This is an automated email from the ASF dual-hosted git repository.
o-nikolas pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new c52946c9c9c Clarify Dag bundle permission upgrade notes (#76499)
c52946c9c9c is described below
commit c52946c9c9c2968a60cc49175b48e0d9028204b5
Author: Jed Cunningham <[email protected]>
AuthorDate: Wed Nov 4 17:43:16 2026 -0700
Clarify Dag bundle permission upgrade notes (#76499)
Refer to the Dag bundle APIs generically in the newsfragment, and tell
multi-team Keycloak deployments upgrading from Airflow 3.4.0 to re-run
create-team for each team so team roles drop the Dag bundles menu entry.
---
airflow-core/newsfragments/76474.significant.rst | 8 +++++---
providers/keycloak/docs/changelog.rst | 3 +++
2 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/airflow-core/newsfragments/76474.significant.rst
b/airflow-core/newsfragments/76474.significant.rst
index 566410cc92f..7a4dcc1f949 100644
--- a/airflow-core/newsfragments/76474.significant.rst
+++ b/airflow-core/newsfragments/76474.significant.rst
@@ -1,7 +1,7 @@
Dag bundles have their own read permission
-The Dag Bundles page and ``GET /api/v2/dagBundles`` used to show a bundle to
anyone who could read a
-Dag in it. They now need the new Dag bundles permission, because they show
every file and count in
+The Dag Bundles page and the Dag bundle APIs used to show a bundle to anyone
who could read a Dag in
+it. They now need the new Dag bundles permission, because they show every file
and count in
a bundle. Users who can read Dags but lack it get a 403. By default it is held
by:
* Simple auth manager: ``op`` and ``admin``.
@@ -10,4 +10,6 @@ a bundle. Users who can read Dags but lack it get a 403. By
default it is held b
``menu access`` on ``Dag Bundles``.
* Keycloak auth manager: every role. In multi-team mode, ``SuperAdmin`` only.
Multi-team
deployments must upgrade ``apache-airflow-providers-keycloak`` together with
Airflow, since older
- releases let every team role read it.
+ releases let every team role read it. When upgrading from Airflow 3.4.0,
also re-run
+ ``airflow keycloak-auth-manager create-team`` for each team, which removes
the Dag bundles menu
+ entry that team roles can no longer open.
diff --git a/providers/keycloak/docs/changelog.rst
b/providers/keycloak/docs/changelog.rst
index 36ec9b7ff3a..199f089884c 100644
--- a/providers/keycloak/docs/changelog.rst
+++ b/providers/keycloak/docs/changelog.rst
@@ -30,6 +30,9 @@ Changelog
``AdminView`` resource, so only ``SuperAdmin`` holds it. Multi-team
deployments must upgrade this
provider together with Airflow 3.4.1: older releases check the view
against ``View``, which every
team role can read.
+ Multi-team deployments upgrading from Airflow 3.4.0 must also re-run
+ ``airflow keycloak-auth-manager create-team`` for each team, which removes
the Dag bundles menu
+ entry that team roles can no longer open.
0.11.2
......
