Docker-airflow: Unable to edit encrypted connections on UI

[plim0793]

I use the docker-compose file to start the webserver and when I go to edit a connection on the UI I get this error:

Traceback (most recent call last): File "/usr/local/lib/python3.6/site-packages/cryptography/fernet.py", line 104, in _verify_signature h.verify(data[-32:]) File "/usr/local/lib/python3.6/site-packages/cryptography/hazmat/primitives/hmac.py", line 67, in verify ctx.verify(signature) File "/usr/local/lib/python3.6/site-packages/cryptography/hazmat/backends/openssl/hmac.py", line 75, in verify raise InvalidSignature("Signature did not match digest.") cryptography.exceptions.InvalidSignature: Signature did not match digest.

I believe this is an issue with the fernet key. Has anyone encountered this issue before and if so how was it resolved?

[zhongjiajie]

which compose yaml file do you use?

[ReptilianBrain]

Hi. I've ran into a similar issue using the docker-compose-LocalExecutor.yml file and trying to edit the postgres_default configuration

But i was able to edit it once I added my fernet_key to the path in my docker-compose file

[mrhorvath]

Reptillian has the right of it. The docs say that the fernet key is generated at startup. If you've re-created the webserver container without bringing down services with the docker-compose file you will run into this issue unless you've set the fernet key in the compose file.

For encrypted connection passwords (in Local or Celery Executor), you must have the same fernet_key. By default docker-airflow generates the fernet_key at startup, you have to set an environment variable in the docker-compose (ie: docker-compose-LocalExecutor.yml) file to set the same key accross containers.

[joaquinclearmetal]

This should be documented at least. It makes sense for throw-away containers, but if you go beyond disposable dev environment, then one needs to know this behavior.

[marlonholland]

Reptillian has the right of it. The docs say that the fernet key is generated at startup. If you've re-created the webserver container without bringing down services with the docker-compose file you will run into this issue unless you've set the fernet key in the compose file.

For encrypted connection passwords (in Local or Celery Executor), you must have the same fernet_key. By default docker-airflow generates the fernet_key at startup, you have to set an environment variable in the docker-compose (ie: docker-compose-LocalExecutor.yml) file to set the same key accross containers.

So how do you properly set the fernet key in the compose file?

[t-jayw]

I'd also like to know the correct way to set a fernet key in the docker-compose-LocalExecutor.yml file so that I can bring my instance up and down safely