Getting Apache Airflow™ administrator credentials

The administrator credentials are stored in a secret in the AirflowCluster namespace.

Finding the secretFinding the secret

To find the secret with the credentials for the cluster in question:

1. Get the cluster UID:

   kubectl get airflowcluster <cluster_name> \
     -n <namespace> \
     -o jsonpath='{.metadata.uid}'
   

2. Find the secrets created for this UID:

   kubectl get secret -n <namespace> \
     -l 'airflow.stackland.yandex.cloud/owner-uid=<cluster_UID>'
   

3. Use the secret name with the -admin suffix instead of <secret_name> in the following commands.

Getting a usernameGetting a username

kubectl get secret <secret_name> \
  -n <namespace> \
  -o jsonpath='{.data.username}' | base64 --decode

The default username is admin.

Getting a passwordGetting a password

kubectl get secret <secret_name> \
  -n <namespace> \
  -o jsonpath='{.data.password}' | base64 --decode

Rotating a passwordRotating a password

To change the admin's password, edit the password key in its secret. The operator monitors changes in the secret and re-runs account configuration. You cannot edit the username key.

1. If the cluster is stopped, restart it.

2. Update only the password key in the secret you found:

   kubectl patch secret <secret_name> \
     -n <namespace> \
     --type=merge \
     -p '{"stringData":{"password":"<new_password>"}}'
   

3. Wait until the change is processed and the cluster switches back to Ready:

   kubectl get airflowcluster <cluster_name> \
     -n <namespace> \
     -w
   

   If the cluster does not switch back to Ready, check status.conditions by running this command: kubectl describe airflowcluster <cluster_name> -n <namespace>. The InitialUserReady condition shows the account configuration result.

4. Log out of the web interface, then log in again with the new password.