AIP 84 - Add Auth to xcom, ti, dag_warning, dag_stats, dag_source, dag_run, dag_parsing

[rawwar]

related to #42360

• dag_run
• dag_parsing
• dag_source
• dag_stats
• dag_warning
• ti
• xcom

[pierrejeambrun]

Great! Looking good thanks.

Just a few suggestions, and need rebasing + CI fixing, should be good to go after that.

[pierrejeambrun]

For CI authenticated request on the K8S tests, you can take a look at #47433 that encountered the same problem I believe.

[pierrejeambrun]

Also you'll need to wait for #47433 because it introduces EditableDagsFilterDep and ReadableDagsFilterDep that you will need for multiple endpoints. For instance dag_warnings, task_instances etc....

Basically it's up to the view to do extra filtering on readable/writable dags for specific endpoints. (there is a handful of endpoints to update)

[Lee-W]

just resolve the conflict and rebase from the latest main. we should have the required methods now

[rawwar]

just resolve the conflict and rebase from the latest main. we should have the required methods now

I'll update based on feedback in sometime

[pierrejeambrun]

Looks good thanks

[pierrejeambrun]

@jason810496 how can this be flaky ? I thought the session was authenticated
https://github.com/apache/airflow/actions/runs/13817174257/job/38655368903?pr=47532

Also forbidden means that the token is provided but not correct. (maybe the signature key is not the same at generation time and at verification time and need to be set in the config). => we do not explicitly set it in the config. Therefore we generate one and set it everytime which might end up causing different keys to be used...

[jason810496]

@jason810496 how can this be flaky ? I thought the session was authenticated https://github.com/apache/airflow/actions/runs/13817174257/job/38655368903?pr=47532

maybe the signature key is not the same at generation time and at verification time and need to be set in the config

Good point, I will create another PR that set the following env in configMap explicitly

• auth_jwt_secret
• auth_jwt_expiration_time ( I think we don't need to set this, since the default value is 86400, the CI will not exceed 1 day )

[Lee-W]

all green and all comments resolved. merging

[pierrejeambrun]

That would be great @jason810496 maybe that will help stabilizing, ty

[jason810496]

That would be great @jason810496 maybe that will help stabilizing, ty

Yeah, I'm already working on it but not able to finish it today. I will raise the PR tomorrow.

[ashb]

@jason810496 how can this be flaky ? I thought the session was authenticated https://github.com/apache/airflow/actions/runs/13817174257/job/38655368903?pr=47532

maybe the signature key is not the same at generation time and at verification time and need to be set in the config

Good point, I will create another PR that set the following env in configMap explicitly

* `auth_jwt_secret`

* `auth_jwt_expiration_time` ( I think we don't need to set this, since the default value is `86400`, the CI will not exceed 1 day )

These will change names soon in #46981

[ashb]

@jason810496 how can this be flaky ? I thought the session was authenticated https://github.com/apache/airflow/actions/runs/13817174257/job/38655368903?pr=47532

Also forbidden means that the token is provided but not correct. (maybe the signature key is not the same at generation time and at verification time and need to be set in the config). => we do not explicitly set it in the config. Therefore we generate one and set it everytime which might end up causing different keys to be used...

#47739 most likely