feng-tao commented on a change in pull request #4642: [WIP] [AIRFLOW-2694]
Declare permissions in DAG definition
URL: https://github.com/apache/airflow/pull/4642#discussion_r253585402
##########
File path: airflow/models/__init__.py
##########
@@ -4244,6 +4254,63 @@ def _test_cycle_helper(self, visit_map, task_id):
visit_map[task_id] = DagBag.CYCLE_DONE
+ def _set_dag_permissions(self, access_control):
+ """Grant permissions on this DAG's ViewModel to the given role(s).
+
+ :param access_control: a dict where each key is a rolename and
+ each value is a set() of permission names (e.g.,
+ {'can_dag_read'}
+ :type access_control: dict
+
+ """
+ sm = cached_appbuilder().sm
Review comment:
this may be a little concern as it requires starting the webserver when
Airflow starts the scheduler.
Two ideas could help solve these cases:
1. move all FAB
models(https://github.com/dpgaspar/Flask-AppBuilder/blob/1e900bba85452de6d988f7da191f9a26fec62226/flask_appbuilder/security/sqla/models.py)
into Airflow code base(cc @mistercrunch who brought up this idea previously).
This helps Airflow not relied on FAB that much.
2. Created an API endpoint in web server for creating permission / delete
permission purpose(https://issues.apache.org/jira/browse/AIRFLOW-2693). In this
way, the Airflow web server handles all the FAB permission actions. And
scheduler just delegates the permission handling to the webserver.
cc @jgao54 @mistercrunch
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
With regards,
Apache Git Services
