apache/airflow

Support fernet key rotation

Open

#18,509 opened on Sep 24, 2021

View on GitHub
 (1 comment) (1 reaction) (0 assignees)Python (16,781 forks)batch import
area:helm-chartgood first issuekind:feature

Repository metrics

Stars
 (44,809 stars)
PR merge metrics
 (Avg merge 7d 18h) (834 merged PRs in 30d)

Description

Description

The current helm chart only allows for easy setting of the fernet key during initial install, and provides no easy way or help with rotating it afterwards.

Use case/motivation

Chart users will eventually (hopefully!) want to rotate their fernet key, and there should be an easy way to do it with the chart.

This may include advising users to explicitly set their fernet key, even if they keep using the generated one, so they are better posed to recover if they need to reinstall their instance.

Related issues

Webserver secret key, also randomly generated, was handled in but the fernet key needs a different approach: #18098

Are you willing to submit a PR?

  • Yes I am willing to submit a PR!

Code of Conduct

Contributor guide

Research direction
Implement fernet key rotation in the Helm chart by storing the key in a Kubernetes secret and adding a pre upgrade hook that generates a new key while preserving the old one for decryption. Ensure backward compatibility and provide documentation.
Tech stack
pythonkubernetes
Domain
devops
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
HelmKubernetesPython
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60