edge3: bind team_name into worker JWT (defense-in-depth for experimental multi-team) by omkhar · Pull Request #67397 · apache/airflow

omkhar · 2026-05-24T02:31:57Z

Supplements #66718 (which clarified WorkerQueuesBase.team_name is an experimental hint).

Defense-in-depth for the experimental edge3 multi-team feature. Worker team_name is currently sent in request bodies only and trusted by the server. This PR binds team_name into the JWT at issue time and rejects requests where the body's team_name disagrees with the JWT's. Legacy pre-team-claim workers (no team_name claim in the JWT) keep the current body-only path for backwards compatibility.

What changes

worker_api/auth.py — include team_name in the issued JWT claims at registration; jwt_token_authorization returns the validated payload (with the JWT-bound team_name) for downstream comparison.
worker_api/routes/jobs.py, worker_api/routes/worker.py — compare body.team_name to the JWT-bound team_name; reject with 403 on mismatch; fall back to body-only when no JWT claim (legacy backcompat).
cli/api_client.py — small alignment so the worker-side path produces a team_name consistent with what the server now binds.
Tests: 4-case validation in test_jobs.py / test_worker.py —
1. Cross-team rejected (403).
2. JWT team used when body omits team_name.
3. Legitimate match succeeds.
4. Legacy backcompat path (no JWT claim) still works.

What does NOT change

The Execution API's team-isolation contract is unchanged. It remains documented as experimental and is not enforced cross-team — see airflow-core/docs/security/workload.rst section "No team-level isolation in Execution API (experimental multi-team feature)". This PR closes a specific JWT-vs-body-mismatch gap ahead of the future team-isolation work referenced in that document.

No new APIs, no behavior change for single-team / no-team setups, no schema migrations.

Notes

Sibling to docs(edge3): clarify WorkerQueuesBase.team_name is an experimental hint, cross-ref workload.rst #66718 (docstring + cross-ref alignment). The two are independent merges; docs(edge3): clarify WorkerQueuesBase.team_name is an experimental hint, cross-ref workload.rst #66718 has already merged at cb2aaf4.
Branch is behind main; happy to rebase once reviewers have eyes on it.

omkhar · 2026-05-24T04:06:02Z

The one failing job (Integration core otel / test_export_legacy_metric_names) looks like a pre-existing flake on main — the identical failure hit apache/main itself on Tests (AMD) run 26342500539 at 2026-05-23 20:16 for SHA 16ad4794 (the same HEAD this PR was rebased onto), and that same SHA then passed Tests (ARM) at 21:43 and CodeQL at 02:14. Nothing in this PR touches OTEL paths.

Could a maintainer kick off a rerun of just the failed job? Happy to push an empty commit instead if that's preferred. Thanks.

jscheffl

I am not sure if in reading the code... adding team_name to JWT will make it any kind more secure. Because all workers share atm the same secret. So even if you add this, as long as all teams/workers share the same, this is only adding complexity but no safety. In this regards I'd rather propose to implement a different key system first, because it would maybe lead to a consideration team_names are secured but they are not.

potiuk · 2026-05-24T15:57:55Z

@omkhar A few things need addressing before review — see our Pull Request quality criteria.

❌ Integration tests fail: Integration and System Tests / Integration core otel — OpenTelemetry integration test is red. Worth checking whether the JWT team-binding change perturbs the otel context, or if this is unrelated/flaky. See the failing job.

No rush.

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. Once you have addressed the points above, an Apache Airflow maintainer — a real person — will take the next look at your PR. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

…tal multi-team) Defense-in-depth for the experimental edge3 multi-team feature. Worker team_name is currently sent in request bodies only and trusted by the server. This change binds team_name into the JWT at issue time and rejects requests where the body's team_name disagrees with the JWT's. Legacy pre-team-claim workers (no team_name claim in the JWT) keep the current body-only path for backwards compatibility. The Execution API's team-isolation contract is unchanged. It is still documented as experimental and not enforced cross-team (see airflow-core/docs/security/workload.rst section 'No team-level isolation in Execution API'). This patch closes a specific JWT-vs-body-mismatch gap ahead of the future team-isolation work referenced in that document. Tests: 4-case validation (cross-team rejected with 403, JWT-team used when body omits team_name, legitimate match succeeds, legacy backcompat path). Signed-off-by: Omkhar Arasaratnam <omkhar@gmail.com>

Apply ruff-format to providers/edge3/tests/unit/edge3/worker_api/ routes/test_jobs.py and test_worker.py. Whitespace-only change to satisfy CI's static-checks job (Run 'ruff format' hook): multi-arg fetch(...) and PUT/DELETE call sites get one-arg-per-line formatting. No semantic change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

omkhar · 2026-05-26T04:27:07Z

Pushed 586913359b — rebased onto current apache/main, which now includes #67455 (bound scheduler shutdown wait, merged 2026-05-25 19:00Z) and #67170 (90s execution_timeout, merged 2026-05-19) — the two recent flake fixes for test_export_legacy_metric_names. The earlier run's CI started 2026-05-24 03:15Z, before #67455 landed.

One conflict during the rebase, in providers/edge3/src/airflow/providers/edge3/worker_api/auth.py: #67374 (merged 2026-05-24 20:32Z) removed jwt_token_authorization_rpc as dead Airflow-2 code; this PR had also been modifying that function. Resolved by taking #67374's deletion — there are no remaining callers (grepped) and the team_name binding work lives in jwt_token_authorization, jwt_token_authorization_rest, and the new assert_jwt_team_matches_body helper, all unaffected.

Diff still scoped to the same 6 providers/edge3/ files; no airflow-core touches. CI re-running against the post-#67455 base.

Drafted-by: Claude Code (Opus 4.7); reviewed by @omkhar before posting

omkhar · 2026-05-24T02:31:57Z

Supplements #66718 (which clarified WorkerQueuesBase.team_name is an experimental hint).

Defense-in-depth for the experimental edge3 multi-team feature. Worker team_name is currently sent in request bodies only and trusted by the server. This PR binds team_name into the JWT at issue time and rejects requests where the body's team_name disagrees with the JWT's. Legacy pre-team-claim workers (no team_name claim in the JWT) keep the current body-only path for backwards compatibility.

What changes

worker_api/auth.py — include team_name in the issued JWT claims at registration; jwt_token_authorization returns the validated payload (with the JWT-bound team_name) for downstream comparison.
worker_api/routes/jobs.py, worker_api/routes/worker.py — compare body.team_name to the JWT-bound team_name; reject with 403 on mismatch; fall back to body-only when no JWT claim (legacy backcompat).
cli/api_client.py — small alignment so the worker-side path produces a team_name consistent with what the server now binds.
Tests: 4-case validation in test_jobs.py / test_worker.py —
1. Cross-team rejected (403).
2. JWT team used when body omits team_name.
3. Legitimate match succeeds.
4. Legacy backcompat path (no JWT claim) still works.

What does NOT change

The Execution API's team-isolation contract is unchanged. It remains documented as experimental and is not enforced cross-team — see airflow-core/docs/security/workload.rst section "No team-level isolation in Execution API (experimental multi-team feature)". This PR closes a specific JWT-vs-body-mismatch gap ahead of the future team-isolation work referenced in that document.

No new APIs, no behavior change for single-team / no-team setups, no schema migrations.

Notes

Sibling to docs(edge3): clarify WorkerQueuesBase.team_name is an experimental hint, cross-ref workload.rst #66718 (docstring + cross-ref alignment). The two are independent merges; docs(edge3): clarify WorkerQueuesBase.team_name is an experimental hint, cross-ref workload.rst #66718 has already merged at cb2aaf4.
Branch is behind main; happy to rebase once reviewers have eyes on it.

omkhar · 2026-05-24T04:06:02Z

The one failing job (Integration core otel / test_export_legacy_metric_names) looks like a pre-existing flake on main — the identical failure hit apache/main itself on Tests (AMD) run 26342500539 at 2026-05-23 20:16 for SHA 16ad4794 (the same HEAD this PR was rebased onto), and that same SHA then passed Tests (ARM) at 21:43 and CodeQL at 02:14. Nothing in this PR touches OTEL paths.

Could a maintainer kick off a rerun of just the failed job? Happy to push an empty commit instead if that's preferred. Thanks.

jscheffl

I am not sure if in reading the code... adding team_name to JWT will make it any kind more secure. Because all workers share atm the same secret. So even if you add this, as long as all teams/workers share the same, this is only adding complexity but no safety. In this regards I'd rather propose to implement a different key system first, because it would maybe lead to a consideration team_names are secured but they are not.

potiuk · 2026-05-24T15:57:55Z

@omkhar A few things need addressing before review — see our Pull Request quality criteria.

❌ Integration tests fail: Integration and System Tests / Integration core otel — OpenTelemetry integration test is red. Worth checking whether the JWT team-binding change perturbs the otel context, or if this is unrelated/flaky. See the failing job.

No rush.

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. Once you have addressed the points above, an Apache Airflow maintainer — a real person — will take the next look at your PR. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

…tal multi-team) Defense-in-depth for the experimental edge3 multi-team feature. Worker team_name is currently sent in request bodies only and trusted by the server. This change binds team_name into the JWT at issue time and rejects requests where the body's team_name disagrees with the JWT's. Legacy pre-team-claim workers (no team_name claim in the JWT) keep the current body-only path for backwards compatibility. The Execution API's team-isolation contract is unchanged. It is still documented as experimental and not enforced cross-team (see airflow-core/docs/security/workload.rst section 'No team-level isolation in Execution API'). This patch closes a specific JWT-vs-body-mismatch gap ahead of the future team-isolation work referenced in that document. Tests: 4-case validation (cross-team rejected with 403, JWT-team used when body omits team_name, legitimate match succeeds, legacy backcompat path). Signed-off-by: Omkhar Arasaratnam <omkhar@gmail.com>

Apply ruff-format to providers/edge3/tests/unit/edge3/worker_api/ routes/test_jobs.py and test_worker.py. Whitespace-only change to satisfy CI's static-checks job (Run 'ruff format' hook): multi-arg fetch(...) and PUT/DELETE call sites get one-arg-per-line formatting. No semantic change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

omkhar · 2026-05-26T04:27:07Z

Pushed 586913359b — rebased onto current apache/main, which now includes #67455 (bound scheduler shutdown wait, merged 2026-05-25 19:00Z) and #67170 (90s execution_timeout, merged 2026-05-19) — the two recent flake fixes for test_export_legacy_metric_names. The earlier run's CI started 2026-05-24 03:15Z, before #67455 landed.

One conflict during the rebase, in providers/edge3/src/airflow/providers/edge3/worker_api/auth.py: #67374 (merged 2026-05-24 20:32Z) removed jwt_token_authorization_rpc as dead Airflow-2 code; this PR had also been modifying that function. Resolved by taking #67374's deletion — there are no remaining callers (grepped) and the team_name binding work lives in jwt_token_authorization, jwt_token_authorization_rest, and the new assert_jwt_team_matches_body helper, all unaffected.

Diff still scoped to the same 6 providers/edge3/ files; no airflow-core touches. CI re-running against the post-#67455 base.

Drafted-by: Claude Code (Opus 4.7); reviewed by @omkhar before posting

omkhar · 2026-05-24T02:31:57Z

Supplements #66718 (which clarified WorkerQueuesBase.team_name is an experimental hint).

Defense-in-depth for the experimental edge3 multi-team feature. Worker team_name is currently sent in request bodies only and trusted by the server. This PR binds team_name into the JWT at issue time and rejects requests where the body's team_name disagrees with the JWT's. Legacy pre-team-claim workers (no team_name claim in the JWT) keep the current body-only path for backwards compatibility.

What changes

worker_api/auth.py — include team_name in the issued JWT claims at registration; jwt_token_authorization returns the validated payload (with the JWT-bound team_name) for downstream comparison.
worker_api/routes/jobs.py, worker_api/routes/worker.py — compare body.team_name to the JWT-bound team_name; reject with 403 on mismatch; fall back to body-only when no JWT claim (legacy backcompat).
cli/api_client.py — small alignment so the worker-side path produces a team_name consistent with what the server now binds.
Tests: 4-case validation in test_jobs.py / test_worker.py —
1. Cross-team rejected (403).
2. JWT team used when body omits team_name.
3. Legitimate match succeeds.
4. Legacy backcompat path (no JWT claim) still works.

What does NOT change

The Execution API's team-isolation contract is unchanged. It remains documented as experimental and is not enforced cross-team — see airflow-core/docs/security/workload.rst section "No team-level isolation in Execution API (experimental multi-team feature)". This PR closes a specific JWT-vs-body-mismatch gap ahead of the future team-isolation work referenced in that document.

No new APIs, no behavior change for single-team / no-team setups, no schema migrations.

Notes

Sibling to docs(edge3): clarify WorkerQueuesBase.team_name is an experimental hint, cross-ref workload.rst #66718 (docstring + cross-ref alignment). The two are independent merges; docs(edge3): clarify WorkerQueuesBase.team_name is an experimental hint, cross-ref workload.rst #66718 has already merged at cb2aaf4.
Branch is behind main; happy to rebase once reviewers have eyes on it.

omkhar · 2026-05-24T04:06:02Z

The one failing job (Integration core otel / test_export_legacy_metric_names) looks like a pre-existing flake on main — the identical failure hit apache/main itself on Tests (AMD) run 26342500539 at 2026-05-23 20:16 for SHA 16ad4794 (the same HEAD this PR was rebased onto), and that same SHA then passed Tests (ARM) at 21:43 and CodeQL at 02:14. Nothing in this PR touches OTEL paths.

Could a maintainer kick off a rerun of just the failed job? Happy to push an empty commit instead if that's preferred. Thanks.

jscheffl

I am not sure if in reading the code... adding team_name to JWT will make it any kind more secure. Because all workers share atm the same secret. So even if you add this, as long as all teams/workers share the same, this is only adding complexity but no safety. In this regards I'd rather propose to implement a different key system first, because it would maybe lead to a consideration team_names are secured but they are not.

potiuk · 2026-05-24T15:57:55Z

@omkhar A few things need addressing before review — see our Pull Request quality criteria.

❌ Integration tests fail: Integration and System Tests / Integration core otel — OpenTelemetry integration test is red. Worth checking whether the JWT team-binding change perturbs the otel context, or if this is unrelated/flaky. See the failing job.

No rush.

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. Once you have addressed the points above, an Apache Airflow maintainer — a real person — will take the next look at your PR. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

…tal multi-team) Defense-in-depth for the experimental edge3 multi-team feature. Worker team_name is currently sent in request bodies only and trusted by the server. This change binds team_name into the JWT at issue time and rejects requests where the body's team_name disagrees with the JWT's. Legacy pre-team-claim workers (no team_name claim in the JWT) keep the current body-only path for backwards compatibility. The Execution API's team-isolation contract is unchanged. It is still documented as experimental and not enforced cross-team (see airflow-core/docs/security/workload.rst section 'No team-level isolation in Execution API'). This patch closes a specific JWT-vs-body-mismatch gap ahead of the future team-isolation work referenced in that document. Tests: 4-case validation (cross-team rejected with 403, JWT-team used when body omits team_name, legitimate match succeeds, legacy backcompat path). Signed-off-by: Omkhar Arasaratnam <omkhar@gmail.com>

Apply ruff-format to providers/edge3/tests/unit/edge3/worker_api/ routes/test_jobs.py and test_worker.py. Whitespace-only change to satisfy CI's static-checks job (Run 'ruff format' hook): multi-arg fetch(...) and PUT/DELETE call sites get one-arg-per-line formatting. No semantic change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

omkhar · 2026-05-26T04:27:07Z

Pushed 586913359b — rebased onto current apache/main, which now includes #67455 (bound scheduler shutdown wait, merged 2026-05-25 19:00Z) and #67170 (90s execution_timeout, merged 2026-05-19) — the two recent flake fixes for test_export_legacy_metric_names. The earlier run's CI started 2026-05-24 03:15Z, before #67455 landed.

One conflict during the rebase, in providers/edge3/src/airflow/providers/edge3/worker_api/auth.py: #67374 (merged 2026-05-24 20:32Z) removed jwt_token_authorization_rpc as dead Airflow-2 code; this PR had also been modifying that function. Resolved by taking #67374's deletion — there are no remaining callers (grepped) and the team_name binding work lives in jwt_token_authorization, jwt_token_authorization_rest, and the new assert_jwt_team_matches_body helper, all unaffected.

Diff still scoped to the same 6 providers/edge3/ files; no airflow-core touches. CI re-running against the post-#67455 base.

Drafted-by: Claude Code (Opus 4.7); reviewed by @omkhar before posting

omkhar · 2026-05-24T02:31:57Z

Supplements #66718 (which clarified WorkerQueuesBase.team_name is an experimental hint).

Defense-in-depth for the experimental edge3 multi-team feature. Worker team_name is currently sent in request bodies only and trusted by the server. This PR binds team_name into the JWT at issue time and rejects requests where the body's team_name disagrees with the JWT's. Legacy pre-team-claim workers (no team_name claim in the JWT) keep the current body-only path for backwards compatibility.

What changes

worker_api/auth.py — include team_name in the issued JWT claims at registration; jwt_token_authorization returns the validated payload (with the JWT-bound team_name) for downstream comparison.
worker_api/routes/jobs.py, worker_api/routes/worker.py — compare body.team_name to the JWT-bound team_name; reject with 403 on mismatch; fall back to body-only when no JWT claim (legacy backcompat).
cli/api_client.py — small alignment so the worker-side path produces a team_name consistent with what the server now binds.
Tests: 4-case validation in test_jobs.py / test_worker.py —
1. Cross-team rejected (403).
2. JWT team used when body omits team_name.
3. Legitimate match succeeds.
4. Legacy backcompat path (no JWT claim) still works.

What does NOT change

The Execution API's team-isolation contract is unchanged. It remains documented as experimental and is not enforced cross-team — see airflow-core/docs/security/workload.rst section "No team-level isolation in Execution API (experimental multi-team feature)". This PR closes a specific JWT-vs-body-mismatch gap ahead of the future team-isolation work referenced in that document.

No new APIs, no behavior change for single-team / no-team setups, no schema migrations.

Notes

Sibling to docs(edge3): clarify WorkerQueuesBase.team_name is an experimental hint, cross-ref workload.rst #66718 (docstring + cross-ref alignment). The two are independent merges; docs(edge3): clarify WorkerQueuesBase.team_name is an experimental hint, cross-ref workload.rst #66718 has already merged at cb2aaf4.
Branch is behind main; happy to rebase once reviewers have eyes on it.

omkhar · 2026-05-24T04:06:02Z

The one failing job (Integration core otel / test_export_legacy_metric_names) looks like a pre-existing flake on main — the identical failure hit apache/main itself on Tests (AMD) run 26342500539 at 2026-05-23 20:16 for SHA 16ad4794 (the same HEAD this PR was rebased onto), and that same SHA then passed Tests (ARM) at 21:43 and CodeQL at 02:14. Nothing in this PR touches OTEL paths.

Could a maintainer kick off a rerun of just the failed job? Happy to push an empty commit instead if that's preferred. Thanks.

jscheffl

I am not sure if in reading the code... adding team_name to JWT will make it any kind more secure. Because all workers share atm the same secret. So even if you add this, as long as all teams/workers share the same, this is only adding complexity but no safety. In this regards I'd rather propose to implement a different key system first, because it would maybe lead to a consideration team_names are secured but they are not.

potiuk · 2026-05-24T15:57:55Z

@omkhar A few things need addressing before review — see our Pull Request quality criteria.

❌ Integration tests fail: Integration and System Tests / Integration core otel — OpenTelemetry integration test is red. Worth checking whether the JWT team-binding change perturbs the otel context, or if this is unrelated/flaky. See the failing job.

No rush.

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. Once you have addressed the points above, an Apache Airflow maintainer — a real person — will take the next look at your PR. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

…tal multi-team) Defense-in-depth for the experimental edge3 multi-team feature. Worker team_name is currently sent in request bodies only and trusted by the server. This change binds team_name into the JWT at issue time and rejects requests where the body's team_name disagrees with the JWT's. Legacy pre-team-claim workers (no team_name claim in the JWT) keep the current body-only path for backwards compatibility. The Execution API's team-isolation contract is unchanged. It is still documented as experimental and not enforced cross-team (see airflow-core/docs/security/workload.rst section 'No team-level isolation in Execution API'). This patch closes a specific JWT-vs-body-mismatch gap ahead of the future team-isolation work referenced in that document. Tests: 4-case validation (cross-team rejected with 403, JWT-team used when body omits team_name, legitimate match succeeds, legacy backcompat path). Signed-off-by: Omkhar Arasaratnam <omkhar@gmail.com>

Apply ruff-format to providers/edge3/tests/unit/edge3/worker_api/ routes/test_jobs.py and test_worker.py. Whitespace-only change to satisfy CI's static-checks job (Run 'ruff format' hook): multi-arg fetch(...) and PUT/DELETE call sites get one-arg-per-line formatting. No semantic change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

omkhar · 2026-05-26T04:27:07Z

Pushed 586913359b — rebased onto current apache/main, which now includes #67455 (bound scheduler shutdown wait, merged 2026-05-25 19:00Z) and #67170 (90s execution_timeout, merged 2026-05-19) — the two recent flake fixes for test_export_legacy_metric_names. The earlier run's CI started 2026-05-24 03:15Z, before #67455 landed.

One conflict during the rebase, in providers/edge3/src/airflow/providers/edge3/worker_api/auth.py: #67374 (merged 2026-05-24 20:32Z) removed jwt_token_authorization_rpc as dead Airflow-2 code; this PR had also been modifying that function. Resolved by taking #67374's deletion — there are no remaining callers (grepped) and the team_name binding work lives in jwt_token_authorization, jwt_token_authorization_rest, and the new assert_jwt_team_matches_body helper, all unaffected.

Diff still scoped to the same 6 providers/edge3/ files; no airflow-core touches. CI re-running against the post-#67455 base.

Drafted-by: Claude Code (Opus 4.7); reviewed by @omkhar before posting

omkhar · 2026-05-24T02:31:57Z

Supplements #66718 (which clarified WorkerQueuesBase.team_name is an experimental hint).

Defense-in-depth for the experimental edge3 multi-team feature. Worker team_name is currently sent in request bodies only and trusted by the server. This PR binds team_name into the JWT at issue time and rejects requests where the body's team_name disagrees with the JWT's. Legacy pre-team-claim workers (no team_name claim in the JWT) keep the current body-only path for backwards compatibility.

What changes

worker_api/auth.py — include team_name in the issued JWT claims at registration; jwt_token_authorization returns the validated payload (with the JWT-bound team_name) for downstream comparison.
worker_api/routes/jobs.py, worker_api/routes/worker.py — compare body.team_name to the JWT-bound team_name; reject with 403 on mismatch; fall back to body-only when no JWT claim (legacy backcompat).
cli/api_client.py — small alignment so the worker-side path produces a team_name consistent with what the server now binds.
Tests: 4-case validation in test_jobs.py / test_worker.py —
1. Cross-team rejected (403).
2. JWT team used when body omits team_name.
3. Legitimate match succeeds.
4. Legacy backcompat path (no JWT claim) still works.

What does NOT change

The Execution API's team-isolation contract is unchanged. It remains documented as experimental and is not enforced cross-team — see airflow-core/docs/security/workload.rst section "No team-level isolation in Execution API (experimental multi-team feature)". This PR closes a specific JWT-vs-body-mismatch gap ahead of the future team-isolation work referenced in that document.

No new APIs, no behavior change for single-team / no-team setups, no schema migrations.

Notes

Sibling to docs(edge3): clarify WorkerQueuesBase.team_name is an experimental hint, cross-ref workload.rst #66718 (docstring + cross-ref alignment). The two are independent merges; docs(edge3): clarify WorkerQueuesBase.team_name is an experimental hint, cross-ref workload.rst #66718 has already merged at cb2aaf4.
Branch is behind main; happy to rebase once reviewers have eyes on it.

omkhar · 2026-05-24T04:06:02Z

The one failing job (Integration core otel / test_export_legacy_metric_names) looks like a pre-existing flake on main — the identical failure hit apache/main itself on Tests (AMD) run 26342500539 at 2026-05-23 20:16 for SHA 16ad4794 (the same HEAD this PR was rebased onto), and that same SHA then passed Tests (ARM) at 21:43 and CodeQL at 02:14. Nothing in this PR touches OTEL paths.

Could a maintainer kick off a rerun of just the failed job? Happy to push an empty commit instead if that's preferred. Thanks.

jscheffl

I am not sure if in reading the code... adding team_name to JWT will make it any kind more secure. Because all workers share atm the same secret. So even if you add this, as long as all teams/workers share the same, this is only adding complexity but no safety. In this regards I'd rather propose to implement a different key system first, because it would maybe lead to a consideration team_names are secured but they are not.

potiuk · 2026-05-24T15:57:55Z

@omkhar A few things need addressing before review — see our Pull Request quality criteria.

❌ Integration tests fail: Integration and System Tests / Integration core otel — OpenTelemetry integration test is red. Worth checking whether the JWT team-binding change perturbs the otel context, or if this is unrelated/flaky. See the failing job.

No rush.

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. Once you have addressed the points above, an Apache Airflow maintainer — a real person — will take the next look at your PR. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

…tal multi-team) Defense-in-depth for the experimental edge3 multi-team feature. Worker team_name is currently sent in request bodies only and trusted by the server. This change binds team_name into the JWT at issue time and rejects requests where the body's team_name disagrees with the JWT's. Legacy pre-team-claim workers (no team_name claim in the JWT) keep the current body-only path for backwards compatibility. The Execution API's team-isolation contract is unchanged. It is still documented as experimental and not enforced cross-team (see airflow-core/docs/security/workload.rst section 'No team-level isolation in Execution API'). This patch closes a specific JWT-vs-body-mismatch gap ahead of the future team-isolation work referenced in that document. Tests: 4-case validation (cross-team rejected with 403, JWT-team used when body omits team_name, legitimate match succeeds, legacy backcompat path). Signed-off-by: Omkhar Arasaratnam <omkhar@gmail.com>

Apply ruff-format to providers/edge3/tests/unit/edge3/worker_api/ routes/test_jobs.py and test_worker.py. Whitespace-only change to satisfy CI's static-checks job (Run 'ruff format' hook): multi-arg fetch(...) and PUT/DELETE call sites get one-arg-per-line formatting. No semantic change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

omkhar · 2026-05-26T04:27:07Z

Pushed 586913359b — rebased onto current apache/main, which now includes #67455 (bound scheduler shutdown wait, merged 2026-05-25 19:00Z) and #67170 (90s execution_timeout, merged 2026-05-19) — the two recent flake fixes for test_export_legacy_metric_names. The earlier run's CI started 2026-05-24 03:15Z, before #67455 landed.

One conflict during the rebase, in providers/edge3/src/airflow/providers/edge3/worker_api/auth.py: #67374 (merged 2026-05-24 20:32Z) removed jwt_token_authorization_rpc as dead Airflow-2 code; this PR had also been modifying that function. Resolved by taking #67374's deletion — there are no remaining callers (grepped) and the team_name binding work lives in jwt_token_authorization, jwt_token_authorization_rest, and the new assert_jwt_team_matches_body helper, all unaffected.

Diff still scoped to the same 6 providers/edge3/ files; no airflow-core touches. CI re-running against the post-#67455 base.

Drafted-by: Claude Code (Opus 4.7); reviewed by @omkhar before posting

omkhar · 2026-05-24T02:31:57Z

Supplements #66718 (which clarified WorkerQueuesBase.team_name is an experimental hint).

Defense-in-depth for the experimental edge3 multi-team feature. Worker team_name is currently sent in request bodies only and trusted by the server. This PR binds team_name into the JWT at issue time and rejects requests where the body's team_name disagrees with the JWT's. Legacy pre-team-claim workers (no team_name claim in the JWT) keep the current body-only path for backwards compatibility.

What changes

worker_api/auth.py — include team_name in the issued JWT claims at registration; jwt_token_authorization returns the validated payload (with the JWT-bound team_name) for downstream comparison.
worker_api/routes/jobs.py, worker_api/routes/worker.py — compare body.team_name to the JWT-bound team_name; reject with 403 on mismatch; fall back to body-only when no JWT claim (legacy backcompat).
cli/api_client.py — small alignment so the worker-side path produces a team_name consistent with what the server now binds.
Tests: 4-case validation in test_jobs.py / test_worker.py —
1. Cross-team rejected (403).
2. JWT team used when body omits team_name.
3. Legitimate match succeeds.
4. Legacy backcompat path (no JWT claim) still works.

What does NOT change

The Execution API's team-isolation contract is unchanged. It remains documented as experimental and is not enforced cross-team — see airflow-core/docs/security/workload.rst section "No team-level isolation in Execution API (experimental multi-team feature)". This PR closes a specific JWT-vs-body-mismatch gap ahead of the future team-isolation work referenced in that document.

No new APIs, no behavior change for single-team / no-team setups, no schema migrations.

Notes

Sibling to docs(edge3): clarify WorkerQueuesBase.team_name is an experimental hint, cross-ref workload.rst #66718 (docstring + cross-ref alignment). The two are independent merges; docs(edge3): clarify WorkerQueuesBase.team_name is an experimental hint, cross-ref workload.rst #66718 has already merged at cb2aaf4.
Branch is behind main; happy to rebase once reviewers have eyes on it.

omkhar · 2026-05-24T04:06:02Z

The one failing job (Integration core otel / test_export_legacy_metric_names) looks like a pre-existing flake on main — the identical failure hit apache/main itself on Tests (AMD) run 26342500539 at 2026-05-23 20:16 for SHA 16ad4794 (the same HEAD this PR was rebased onto), and that same SHA then passed Tests (ARM) at 21:43 and CodeQL at 02:14. Nothing in this PR touches OTEL paths.

Could a maintainer kick off a rerun of just the failed job? Happy to push an empty commit instead if that's preferred. Thanks.

jscheffl

I am not sure if in reading the code... adding team_name to JWT will make it any kind more secure. Because all workers share atm the same secret. So even if you add this, as long as all teams/workers share the same, this is only adding complexity but no safety. In this regards I'd rather propose to implement a different key system first, because it would maybe lead to a consideration team_names are secured but they are not.

potiuk · 2026-05-24T15:57:55Z

@omkhar A few things need addressing before review — see our Pull Request quality criteria.

❌ Integration tests fail: Integration and System Tests / Integration core otel — OpenTelemetry integration test is red. Worth checking whether the JWT team-binding change perturbs the otel context, or if this is unrelated/flaky. See the failing job.

No rush.

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. Once you have addressed the points above, an Apache Airflow maintainer — a real person — will take the next look at your PR. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

…tal multi-team) Defense-in-depth for the experimental edge3 multi-team feature. Worker team_name is currently sent in request bodies only and trusted by the server. This change binds team_name into the JWT at issue time and rejects requests where the body's team_name disagrees with the JWT's. Legacy pre-team-claim workers (no team_name claim in the JWT) keep the current body-only path for backwards compatibility. The Execution API's team-isolation contract is unchanged. It is still documented as experimental and not enforced cross-team (see airflow-core/docs/security/workload.rst section 'No team-level isolation in Execution API'). This patch closes a specific JWT-vs-body-mismatch gap ahead of the future team-isolation work referenced in that document. Tests: 4-case validation (cross-team rejected with 403, JWT-team used when body omits team_name, legitimate match succeeds, legacy backcompat path). Signed-off-by: Omkhar Arasaratnam <omkhar@gmail.com>

Apply ruff-format to providers/edge3/tests/unit/edge3/worker_api/ routes/test_jobs.py and test_worker.py. Whitespace-only change to satisfy CI's static-checks job (Run 'ruff format' hook): multi-arg fetch(...) and PUT/DELETE call sites get one-arg-per-line formatting. No semantic change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

omkhar · 2026-05-26T04:27:07Z

Pushed 586913359b — rebased onto current apache/main, which now includes #67455 (bound scheduler shutdown wait, merged 2026-05-25 19:00Z) and #67170 (90s execution_timeout, merged 2026-05-19) — the two recent flake fixes for test_export_legacy_metric_names. The earlier run's CI started 2026-05-24 03:15Z, before #67455 landed.

One conflict during the rebase, in providers/edge3/src/airflow/providers/edge3/worker_api/auth.py: #67374 (merged 2026-05-24 20:32Z) removed jwt_token_authorization_rpc as dead Airflow-2 code; this PR had also been modifying that function. Resolved by taking #67374's deletion — there are no remaining callers (grepped) and the team_name binding work lives in jwt_token_authorization, jwt_token_authorization_rest, and the new assert_jwt_team_matches_body helper, all unaffected.

Diff still scoped to the same 6 providers/edge3/ files; no airflow-core touches. CI re-running against the post-#67455 base.

Drafted-by: Claude Code (Opus 4.7); reviewed by @omkhar before posting

omkhar · 2026-05-24T02:31:57Z

Supplements #66718 (which clarified WorkerQueuesBase.team_name is an experimental hint).

Defense-in-depth for the experimental edge3 multi-team feature. Worker team_name is currently sent in request bodies only and trusted by the server. This PR binds team_name into the JWT at issue time and rejects requests where the body's team_name disagrees with the JWT's. Legacy pre-team-claim workers (no team_name claim in the JWT) keep the current body-only path for backwards compatibility.

What changes

worker_api/auth.py — include team_name in the issued JWT claims at registration; jwt_token_authorization returns the validated payload (with the JWT-bound team_name) for downstream comparison.
worker_api/routes/jobs.py, worker_api/routes/worker.py — compare body.team_name to the JWT-bound team_name; reject with 403 on mismatch; fall back to body-only when no JWT claim (legacy backcompat).
cli/api_client.py — small alignment so the worker-side path produces a team_name consistent with what the server now binds.
Tests: 4-case validation in test_jobs.py / test_worker.py —
1. Cross-team rejected (403).
2. JWT team used when body omits team_name.
3. Legitimate match succeeds.
4. Legacy backcompat path (no JWT claim) still works.

What does NOT change

The Execution API's team-isolation contract is unchanged. It remains documented as experimental and is not enforced cross-team — see airflow-core/docs/security/workload.rst section "No team-level isolation in Execution API (experimental multi-team feature)". This PR closes a specific JWT-vs-body-mismatch gap ahead of the future team-isolation work referenced in that document.

No new APIs, no behavior change for single-team / no-team setups, no schema migrations.

Notes

Sibling to docs(edge3): clarify WorkerQueuesBase.team_name is an experimental hint, cross-ref workload.rst #66718 (docstring + cross-ref alignment). The two are independent merges; docs(edge3): clarify WorkerQueuesBase.team_name is an experimental hint, cross-ref workload.rst #66718 has already merged at cb2aaf4.
Branch is behind main; happy to rebase once reviewers have eyes on it.

omkhar · 2026-05-24T04:06:02Z

The one failing job (Integration core otel / test_export_legacy_metric_names) looks like a pre-existing flake on main — the identical failure hit apache/main itself on Tests (AMD) run 26342500539 at 2026-05-23 20:16 for SHA 16ad4794 (the same HEAD this PR was rebased onto), and that same SHA then passed Tests (ARM) at 21:43 and CodeQL at 02:14. Nothing in this PR touches OTEL paths.

Could a maintainer kick off a rerun of just the failed job? Happy to push an empty commit instead if that's preferred. Thanks.

jscheffl

I am not sure if in reading the code... adding team_name to JWT will make it any kind more secure. Because all workers share atm the same secret. So even if you add this, as long as all teams/workers share the same, this is only adding complexity but no safety. In this regards I'd rather propose to implement a different key system first, because it would maybe lead to a consideration team_names are secured but they are not.

potiuk · 2026-05-24T15:57:55Z

@omkhar A few things need addressing before review — see our Pull Request quality criteria.

❌ Integration tests fail: Integration and System Tests / Integration core otel — OpenTelemetry integration test is red. Worth checking whether the JWT team-binding change perturbs the otel context, or if this is unrelated/flaky. See the failing job.

No rush.

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. Once you have addressed the points above, an Apache Airflow maintainer — a real person — will take the next look at your PR. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

…tal multi-team) Defense-in-depth for the experimental edge3 multi-team feature. Worker team_name is currently sent in request bodies only and trusted by the server. This change binds team_name into the JWT at issue time and rejects requests where the body's team_name disagrees with the JWT's. Legacy pre-team-claim workers (no team_name claim in the JWT) keep the current body-only path for backwards compatibility. The Execution API's team-isolation contract is unchanged. It is still documented as experimental and not enforced cross-team (see airflow-core/docs/security/workload.rst section 'No team-level isolation in Execution API'). This patch closes a specific JWT-vs-body-mismatch gap ahead of the future team-isolation work referenced in that document. Tests: 4-case validation (cross-team rejected with 403, JWT-team used when body omits team_name, legitimate match succeeds, legacy backcompat path). Signed-off-by: Omkhar Arasaratnam <omkhar@gmail.com>

Apply ruff-format to providers/edge3/tests/unit/edge3/worker_api/ routes/test_jobs.py and test_worker.py. Whitespace-only change to satisfy CI's static-checks job (Run 'ruff format' hook): multi-arg fetch(...) and PUT/DELETE call sites get one-arg-per-line formatting. No semantic change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

omkhar · 2026-05-26T04:27:07Z

Pushed 586913359b — rebased onto current apache/main, which now includes #67455 (bound scheduler shutdown wait, merged 2026-05-25 19:00Z) and #67170 (90s execution_timeout, merged 2026-05-19) — the two recent flake fixes for test_export_legacy_metric_names. The earlier run's CI started 2026-05-24 03:15Z, before #67455 landed.

One conflict during the rebase, in providers/edge3/src/airflow/providers/edge3/worker_api/auth.py: #67374 (merged 2026-05-24 20:32Z) removed jwt_token_authorization_rpc as dead Airflow-2 code; this PR had also been modifying that function. Resolved by taking #67374's deletion — there are no remaining callers (grepped) and the team_name binding work lives in jwt_token_authorization, jwt_token_authorization_rest, and the new assert_jwt_team_matches_body helper, all unaffected.

Diff still scoped to the same 6 providers/edge3/ files; no airflow-core touches. CI re-running against the post-#67455 base.

Drafted-by: Claude Code (Opus 4.7); reviewed by @omkhar before posting

omkhar requested review from dheerajturaga and jscheffl as code owners May 24, 2026 02:31

boring-cyborgBot added area:providers provider:edge Edge Executor / Worker (AIP-69) / edge3 labels May 24, 2026

jscheffl reviewed May 24, 2026
View reviewed changes

omkharand others added 2 commits May 25, 2026 21:24