Subham-KRLX opened a new pull request, #53572: URL: https://github.com/apache/airflow/pull/53572
Make Execution API SSL Verification Configurable for Self-Signed Certificates This PR addresses an issue where, when using a self-signed certificate on the API server, Airflow workers could not connect due to strict SSL verification ([SSL: CERTIFICATE_VERIFY_FAILED]). This created obstacles for users running Airflow in Docker Compose, local development setups, or private deployments with self-signed or internal CA certificates. What's changed: Adds support for the AIRFLOW_EXECUTION_API_SSL_VERIFY environment variable in the Task SDK execution API client: Set to false, 0, or no to disable SSL verification (recommended only for development/testing; not for production). Set to an absolute file path (e.g., /etc/ssl/certs/org-root-ca.pem) to trust a custom certificate authority. Leave unset or set to true/yes for secure, standard verification using built-in system CAs (default). Usage Examples: text # Disable verification (for development or test environments only!) export AIRFLOW_EXECUTION_API_SSL_VERIFY=false # Use a custom CA bundle (recommended for private or organization CAs) export AIRFLOW_EXECUTION_API_SSL_VERIFY=/etc/ssl/certs/my-ca-bundle.crt # Secure, default behavior (system CA validation; do not set or set to true/yes) # export AIRFLOW_EXECUTION_API_SSL_VERIFY=true Testing: Validated that DAG runs succeed when the environment variable is set appropriately for self-signed or internal CA certificates. Confirmed that default behavior remains secure: users who do not set this variable continue to use strict certificate verification in all environments. Security Note: Disabling SSL verification (false) should only be used for development or local troubleshooting. For any production or sensitive workloads, always use a valid CA bundle or retain the secure default. closes: #53493 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
