potiuk commented on code in PR #76490:
URL: https://github.com/apache/airflow/pull/76490#discussion_r4482608085
##########
providers/fab/docs/changelog.rst:
##########
@@ -20,17 +20,53 @@
Changelog
---------
+3.11.0
+......
+
.. note::
- Airflow 3.4.1 gives Dag bundles their own ``Dag Bundles`` resource, which
``Op`` and ``Admin``
- get by default. Upgrade this provider together with Airflow 3.4.1: older
releases deny the Dag
- bundle pages and API to every role, including ``Admin``, while still
showing the Browse menu
- entry. Custom roles need ``can read`` and ``menu access`` on ``Dag
Bundles`` added by hand.
-
- ``POST /auth/token`` now checks a username and password only against the
configured
- ``AUTH_TYPE``: with ``AUTH_LDAP`` it no longer falls back to database
passwords, and with other
- authentication types (OAuth, remote user) it no longer issues tokens for a
username and
+ Airflow 3.4.1 gives Dag bundles their own ``Dag Bundles`` resource, which
only ``Op`` and
+ ``Admin`` get by default, so ``Viewer`` and ``User`` lose the Dag bundle
pages and API they
+ reached through Dag read access. Upgrade this provider together with
Airflow 3.4.1: older
+ releases deny the Dag bundle pages and API to every role, including
``Admin``, while still
+ showing the Browse menu entry. Custom roles need ``can read`` and ``menu
access`` on
+ ``Dag Bundles`` added by hand.
+
+ ``POST /auth/token`` and ``POST /auth/token/cli`` now check a username and
password only against
+ the configured ``AUTH_TYPE``: with ``AUTH_LDAP`` they no longer fall back
to database passwords, and
+ with other authentication types (OAuth, remote user) they no longer issue
tokens for a username and
password; use that type's own login flow instead. Passwords made only of
NUL bytes are rejected.
+Features
+~~~~~~~~
+
+* ``Give Dag bundles their own read permission (#76329)``
Review Comment:
**Changelog entry does not state the required Airflow version**
We should likely say here that this needs Airflow 3.4.1, for example ``Give
Dag bundles their own read permission, on Airflow 3.4.1+ (#76329)``. The
resource only takes effect when Airflow has `AccessView.DAG_BUNDLES`, so on
3.4.0 the entry describes something users will not get.
##########
providers/keycloak/docs/changelog.rst:
##########
@@ -34,6 +37,23 @@ Changelog
``airflow keycloak-auth-manager create-team`` for each team, which removes
the Dag bundles menu
entry that team roles can no longer open.
+Features
+~~~~~~~~
+
+* ``Restrict the Dag bundles view to SuperAdmin in multi-team mode (#76329)``
Review Comment:
**Changelog entry does not state the required Airflow version**
Same as in the fab changelog: we should likely say this needs Airflow 3.4.1,
for example ``Restrict the Dag bundles view to SuperAdmin in multi-team mode on
Airflow 3.4.1+ (#76329)``.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
