In cli "airflow roles export / import" : add the permissions to the json file processed.

[gbonazzoli]

Description

Actually (Airflow 2.7.3) the cli command airflow roles export does only export custom roles but without specifing the related permission, so it is quite useless as a mean to backup & restore configuration between airflows.

Use case/motivation

Now that the Param structure has been recently added, it is very common for us to create a DAG with input parameters and give it to final (non IT) users with a profile limited to that DAG.

So having an import export DAG can give us an instrument to profile a role in test and transport it in production when the test is accomplished.

Related issues

No response

Are you willing to submit a PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[pateash]

Can take this up to poke into the Airflow CLI for a bit. 😆

[dominikhei]

Hey @gbonazzoli @potiuk I have thought about a possible structure for the exported and imported json.

We could maybe follow a structure similar to the airflow roles list -o json -pcommand:

[{"name": "TestRole", "resource": "Actions", "action": "menu_access"}, 
{"name": "TestRole", "resource": "Admin", "action": "menu_access"}, 
{"name": "AnotherTestRole", "resource": "Audit Logs", "action": "can_read,menu_access"}]

Meaning if the command is: roles export roles.json -p (With the p flag being a new addition to support exporting permissions), we would export in the structure above, otherwise just as it was before or just use {'name' : 'TestRole'}, what is your take on that?

This structure would also allow us to reuse some of the code from __roles_add_or_remove_permissions to add the permissions if a json of the same structure was imported.

[gbonazzoli]

@dominikhei

I'm not a developer but it seems to me that if you can export and produce a file with that syntax and re-import it without having any trouble and reproduce the same set of permission, you are OK.

The only thing to take care is the process of import a role that is already existing with a set of permission that differs from those contained on the file.

What would you do ?

[potiuk]

This looks good. And re "existing" role - we want to make it simple, any complex merging should be avoided. Generally speaking deleting a role when it exists an is being imported is preferred approach. Feel free to create a PR @dominikhei - it's best to discuss on a feature with live code/PR

[dominikhei]

This looks good. And re "existing" role - we want to make it simple, any complex merging should be avoided. Generally speaking deleting a role when it exists an is being imported is preferred approach. Feel free to create a PR @dominikhei - it's best to discuss on a feature with live code/PR

I am working on it 👍