nathaliaceballoshurtado opened a new issue, #56343:
URL: https://github.com/apache/airflow/issues/56343
### Official Helm Chart version
1.18.0 (latest released)
### Apache Airflow version
3.1.0
### Kubernetes Version
1.33
### Helm Chart configuration
apiServerConfig:
apiServerConfig: |
from airflow.www.fab_security.manager import AUTH_OAUTH
from airflow import configuration as conf
SQLALCHEMY_DATABASE_URI = conf.get('core', 'SQL_ALCHEMY_CONN')
basedir = os.path.abspath(os.path.dirname(__file__))
# Flask-WTF flag for CSRF
WTF_CSRF_ENABLED = True
OIDC_SCOPES = ['openid', 'email', 'profile', 'groups']
AUTH_TYPE = AUTH_OAUTH
AUTH_USER_REGISTRATION = True
AUTH_ROLE_ADMIN = "Admin"
PERMANENT_SESSION_LIFETIME = 43200 # in seconds(12 hours)
# use your Airflow’s Host URI
OVERWRITE_REDIRECT_URI =
"https://dash-airflow.cashmind.mx/oidc_callback";
# Here, set your Okta creds -
# the names of the credentials are self-explanatory. Also, we took
advantage of
# Airflow’s 'secret' section in the helm chart to retrieve those
secrets from K8s-secrets.
# You will probably need your IT Team to get those first and then
store them as K8s secrets.
OAUTH_PROVIDERS = [
{
"name": "okta",
"icon": "fa-circle-o",
"token_key": "access_token",
"remote_app": {
"client_id": "0oavzi34qoreu2hsm697",
"client_secret":
"PjcVV73N-yfznLT2LfOIpV3INUnplO-t0_k-w-6dA5y01o29Pr3n9fak1PBzDx-x",
"api_base_url": os.getenv("kamet.okta.com/oauth2/v1/"),
"client_kwargs": {
"scope": "openid profile email groups"
},
"access_token_url": "https://kamet.okta.com/oauth2/v1/token";,
"authorize_url": "https://kamet.okta.com/oauth2/v1/authorize";,
"jwks_uri": "https://kamet.okta.com/oauth2/v1/keys";
}
}]
FAB_ADMIN_ROLE = "Admin"
FAB_VIEWER_ROLE = "Viewer"
# your custom roles mapping, in the format - {Okta-Group:
[Airflow-Role1,...]}
# here is our map of Okta Group(team) to its Airflow Role which will
be used and explained later on
AUTH_ROLES_MAPPING = {
"aws#cashmind-prod#platform-team-role#939276888979":["Admin"],
"aws#cashmind-staging#stream-aligned-team-role#269031123106":["stream-aligned-team-role"],
}
from airflow.www.security import AirflowSecurityManager
import logging
from typing import Dict, Any, List, Union
import os
log = logging.getLogger(__name__)
# AirflowSecurityManager Class Implementation - our custom Okta
Authorizer Manager class
# which allows us to relate a new user into his Airflow role and save
it to Airflow’s DB
class OktaTeamAuthorizer(AirflowSecurityManager):
def get_airflow_role(self, user_groups: List[str]) -> str:
for okta_group, airflow_role in AUTH_ROLES_MAPPING.items():
if okta_group in user_groups:
return okta_group
return 'Viewer'
def get_oauth_user_info(
self, provider: str, resp: Any
) -> Dict[str, Union[str, List[str]]]:
remote_app = self.appbuilder.sm.oauth_remotes[provider]
me = remote_app.get("userinfo")
user_data = me.json()
user_groups = user_data.get("groups")
role = self.get_airflow_role(user_groups)
# How a new user record will be saved in the DB
return {
"username": "okta_" + user_data.get("preferred_username",
""),
"first_name": user_data.get("given_name", ""),
"last_name": user_data.get("family_name", ""),
"email": user_data.get("email", ""),
"role_keys": [role]
}
# set your custom class as the security_manager_class of airflow
SECURITY_MANAGER_CLASS = OktaTeamAuthorizer
### Docker Image customizations
```FROM apache/airflow:3.1.0
RUN pip install --no-cache-dir \
flask-oidc2==1.5.0 \
fab-oidc2==0.0.3
```
### What happened
configmap is not being mounted in the pod despited of being specificate in
the values, the configmap is never create also
### What you think should happen instead
configmap should be created
configmap should be mounted in api server
### How to reproduce
creating a deployment with the values and the configmap template
### Anything else
_No response_
### Are you willing to submit PR?
- [x] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of
Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
