same team.
Usage:
- ``team_analytics_producer`` (belonging to ``team_analytics``) produces events on ``shared_data``.
- ``team_ml_consumer`` (belonging to ``team_ml``) consumes ``shared_data``.
- - Because ``shared_data`` has ``allow_producer_teams=["team_analytics"]``, events from ``team_analytics``
- are accepted by ``team_ml_consumer``.
- - Without ``allow_producer_teams``, the cross-team event would be blocked.
+ - Because ``shared_data`` has ``access_control=AssetAccessControl(producer_teams=["team_analytics"])``,
+ events from ``team_analytics`` are accepted by ``team_ml_consumer``.
+ - Without ``access_control``, the cross-team event would be blocked.
"""
from __future__ import annotations
import pendulum
from airflow.providers.standard.operators.bash import BashOperator
-from airflow.sdk import DAG, Asset
+from airflow.sdk import DAG, Asset, AssetAccessControl
-# [START asset_allow_producer_teams]
-# Define an asset that accepts events from team_analytics in addition to the consumer's own team.
+# [START asset_access_control]
Review Comment:
Where is this referenced? I expected to see some docs pull this as an example.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Replace `allow_producer_teams` with `access_control` on Asset [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on code in PR #66954:
URL: https://github.com/apache/airflow/pull/66954#discussion_r3249410915
##########
airflow-core/src/airflow/example_dags/example_asset_allow_teams.py:
##########
@@ -15,32 +15,34 @@
# specific language governing permissions and limitations
# under the License.
"""
-Example DAG demonstrating cross-team asset triggering with ``allow_producer_teams``.
+Example DAG demonstrating cross-team asset triggering with ``AssetAccessControl``.
When Multi-Team mode is enabled (``[core] multi_team = True``), asset events are filtered by team
membership. By default, a consuming DAG only receives events from DAGs within the same team.
Usage:
- ``team_analytics_producer`` (belonging to ``team_analytics``) produces events on ``shared_data``.
- ``team_ml_consumer`` (belonging to ``team_ml``) consumes ``shared_data``.
- - Because ``shared_data`` has ``allow_producer_teams=["team_analytics"]``, events from ``team_analytics``
- are accepted by ``team_ml_consumer``.
- - Without ``allow_producer_teams``, the cross-team event would be blocked.
+ - Because ``shared_data`` has ``access_control=AssetAccessControl(producer_teams=["team_analytics"])``,
+ events from ``team_analytics`` are accepted by ``team_ml_consumer``.
+ - Without ``access_control``, the cross-team event would be blocked.
"""
from __future__ import annotations
import pendulum
from airflow.providers.standard.operators.bash import BashOperator
-from airflow.sdk import DAG, Asset
+from airflow.sdk import DAG, Asset, AssetAccessControl
-# [START asset_allow_producer_teams]
-# Define an asset that accepts events from team_analytics in addition to the consumer's own team.
+# [START asset_access_control]
Review Comment:
Yeah I split the documentation and implementation in 2 different PRs, hence the ambiguity. I did that to avoid having massive PRs. I'll rebase and update the doc in https://github.com/apache/airflow/pull/66949 once this one merged. Unless you want me to consolidate everything in one PR?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org