You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by GitBox <gi...@apache.org> on 2022/09/16 15:11:17 UTC
[GitHub] [airflow] Jeoffreybauvin opened a new issue, #26438: Kerberos : swtich MIT to Heimdal
Jeoffreybauvin opened a new issue, #26438:
URL: https://github.com/apache/airflow/issues/26438
### Apache Airflow version
2.3.4
### What happened
Hi,
In my infrastructure, we are using Kerberos Heimdal for our keytabs. I can see that airflow seems to be using MIT...
I managed to switch to Heimdal by customizing the image : replacing krb5 packages with heimdal-clients.
```
ADDITIONAL_RUNTIME_APT_DEPS=""
RUNTIME_APT_DEPS="apt-transport-https apt-utils ca-certificates curl dumb-init freetds-bin gosu heimdal-clients ldap-utils libffi7 libldap-2.4-2 libsasl2-2 libsasl2-modules libssl1.1 locales lsb-release netcat openssh-client python3-selinux rsync sasl2-bin sqlite3 sudo unixodbc"
```
But the kinit command used by Airflow seems to be specific with MIT :
```
airflow@7e253512ada7:/opt/airflow$ kinit -f -a -r 5m -k -t /opt/airflow/security/airflow.service.keytab -c /tmp/airflow_krb5_ccache airflow/dtl-airflowdocker01-d01.dc05@DC05
5m@DC05's Password:
kinit: krb5_get_init_creds: Client (5m@DC05) unknown
```
the "-r 5m" seems to be the problem. Adding --renewable or deleting -r 5m seems to fix this issue. But how to "fix" this properly ?
Regards,
### What you think should happen instead
Either :
- find a way to switch to Heimdal properly
- maybe an option to customize args to kinit
- ...
### How to reproduce
Use kerberos with Heimdal.
### Operating System
Debian (Docker)
### Versions of Apache Airflow Providers
```
airflow-exporter==1.5.3
apache-airflow==2.3.4
apache-airflow-providers-amazon==5.0.0
apache-airflow-providers-apache-cassandra==3.0.0
apache-airflow-providers-apache-hdfs==3.1.0
apache-airflow-providers-celery==3.0.0
apache-airflow-providers-cncf-kubernetes==4.3.0
apache-airflow-providers-common-sql==1.1.0
apache-airflow-providers-docker==3.1.0
apache-airflow-providers-elasticsearch==4.2.0
apache-airflow-providers-ftp==3.1.0
apache-airflow-providers-google==8.3.0
apache-airflow-providers-grpc==3.0.0
apache-airflow-providers-hashicorp==3.1.0
apache-airflow-providers-http==4.0.0
apache-airflow-providers-imap==3.0.0
apache-airflow-providers-microsoft-azure==4.2.0
apache-airflow-providers-mysql==3.2.0
apache-airflow-providers-odbc==3.1.1
apache-airflow-providers-postgres==5.2.0
apache-airflow-providers-redis==3.0.0
apache-airflow-providers-sendgrid==3.0.0
apache-airflow-providers-sftp==4.0.0
apache-airflow-providers-slack==5.1.0
apache-airflow-providers-sqlite==3.2.0
apache-airflow-providers-ssh==3.1.0
google-cloud-orchestration-airflow==1.4.1
```
### Deployment
Other Docker-based deployment
### Deployment details
_No response_
### Anything else
_No response_
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on issue #26438: Kerberos : switch MIT to Heimdal
Posted by GitBox <gi...@apache.org>.
potiuk commented on issue #26438:
URL: https://github.com/apache/airflow/issues/26438#issuecomment-1249560213
I changed the issue type from bug to "feature" - because that is what it is.
Why don't you implement this kind of switch @Jeoffreybauvin ? It does not seem to be a difficult one to implement, requires little Python knowledge and you could test it with your Heimdal Kerberos, so you seem to be a very good candidate to implement, test and contribiute - you could join the > 2100 contributors to Airflow - mostly users like you who had some problem and solved it by contributing.
I also marked it as "good-first-issue", so maybe someone will pick it but, the "surest" way to get it in is if you implement it (just wanted you to know so that you know that such features only get implemented if someone gets interested in implementing it, and you seem to be rather interested in implementing it).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on issue #26438: Kerberos : switch MIT to Heimdal
Posted by GitBox <gi...@apache.org>.
potiuk commented on issue #26438:
URL: https://github.com/apache/airflow/issues/26438#issuecomment-1249613483
Add options only. Removing support for MIT kerberos would make a breaking change (and there are probably plenty of users using MIT one, so that wouldn't be empathetic towards them.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] Jeoffreybauvin commented on issue #26438: Kerberos : switch MIT to Heimdal
Posted by GitBox <gi...@apache.org>.
Jeoffreybauvin commented on issue #26438:
URL: https://github.com/apache/airflow/issues/26438#issuecomment-1249572053
I can try, but I'm not sure what I need to do. Change the possible options for kinit ? Or switch to heimdal ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] maheshsv commented on issue #26438: Kerberos : switch MIT to Heimdal
Posted by GitBox <gi...@apache.org>.
maheshsv commented on issue #26438:
URL: https://github.com/apache/airflow/issues/26438#issuecomment-1249619284
can you please assign it to me ,
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on issue #26438: Kerberos : switch MIT to Heimdal
Posted by GitBox <gi...@apache.org>.
potiuk commented on issue #26438:
URL: https://github.com/apache/airflow/issues/26438#issuecomment-1249632606
Assigned @maheshsv !
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org