Security — Airflow

ChartVersion3.0.1TypeapplicationAppVersion3.0.2

CompatibilityKubernetes1.32+OpenShift4.19+Rancher2.10.x+

Feature SupportLDAPsupported

The tdp-airflow chart supports optional LDAP authentication for the Airflow web interface (Flask-AppBuilder). By default, tdp-airflow.ldap.enabled is false.

When enabled, LDAP authentication is configured for Airflow through tdp-airflow.ldap and environment variables injected via tdp-airflow.extraEnv. Provide a Secret containing the LDAP bind password and reference it from tdp-airflow.extraEnv.

Prerequisites

• LDAP server accessible from the Kubernetes cluster
• Bind credentials (username and password), normally provided via Secret

Credentials and Secrets

Create the LDAP bind Secret before installing the chart:

Terminal input

kubectl create secret generic tdp-airflow-ldap-bind \
  --from-literal=password="<LDAP_BIND_PASSWORD>" \
  -n <NAMESPACE>

Important

If the Secret referenced in tdp-airflow.extraEnv does not exist, pods may fail to initialize.

LDAP configuration

In a custom values file (for example <VALUES_FILE>), use the prefix tdp-airflow.ldap.* and inject the password with tdp-airflow.extraEnv:

tdp-airflow:
  ldap:
    enabled: true
    apiServerConfig: |
      import os
      from flask_appbuilder.security.manager import AUTH_LDAP

      AUTH_TYPE = AUTH_LDAP
      AUTH_LDAP_SERVER = "ldap://<LDAP_HOST>:389"
      AUTH_LDAP_USE_TLS = False
      AUTH_LDAP_BIND_USER = "uid=<LDAP_BIND_USER>,cn=users,cn=accounts,dc=example,dc=com"
      AUTH_LDAP_BIND_PASSWORD = os.environ.get("LDAP_BIND_PASSWORD", "")
      AUTH_LDAP_SEARCH = "cn=users,cn=accounts,dc=example,dc=com"
      AUTH_LDAP_UID_FIELD = "uid"

  extraEnv: |
    - name: LDAP_BIND_PASSWORD
      valueFrom:
        secretKeyRef:
          name: tdp-airflow-ldap-bind
          key: password

tip

The bind password must not be in plain text in the versioned values.yaml; use valueFrom.secretKeyRef in tdp-airflow.extraEnv.

Installation or upgrade

Terminal input

helm upgrade --install <RELEASE_NAME> oci://registry.tecnisys.com.br/tdp/charts/tdp-airflow \
  -n <NAMESPACE> --create-namespace \
  -f <VALUES_FILE>

Parameters

Parameter	Description
tdp-airflow.ldap.enabled	Enable LDAP authentication
tdp-airflow.ldap.apiServerConfig	Flask-AppBuilder Python Snippet (AUTH_LDAP, etc.)
tdp-airflow.extraEnv	Extra variables; use for LDAP_BIND_PASSWORD via Secret

Troubleshooting

Problem	Probable cause	Solution
Pod won't start	Missing bind secret or incorrect name	Create/fix Secret and align secretKeyRef.name in tdp-airflow.extraEnv
Invalid credentials	Incorrect bind DN or password	Validate bind with LDAP tools in the environment
User not found	Search base or UID field is incorrect	Validate AUTH_LDAP_SEARCH and AUTH_LDAP_UID_FIELD against the directory