Airflow User Access management

Question

I am evaluating Airflow as a Job scheduling tool. 1) Can we create few users like admin, developer and readonly user? 2) Can we implement access control to the Airflow UI 3) Can we control access to the dags folder? Is there any dag Deployment mechanism

Answer 1

Taken from Airflow read the docs.

This is all functional if your Airflow version is 1.10 or higher. You must set rbac= True in your airflow.cfg file. I believe if you are updating airflow and not installing fresh, you must also run airflow create_user to create the admin user.

1. Can we create few users like admin, developer and readonly user?

Yes. There are five roles created for Airflow by default: Public, Admin, Viewer, User, Op.

• Public has no permissions at all.

• Admin has the full set of permissions

• Viewer: for users without DAG ownership. They have read access to DAGs, but cannot perform any action that could potentially change the state of the database.

• User: this is for users with DAG ownership. They have both read and write access to DAGs, therefore can perform actions such as starting/stopping scheduled DAGs, running DAGs ad-hoc, clearing historical DagRuns or marking DagRuns as success/failure, etc.

• Op: this is for devops that handle Airflow deployment and maintain its uptime. They have access to airflow configuration files via the UI, and can modify shared objects like Variables and Connections.

  2. Can we implement access control to the Airflow UI?

You can restrict usage to the server Airflow is hosted on, restricting access by SSH authentication. Users then must be tunneled into the server to view the UI.

3. Can we control access to the dags folder?

Yes through user groups on the Airflow server.

4. Is there any dag Deployment mechanism

No not to my knowledge, but this is relatively easy to implement. Commit your updated DAGS to an online repository like SVN/Git. Use a bash script to check for new updates and pull the updated ones down for deployment.

Check out airflow security section for more information.