OpenMetadata连接Airflow API时admin用户认证失败问题求助

环境信息 #

• 部署方式：官方Helm Chart v1.1.4
• 集成组件：Elasticsearch + Airflow
• 使用镜像：docker.getcollate.io/openmetadata/ingestion
• OpenMetadata版本：与Helm Chart v1.1.4对应的最新版本

问题现象 #

配置Basic Auth（也曾测试过已正常工作的SSO KeyCloak，问题表现一致）后，在OpenMetadata UI中尝试添加Pipeline或Database服务时，出现错误：

Authentication failed for user [admin] trying to access the Airflow APIs

但以下操作均正常：

• 在OpenMetadata Pod内直接调用Airflow API无认证问题
• admin用户可正常登录Airflow UI
• OpenMetadata容器内环境变量配置正常
  仅通过浏览器操作OpenMetadata UI时触发认证失败错误

已执行排查步骤 #

• 严格按照官方文档更新Helm配置
• 创建新的Admin用户并更新对应配置，问题依旧
• 在OpenMetadata Pod内测试Airflow API连通性：
  • 无认证调用健康检查接口：

    bash-5.1# curl -XGET ${PIPELINE_SERVICE_CLIENT_ENDPOINT}/api/v1/openmetadata/health                                                                                                     
    {"status": "healthy", "version": "1.1.0.3"}
    

  • 使用admin用户调用接口，无401错误：

    bash-5.1# curl -XPOST ${PIPELINE_SERVICE_CLIENT_ENDPOINT}/api/v1/openmetadata/enable --data-raw '{"dag_id": "123"}' -u "admin:admin" --header 'Content-Type: application/json'
    {"error": "DAG 123 not found."}
    

配置详情 #

依赖Chart（Airflow）的values.yaml #

airflow:
  enabled: {{ is_airflow_enabled }}
  airflow:
    image:
      repository: docker.getcollate.io/openmetadata/ingestion
      tag: {{ airflow_image_tag }}
      pullPolicy: "IfNotPresent"
    executor: "KubernetesExecutor"
    config:
      # This is required for OpenMetadata UI to fetch status of DAGs
      AIRFLOW__API__AUTH_BACKENDS: "airflow.api.auth.backend.basic_auth"
      # OpenMetadata Airflow Apis Plugin DAGs Configuration
      AIRFLOW__OPENMETADATA_AIRFLOW_APIS__DAG_GENERATED_CONFIGS: "/opt/airflow/dags"
      # OpenMetadata Airflow Secrets Manager Configuration
      AIRFLOW__OPENMETADATA_SECRETS_MANAGER__AWS_REGION: ""
      AIRFLOW__OPENMETADATA_SECRETS_MANAGER__AWS_ACCESS_KEY_ID: ""
      AIRFLOW__OPENMETADATA_SECRETS_MANAGER__AWS_ACCESS_KEY: ""
      AIRFLOW__WEBSERVER__EXPOSE_CONFIG: 'true'

    users:
    - username: admin
      password: admin
      role: Admin
      email: spiderman@superhero.org
      firstName: Peter
      lastName: Parker

OpenMetadata Chart的values.yaml #

pipelineServiceClientConfig:
      enabled: true
      className: "org.openmetadata.service.clients.pipeline.airflow.AirflowRESTClient"
      apiEndpoint: http://openmetadata-dependencies-web.{{ openmetadata_namespace }}.svc.cluster.local:8080
      metadataApiEndpoint: http://openmetadata.{{ openmetadata_namespace }}.svc.cluster.local:8585/api
      verifySsl: "no-ssl"
      hostIp: ""
      ingestionIpInfoEnabled: false
      # healthCheckInterval in seconds
      healthCheckInterval: 300
      # local path in Airflow Pod
      sslCertificatePath: "/no/path"
      auth:
        username: admin
        password:
          secretRef: airflow-secrets
          secretKey: openmetadata-airflow-password

内容的提问来源于stack exchange，提问作者Martin Majtán