-
Notifications
You must be signed in to change notification settings - Fork 15.6k
Add cert used for apiserver to client (fix for self-signed) #53574
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide (https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
|
Although there are no config changes with this the self-signed certificate does need subject alt names set:
For the certificate to be accepted (this is based on the quick start docker-compose.yaml). As well as the cert being passed to curl using I think this should be documented somewhere but I am unsure where the best place would be. It is supposed to be non-production use but some instances may require the additional security even for this. |
You can run the pre-commit hook locally—this will automatically fix any static check issues |
Also, it would be great to add a unit test covering it. @Subham-KRLX -> you said you can collaborate, so maybe adding a unit test as PR to the PR might be a good idea :) |
c857759
to
debd475
Compare
Hi @danieldean I have added a unit test for the new SSL certificate config logic in the API client and confirmed that it passes locally |
This appears to be based on a different logic contained within the client to that in this PR? I think you need to use my branch as a base and make a test based on that if possible. |
I have rebased my branch on top of yours and updated the base of my PR accordingly. The unit test now aligns with your changes. Please let me know if you need any adjustments or additional coverage. |
I am unsure what has happened but there appears to be something wrong with this. You have different code in the I have built an image from my branch so I can get on with things. It is here if it is of any use to anyone: https://hub.docker.com/r/danieldean/airflow-test |
@danieldean ,Could you please clarify which specific changes or tests you want me to update so everything aligns? I will make the adjustments accordingly. |
I see the MyPy checks are failing due to type errors involving direct assignment to ssl.SSLContext methods and some type mismatches in task-sdk/tests/task_sdk/init.py. If you can share how you had prefer the SSL method mocking or type annotations to be adjusted . Just let me know if you want me to try specific fixes or take a look at detailed errors to help move this forward. |
I have done some reading on testing and revised my methods. I believe static checks and tests all now pass. Just a short how to on this and all is hopefully done. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Very clever :)
Rebased it. I think the mypy error is already fixed in main. |
Awesome work, congrats on your first merged pull request! You are invited to check our Issue Tracker for additional contributions. |
🎉 |
@potiuk excellent, thanks for your help. I will take a look at adding to the documentation over the coming week. |
…d) (apache#53574) * Add cert used for apiserver to client (fix for self-signed) * Correct indentation, run pre-commit checks * Add test for cert load * Update config description for api ssl_cert * Use mock instead and check error when non-existant CA is not found (cherry picked from commit 6dba101) Co-authored-by: Daniel Dean <[email protected]>
…d) (#53574) (#53793) * Add cert used for apiserver to client (fix for self-signed) * Correct indentation, run pre-commit checks * Add test for cert load * Update config description for api ssl_cert * Use mock instead and check error when non-existant CA is not found (cherry picked from commit 6dba101) Co-authored-by: Daniel Dean <[email protected]>
…3574) * Add cert used for apiserver to client (fix for self-signed) * Correct indentation, run pre-commit checks * Add test for cert load * Update config description for api ssl_cert * Use mock instead and check error when non-existant CA is not found
…3574) * Add cert used for apiserver to client (fix for self-signed) * Correct indentation, run pre-commit checks * Add test for cert load * Update config description for api ssl_cert * Use mock instead and check error when non-existant CA is not found
An addition to the tasks sdk apt client to import the same certificate used for the apiserver by getting the path from the config options so that self-signed certificates get trusted. No additional config options and user wise nothing of note has changed other than a self-signed certificate working without workarounds.
Verification remains on so there is otherwise no security implications.
Closes: #53493