This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch v3-3-test
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/v3-3-test by this push:
new c313f5da521 [v3-3-test] Clarify that AccessView.JOBS is the Edge
worker management permission (#72627) (#73073)
c313f5da521 is described below
commit c313f5da5217a5cbf06e9c4ef04e4aaccfee1a48
Author: Jarek Potiuk <[email protected]>
AuthorDate: Sun Sep 13 16:45:30 2026 +0630
[v3-3-test] Clarify that AccessView.JOBS is the Edge worker management
permission (#72627) (#73073)
The Edge UI plugin docs say that "can read on Plugins" and "can read on
Jobs" let you view the UI and manage the workers, but they do not say how
the two permissions differ, and they do not mention what the default
Viewer role already holds.
Both gaps matter, because the endpoints and the navigation are gated
differently:
- The worker management endpoints under /edge_worker/ui/ check only
AccessView.JOBS, and the check is not method-aware -- the same
dependency guards the GET reads and the POST/PATCH/DELETE mutations.
- "can read on Plugins" only controls whether the plugin shows up in the
UI navigation. It is not required in order to call the endpoints.
So "can read on Jobs" alone is enough to shut down, delete, re-queue and
retune Edge workers, whether or not the plugin is visible to that user.
That is intentional -- AccessView.JOBS is the management permission for
the plugin rather than a read-only grant -- but it reads as surprising
from the code alone, where a permission named "can read" guards mutating
routes. It is more surprising in a default Flask AppBuilder setup, where
the Viewer role includes (ACTION_CAN_READ, RESOURCE_JOB) but not the
Plugins read: such a user cannot see the Edge plugin and can still reach
its management endpoints.
Adds a warning to the UI plugin docs stating the intent, the split
between the two permissions, the consequence for the default Viewer role,
and the concrete action for deployments where Viewers must not manage
workers. Points at the existing "fine granular access control" entry in
architecture.rst rather than restating it.
Documentation only; no behaviour change.
(cherry picked from commit 1391b0934240aa70c90d7cad186d71a235bdfdd2)
---
providers/edge3/docs/ui_plugin.rst | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/providers/edge3/docs/ui_plugin.rst
b/providers/edge3/docs/ui_plugin.rst
index d524b555e3d..ff2c969e44d 100644
--- a/providers/edge3/docs/ui_plugin.rst
+++ b/providers/edge3/docs/ui_plugin.rst
@@ -64,5 +64,25 @@ To be able to use the UI plugin you need to be in role
"Admin" or "Op" or have t
configure the remote workers (Technical key: AccessView.JOBS). With this
permission you can also manage
the workers like adjusting queues, concurrency, set them to maintenance mode
or shutdown the workers.
+.. warning::
+
+ "can read on Jobs" (``AccessView.JOBS``) is the **management** permission
for Edge workers, not a
+ read-only one. It is deliberately the single permission gating the whole
plugin, and the worker
+ management endpoints under ``/edge_worker/ui/`` check only this permission
-- the HTTP method is not
+ part of the check. "can read on Plugins" governs only whether the plugin
appears in the UI
+ navigation; it is not required in order to call the endpoints.
+
+ A principal holding "can read on Jobs" can therefore shut down, delete,
re-queue and retune Edge
+ workers by calling those endpoints directly, whether or not the plugin is
visible to them.
+
+ This matters for the default ``Viewer`` role, which **includes "can read
on Jobs"**. In a default
+ Flask AppBuilder setup a Viewer does not see the Edge plugin in the
navigation (Viewer has no
+ "can read on Plugins"), but can still reach the worker management
endpoints. If Viewers in your
+ deployment must not manage Edge workers, remove "can read on Jobs" from
that role or give those
+ users a custom role without it.
+
+ Finer-grained separation of read and management permissions for Edge
workers is not implemented;
+ it is listed under :doc:`architecture` as a known missing feature.
+
Note that maintenance mode can also be adjusted via CLI.
See :ref:`deployment:maintenance` for more details.
