Connection encryption in Apache Airflow - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the encryption type in an Airflow connection URI.

Apache Airflow

conn = 'postgresql+psycopg2://user:password@host:5432/dbname?sslmode=[1]'

Drag options to blanks, or click blank then click option'

Adisable

Brequire

Cnone

Doff

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'disable' or 'none' disables encryption, which is insecure.

Using 'off' is not a valid sslmode value.

The sslmode=require option enforces SSL encryption for the connection.

2fill in blank

medium

Complete the Airflow connection URI to enable TLS encryption with verification.

Apache Airflow

conn = 'mysql+pymysql://user:password@host/db?ssl_ca=[1]'

Drag options to blanks, or click blank then click option'

Atrue

Bfalse

C/path/to/ca.pem

D/path/to/key.pem

Attempts:

3 left

💡 Hint

Common Mistakes

Using boolean values like 'true' or 'false' instead of a file path.

Providing the client key file path instead of the CA certificate.

Specifying the path to the CA certificate file enables TLS with verification.

3fill in blank

hard

Fix the error in the Airflow connection URI to correctly enable SSL encryption for a PostgreSQL connection.

Apache Airflow

conn = 'postgresql://user:password@host:5432/dbname?sslmode=[1]'

Drag options to blanks, or click blank then click option'

Averify-full

Bdisable

Cno-verify

Dfalse

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'disable' or 'false' disables encryption.

Using 'no-verify' is not a valid sslmode value.

The sslmode=verify-full option enables SSL encryption with full verification of the server certificate.

4fill in blank

hard

Fill both blanks to create an Airflow connection URI for MySQL with encrypted connection and client certificate authentication.

Apache Airflow

conn = 'mysql+pymysql://user:password@host/db?ssl_ca=[1]&ssl_cert=[2]'

Drag options to blanks, or click blank then click option'

A/etc/ssl/certs/ca.pem

B/etc/ssl/private/client-key.pem

C/etc/ssl/certs/client-cert.pem

D/etc/ssl/private/ca-key.pem

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing client key and client cert paths.

Using private key paths for CA or cert parameters.

The ssl_ca parameter points to the CA certificate, and ssl_cert points to the client certificate for authentication.

5fill in blank

hard

Fill all three blanks to define an Airflow connection URI for PostgreSQL with SSL encryption, client certificate, and client key.

Apache Airflow

conn = 'postgresql+psycopg2://user:password@host:5432/dbname?sslmode=[1]&sslcert=[2]&sslkey=[3]'

Drag options to blanks, or click blank then click option'

Arequire

Bverify-ca

C/home/user/.postgresql/postgresql.key

D/home/user/.postgresql/postgresql.crt

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'require' without verification for sslmode.

Swapping client cert and key file paths.

sslmode=verify-ca enables SSL with CA verification. sslcert is the client certificate path, and sslkey is the client private key path.

Practice

1. What is the main purpose of enabling connection encryption in Airflow?

easy

A. To protect data exchanged between Airflow and external systems

B. To speed up the connection between Airflow and databases

C. To reduce the size of data transferred over the network

D. To allow Airflow to connect without authentication

Solution

1. Step 1: Understand connection encryption

   Encryption secures data by making it unreadable to outsiders during transfer.

2. Step 2: Apply to Airflow connections

   Airflow uses encryption to protect sensitive data when communicating with external systems.

3. Final Answer:

   To protect data exchanged between Airflow and external systems -> Option A

4. Quick Check:

   Encryption protects data [OK]

Hint: Encryption means data is safe from outsiders [OK]

Common Mistakes:

• Thinking encryption speeds up connections
• Confusing encryption with data compression
• Assuming encryption removes authentication

2. Which of the following is the correct way to specify SSL encryption in an Airflow connection's extra field?

easy

A. {"sslmode": "require"}

B. {"ssl": "false"}

C. {"encrypt": "no"}

D. {"ssl_enabled": "off"}

Solution

1. Step 1: Identify correct SSL option key

   The standard key for SSL mode in Airflow connection extras is "sslmode" with values like "require".

2. Step 2: Check option values

   "require" enables SSL, while other options like "false", "no", or "off" disable encryption.

3. Final Answer:

   {"sslmode": "require"} -> Option A

4. Quick Check:

   Use "sslmode": "require" for SSL [OK]

Hint: Use "sslmode": "require" to enable SSL in extras [OK]

Common Mistakes:

• Using incorrect keys like "ssl_enabled"
• Setting SSL to false or no disables encryption
• Wrong JSON format in extras field

3. Given this Airflow connection extra field: {"sslmode": "verify-full", "sslrootcert": "/path/to/ca.pem"}, what is the effect when Airflow connects to the database?

medium

A. Airflow disables SSL and uses plain text

B. Airflow uses SSL but does not verify the server certificate

C. Airflow connects without encryption

D. Airflow uses SSL and verifies the server certificate against the CA file

Solution

1. Step 1: Understand sslmode "verify-full"

   This mode means SSL is used and the server certificate is fully verified.

2. Step 2: Role of sslrootcert

   The "sslrootcert" points to the CA certificate file used to verify the server's certificate authenticity.

3. Final Answer:

   Airflow uses SSL and verifies the server certificate against the CA file -> Option D

4. Quick Check:

   "verify-full" + CA cert = full SSL verification [OK]

Hint: "verify-full" means SSL with full certificate check [OK]

Common Mistakes:

• Confusing "verify-full" with no verification
• Ignoring the CA certificate path
• Assuming SSL is off with these settings

4. You configured an Airflow connection with {"sslmode": "require"} in the extra field, but Airflow still connects without encryption. What is the most likely cause?

medium

A. The database server does not support SSL connections

B. The Airflow scheduler was not restarted after the change

C. The extra field JSON is missing a closing brace

D. The connection type does not support SSL encryption

Solution

1. Step 1: Airflow connection caching

   Airflow components like the scheduler cache connections in memory. Changes to connections require restarting to load new configuration.

2. Step 2: Verify other causes

   Without restart, the new SSL extra is ignored, using cached unencrypted connection. Server lacking SSL support would fail the connection; malformed JSON or unsupported conn type would error differently.

3. Final Answer:

   The Airflow scheduler was not restarted after the change -> Option B

4. Quick Check:

   Restart Airflow after connection changes [OK]

Hint: Restart Airflow scheduler after connection config changes [OK]

Common Mistakes:

• Assuming Airflow ignores server capabilities
• Not checking server SSL configuration
• Forgetting to restart Airflow after config changes

5. You want to configure an Airflow connection to a PostgreSQL database with full SSL verification using a CA certificate file located at /certs/ca.pem. Which extra field JSON is correct?

hard

A. {"sslmode": "require", "sslrootcert": "/certs/ca.pem"}

B. {"sslmode": "disable", "sslrootcert": "/certs/ca.pem"}

C. {"sslmode": "verify-full", "sslrootcert": "/certs/ca.pem"}

D. {"sslmode": "verify-ca", "sslrootcert": "/certs/ca.pem"}

Solution

1. Step 1: Understand SSL modes for PostgreSQL

   "verify-full" requires SSL and full verification of the server certificate against the CA file.

2. Step 2: Compare other modes

   "require" enables SSL but does not verify the server certificate fully; "disable" turns off SSL; "verify-ca" verifies the CA but not the hostname.

3. Final Answer:

   {"sslmode": "verify-full", "sslrootcert": "/certs/ca.pem"} -> Option C

4. Quick Check:

   Full verification needs "verify-full" mode [OK]

Hint: "verify-full" + CA cert = strongest SSL verification [OK]

Common Mistakes:

• Using "require" instead of "verify-full" for full verification
• Confusing "verify-ca" with full hostname verification
• Disabling SSL accidentally