Considerations for Using Airflow CLI Commands

Describes security considerations for using Airflow CLI commands.

NOTE
Starting with DEP 10.1.0 (Data Fabric 8.1.0) , the Airflow CLI commands have been updated to align with the official Apache Airflow naming conventions. The following changes apply:
  • airflow-admin → airflow — The previous airflow-admin command is now airflow. Use this command for Airflow server administration tasks.
  • airflow → airflowctl — The previous airflow command has been renamed to airflowctl, reflecting that Airflow CTL is now distributed as a separate package (airflowctl).

These changes ensure that examples and instructions from the official Apache Airflow documentation can be used as-is, without modification.

For EEP 9.2.2 and later, Airflow 2.8.3 has four types of security options related to the use of Airflow CLI commands. In opt/mapr/airflow/airflow-<version>/conf/airflow.cfgfile, you can set one of the following four options:

Option 1: This is default option. When admin_only_cli_access = false and admin_cli_with_impersonation = false:
  • Only users with Data Fabric tickets can use Airflow CLI commands.
  • If a user that has no ticket issues a CLI command, the command line returns an error. For example:
    $ airflow users create --username mapr1 --firstname mapr1 --lastname mapr1 -p mapr1 --role Admin --email admin3@example.org
Traceback (most recent call last):
  File "/opt/mapr/airflow/airflow-2.6.1/bin/airflow", line 8, in <module>
    sys.exit(main())
  File "/opt/mapr/airflow/airflow-2.6.1/build/env/lib/python3.9/site-packages/airflow/__main__.py", line 45, in main
    resp = security_client.start("maprsasl")[2]
  File "/opt/mapr/airflow/airflow-2.6.1/build/env/lib/python3.9/site-packages/airflow/security/maprsasl.py", line 73, in start
    return True, mechanism, self.get_init_response()
  File "/opt/mapr/airflow/airflow-2.6.1/build/env/lib/python3.9/site-packages/airflow/security/maprsasl.py", line 55, in get_init_response
    server_key_bytes = maprsecurity.GetTicketAndKeyForClusterInternal(MAPR_CLUSTER_NAME, 1)
SystemError: <built-in function GetTicketAndKeyForClusterInternal> returned NULL without setting an error
  • Only the cluster administrator (typically the mapr user) can issue commands related to Airflow users. For example, only the cluster admin can issue the airflow users list command or create the admin user role. An exception is generated if a non-cluster-admin user issues a command such as airflow users list. For example:
    $ airflow users list
Traceback (most recent call last):
  File "/opt/mapr/airflow/airflow-2.6.1/bin/airflow", line 8, in <module>
    sys.exit(main())
.........................................................................................................
  File "/opt/mapr/airflow/airflow-2.6.1/build/env/lib/python3.9/site-packages/airflow/cli/commands/user_command.py", line 38, in <module>
    class UserSchema(Schema):
  File "/opt/mapr/airflow/airflow-2.6.1/build/env/lib/python3.9/site-packages/airflow/cli/commands/user_command.py", line 42, in UserSchema
    raise Exception("Only admin cluster user can manage Airflow users list")
Exception: Only admin cluster user can manage Airflow users list
Option 2: When admin_only_cli_access = true and admin_cli_with_impersonation = false:
  • Only cluster administrator can access ALL Airflow CLI commands.
  • Impersonation is disabled.
Option 3: When admin_only_cli_access = false and admin_cli_with_impersonation = true:
  • Cluster administrator can access ALL Airflow CLI commands.
  • Users with Data Fabric tickets have access only to the Airflow Task command.
  • Impersonation is enabled.