You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@airflow.apache.org by Deng Xiaodong <xd...@gmail.com> on 2019/06/26 09:27:40 UTC
Field "owner" in DAG Model
Hi folks,
In DAG Model, we have "owner" field. In earlier Flask-Admin based UI (which
is already removed in master branch), it was used by "filter_by_user"
config item in [webserver] section to help control access. But now seems
it's not used anywhere already (correct me if I'm wrong).
I would like to understand from the community: shall we remove this field?
Or there can be other usage on this field?
One use case I have in mind is to use "owner" to enhance DAG-level access
control. Currently the DAG-level access control is implemented by creating
a new permission for each DAG, which may be "tedious" to manage if there
are many DAGs. We may use "owner" to group DAGs, so we can create new
permission for each "owner" rather than creating new permission for each
single DAG.
Please share your thoughts. Thanks.
Best regards,
XD
Re: Field "owner" in DAG Model
Posted by Deng Xiaodong <xd...@gmail.com>.
Sure thing :) Please refer to
https://airflow.readthedocs.io/en/1.10.3post1/security.html?highlight=filter_by_owner#multi-tenancy
I didn’t use this feature myself though.
XD
On Wed, Jun 26, 2019 at 18:00 airflowuser
<ai...@protonmail.com.invalid> wrote:
> If I may ask...
> in the Old UI how do you filter DAGs by owner?
> I'm running 1.10.3 and in the Search bar it searches only DAG it doesn't
> search by owner.
>
>
> Sent with ProtonMail Secure Email.
>
> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> On Wednesday, June 26, 2019 12:27 PM, Deng Xiaodong <xd...@gmail.com>
> wrote:
>
> > Hi folks,
> >
> > In DAG Model, we have "owner" field. In earlier Flask-Admin based UI
> (which
> > is already removed in master branch), it was used by "filter_by_user"
> > config item in [webserver] section to help control access. But now seems
> > it's not used anywhere already (correct me if I'm wrong).
> >
> > I would like to understand from the community: shall we remove this
> field?
> > Or there can be other usage on this field?
> >
> > One use case I have in mind is to use "owner" to enhance DAG-level access
> > control. Currently the DAG-level access control is implemented by
> creating
> > a new permission for each DAG, which may be "tedious" to manage if there
> > are many DAGs. We may use "owner" to group DAGs, so we can create new
> > permission for each "owner" rather than creating new permission for each
> > single DAG.
> >
> > Please share your thoughts. Thanks.
> >
> > Best regards,
> >
> > XD
>
>
>
Re: Field "owner" in DAG Model
Posted by Ash Berlin-Taylor <as...@apache.org>.
That was broken in 1.10.3 - should be fixed in .4
> On 26 Jun 2019, at 11:00, airflowuser <ai...@protonmail.com.INVALID> wrote:
>
> If I may ask...
> in the Old UI how do you filter DAGs by owner?
> I'm running 1.10.3 and in the Search bar it searches only DAG it doesn't search by owner.
>
>
> Sent with ProtonMail Secure Email.
>
> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> On Wednesday, June 26, 2019 12:27 PM, Deng Xiaodong <xd...@gmail.com> wrote:
>
>> Hi folks,
>>
>> In DAG Model, we have "owner" field. In earlier Flask-Admin based UI (which
>> is already removed in master branch), it was used by "filter_by_user"
>> config item in [webserver] section to help control access. But now seems
>> it's not used anywhere already (correct me if I'm wrong).
>>
>> I would like to understand from the community: shall we remove this field?
>> Or there can be other usage on this field?
>>
>> One use case I have in mind is to use "owner" to enhance DAG-level access
>> control. Currently the DAG-level access control is implemented by creating
>> a new permission for each DAG, which may be "tedious" to manage if there
>> are many DAGs. We may use "owner" to group DAGs, so we can create new
>> permission for each "owner" rather than creating new permission for each
>> single DAG.
>>
>> Please share your thoughts. Thanks.
>>
>> Best regards,
>>
>> XD
>
>
Re: Field "owner" in DAG Model
Posted by airflowuser <ai...@protonmail.com.INVALID>.
If I may ask...
in the Old UI how do you filter DAGs by owner?
I'm running 1.10.3 and in the Search bar it searches only DAG it doesn't search by owner.
Sent with ProtonMail Secure Email.
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Wednesday, June 26, 2019 12:27 PM, Deng Xiaodong <xd...@gmail.com> wrote:
> Hi folks,
>
> In DAG Model, we have "owner" field. In earlier Flask-Admin based UI (which
> is already removed in master branch), it was used by "filter_by_user"
> config item in [webserver] section to help control access. But now seems
> it's not used anywhere already (correct me if I'm wrong).
>
> I would like to understand from the community: shall we remove this field?
> Or there can be other usage on this field?
>
> One use case I have in mind is to use "owner" to enhance DAG-level access
> control. Currently the DAG-level access control is implemented by creating
> a new permission for each DAG, which may be "tedious" to manage if there
> are many DAGs. We may use "owner" to group DAGs, so we can create new
> permission for each "owner" rather than creating new permission for each
> single DAG.
>
> Please share your thoughts. Thanks.
>
> Best regards,
>
> XD
Re: Field "owner" in DAG Model
Posted by James Coder <jc...@gmail.com>.
I would be in favor of keeping it and implementing the groups permissions. As we expand our use of airflow it would be very helpful to have this as an option.
James Coder
> On Jun 26, 2019, at 5:27 AM, Deng Xiaodong <xd...@gmail.com> wrote:
>
> Hi folks,
>
> In DAG Model, we have "owner" field. In earlier Flask-Admin based UI (which
> is already removed in master branch), it was used by "filter_by_user"
> config item in [webserver] section to help control access. But now seems
> it's not used anywhere already (correct me if I'm wrong).
>
> I would like to understand from the community: shall we remove this field?
> Or there can be other usage on this field?
>
> One use case I have in mind is to use "owner" to enhance DAG-level access
> control. Currently the DAG-level access control is implemented by creating
> a new permission for each DAG, which may be "tedious" to manage if there
> are many DAGs. We may use "owner" to group DAGs, so we can create new
> permission for each "owner" rather than creating new permission for each
> single DAG.
>
> Please share your thoughts. Thanks.
>
>
> Best regards,
>
> XD