Updated app to support configuring the caching hash method for FIPS v2 #30675
Conversation
vchiapaikeo
requested review from
ryanahamilton,
ashb,
bbovenzi,
kaxil and
XD-DENG
as code owners
boring-cyborg
bot
added
area:serialization
area:webserver
|
Nice, thanks for picking this one up! |
| caching_hash_method: | ||
| description: | | ||
| The caching algorithm used by the webserver. Must be a valid hashlib function name. | ||
| version_added: |
There was a problem hiding this comment.
I guess we should put 2.7.0 here?
There was a problem hiding this comment.
Unless @ephraimbuddy will decide to merge in to 2.6.0 ?
There was a problem hiding this comment.
I know I wrote on slack that it is 2.7 - but on a hindsight - unless it's not too late - that one looks super safe
There was a problem hiding this comment.
Ah. I see it is missing at all :(
There was a problem hiding this comment.
Ah whoops! Let me know if I can do a fast follow up here to add 2.7.0 here @potiuk
There was a problem hiding this comment.
Let's tag it 2.6.0. I will no longer do the RC today
There was a problem hiding this comment.
Yeah. Can you please add 2.6.0 added PR @vchiapaikeo :)?
There was a problem hiding this comment.
Yes, not a problem. PR: #30688
Created in response to a stale PR at the direction of @eladkal: #28846
This was created to address issues that occurred in a FIPS enabled environment. This allows you to set the CACHING_HASH_METHOD config value to override the default of md5. Also updates the serialized_dag hash code to work even in a FIPS environment.
Testing:
Started up breeze and ensured webserver started fine:
Inspected serialized dag dag_hash field:
Modified the hash method to sha256 and restarted breeze with this configuration in
files/airflow-breeze-config/init.sh:Checked configuration:
Rechecked dag hash field:
Test a simple dag:
To explicit md5:
^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named
{pr_number}.significant.rstor{issue_number}.significant.rst, in newsfragments.