[GitHub] [airflow] feng-tao edited a comment on issue #8609: DAG's parameter access_control is not refreshing in the UI

[GitBox <gi...@apache.org>]

feng-tao edited a comment on issue #8609:
URL: https://github.com/apache/airflow/issues/8609#issuecomment-669640525


   @jdavidheiser haven't got pinged in Airflow for a while :) If I recall(~ 2 years ago), we first need this commit (https://github.com/apache/airflow/pull/4642/files) to be use access_control in the Airflow version.
   
   I have thought about that at that time to allow calling `sync_perm_for_dag` to work around this issue (Pinterest did this way). But the issue here is that RBAC lives in webserver/ flask-app builder while scheduler does the DAG parsing. Calling a webserver function within scheduler kinda violate the contract which ideally it should calls a DB function instead of a webserver internal call(scheduler shouldn't be aware of webserver internal and shouldn't instantiate a webserver obj). But the challenge is that all the RBAC db models live in RBAC instead of Airflow if I recall.
   
   I think the ultimate solution is to have an API gateway(if we don't have that, webserver API is fine) which allows scheduler to calls that to update permission. What we did currently to workaround is to use cli to periodic update that part (cc @astahlman ). I haven't looked at the latest Airflow code for a while, will defer to @ashb or other to comment if there are other alternative approaches. 


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org