Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[AIRFLOW-5145] take false is_encrypted choice away from user #5761

Merged
merged 1 commit into from Aug 23, 2019

Conversation

jstern
Copy link
Contributor

@jstern jstern commented Aug 8, 2019

Make sure you have checked all steps below.

Jira

  • My PR addresses the following Airflow Jira issues and references them in the PR title. For example, "[AIRFLOW-XXX] My Airflow PR"
    • https://issues.apache.org/jira/browse/AIRFLOW-5145
    • In case you are fixing a typo in the documentation you can prepend your commit with [AIRFLOW-XXX], code changes always need a Jira issue.
    • In case you are proposing a fundamental code change, you need to create an Airflow Improvement Proposal (AIP).
    • In case you are adding a dependency, check if the license complies with the ASF 3rd Party License Policy.

Description

  • Here are some details about my PR, including screenshots of any UI changes:

Don't display the Is Encrypted checkbox in the Variable add UI; the user's decision (explicit or implicit) here can incorrectly override the correct setting of this value when the model is saved.

In other words, this attempts to prevent this scenario from occurring
when the airflow instance has a fernet key set up and user forgets or decides not to check Is Encrypted:

  • Database value is ciphertext, while is_encrypted is false.
  • Variable.get does not attempt to decrypt the ciphertext and therefore does not return the correct value.
  • Instead, the ciphertext, which looks like gAAAAABdS1d_Mw<SNIP>D-O9SIg==, is treated as the actual value ... so json deserialization and any other intended usage of the value fails.

UI Changes:

Is Encrypted checkbox is removed from the variable create screen.

Current /variable/add in my local 1.10.3 instance:

current-with-is-enc-cb

After change in that instance:

no-is-encrypted-cb

Tests

  • My PR adds the following unit tests OR does not need testing for this extremely good reason:
  • No tests added yet as this is a minor config change ... but I'm new to this to so willing to stand corrected :)

Commits

  • My commits all reference Jira issues in their subject lines, and I have squashed multiple commits if they address the same issue. In addition, my commits follow the guidelines from "How to write a good git commit message":
    1. Subject is separated from body by a blank line
    2. Subject is limited to 50 characters (not including Jira issue reference)
    3. Subject does not end with a period
    4. Subject uses the imperative mood ("add", not "adding")
    5. Body wraps at 72 characters
    6. Body explains "what" and "why", not "how"

Documentation

  • In case of new functionality, my PR adds documentation that describes how to use it.
    • All the public functions and the classes in the PR contain docstrings that explain what it does
    • If you implement backwards incompatible changes, please leave a note in the Updating.md so we can assign it to a appropriate release

Code Quality

  • Passes flake8

@jstern
Copy link
Contributor Author

jstern commented Aug 9, 2019

Going to close and re-open to re-trigger travis (failure appeared unrelated to change).

@jstern jstern closed this Aug 9, 2019
@jstern jstern reopened this Aug 9, 2019
@jstern jstern changed the title take false is_encrypted choice away from user [AIRFLOW-5145] take false is_encrypted choice away from user Aug 9, 2019
@ashb ashb merged commit e5e7a9e into apache:master Aug 23, 2019
kaxil pushed a commit that referenced this pull request Aug 30, 2019
kaxil pushed a commit that referenced this pull request Aug 30, 2019
kaxil pushed a commit that referenced this pull request Aug 30, 2019
Jerryguo pushed a commit to Jerryguo/airflow that referenced this pull request Sep 2, 2019
…le screens (apache#5761)

With webserver `rbac=True` and core fernet_key set, variable values are always
encrypted, but they are only marked as is_encrypted = true in the database if
the user explicitly checks the Is Encrypted checkbox on the variable create
screen. If a variable is set up this way, then it is not correctly displayed in
the UI and calls to Variable.get return the cipher text instead of the
decrypted value.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants