Airflow 2.5.3, unable to specify ssl key and cert for webserver in Docker based installation

[jayramr]

Apache Airflow version

Other Airflow 2 version (please specify below)

What happened

airflow webserver --ssl-cert domain.pem --ssl-key domain.key

What you think should happen instead

it should server the website with ssl

How to reproduce

Without ssl works
$airflow webserver

With ssl , the webserver not working and no logs even with debug
$airflow webserver --ssl-cert domain.pem --ssl-key domain.key

Operating System

ubuntu 20.04

Versions of Apache Airflow Providers

2.5.3

Deployment

Virtualenv installation

Deployment details

No response

Anything else

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[boring-cyborg[bot]]

Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.

[jayramr]

Hi,

With pypi based installation, below works with ssl.

airflow webserver --ssl-cert domain.cer --ssl-key domain.key

When I specify in airflow.cfg, the webservice is not starting.

But on docker setup, i defined in airflow.cfg and also as a variable as follows

AIRFLOW__WEBSERVER__WEB_SERVER_SSL_CERT: /opt/airflow/certs/domain.cer
AIRFLOW__WEBSERVER__WEB_SERVER_SSL_KEY: /opt/airflow/certs/domain.key

The webserver service for the container is showing unhealthy. Kindly let me know how can i integrate ssl in docker based installation.

Thanks
Jay

[potiuk]

I guess the same. Just use those command switches when running webserver.

[potiuk]

But you need to check if you have all the required dependencis added for that in the image - there is no reason of why webserver run locally with the switches work, while in the docker it does not - than some dependencies that might be needed.

Converted it into a discussion as this is deployment question not Airlfow issue (and try not to open issues when things are about configuring and running issues in the future).

[jayramr]

Thanks @potiuk for your suggestions. Sure next time i will open as a discussion.

I already specified the same switch in the docker-compose file as follows

  airflow-webserver:
    <<: *airflow-common
    command: webserver --ssl-cert domain.cer --ssl-key domain.key
    ports:
      - "8080:8080"
    healthcheck:
      test: ["CMD", "curl", "--fail", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s
    restart: always
    depends_on:
      <<: *airflow-common-depends-on
      airflow-init:
        condition: service_completed_successfully

The docker compose status shows unhealtly state and even i started with --debug option, still no valid logs found.

I believe the image apache/airflow:2.5.3 comes with all the necessary dependencies.

Please let me know

Thanks
Jay

[potiuk]

The docker compose status shows unhealtly state and even i started with --debug option, still no valid logs found.

I think you answered yourself. Isn't that because you use http in the health check? And did you check the port number opened by the webserver and whether the forwarded port is properly specified?

The docker-compose is yours to edit if you want to change it's beheviour to fit your expectations. Docker Compose is a "developer" tool - its not customizable in ways to enale/disable features by configuring it. It is supposed to be modified if you want to modify it's behaviour. In this case you changed the protocol at which the webserver responds, but at the same time you have not changed the protocol of the health-check that checks it.

You shoudl consult docker compose to check what logs you can get as outpug of health-check.

Also (possibly - depending what kind of certificate you have (self signed or not) you might need to make sure the health check works with it and validates the right certificate. But I will leave that exercise to you.

[jayramr]

Thanks @potiuk for the pointer.

I changed the health check from http to https fixed the issue.

I'm not using self signed.

I'm marking this discussion as solved and closed.

Thanks
Jay