You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by GitBox <gi...@apache.org> on 2020/07/21 12:03:25 UTC
[GitHub] [airflow] pat-s opened a new issue #9912: Permission denied when enabling SSL from `airflow/bin/cli.py`
pat-s opened a new issue #9912:
URL: https://github.com/apache/airflow/issues/9912
**Apache Airflow version**: 1.10.11
**Environment**:
- **Cloud provider or hardware configuration**: Exoscale
- **OS** (e.g. from /etc/os-release): bionic
- **Kernel** (e.g. `uname -a`): 4.15.0-112-generic
- **Install tools**: Ansible
- **Others**: python 3.7
**What happened**:
Getting a permission error when trying to enable SSL.
```
Start airflow webserver...
Jul 21 11:51:13 airflow airflow-webserver[21377]: [2020-07-21 11:51:13,731] {__init__.py:50} INFO - Using executor SequentialExecutor
Jul 21 11:51:13 airflow airflow-webserver[21377]: [2020-07-21 11:51:13,732] {dagbag.py:396} INFO - Filling up the DagBag from /var/lib/airflow/airflow/dags
Jul 21 11:51:13 airflow airflow-webserver[21377]: * Serving Flask app "airflow.www.app" (lazy loading)
Jul 21 11:51:13 airflow airflow-webserver[21377]: * Environment: production
Jul 21 11:51:13 airflow airflow-webserver[21377]: WARNING: This is a development server. Do not use it in a production deployment.
Jul 21 11:51:13 airflow airflow-webserver[21377]: Use a production WSGI server instead.
Jul 21 11:51:13 airflow airflow-webserver[21377]: * Debug mode: on
Jul 21 11:51:13 airflow airflow-webserver[21377]: Traceback (most recent call last):
Jul 21 11:51:13 airflow airflow-webserver[21377]: File "/var/lib/airflow/venv/bin/airflow", line 37, in <module>
Jul 21 11:51:13 airflow airflow-webserver[21377]: args.func(args)
Jul 21 11:51:13 airflow airflow-webserver[21377]: File "/var/lib/airflow/venv/lib/python3.7/site-packages/airflow/utils/cli.py", line 76, in wrapper
Jul 21 11:51:13 airflow airflow-webserver[21377]: return f(*args, **kwargs)
Jul 21 11:51:13 airflow airflow-webserver[21377]: File "/var/lib/airflow/venv/lib/python3.7/site-packages/airflow/bin/cli.py", line 1073, in webserver
Jul 21 11:51:13 airflow airflow-webserver[21377]: ssl_context=(ssl_cert, ssl_key) if ssl_cert and ssl_key else None)
Jul 21 11:51:13 airflow airflow-webserver[21377]: File "/var/lib/airflow/venv/lib/python3.7/site-packages/flask/app.py", line 990, in run
Jul 21 11:51:13 airflow airflow-webserver[21377]: run_simple(host, port, self, **options)
Jul 21 11:51:13 airflow airflow-webserver[21377]: File "/var/lib/airflow/venv/lib/python3.7/site-packages/werkzeug/serving.py", line 990, in run_simple
Jul 21 11:51:13 airflow airflow-webserver[21377]: s.bind(server_address)
Jul 21 11:51:13 airflow airflow-webserver[21377]: PermissionError: [Errno 13] Permission denied
Jul 21 11:51:14 airflow airflow-webserver[21377]: ...fail!
```
<!-- (please include exact error messages if you can) -->
**What you expected to happen**:
Normal startup.
**What do you think went wrong?**
I don't know.
SSL seems to be correctly configured in `airflow.cfg`:
```
[webserver]
web_server_port = 443
web_server_ssl_key = /etc/letsencrypt/live/<domain>/privkey.pem
web_server_ssl_cert = /etc/letsencrypt/live/<domain>/fullchain.pem
base_url = https://<domain>:443
```
Without SSL configuration, everything works on localhost:8080.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] mik-laj commented on issue #9912: Permission denied when enabling SSL from `airflow/bin/cli.py`
Posted by GitBox <gi...@apache.org>.
mik-laj commented on issue #9912:
URL: https://github.com/apache/airflow/issues/9912#issuecomment-661824191
I recommend configuring SSL on the proxy server e.g. Traefik, Nginx. It is not safe to have an SSL certificate, because Airflow executes the user code and this code can steal the certificates.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] pat-s closed issue #9912: Permission denied when enabling SSL from `airflow/bin/cli.py`
Posted by GitBox <gi...@apache.org>.
pat-s closed issue #9912:
URL: https://github.com/apache/airflow/issues/9912
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] boring-cyborg[bot] commented on issue #9912: Permission denied when enabling SSL from `airflow/bin/cli.py`
Posted by GitBox <gi...@apache.org>.
boring-cyborg[bot] commented on issue #9912:
URL: https://github.com/apache/airflow/issues/9912#issuecomment-661814287
Thanks for opening your first issue here! Be sure to follow the issue template!
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] pat-s commented on issue #9912: Permission denied when enabling SSL from `airflow/bin/cli.py`
Posted by GitBox <gi...@apache.org>.
pat-s commented on issue #9912:
URL: https://github.com/apache/airflow/issues/9912#issuecomment-662090509
Ah yeah, that makes sense. Mapped it to 443 to have direct SSL access via the domain.
I should better make use of nginx probably.
After mapping it to one > 1024, I am getting some different errors. So I'll guess your hint applies here 👍 Closing here.
Thanks, learned something new today.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] mik-laj commented on issue #9912: Permission denied when enabling SSL from `airflow/bin/cli.py`
Posted by GitBox <gi...@apache.org>.
mik-laj commented on issue #9912:
URL: https://github.com/apache/airflow/issues/9912#issuecomment-662074139
I suspect that you are trying to run Airflow on a low port(<1024) and that requires high privileges on Linux.
https://www.w3.org/Daemon/User/Installation/PrivilegedPorts.html
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] pat-s commented on issue #9912: Permission denied when enabling SSL from `airflow/bin/cli.py`
Posted by GitBox <gi...@apache.org>.
pat-s commented on issue #9912:
URL: https://github.com/apache/airflow/issues/9912#issuecomment-662071761
Thanks. I'll take a look if I can set up nginx quickly.
Do you know if this could be a possible solution to the issue I faced above?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org