Fix/FabAuthManager race condition on startup with multiple workers#62737
Merged
potiuk merged 7 commits intoapache:mainfrom Mar 5, 2026
Merged
Fix/FabAuthManager race condition on startup with multiple workers#62737potiuk merged 7 commits intoapache:mainfrom
potiuk merged 7 commits intoapache:mainfrom
Conversation
…o prevent erroneous logging for concurrent duplicate permission assignments and add a helper method to check for existing permissions
Contributor
Author
|
@jason810496 @Lee-W can you please review this |
vincbeck
approved these changes
Mar 2, 2026
providers/fab/tests/unit/fab/auth_manager/security_manager/test_override.py
Outdated
Show resolved
Hide resolved
providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py
Outdated
Show resolved
Hide resolved
providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py
Outdated
Show resolved
Hide resolved
Contributor
There was a problem hiding this comment.
Pull request overview
Addresses a startup race condition when running the API server with multiple workers using FabAuthManager, where concurrent permission-role initialization can trigger DB IntegrityErrors.
Changes:
- Catch
sqlalchemy.exc.IntegrityErrorinadd_permission_to_roleand suppress logging when the permission-role association already exists after rollback. - Add
_is_permission_assigned_to_rolehelper to verify whether the association exists in the DB. - Add unit tests covering both the “ignore duplicate” and “log error when not persisted” cases.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py |
Adds IntegrityError handling and DB verification to avoid noisy logs during concurrent FAB permission initialization. |
providers/fab/tests/unit/fab/auth_manager/security_manager/test_override.py |
Adds unit tests validating the new duplicate-handling behavior and the fallback error logging behavior. |
providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py
Outdated
Show resolved
Hide resolved
providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py
Outdated
Show resolved
Hide resolved
providers/fab/tests/unit/fab/auth_manager/security_manager/test_override.py
Outdated
Show resolved
Hide resolved
providers/fab/tests/unit/fab/auth_manager/security_manager/test_override.py
Outdated
Show resolved
Hide resolved
…rmissions to roles and improve permission check query.
Lee-W
approved these changes
Mar 3, 2026
providers/fab/tests/unit/fab/auth_manager/security_manager/test_override.py
Outdated
Show resolved
Hide resolved
jason810496
reviewed
Mar 5, 2026
Member
jason810496
left a comment
There was a problem hiding this comment.
Thanks for the fix. LGTM overall.
providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py
Outdated
Show resolved
Hide resolved
providers/fab/tests/unit/fab/auth_manager/security_manager/test_override.py
Show resolved
Hide resolved
1Ninad
pushed a commit
to 1Ninad/airflow
that referenced
this pull request
Mar 6, 2026
…pache#62737) * fix: Gracefully handle `IntegrityError` in `add_permission_to_role` to prevent erroneous logging for concurrent duplicate permission assignments and add a helper method to check for existing permissions * fix: Correctly handle IntegrityError on session commit when adding permissions to roles and improve permission check query. * refactor: optimize permission role existence check query using `sqlalchemy.exists()` * use for assertions * changing error log message * change log from debug to info
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
issue : #62563
When running the API server with multiple workers, they all try to initialize FAB permissions at exactly the same time, which causes a database race condition.
This PR simply catches that
IntegrityErrorto safely ignore it, since having multiple workers trying to add the exact same permission is actually fine. Also added 2 tests to verify this logic works.prek checks passed
{pr_number}.significant.rstor{issue_number}.significant.rst, in airflow-core/newsfragments.