Add [webserver]update_fab_perms to deprecated configs (#40317)

* Add `[webserver]update_fab_perms` to deprecated configs `[webserver]update_fab_perms` is deprecated in favour of `[fab]update_fab_perms` and has been a breaking change since 2.9.0. This PR adds the config to the deprecated config list to properly inform users and have both options work at the moment * Move provider config loading into init_appbuilder * Remove deprecated webserver config options from config.yml * Remove fallbacks * Remove update_fab_perms and return the provider initialization * Include FAB config in core configuration reference * Update docs/apache-airflow/faq.rst * Fix doc build error (cherry picked from commit e24b7c1)
apache · Jul 2, 2024 · d420d79 · d420d79
1 parent 766f1c7
commit d420d79
Show file tree

Hide file tree

Showing 5 changed files with 14 additions and 68 deletions.
diff --git a/airflow/config_templates/config.yml b/airflow/config_templates/config.yml
@@ -1880,16 +1880,6 @@ webserver:
       type: boolean
       example: ~
       default: "True"
-    update_fab_perms:
-      description: |
-        Update FAB permissions and sync security manager roles
-        on webserver startup
-      version_added: 1.10.7
-      type: string
-      example: ~
-      default: "True"
-      version_deprecated: 2.9.0
-      deprecation_reason: This config has been moved to fab provider. Please use the config from fab provider.
     session_lifetime_minutes:
       description: |
         The UI cookie lifetime in minutes. User will be logged out from UI after
@@ -1959,24 +1949,6 @@ webserver:
       type: boolean
       example: ~
       default: "False"
-    auth_rate_limited:
-      description: |
-        Boolean for enabling rate limiting on authentication endpoints.
-      version_added: 2.6.0
-      type: boolean
-      example: ~
-      default: "True"
-      version_deprecated: 2.9.0
-      deprecation_reason: This config has been moved to fab provider. Please use the config from fab provider.
-    auth_rate_limit:
-      description: |
-        Rate limit for authentication endpoints.
-      version_added: 2.6.0
-      type: string
-      example: ~
-      default: "5 per 40 second"
-      version_deprecated: 2.9.0
-      deprecation_reason: This config has been moved to fab provider. Please use the config from fab provider.
     caching_hash_method:
       description: |
         The caching algorithm used by the webserver. Must be a valid hashlib function name.

diff --git a/airflow/configuration.py b/airflow/configuration.py
@@ -390,6 +390,9 @@ def sensitive_config_values(self) -> Set[tuple[str, str]]:  # noqa: UP006
             "worker_pods_pending_timeout_check_interval",
             "2.6.0",
         ),
+        ("fab", "update_fab_perms"): ("webserver", "update_fab_perms", "2.9.0"),
+        ("fab", "auth_rate_limited"): ("webserver", "auth_rate_limited", "2.9.0"),
+        ("fab", "auth_rate_limit"): ("webserver", "auth_rate_limit", "2.9.0"),
     }
 
     # A mapping of new configurations to a list of old configurations for when one configuration

diff --git a/airflow/providers/fab/provider.yaml b/airflow/providers/fab/provider.yaml
@@ -55,22 +55,22 @@ config:
       auth_rate_limited:
         description: |
           Boolean for enabling rate limiting on authentication endpoints.
-        version_added: 1.0.0
+        version_added: 1.0.2
         type: boolean
         example: ~
         default: "True"
       auth_rate_limit:
         description: |
           Rate limit for authentication endpoints.
-        version_added: 2.6.0
+        version_added: 1.0.2
         type: string
         example: ~
         default: "5 per 40 second"
       update_fab_perms:
         description: |
           Update FAB permissions and sync security manager roles
           on webserver startup
-        version_added: 1.10.7
+        version_added: 1.0.2
         type: string
         example: ~
         default: "True"

diff --git a/airflow/www/extensions/init_appbuilder.py b/airflow/www/extensions/init_appbuilder.py
@@ -131,19 +131,6 @@ def __init__(
         base_template="airflow/main.html",
         static_folder="static/appbuilder",
         static_url_path="/appbuilder",
-        update_perms=conf.getboolean(
-            "fab", "UPDATE_FAB_PERMS", fallback=conf.getboolean("webserver", "UPDATE_FAB_PERMS")
-        ),
-        auth_rate_limited=conf.getboolean(
-            "fab",
-            "AUTH_RATE_LIMITED",
-            fallback=conf.getboolean("webserver", "AUTH_RATE_LIMITED", fallback=True),
-        ),
-        auth_rate_limit=conf.get(
-            "fab",
-            "AUTH_RATE_LIMIT",
-            fallback=conf.get("webserver", "AUTH_RATE_LIMIT", fallback="5 per 40 second"),
-        ),
     ):
         """
         App-builder constructor.
@@ -160,14 +147,11 @@ def __init__(
             optional, your override for the global static folder
         :param static_url_path:
             optional, your override for the global static url path
-        :param update_perms:
-            optional, update permissions flag (Boolean) you can use
-            FAB_UPDATE_PERMS config key also
-        :param auth_rate_limited:
-            optional, rate limit authentication attempts if set to True (defaults to True)
-        :param auth_rate_limit:
-            optional, rate limit authentication attempts configuration (defaults "to 5 per 40 second")
         """
+        from airflow.providers_manager import ProvidersManager
+
+        providers_manager = ProvidersManager()
+        providers_manager.initialize_providers_configuration()
         self.baseviews = []
         self._addon_managers = []
         self.addon_managers = {}
@@ -177,9 +161,9 @@ def __init__(
         self.static_folder = static_folder
         self.static_url_path = static_url_path
         self.app = app
-        self.update_perms = update_perms
-        self.auth_rate_limited = auth_rate_limited
-        self.auth_rate_limit = auth_rate_limit
+        self.update_perms = conf.getboolean("fab", "UPDATE_FAB_PERMS")
+        self.auth_rate_limited = conf.getboolean("fab", "AUTH_RATE_LIMITED")
+        self.auth_rate_limit = conf.get("fab", "AUTH_RATE_LIMIT")
         if app is not None:
             self.init_app(app, session)
 
@@ -677,17 +661,4 @@ def init_appbuilder(app: Flask) -> AirflowAppBuilder:
         app=app,
         session=settings.Session,
         base_template="airflow/main.html",
-        update_perms=conf.getboolean(
-            "fab", "UPDATE_FAB_PERMS", fallback=conf.getboolean("webserver", "UPDATE_FAB_PERMS")
-        ),
-        auth_rate_limited=conf.getboolean(
-            "fab",
-            "AUTH_RATE_LIMITED",
-            fallback=conf.getboolean("webserver", "AUTH_RATE_LIMITED", fallback=True),
-        ),
-        auth_rate_limit=conf.get(
-            "fab",
-            "AUTH_RATE_LIMIT",
-            fallback=conf.get("webserver", "AUTH_RATE_LIMIT", fallback="5 per 40 second"),
-        ),
     )
diff --git a/docs/apache-airflow/faq.rst b/docs/apache-airflow/faq.rst
@@ -466,7 +466,7 @@ Setting retries for each task drastically reduces the chance that either of thes
 How do I stop the sync perms happening multiple times per webserver?
 --------------------------------------------------------------------
 
-Set the value of ``update_fab_perms`` configuration in ``airflow.cfg`` to ``False``.
+Set the value of ``[fab] update_fab_perms`` configuration in ``airflow.cfg`` to ``False``.
 
 
 How to reduce the airflow UI page load time?