This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 0211b908ba6 Make kinit renewable lifetime configurable for Heimdal
Kerberos support (#67804)
0211b908ba6 is described below
commit 0211b908ba6ea3e2c6a3d8a774390d8423ad6e5b
Author: Kenan Adel <[email protected]>
AuthorDate: Fri Jul 3 23:58:54 2026 +0300
Make kinit renewable lifetime configurable for Heimdal Kerberos support
(#67804)
* feat: make kinit renewable lifetime configurable
* feat: add include_renewal_lifetime configuration for kerberos
* test: add unit tests for include_renewal_lifetime
* docs: quote Heimdal with backticks to fix spellcheck error
* Change version_added for kinit renewable lifetime option
Updated version_added for renewable lifetime option in kinit command from
3.0.0 to 3.3.0.
* Refactor cmdv.extend to use multiline syntax
* Change version_added from 3.3.0 to 3.4.0
Updated version_added for renewable lifetime option in kinit command.
---
.../src/airflow/config_templates/config.yml | 9 +++++++
airflow-core/src/airflow/security/kerberos.py | 24 +++++++++++------
airflow-core/tests/unit/security/test_kerberos.py | 30 ++++++++++++++++++++++
3 files changed, 55 insertions(+), 8 deletions(-)
diff --git a/airflow-core/src/airflow/config_templates/config.yml
b/airflow-core/src/airflow/config_templates/config.yml
index 975e6ba1121..545cded21d7 100644
--- a/airflow-core/src/airflow/config_templates/config.yml
+++ b/airflow-core/src/airflow/config_templates/config.yml
@@ -3050,6 +3050,15 @@ kerberos:
type: boolean
example: ~
default: "True"
+ include_renewal_lifetime:
+ description: |
+ Whether to include the renewable lifetime option (`-r`) in the `kinit`
command.
+ This is enabled by default for MIT Kerberos, but can be disabled (set
to False)
+ if using a Kerberos implementation that doesn't support this flag,
such as `Heimdal`.
+ version_added: 3.4.0
+ type: boolean
+ example: ~
+ default: "True"
sensors:
description: ~
options:
diff --git a/airflow-core/src/airflow/security/kerberos.py
b/airflow-core/src/airflow/security/kerberos.py
index fa0cdc84491..924057c2bcd 100644
--- a/airflow-core/src/airflow/security/kerberos.py
+++ b/airflow-core/src/airflow/security/kerberos.py
@@ -87,19 +87,27 @@ def renew_from_kt(principal: str | None, keytab: str,
exit_on_fail: bool = True)
else:
include_ip = "-A"
+ include_renewal_lifetime = conf.getboolean("kerberos",
"include_renewal_lifetime", fallback=True)
+
cmdv: list[str] = [
conf.get_mandatory_value("kerberos", "kinit_path"),
forwardable,
include_ip,
- "-r",
- renewal_lifetime,
- "-k", # host ticket
- "-t",
- keytab, # specify keytab
- "-c",
- conf.get_mandatory_value("kerberos", "ccache"), # specify credentials
cache
- cmd_principal,
]
+
+ if include_renewal_lifetime:
+ cmdv.extend(["-r", renewal_lifetime])
+
+ cmdv.extend(
+ [
+ "-k", # host ticket
+ "-t",
+ keytab, # specify keytab
+ "-c",
+ conf.get_mandatory_value("kerberos", "ccache"), # specify
credentials cache
+ cmd_principal,
+ ]
+ )
log.info("Re-initialising kerberos from keytab: %s", "
".join(shlex.quote(f) for f in cmdv))
with subprocess.Popen(
diff --git a/airflow-core/tests/unit/security/test_kerberos.py
b/airflow-core/tests/unit/security/test_kerberos.py
index f591768b528..88257af6cfc 100644
--- a/airflow-core/tests/unit/security/test_kerberos.py
+++ b/airflow-core/tests/unit/security/test_kerberos.py
@@ -88,6 +88,36 @@ class TestKerberos:
"test-principal",
],
),
+ (
+ {("kerberos", "include_renewal_lifetime"): "False"},
+ [
+ "kinit",
+ "-f",
+ "-a",
+ "-k",
+ "-t",
+ "keytab",
+ "-c",
+ "/tmp/airflow_krb5_ccache",
+ "test-principal",
+ ],
+ ),
+ (
+ {("kerberos", "include_renewal_lifetime"): "True"},
+ [
+ "kinit",
+ "-f",
+ "-a",
+ "-r",
+ "3600m",
+ "-k",
+ "-t",
+ "keytab",
+ "-c",
+ "/tmp/airflow_krb5_ccache",
+ "test-principal",
+ ],
+ ),
],
)
@mock.patch("time.sleep", return_value=None)
