`airflow sync-perm --include-dags` can fail due to a single misconfigured DAG
- Dominant language
- Python
- Stars
- 46.9k
- Forks
- 17.8k
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 472
Description
### Under which category would you file this issue?
Providers
### Apache Airflow version
3.2.2
### What happened and how to reproduce it?
To reproduce the issue:
1. Create a dummy dag, and in access control block of the DAG, set a role that doesn't exist in the Airflow
2. This DAG shows up with import errors on Airflow UI, but still in serialized dags table
3. In the same container, or another container connecting to the same Airflow metadata DB, run `airflow sync-perm --include-dags`. It will fail with a FABException saying the role for that bad DAG doesn't exist, and it blocks permission sync for all other good DAGs.
### What you think should happen instead?
Bad/Misconfigured DAGs or non-existing roles should be ignored when running `airflow sync-perm --include-dags`, or at least, it should continue syncing permissions for other DAGs, instead of stopping at the misconfigured DAG.
### Operating System
_No response_
### Deployment
None
### Apache Airflow Provider(s)
fab
### Versions of Apache Airflow Providers
3.6.4
### Official Helm Chart version
Not Applicable
### Kubernetes Version
_No response_
### Helm Chart configuration
_No response_
### Docker Image customizations
Official 3.2.2 docker image
### Anything else?
_No response_
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
Contributor guide
Research direction
Start by reproducing the failure with a serialized DAG whose access-control role does not exist, then inspect the permission-sync path used by `airflow sync-perm --include-dags`. The work is done when the command ignores or reports the misconfigured DAG and continues syncing permissions for other valid DAGs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authorization, cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100