Warnings about refusal to delete permissions on XComModelView

Apache Airflow version: 1.10.11

Kubernetes version (if you are using kubernetes) (use kubectl version): Client Version: version.Info{Major:“1”, Minor:“18”, GitVersion:“v1.18.6”, GitCommit:“dff82dc0de47299ab66c83c626e08b245ab19037”, GitTreeState:“clean”, BuildDate:“2020-07-16T00:04:31Z”, GoVersion:“go1.14.4”, Compiler:“gc”, Platform:“darwin/amd64”} Server Version: version.Info{Major:“1”, Minor:“17”, GitVersion:“v1.17.4”, GitCommit:“8d8aa39598534325ad77120c120a22b3a990b5ea”, GitTreeState:“clean”, BuildDate:“2020-03-13T06:39:58Z”, GoVersion:“go1.13.8”, Compiler:“gc”, Platform:“linux/amd64”}

Environment:

• Cloud provider or hardware configuration: Azure Kubernetes Service
• OS (e.g. from /etc/os-release): Debian GNU/Linux 10 (buster)
• Kernel (e.g. uname -a): Linux airflow-web-65cb7d9cb8-qzcbv 4.15.0-1089-azure #99~16.04.1-Ubuntu SMP Fri Jun 5 15:30:32 UTC 2020 x86_64 GNU/Linux
• Install tools: Helm chart “stable/airflow”
• Others:

What happened:

After upgrading from 1.10.10 to 1.10.11 (and also with new installs of 1.10.11) there are some permission warnings in the webserver logs:

[2020-08-14 22:19:30,022] {manager.py:545} WARNING - Refused to delete permission view, assoc with role exists XComModelView.can_add Admin
[2020-08-14 22:19:30,038] {manager.py:545} WARNING - Refused to delete permission view, assoc with role exists XComModelView.can_edit Admin

It seems to be directly related to https://github.com/apache/airflow/pull/9614 that @kaxil introduced for 1.10.11 which removes the can_add and can_edit permissions from XComModelView, but Airflow can not delete the permissions from that view because relations to those permissions still exist on the “Admin” and “Op” roles.

In more technical terms, the two permissions can’t be deleted from ab_permission_view table because each have relations to both the Admin’s and Op’s role_ids in the ab_permission_view_role table.

What you expected to happen: No warnings with Airflow 1.10.11

How to reproduce it:

1. Install 1.10.11
2. Either:
   1. View the logs of the webserver
   2. Run any airflow CLI command, such as airflow list_users and view the outputted log messages
3. After a few lines of the log you will see the warnings

Anything else we need to know:

If those 4 role permissions are removed from the ab_permission_view_role table the warnings should stop. I think a migration needs to be added, or some logic that cleans up these role permissions is failing to do its job.

[Nimesh-K-Makwana]

And solution? Facing similar problem in airflow 2.1.1. Unable to delete or edit list user from airflow UI (being Admin also is not allowing to edit permission of other users).

[kaxil]

i got the same warnings on 2.0.0 (release:2.0.0+ab5f770bfcd8c690cbe4d0825896325aca0beeca):

2021-01-11T12:13:35.605-05:00	[2021-01-11 17:13:35,604] {{manager.py:547}} WARNING - Refused to delete permission view, assoc with role exists Airflow.can_pickle_info Admin

2021-01-11T12:13:35.613-05:00	[2021-01-11 17:13:35,613] {{manager.py:547}} WARNING - Refused to delete permission view, assoc with role exists Airflow.can_elasticsearch Admin

2021-01-11T12:13:35.621-05:00	[2021-01-11 17:13:35,621] {{manager.py:547}} WARNING - Refused to delete permission view, assoc with role exists Airflow.can_dagrun_success Admin

...

i checked the database, it’s been migrated successfully alembic_version is e959f08ac86c

Yeah currently we don’t have migrations that remove those view permission – but they are harmless warning that you can ignore

cc @jhtimmins