airflow db init fips enable

[billglennon]

Hi,

I am working on a project that has CentOS 7 fips enabled configuration using Python 3.6.8.
Airflow version 2.0.0
If I disable fips, I can get "airflow db init" to run correctly.
However, with fips enabled I get the traceback below when I run "airflow db init".

With fips enabled you can't use md5 hash. However, that is what is happening in the Airflow installation I believe.
Just one example is to look at flask_caching/backends/filesystemcache.py file.

Is there a way to get Airflow working without disabling fips?
I did some research but I have not come across anything yet.

Thanks in advance for your help!

Traceback (most recent call last):
  File "/home/airflow/airflowpoc/bin/airflow", line 8, in <module>
    sys.exit(main())
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/airflow/__main__.py", line 40, in main
    args.func(args)
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/airflow/cli/cli_parser.py", line 48, in command
    return func(*args, **kwargs)
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/airflow/cli/commands/db_command.py", line 31, in initdb
    db.initdb()
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/airflow/utils/db.py", line 549, in initdb
    upgradedb()
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/airflow/utils/db.py", line 688, in upgradedb
    command.upgrade(config, 'heads')
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/alembic/command.py", line 294, in upgrade
    script.run_env()
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/alembic/script/base.py", line 481, in run_env
    util.load_python_file(self.dir, "env.py")
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/alembic/util/pyfiles.py", line 97, in load_python_file
    module = load_module_py(module_id, path)
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/alembic/util/compat.py", line 182, in load_module_py
    spec.loader.exec_module(module)
  File "<frozen importlib._bootstrap_external>", line 678, in exec_module
  File "<frozen importlib._bootstrap>", line 219, in _call_with_frames_removed
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/airflow/migrations/env.py", line 108, in <module>
    run_migrations_online()
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/airflow/migrations/env.py", line 102, in run_migrations_online
    context.run_migrations()
  File "<string>", line 8, in run_migrations
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/alembic/runtime/environment.py", line 813, in run_migrations
    self.get_context().run_migrations(**kw)
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/alembic/runtime/migration.py", line 560, in run_migrations
    step.migration_fn(**kw)
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/airflow/migrations/versions/2c6edca13270_resource_based_permissions.py", line 310, in upgrade
    remap_permissions()
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/airflow/migrations/versions/2c6edca13270_resource_based_permissions.py", line 287, in remap_permissions
    appbuilder = create_app(config={'FAB_UPDATE_PERMS': False}).appbuilder
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/airflow/www/app.py", line 105, in create_app
    Cache(app=flask_app, config={'CACHE_TYPE': 'filesystem', 'CACHE_DIR': '/tmp'})
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/flask_caching/__init__.py", line 155, in __init__
    self.init_app(app, config)
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/flask_caching/__init__.py", line 210, in init_app
    self._set_cache(app, config)
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/flask_caching/__init__.py", line 237, in _set_cache
    app, config, cache_args, cache_options
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/flask_caching/backends/__init__.py", line 68, in filesystem
    return FileSystemCache(*args, **kwargs)
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/flask_caching/backends/filesystemcache.py", line 80, in __init__
    self._update_count(value=len(self._list_dir()))
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/flask_caching/backends/filesystemcache.py", line 108, in _list_dir
    for name in (self._fs_count_file,)
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/flask_caching/backends/filesystemcache.py", line 108, in <listcomp>
    for name in (self._fs_count_file,)
  File "/home/airflow/airflowpoc/lib64/python3.6/site-packages/flask_caching/backends/filesystemcache.py", line 149, in _get_filename
    hash = self._hash_method(key).hexdigest()
ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips

[turbaszek]

Possibly @mik-laj may have some insights in this matter?

[brostwalt87]

We found that running airflow on a FIPS enabled host is what causes this

There is probably a long term fix, but we ran

sed -i 's/md5/sha256/g' /opt/bitnami/airflow/venv/lib/python3.8/site-packages/flask_caching/backends/filesystemcache.py

to remediate in the short term

[shyft-mike]

I currently have a pull request related to this -
#28846

[potiuk]

Yep. I added one small NIT to fix and looking forward to another committer's approval to merge it.