Re: [PR] Add `allow_global` option to asset access control [airflow]
vincbeck merged PR #67251: URL: https://github.com/apache/airflow/pull/67251 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
Re: [PR] Add `allow_global` option to asset access control [airflow]
vincbeck commented on code in PR #67251: URL: https://github.com/apache/airflow/pull/67251#discussion_r3288348489 ## airflow-core/src/airflow/migrations/versions/0114_3_3_0_add_allow_producer_teams_to_dag_schedule_asset_reference.py: ## @@ -17,7 +17,7 @@ # under the License. """ -Add allow_producer_teams column to dag_schedule_asset_reference table. +Add access control columns to dag_schedule_asset_reference table. Review Comment: Good point -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
Re: [PR] Add `allow_global` option to asset access control [airflow]
vincbeck commented on PR #67251: URL: https://github.com/apache/airflow/pull/67251#issuecomment-4518664739 > May be it's worth mentioning or documenting that the default for allow_global=True and setting it to False would mean accepting the events from same team producers. Yep, will be done in https://github.com/apache/airflow/pull/66949 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
Re: [PR] Add `allow_global` option to asset access control [airflow]
Shrividya commented on code in PR #67251: URL: https://github.com/apache/airflow/pull/67251#discussion_r3285160352 ## airflow-core/src/airflow/migrations/versions/0114_3_3_0_add_allow_producer_teams_to_dag_schedule_asset_reference.py: ## @@ -17,7 +17,7 @@ # under the License. """ -Add allow_producer_teams column to dag_schedule_asset_reference table. +Add access control columns to dag_schedule_asset_reference table. Review Comment: nit: Since this migration now adds both the columns, should the file be renamed to `airflow-core/src/airflow/migrations/versions/0114_3_3_0_add_access_control_columns_to_dag_schedule_asset_reference.py` ? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
Re: [PR] Add `allow_global` option to asset access control [airflow]
Shrividya commented on code in PR #67251: URL: https://github.com/apache/airflow/pull/67251#discussion_r3285160352 ## airflow-core/src/airflow/migrations/versions/0114_3_3_0_add_allow_producer_teams_to_dag_schedule_asset_reference.py: ## @@ -17,7 +17,7 @@ # under the License. """ -Add allow_producer_teams column to dag_schedule_asset_reference table. +Add access control columns to dag_schedule_asset_reference table. Review Comment: nit: Since this migration now adds both the columns, should the file be renamed to `airflow-core/src/airflow/migrations/versions/0114_3_3_0_add_access_control_columns_to_dag_schedule_asset_reference.py` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
Re: [PR] Add `allow_global` option to asset access control [airflow]
vincbeck commented on code in PR #67251: URL: https://github.com/apache/airflow/pull/67251#discussion_r3281564594 ## airflow-core/src/airflow/models/asset.py: ## @@ -592,6 +592,9 @@ class DagScheduleAssetReference(Base): asset_id: Mapped[int] = mapped_column(Integer, primary_key=True, nullable=False) dag_id: Mapped[str] = mapped_column(StringID(), primary_key=True, nullable=False) allow_producer_teams: Mapped[list | None] = mapped_column(sa.JSON(), nullable=True) +allow_global_producers: Mapped[bool] = mapped_column( +sa.Boolean(), nullable=False, server_default=sa.true() Review Comment: It makes to me to enable it by default. Global Dags by nature are global so, to me, it makes sense everybody can consume/produce from/to it by default. WDYT? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
Re: [PR] Add `allow_global` option to asset access control [airflow]
vincbeck commented on code in PR #67251: URL: https://github.com/apache/airflow/pull/67251#discussion_r3281564594 ## airflow-core/src/airflow/models/asset.py: ## @@ -592,6 +592,9 @@ class DagScheduleAssetReference(Base): asset_id: Mapped[int] = mapped_column(Integer, primary_key=True, nullable=False) dag_id: Mapped[str] = mapped_column(StringID(), primary_key=True, nullable=False) allow_producer_teams: Mapped[list | None] = mapped_column(sa.JSON(), nullable=True) +allow_global_producers: Mapped[bool] = mapped_column( +sa.Boolean(), nullable=False, server_default=sa.true() Review Comment: It makes to me to enable it by default. Global Dags by nature are global so, to me, it makes sense everybody can consume/produce from/to it. WDYT? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
Re: [PR] Add `allow_global` option to asset access control [airflow]
o-nikolas commented on code in PR #67251: URL: https://github.com/apache/airflow/pull/67251#discussion_r3276931054 ## airflow-core/src/airflow/models/asset.py: ## @@ -592,6 +592,9 @@ class DagScheduleAssetReference(Base): asset_id: Mapped[int] = mapped_column(Integer, primary_key=True, nullable=False) dag_id: Mapped[str] = mapped_column(StringID(), primary_key=True, nullable=False) allow_producer_teams: Mapped[list | None] = mapped_column(sa.JSON(), nullable=True) +allow_global_producers: Mapped[bool] = mapped_column( +sa.Boolean(), nullable=False, server_default=sa.true() Review Comment: Should the default err on the side of security and disable this? Or do we want to keep it on the side of mimicking what current Airflow does? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
[PR] Add `allow_global` option to asset access control [airflow]
vincbeck opened a new pull request, #67251:
URL: https://github.com/apache/airflow/pull/67251
This new parameter allows the user to enable/disable global Dags to
consume/produce events from an asset. The `allow_producer_teams` option allows
to allow list some teams to access events from other teams. However, some teams
might want to not allow a Dag to be triggered whenever a global Dag produce an
event (default behavior). Uers can do that by turning the flag `allow_global`
to `False` .
---
# Was generative AI tooling used to co-author this PR?
- [ ] Yes (please specify the tool below)
---
* Read the **[Pull Request
Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)**
for more information. Note: commit author/co-author name and email in commits
become permanently public when merged.
* For fundamental code changes, an Airflow Improvement Proposal
([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals))
is needed.
* When adding dependency, check compliance with the [ASF 3rd Party License
Policy](https://www.apache.org/legal/resolved.html#category-x).
* For significant user-facing changes create newsfragment:
`{pr_number}.significant.rst`, in
[airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments).
You can add this file in a follow-up commit after the PR is created so you
know the PR number.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
