You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "Subham-KRLX (via GitHub)" <gi...@apache.org> on 2025/07/20 17:03:26 UTC
[PR] Make Execution API SSL verification configurable for self-signed certificates (#53493) [airflow]
Subham-KRLX opened a new pull request, #53572:
URL: https://github.com/apache/airflow/pull/53572
Make Execution API SSL Verification Configurable for Self-Signed Certificates
This PR addresses an issue where, when using a self-signed certificate on the API server, Airflow workers could not connect due to strict SSL verification ([SSL: CERTIFICATE_VERIFY_FAILED]). This created obstacles for users running Airflow in Docker Compose, local development setups, or private deployments with self-signed or internal CA certificates.
What's changed:
Adds support for the AIRFLOW_EXECUTION_API_SSL_VERIFY environment variable in the Task SDK execution API client:
Set to false, 0, or no to disable SSL verification (recommended only for development/testing; not for production).
Set to an absolute file path (e.g., /etc/ssl/certs/org-root-ca.pem) to trust a custom certificate authority.
Leave unset or set to true/yes for secure, standard verification using built-in system CAs (default).
Usage Examples:
text
# Disable verification (for development or test environments only!)
export AIRFLOW_EXECUTION_API_SSL_VERIFY=false
# Use a custom CA bundle (recommended for private or organization CAs)
export AIRFLOW_EXECUTION_API_SSL_VERIFY=/etc/ssl/certs/my-ca-bundle.crt
# Secure, default behavior (system CA validation; do not set or set to true/yes)
# export AIRFLOW_EXECUTION_API_SSL_VERIFY=true
Testing:
Validated that DAG runs succeed when the environment variable is set appropriately for self-signed or internal CA certificates.
Confirmed that default behavior remains secure: users who do not set this variable continue to use strict certificate verification in all environments.
Security Note:
Disabling SSL verification (false) should only be used for development or local troubleshooting. For any production or sensitive workloads, always use a valid CA bundle or retain the secure default.
closes: #53493
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Make Execution API SSL verification configurable for self-signed certificates (#53493) [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk closed pull request #53572: Make Execution API SSL verification configurable for self-signed certificates (#53493)
URL: https://github.com/apache/airflow/pull/53572
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Make Execution API SSL verification configurable for self-signed certificates (#53493) [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #53572:
URL: https://github.com/apache/airflow/pull/53572#issuecomment-3094651721
Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide (https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
Here are some useful points:
- Pay attention to the quality of your code (ruff, mypy and type annotations). Our [pre-commits]( https://github.com/apache/airflow/blob/main/contributing-docs/08_static_code_checks.rst#prerequisites-for-pre-commit-hooks) will help you with that.
- In case of a new feature add useful documentation (in docstrings or in `docs/` directory). Adding a new operator? Check this short [guide](https://github.com/apache/airflow/blob/main/airflow-core/docs/howto/custom-operator.rst) Consider adding an example DAG that shows how users should use it.
- Consider using [Breeze environment](https://github.com/apache/airflow/blob/main/dev/breeze/doc/README.rst) for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
- Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
- Please follow [ASF Code of Conduct](https://www.apache.org/foundation/policies/conduct) for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
- Be sure to read the [Airflow Coding style]( https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#coding-style-and-best-practices).
- Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
Apache Airflow is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: dev@airflow.apache.org
Slack: https://s.apache.org/airflow-slack
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Make Execution API SSL verification configurable for self-signed certificates (#53493) [airflow]
Posted by "Subham-KRLX (via GitHub)" <gi...@apache.org>.
Subham-KRLX commented on PR #53572:
URL: https://github.com/apache/airflow/pull/53572#issuecomment-3096617134
This PR was opened from the wrong branch and does not contain the intended changes for the feature/fix. Please ignore/close this PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Make Execution API SSL verification configurable for self-signed certificates (#53493) [airflow]
Posted by "Subham-KRLX (via GitHub)" <gi...@apache.org>.
Subham-KRLX commented on PR #53572:
URL: https://github.com/apache/airflow/pull/53572#issuecomment-3095023813
There are too many conflicts on this PR. I will open a new clean one based on the latest main.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Make Execution API SSL verification configurable for self-signed certificates (#53493) [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #53572:
URL: https://github.com/apache/airflow/pull/53572#issuecomment-3094668010
There is some terrible conflict ;)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org