edge3: bind team_name into worker JWT (defense-in-depth for experimental multi-team)#67397
Open
omkhar wants to merge 2 commits into
Open
edge3: bind team_name into worker JWT (defense-in-depth for experimental multi-team)#67397omkhar wants to merge 2 commits into
omkhar wants to merge 2 commits into
Conversation
boring-cyborg
Bot
added
area:providers
provider:edge
…tal multi-team) Defense-in-depth for the experimental edge3 multi-team feature. Worker team_name is currently sent in request bodies only and trusted by the server. This change binds team_name into the JWT at issue time and rejects requests where the body's team_name disagrees with the JWT's. Legacy pre-team-claim workers (no team_name claim in the JWT) keep the current body-only path for backwards compatibility. The Execution API's team-isolation contract is unchanged. It is still documented as experimental and not enforced cross-team (see airflow-core/docs/security/workload.rst section 'No team-level isolation in Execution API'). This patch closes a specific JWT-vs-body-mismatch gap ahead of the future team-isolation work referenced in that document. Tests: 4-case validation (cross-team rejected with 403, JWT-team used when body omits team_name, legitimate match succeeds, legacy backcompat path). Signed-off-by: Omkhar Arasaratnam <omkhar@gmail.com>
Apply ruff-format to providers/edge3/tests/unit/edge3/worker_api/ routes/test_jobs.py and test_worker.py. Whitespace-only change to satisfy CI's static-checks job (Run 'ruff format' hook): multi-arg fetch(...) and PUT/DELETE call sites get one-arg-per-line formatting. No semantic change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
omkhar
force-pushed
the
omkhar/edge3-bind-team-name-in-jwt
branch
from
4c23d36 to
a14693f
Compare
Contributor
Author
|
The one failing job ( Could a maintainer kick off a rerun of just the failed job? Happy to push an empty commit instead if that's preferred. Thanks. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supplements #66718 (which clarified
WorkerQueuesBase.team_nameis an experimental hint).Defense-in-depth for the experimental edge3 multi-team feature. Worker
team_nameis currently sent in request bodies only and trusted by the server. This PR bindsteam_nameinto the JWT at issue time and rejects requests where the body'steam_namedisagrees with the JWT's. Legacy pre-team-claim workers (noteam_nameclaim in the JWT) keep the current body-only path for backwards compatibility.What changes
worker_api/auth.py— includeteam_namein the issued JWT claims at registration;jwt_token_authorizationreturns the validated payload (with the JWT-boundteam_name) for downstream comparison.worker_api/routes/jobs.py,worker_api/routes/worker.py— comparebody.team_nameto the JWT-boundteam_name; reject with 403 on mismatch; fall back to body-only when no JWT claim (legacy backcompat).cli/api_client.py— small alignment so the worker-side path produces ateam_nameconsistent with what the server now binds.test_jobs.py/test_worker.py—team_name.What does NOT change
The Execution API's team-isolation contract is unchanged. It remains documented as experimental and is not enforced cross-team — see
airflow-core/docs/security/workload.rstsection "No team-level isolation in Execution API (experimental multi-team feature)". This PR closes a specific JWT-vs-body-mismatch gap ahead of the future team-isolation work referenced in that document.No new APIs, no behavior change for single-team / no-team setups, no schema migrations.
Notes
cb2aaf4.