Re: [PR] Add `allow_global` option to asset access control [airflow]
vincbeck merged PR #67251: URL: https://github.com/apache/airflow/pull/67251 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
Re: [PR] Add `allow_global` option to asset access control [airflow]
vincbeck commented on code in PR #67251: URL: https://github.com/apache/airflow/pull/67251#discussion_r3288348489 ## airflow-core/src/airflow/migrations/versions/0114_3_3_0_add_allow_producer_teams_to_dag_schedule_asset_reference.py: ## @@ -17,7 +17,7 @@ # under the License. """ -Add allow_producer_teams column to dag_schedule_asset_reference table. +Add access control columns to dag_schedule_asset_reference table. Review Comment: Good point -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
Re: [PR] Add `allow_global` option to asset access control [airflow]
vincbeck commented on PR #67251: URL: https://github.com/apache/airflow/pull/67251#issuecomment-4518664739 > May be it's worth mentioning or documenting that the default for allow_global=True and setting it to False would mean accepting the events from same team producers. Yep, will be done in https://github.com/apache/airflow/pull/66949 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
Re: [PR] Add `allow_global` option to asset access control [airflow]
Shrividya commented on code in PR #67251: URL: https://github.com/apache/airflow/pull/67251#discussion_r3285160352 ## airflow-core/src/airflow/migrations/versions/0114_3_3_0_add_allow_producer_teams_to_dag_schedule_asset_reference.py: ## @@ -17,7 +17,7 @@ # under the License. """ -Add allow_producer_teams column to dag_schedule_asset_reference table. +Add access control columns to dag_schedule_asset_reference table. Review Comment: nit: Since this migration now adds both the columns, should the file be renamed to `airflow-core/src/airflow/migrations/versions/0114_3_3_0_add_access_control_columns_to_dag_schedule_asset_reference.py` ? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
Re: [PR] Add `allow_global` option to asset access control [airflow]
Shrividya commented on code in PR #67251: URL: https://github.com/apache/airflow/pull/67251#discussion_r3285160352 ## airflow-core/src/airflow/migrations/versions/0114_3_3_0_add_allow_producer_teams_to_dag_schedule_asset_reference.py: ## @@ -17,7 +17,7 @@ # under the License. """ -Add allow_producer_teams column to dag_schedule_asset_reference table. +Add access control columns to dag_schedule_asset_reference table. Review Comment: nit: Since this migration now adds both the columns, should the file be renamed to `airflow-core/src/airflow/migrations/versions/0114_3_3_0_add_access_control_columns_to_dag_schedule_asset_reference.py` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
Re: [PR] Add `allow_global` option to asset access control [airflow]
vincbeck commented on code in PR #67251: URL: https://github.com/apache/airflow/pull/67251#discussion_r3281564594 ## airflow-core/src/airflow/models/asset.py: ## @@ -592,6 +592,9 @@ class DagScheduleAssetReference(Base): asset_id: Mapped[int] = mapped_column(Integer, primary_key=True, nullable=False) dag_id: Mapped[str] = mapped_column(StringID(), primary_key=True, nullable=False) allow_producer_teams: Mapped[list | None] = mapped_column(sa.JSON(), nullable=True) +allow_global_producers: Mapped[bool] = mapped_column( +sa.Boolean(), nullable=False, server_default=sa.true() Review Comment: It makes to me to enable it by default. Global Dags by nature are global so, to me, it makes sense everybody can consume/produce from/to it by default. WDYT? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
Re: [PR] Add `allow_global` option to asset access control [airflow]
vincbeck commented on code in PR #67251: URL: https://github.com/apache/airflow/pull/67251#discussion_r3281564594 ## airflow-core/src/airflow/models/asset.py: ## @@ -592,6 +592,9 @@ class DagScheduleAssetReference(Base): asset_id: Mapped[int] = mapped_column(Integer, primary_key=True, nullable=False) dag_id: Mapped[str] = mapped_column(StringID(), primary_key=True, nullable=False) allow_producer_teams: Mapped[list | None] = mapped_column(sa.JSON(), nullable=True) +allow_global_producers: Mapped[bool] = mapped_column( +sa.Boolean(), nullable=False, server_default=sa.true() Review Comment: It makes to me to enable it by default. Global Dags by nature are global so, to me, it makes sense everybody can consume/produce from/to it. WDYT? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
Re: [PR] Add `allow_global` option to asset access control [airflow]
o-nikolas commented on code in PR #67251: URL: https://github.com/apache/airflow/pull/67251#discussion_r3276931054 ## airflow-core/src/airflow/models/asset.py: ## @@ -592,6 +592,9 @@ class DagScheduleAssetReference(Base): asset_id: Mapped[int] = mapped_column(Integer, primary_key=True, nullable=False) dag_id: Mapped[str] = mapped_column(StringID(), primary_key=True, nullable=False) allow_producer_teams: Mapped[list | None] = mapped_column(sa.JSON(), nullable=True) +allow_global_producers: Mapped[bool] = mapped_column( +sa.Boolean(), nullable=False, server_default=sa.true() Review Comment: Should the default err on the side of security and disable this? Or do we want to keep it on the side of mimicking what current Airflow does? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
