yanshil commented on issue #52327: URL: https://github.com/apache/airflow/issues/52327#issuecomment-3018824185
## Solution If you are deploying Airflow 3 as I do, DO NOT use the `config.api_auth.jwt_secret`, use `jwtSecret`! ## Detail After looking into the Helm Chart implementation of jwtSecret, I finally realised why I got a 403 Error. It is caused by the mismatch of server jwt secret and worker's jwt secret. By using helm chart installation for the central server, jwt secret will only be grabbed from `jwtSecret`, both ENV and `config.api_auth.jwt_secret` woult NOT be used.   Even though the helm chart deployment has some instructions for JWT Secreate Key: `Secret key used to encode and decode JWTs to authenticate to public and private APIs (can only be set during install, not upgrade).` , but the following two is actually not clear enough 1. Correctly set jwt_secret correctly in helm chart values.yaml 2. edge deployment will use the jwt secret (fixed by #51905 , but the documentation might still not clear enough) --- ## Suggesstion on charts and docs 1. chart\values.yaml, add omments to indicate that jwtSecret can ONLY be explicitly set via this setting 2. add a hint about jwtSecret key (might be something similar to Fernet Key one (could be in helm chart deploy notes/edge deployment docs) ``` You can get JWT Secret Key value by running the following: echo JWT Secret Key: $(kubectl get secret --namespace {namespace} airflow-jwt-secret -o jsonpath="{.data.fernet-key}" | base64 --decode) ``` 3. FAQ section for specific error code * In the very fist time, I got 405 without setting `api_enabled` and `api_url` in SERVER side. The error hint is `method not allowed`. (Well, this is my bad. I actually don't want to copy the whold airflow.cfg from server to worker even though `Airflow configuration settings should be homogeneous across the cluster and on the edge site`, so I was testing to get a minimum setting setup) * And then I got this 403 because jwt_secret mismatched. The error hint is `Forbidden`. I realised it sometimes also means credential not fits, which guide me to check the jwt secret settings. Ahh but I would wish to see something like `Failed on matching Jwt secret (3.0+)/internal_api_secret_key(3.0-), please check the configuration.` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
