Possible to Restrict Access to Variables by DAGs

[alexanderursu99]

Hi, I'm wondering if it's possible to restrict which DAGs can access certain variables and connections.

I ask this because I'm looking at using Hashicorp Vault as an alternative secrets backend, but it seems as though all DAGs would have access to any variables created in the specified paths in Vault.

Is there some way to make a single Airflow deployment work for separate teams, so that no team would have access to secret variables of other teams? Or is the way to go just to give each team their own Airflow deployment?

[turbaszek]

As far as I know it's not possible. Any variable can be read using Variable.get(...) so this is not something DAG or user related. Probably you can roll out your custom SecretBackend by overriding HashiCorp one and implementing the restriction logic. This is an interesting problem so I would encourage you to bring it to dev@airflow.apache.org mailing list so we can discuss it with more people

[alexanderursu99]

I see, thanks for the recommendation!

[mik-laj]

Related issue: #10130