[schwarztrinker]

Fixes #1047.

What

The API server ran Airflow 3's default SimpleAuthManager, while every user the platform provisions is a FAB user. POST /auth/token therefore answered 401 {"detail":"Invalid credentials"} for nova-api (Secret airflow-nova-api), for admin (Secret airflow-admin), and for everyone else. Nova renders that as “The scheduler did not answer” and “Could not read runs”; the scheduler itself was healthy.

This puts the FAB manager back on the api-server and adds manifests/airflow-auth-manager.yaml, a ConfigMap carrying one small subclass:

• The stock FabAuthManager.create_token only checks a password when FAB's AUTH_TYPE is AUTH_DB/AUTH_LDAP. This platform runs AUTH_TYPE=AUTH_OAUTH so people sign in through Keycloak, so the stock class refuses every password exchange — including the service accounts that have no browser.
• StardeltFabAuthManager.create_token asks the FAB user store directly, with the same input validation. A Keycloak user has no local password, so people still sign in only through OIDC.
• The auth manager and the module are mounted only on the api-server (the one container that serves the API), and step-airflow applies the ConfigMap before helm upgrade, so a fresh install cannot start without it.

Evidence (live cluster, before → after)

# before: the Secret's password is rejected
$ POST /auth/token {"username":"nova-api", ...}  -> 401 {"detail":"Invalid credentials"}
$ POST /auth/token {"username":"admin", ...}     -> 401 {"detail":"Invalid credentials"}
$ kubectl -n stardelt get deploy airflow-api-server ... AIRFLOW__API_AUTH__JWT_SECRET=<set>   # SimpleAuthManager

# after
$ POST /auth/token {"username":"nova-api", ...}  -> 201, token 315 chars
$ GET  /api/v2/dags                             -> 200 {"dags":[{"dag_id":"nyc_taxi_load",...}]}
$ POST /auth/token {"username":"admin", ...}     -> 201
$ POST /auth/token {"username":"nova-api","password":"wrong"} -> 401
$ GET  /api/v2/dags/pegelonline_hourly/dagRuns   -> 200, 3 runs

kubectl -n stardelt logs deploy/nova --since=4m | grep -c "sign-in was refused" → 0.

Checks

• python3 -m unittest discover -s scripts/tests → Ran 273 tests, OK (skipped=1); the new test_airflow_auth_manager.py covers the wiring: the manager name, the mount and PYTHONPATH, the module compiles from the ConfigMap, the Makefile applies it before Helm, and the -vN name in manifest and values agree.
• make lint → lint: OK (includes check-airflow-users).
• helm template airflow apache-airflow/airflow --version 1.22.0 -f helm-values/airflow.yaml renders AIRFLOW__CORE__AUTH_MANAGER and the mount on the api-server only.
• Deployed live with make step-airflow; release 38, api-server rolled cleanly.

Note for a later values edit

The ConfigMap name is versioned (airflow-auth-manager-v1). A content edit needs the suffix bumped — then the volume name changes and the pod rolls; an in-place ConfigMap edit would not.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.