Skip to content

fix: Support OPA for Airflow when user role is not 'Admin'#1512

Merged
sweb merged 3 commits into
mainfrom
fix-airflow-opa-interop
May 28, 2026
Merged

fix: Support OPA for Airflow when user role is not 'Admin'#1512
sweb merged 3 commits into
mainfrom
fix-airflow-opa-interop

Conversation

@sweb
Copy link
Copy Markdown
Member

@sweb sweb commented May 27, 2026

Description

Fixes an issue in the Airflow 3 OPA auth manager that broke non-Admin users:

  • DAG listings and menu items were empty for users without Flask AppBuilder DB roles

While also relevant for Airflow 2, I opted to only adjust it for Airflow 3. If required, I can look into Airflow 2 as a follow up.

Definition of Done Checklist

Note

Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant.

Please make sure all these things are done and tick the boxes

  • Changes are OpenShift compatible
  • All added packages (via microdnf or otherwise) have a comment on why they are added
  • Things not downloaded from Red Hat repositories should be mirrored in the Stackable repository and downloaded from there
  • All packages should have (if available) signatures/hashes verified
  • Add an entry to the CHANGELOG.md file
  • Integration tests ran successfully (see chore: add test to reproduce Airflow / OPA interop issue airflow-operator#800)
TIP: Running integration tests with a new product image

The image can be built and uploaded to the kind cluster with the following commands:

boil build <IMAGE> --image-version <RELEASE_VERSION> --strip-architecture --load
kind load docker-image <MANIFEST_URI> --name=<name-of-your-test-cluster>

See the output of boil to retrieve the image manifest URI for <MANIFEST_URI>.

@sweb sweb force-pushed the fix-airflow-opa-interop branch from 15df1f0 to bc45cdf Compare May 27, 2026 14:36
@razvan razvan self-requested a review May 28, 2026 06:46
@sweb sweb marked this pull request as ready for review May 28, 2026 07:38
@sbernauer sbernauer moved this to Development: Waiting for Review in Stackable Engineering May 28, 2026
razvan
razvan previously approved these changes May 28, 2026
Copy link
Copy Markdown
Member

@razvan razvan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, nice work with the tests. One conflict needs to be fixed before merge though.

@sweb sweb force-pushed the fix-airflow-opa-interop branch from 8e642d3 to 2f8fe65 Compare May 28, 2026 10:51
@sweb sweb force-pushed the fix-airflow-opa-interop branch from 2f8fe65 to cd5d7d5 Compare May 28, 2026 10:54
Copy link
Copy Markdown
Member

@razvan razvan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@sweb sweb added this pull request to the merge queue May 28, 2026
Merged via the queue into main with commit bee0cb5 May 28, 2026
3 checks passed
@sweb sweb deleted the fix-airflow-opa-interop branch May 28, 2026 12:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Development: Waiting for Review

Development

Successfully merging this pull request may close these issues.

3 participants