CSRF会话令牌在气流中丢失

Question

我使用docker为气流。下面的docker-compose文件主要来自于气流官方网站。这在我的笔记本电脑上工作得很好，但当我上传到服务器时，当我在前端浏览时，我一直得到错误消息。

错误请求

CSRF会话令牌缺失。

从文档中，它告诉我我需要添加AIRFLOW__WEBSERVER__SECRET_KEY，所以我添加了它。我错过了什么吗?

version: '3'
x-airflow-common:
&airflow-common
image: <image name>
environment:
&airflow-common-env
AIRFLOW__CORE__EXECUTOR: CeleryExecutor
AIRFLOW__CORE__SQL_ALCHEMY_CONN: postgresql+psycopg2://<some connection  sting>
AIRFLOW__CELERY__RESULT_BACKEND: db+postgresql://<some connection  sting>
AIRFLOW__CELERY__BROKER_URL: redis://:@redis:6379/0
AIRFLOW__CELERY__FLOWER_PORT: '5556'
AIRFLOW__CORE__FERNET_KEY: ''
AIRFLOW__CORE__DAGS_ARE_PAUSED_AT_CREATION: 'True'
AIRFLOW__CORE__LOAD_EXAMPLES: 'False'
AIRFLOW__API__AUTH_BACKEND: 'airflow.api.auth.backend.basic_auth'
AIRFLOW__CORE__EXPOSE_CONFIG: 'True'
AIRFLOW__CORE__REMOTE_LOGGING: 'True'
AIRFLOW__CORE__REMOTE_BASE_LOG_FOLDER: <s3 location>
AIRFLOW__CORE__REMOTE_LOG_CONN_ID: 's3_connection'
AIRFLOW__CORE__ENCRYPT_S3_LOGS: 'False'
AIRFLOW__SMTP__SMTP_HOST: 'smtp.sendgrid.net'
AIRFLOW__SMTP__SMTP_STARTTLS: 'True'
AIRFLOW__SMTP__SMTP_SSL: 'False'
#AIRFLOW__SMTP__SMTP_USER: 'apikey'
#AIRFLOW__SMTP__SMTP_PASSWORD: <password>
AIRFLOW__SMTP__SMTP_PORT: '587'
AIRFLOW__SMTP__SMTP_MAIL_FROM: <email address>
_PIP_ADDITIONAL_REQUIREMENTS: ""
AIRFLOW__WEBSERVER__WORKERS: '1'
AIRFLOW__WEBSERVER__SECRET_KEY: 'secret_key'
volumes:
- ../dags:/opt/airflow/dags
- ../scripts:/opt/airflow/scripts
user: "${AIRFLOW_UID:-50000}:${AIRFLOW_GID:-50000}"
depends_on:
redis:
condition: service_healthy
services:
redis:
image: redis:latest
ports:
- 6379:6379
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 5s
timeout: 30s
retries: 50
restart: always
airflow-webserver:
<<: *airflow-common
command: webserver
extra_hosts:
- "host.docker.internal:host-gateway"
ports:
- 8080:8080
- 9000:9000
healthcheck:
test: ["CMD", "curl", "--fail", "http://localhost:8080/health"]
interval: 10s
timeout: 10s
retries: 5
restart: always
airflow-scheduler:
<<: *airflow-common
command: scheduler
healthcheck:
test: ["CMD-SHELL", 'airflow jobs check --job-type SchedulerJob --hostname "$${HOSTNAME}"']
interval: 10s
timeout: 10s
retries: 5
restart: always
airflow-worker:
<<: *airflow-common
command: celery worker
healthcheck:
test:
- "CMD-SHELL"
- 'celery --app airflow.executors.celery_executor.app inspect ping -d "celery@$${HOSTNAME}"'
interval: 10s
timeout: 10s
retries: 5
restart: always
airflow-init:
<<: *airflow-common
command: version
environment:
<<: *airflow-common-env
_AIRFLOW_DB_UPGRADE: 'true'
_AIRFLOW_WWW_USER_CREATE: 'true'
_AIRFLOW_WWW_USER_USERNAME: ${_AIRFLOW_WWW_USER_USERNAME:-airflow}
_AIRFLOW_WWW_USER_PASSWORD: ${_AIRFLOW_WWW_USER_PASSWORD:-airflow}
flower:
<<: *airflow-common
command: celery flower
ports:
- 5556:5556
healthcheck:
test: ["CMD", "curl", "--fail", "http://localhost:5556/"]
interval: 10s
timeout: 10s
retries: 5
restart: always
volumes:
postgres-db-volume:

Answer 1

确保工作节点和web服务器(主节点)中的AIRFLOW__WEBSERVER__SECRET_KEY的值相同。你可以在这篇文章中找到更多的细节。

工作节点运行一个web服务器来处理访问执行日志的请求，这就是为什么你看到这样的错误:*** Failed to fetch log file from worker. 403 Client Error: FORBIDDEN for url: https://worker.worker或CSRF session token is missing。

在你的worker，您可以将密钥的值添加到.env文件中，并将其加载到docker-compose定义中:

environment: &airflow-common-env
AIRFLOW__CORE__FERNET_KEY: ${FERNET_KEY}
AIRFLOW__WEBSERVER__SECRET_KEY: ${SECRET_KEY}
env_file:
- .env