You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is called from within a DAG by using the connection that was defined earlier.
67
-
It is wrapped by the `KubernetesHook` that the Airflow Kubernetes provider makes available https://github.com/apache/airflow/blob/main/airflow/providers/cncf/kubernetes/operators/spark_kubernetes.py[here].
67
+
It is wrapped by the `KubernetesHook` that the Airflow Kubernetes provider makes available https://github.com/apache/airflow/blob/main/providers/cncf/kubernetes/src/airflow/providers/cncf/kubernetes/operators/spark_kubernetes.py[here{external-link-icon}^].
NOTE: If the `KubernetesExecutor` is employed the logs are only accessible via the SDP logging mechanism, described https://docs.stackable.tech/home/stable/concepts/logging[here].
107
107
108
-
TIP: A full example of the above is used as an integration test https://github.com/stackabletech/airflow-operator/tree/main/tests/templates/kuttl/mount-dags-gitsync[here].
108
+
TIP: A full example of the above is used as an integration test https://github.com/stackabletech/airflow-operator/tree/main/tests/templates/kuttl/mount-dags-gitsync[here{external-link-icon}^].
Secure Apache Airflow by configuring user authentication and authorization.
@@ -47,7 +47,7 @@ spec:
47
47
<1> The reference to an AuthenticationClass called `ldap`
48
48
<2> The default role that all users are assigned to
49
49
50
-
Users that log in with LDAP are assigned to a default {airflow-access-control-docs}[role] which is specified with the `userRegistrationRole` property.
50
+
Users that log in with LDAP are assigned to a default {airflow-access-control-docs}[role{external-link-icon}^] which is specified with the `userRegistrationRole` property.
51
51
52
52
You can follow the xref:tutorials:authentication_with_openldap.adoc[] tutorial to learn how to set up an AuthenticationClass for an LDAP server, as well as consulting the {crd-docs}/authentication.stackable.tech/authenticationclass/v1alpha1/[AuthenticationClass reference {external-link-icon}^].
53
53
@@ -61,7 +61,7 @@ An OpenID Connect provider can be used for authentication.
61
61
Unfortunately, there is no generic support for OpenID Connect built into Airflow.
62
62
This means that only specific OpenID Connect providers can be configured.
63
63
64
-
IMPORTANT: Airflow deployments on the Stackable Data Platform only support {keycloak}[Keycloak].
64
+
IMPORTANT: Airflow deployments on the Stackable Data Platform only support {keycloak}[Keycloak{external-link-icon}^].
65
65
66
66
[source,yaml]
67
67
----
@@ -84,7 +84,7 @@ spec:
84
84
<2> The reference to the Secret containing the Airflow client credentials
85
85
<3> The default role to which all users are assigned
86
86
87
-
Users that log in with OpenID Connect are assigned to a default {airflow-access-control-docs}[role] which is specified with the `userRegistrationRole` property.
87
+
Users that log in with OpenID Connect are assigned to a default {airflow-access-control-docs}[role{external-link-icon}^] which is specified with the `userRegistrationRole` property.
88
88
89
89
The Secret containing the Airflow client credentials:
90
90
@@ -130,7 +130,7 @@ Further information for specifying an AuthenticationClass for an OIDC provider c
130
130
131
131
== Authorization
132
132
133
-
The Airflow Webserver delegates the {airflow-access-control-docs}[handling of user access control] to the https://flask-appbuilder.readthedocs.io/en/latest/security.html[Flask AppBuilder].
133
+
The Airflow Webserver delegates the {airflow-access-control-docs}[handling of user access control{external-link-icon}^] to the https://flask-appbuilder.readthedocs.io/en/latest/security.html[Flask AppBuilder{external-link-icon}^].
134
134
The AuthManager in the Flask AppBuilder can be configured to fetch the user roles from the authentication backend, e.g. LDAP.
135
135
Instead of using the integrated authorization, the Stackable Data Platform also provides an AuthManager which delegates the authorization requests to an xref:opa:index.adoc[Open Policy Agent (OPA)].
136
136
@@ -142,7 +142,7 @@ You can view, add to, and assign the roles displayed in the Airflow Webserver UI
142
142
143
143
==== LDAP
144
144
145
-
Airflow supports assigning {airflow-access-control-docs}[Roles] to users based on their LDAP group membership, though this is not yet supported by the Stackable operator.
145
+
Airflow supports assigning {airflow-access-control-docs}[Roles{external-link-icon}^] to users based on their LDAP group membership, though this is not yet supported by the Stackable operator.
146
146
All the users logging in via LDAP get assigned to the same role which you can configure via the attribute `authenticationConfig.userRegistrationRole` on the AirflowCluster object:
147
147
148
148
[source,yaml]
@@ -164,7 +164,7 @@ spec:
164
164
==== OpenID Connect
165
165
166
166
The mechanism for assigning roles to users described in the LDAP section also applies to OpenID Connect.
167
-
Airflow supports assigning {airflow-access-control-docs}[Roles] to users based on their OpenID Connect scopes, though this is not yet supported by the Stackable operator.
167
+
Airflow supports assigning {airflow-access-control-docs}[Roles{external-link-icon}^] to users based on their OpenID Connect scopes, though this is not yet supported by the Stackable operator.
168
168
All the users logging in via OpenID Connect get assigned to the same role which you can configure via the attribute `authentication[*].userRegistrationRole` on the `AirflowCluster` object:
0 commit comments