Principle:Apache Airflow Production Hardening
| Knowledge Sources | |
|---|---|
| Domains | Security, Kubernetes |
| Last Updated | 2026-02-08 00:00 GMT |
Overview
A security hardening pattern for production Airflow deployments covering RBAC, secret management, network policies, and pod-level isolation.
Description
Production Hardening encompasses security best practices for Airflow in Kubernetes: RBAC roles scoped to minimum required permissions, Fernet encryption for sensitive data, Kubernetes Secrets for credentials, network policies for pod isolation, and KubernetesExecutor for per-task pod isolation. The Helm chart includes templates for all security resources with sensible defaults.
Usage
Apply production hardening when deploying Airflow in any environment beyond development. Enable network policies, use external secret management, configure RBAC, and consider KubernetesExecutor for workload isolation.
Theoretical Basis
Defense in Depth:
- RBAC: Least-privilege roles for pod launching, log reading, job management
- Secrets: Fernet key, webserver secret key, database credentials encrypted at rest
- Network: Pod-to-pod communication restricted by network policies
- Isolation: KubernetesExecutor runs each task in a separate pod
- Audit: OpenTelemetry tracing for request tracking