Copilot commented on code in PR #69190: URL: https://github.com/apache/airflow/pull/69190#discussion_r3560839748
########## providers/amazon/docs/logging/s3-compatible-remote-logging.rst: ########## @@ -0,0 +1,210 @@ + .. Licensed to the Apache Software Foundation (ASF) under one + or more contributor license agreements. See the NOTICE file + distributed with this work for additional information + regarding copyright ownership. The ASF licenses this file + to you under the Apache License, Version 2.0 (the + "License"); you may not use this file except in compliance + with the License. You may obtain a copy of the License at + + .. http://www.apache.org/licenses/LICENSE-2.0 + + .. Unless required by applicable law or agreed to in writing, + software distributed under the License is distributed on an + "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + KIND, either express or implied. See the License for the + specific language governing permissions and limitations + under the License. + +.. _write-logs-s3-compatible: + +Use an S3-compatible object store for Airflow remote task logs +============================================================== + +The Amazon provider talks to any S3-compatible object store, not just Amazon S3. Because the +:ref:`S3 remote task handler <write-logs-amazon-s3>` issues standard S3 API calls, pointing the +``aws`` connection at a custom ``endpoint_url`` makes it write Airflow task logs to that +endpoint with no new provider and no core change. You use the ``s3://`` scheme in +``[logging]`` exactly as you would for Amazon S3, and the same connection also backs +``ObjectStoragePath("s3://...")`` for Dag data. + +Amazon S3 is the baseline. The same steps work against other services that expose an +S3-compatible API, for example Backblaze B2, Cloudflare R2, and MinIO. The only per-provider +differences are the endpoint URL, the region, and whether path-style addressing is required. + +This recipe targets Airflow 3.x with ``apache-airflow-providers-amazon``. + +Prerequisites +------------- + +- A bucket for logs (private). The examples use ``$S3_BUCKET_NAME``. +- An access key and secret scoped to that bucket. Prefer a bucket-scoped key over an + account-wide one. +- ``apache-airflow-providers-amazon`` installed. For ``ObjectStoragePath`` you also need the + ``s3fs`` extra: ``pip install 'apache-airflow-providers-amazon[s3fs]'``. + +Every S3-compatible service issues an access key id and a secret access key. Map them onto the +AWS connection fields as follows. + +============================ ================================= ============================================= +S3-compatible value Standardized env var AWS connection field +============================ ================================= ============================================= +Access key id ``S3_ACCESS_KEY_ID`` ``login`` (AWS access key id) +Secret access key ``S3_SECRET_ACCESS_KEY`` ``password`` (AWS secret access key) +Bucket name ``S3_BUCKET_NAME`` used in ``remote_base_log_folder`` +Region ``S3_REGION`` ``extra.region_name`` +S3 endpoint ``S3_ENDPOINT`` ``extra.endpoint_url`` +============================ ================================= ============================================= + +Find the endpoint and region for your bucket in your provider's console or CLI. For Amazon S3 +the endpoint is the default AWS endpoint and you can omit ``endpoint_url`` entirely; for other +S3-compatible services set ``endpoint_url`` to the provider's S3 endpoint, such as +``https://your-s3-endpoint.example.com``. The connection ``extra.endpoint_url`` must include a +scheme, for example ``https://`` or ``http://``. + +Step 1: Create the connection pointing at your endpoint +------------------------------------------------------- + +Create an ``aws`` connection whose ``endpoint_url`` extra is your S3 endpoint. The Amazon +provider sends every S3 call to that endpoint instead of the AWS default, which is what makes +the S3 handler talk to your store. For Amazon S3 you can leave ``endpoint_url`` unset and the +provider uses the default AWS endpoint. + +Using the Airflow CLI with an environment-variable connection (no secrets on the command +line): Review Comment: The text says “Using the Airflow CLI…”, but the snippet that follows only sets the `AIRFLOW_CONN_*` environment variable and does not use the CLI. This is a bit misleading; either drop the “CLI” wording or add an actual `airflow connections ...` example. ########## providers/amazon/docs/logging/s3-compatible-remote-logging.rst: ########## @@ -0,0 +1,210 @@ + .. Licensed to the Apache Software Foundation (ASF) under one + or more contributor license agreements. See the NOTICE file + distributed with this work for additional information + regarding copyright ownership. The ASF licenses this file + to you under the Apache License, Version 2.0 (the + "License"); you may not use this file except in compliance + with the License. You may obtain a copy of the License at + + .. http://www.apache.org/licenses/LICENSE-2.0 + + .. Unless required by applicable law or agreed to in writing, + software distributed under the License is distributed on an + "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + KIND, either express or implied. See the License for the + specific language governing permissions and limitations + under the License. + +.. _write-logs-s3-compatible: + +Use an S3-compatible object store for Airflow remote task logs +============================================================== + +The Amazon provider talks to any S3-compatible object store, not just Amazon S3. Because the +:ref:`S3 remote task handler <write-logs-amazon-s3>` issues standard S3 API calls, pointing the +``aws`` connection at a custom ``endpoint_url`` makes it write Airflow task logs to that +endpoint with no new provider and no core change. You use the ``s3://`` scheme in +``[logging]`` exactly as you would for Amazon S3, and the same connection also backs +``ObjectStoragePath("s3://...")`` for Dag data. + +Amazon S3 is the baseline. The same steps work against other services that expose an +S3-compatible API, for example Backblaze B2, Cloudflare R2, and MinIO. The only per-provider +differences are the endpoint URL, the region, and whether path-style addressing is required. + +This recipe targets Airflow 3.x with ``apache-airflow-providers-amazon``. + +Prerequisites +------------- + +- A bucket for logs (private). The examples use ``$S3_BUCKET_NAME``. +- An access key and secret scoped to that bucket. Prefer a bucket-scoped key over an + account-wide one. +- ``apache-airflow-providers-amazon`` installed. For ``ObjectStoragePath`` you also need the + ``s3fs`` extra: ``pip install 'apache-airflow-providers-amazon[s3fs]'``. + +Every S3-compatible service issues an access key id and a secret access key. Map them onto the +AWS connection fields as follows. + +============================ ================================= ============================================= +S3-compatible value Standardized env var AWS connection field +============================ ================================= ============================================= +Access key id ``S3_ACCESS_KEY_ID`` ``login`` (AWS access key id) +Secret access key ``S3_SECRET_ACCESS_KEY`` ``password`` (AWS secret access key) +Bucket name ``S3_BUCKET_NAME`` used in ``remote_base_log_folder`` +Region ``S3_REGION`` ``extra.region_name`` +S3 endpoint ``S3_ENDPOINT`` ``extra.endpoint_url`` +============================ ================================= ============================================= + +Find the endpoint and region for your bucket in your provider's console or CLI. For Amazon S3 +the endpoint is the default AWS endpoint and you can omit ``endpoint_url`` entirely; for other +S3-compatible services set ``endpoint_url`` to the provider's S3 endpoint, such as +``https://your-s3-endpoint.example.com``. The connection ``extra.endpoint_url`` must include a +scheme, for example ``https://`` or ``http://``. + +Step 1: Create the connection pointing at your endpoint +------------------------------------------------------- + +Create an ``aws`` connection whose ``endpoint_url`` extra is your S3 endpoint. The Amazon +provider sends every S3 call to that endpoint instead of the AWS default, which is what makes +the S3 handler talk to your store. For Amazon S3 you can leave ``endpoint_url`` unset and the +provider uses the default AWS endpoint. + +Using the Airflow CLI with an environment-variable connection (no secrets on the command +line): + +.. code-block:: bash + + export AIRFLOW_CONN_AWS_S3='{ + "conn_type": "aws", + "login": "'"$S3_ACCESS_KEY_ID"'", + "password": "'"$S3_SECRET_ACCESS_KEY"'", + "extra": { + "endpoint_url": "'"$S3_ENDPOINT"'", + "region_name": "'"$S3_REGION"'", + "config_kwargs": {"s3": {"addressing_style": "path"}} + } + }' + +The ``config_kwargs`` ``addressing_style: path`` selects path-style addressing +(``endpoint/bucket/key``). Amazon S3 accepts both styles; several S3-compatible services expect +path-style addressing, so set it when your provider requires it. + +The equivalent JSON when you create the connection in the UI (``Admin -> Connections``, +connection type ``Amazon Web Services``) or store it in a secrets backend: + +.. code-block:: json + + { + "conn_type": "aws", + "login": "<S3_ACCESS_KEY_ID>", + "password": "<S3_SECRET_ACCESS_KEY>", + "extra": { + "endpoint_url": "https://your-s3-endpoint.example.com";, + "region_name": "us-east-1", + "config_kwargs": {"s3": {"addressing_style": "path"}} + } + } + +Never hardcode the secret access key in a Dag, ``airflow.cfg``, or version control. Read it +from the environment or a secrets backend. + +Step 2: Enable remote logging to the bucket +------------------------------------------- + +Configure the ``[logging]`` section of ``airflow.cfg`` (or the equivalent +``AIRFLOW__LOGGING__*`` environment variables) so Airflow uploads task logs to the bucket +through the connection from Step 1: + +.. code-block:: ini + + [logging] + remote_logging = True + remote_base_log_folder = s3://<S3_BUCKET_NAME>/logs + remote_log_conn_id = aws_s3 + # Server-side encryption headers are an Amazon S3 feature; leave this off for stores that + # do not support them. Review Comment: `encrypt_s3_logs` is described elsewhere as “server-side encryption for logs stored in S3” and is not specific to Amazon S3. The current comment (“an Amazon S3 feature”) is likely inaccurate for many S3-compatible implementations (some do support the same header). Rephrase to indicate that not all S3-compatible stores support the encryption headers, rather than tying it to Amazon S3 specifically. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
