When Airflow secrets are stored unencrypted in its database, anyone with database access can read them. Fernet encryption stores secrets as ciphertext and uses the same key to encrypt and decrypt them. section 16.2
Protect encrypted secrets by managing the key carefully:
- Generate a Fernet key and provide it to Airflow through AIRFLOW__CORE__FERNET_KEY. section 16.2
- Keep the key secret: anyone who has it can decrypt the secrets. If the key is lost, those secrets can no longer be decrypted. section 16.2
Generate a Fernet key
from cryptography.fernet import Fernet fernet_key = Fernet.generate_key() print(fernet_key.decode()) section 16.2
Figure 16.7 A Fernet key encrypts data before storing it in the database and decrypts data before reading it from the database. Without access to the Fernet key, passwords are useless to an intruder.
Shows how a Fernet key encrypts data before database storage and decrypts it when read. section 16.2
Encryption also protects Airflow traffic over HTTPS. A self-signed certificate can serve a local UI, but users must trust it; for an address accessible to others, use a certificate from a trusted authority. section 16.4.2
