当我在Airflow版本1.10中使用 KubernetesPodOperator 运行docker镜像时
pods 成功完成任务后， Airflow 会尝试通过k8s流客户端建立与 pods 的连接，从而获得xcom值。
以下是我遇到的错误:
[2018-12-18 05:29:02,209] {{models.py:1760}} ERROR - (0)
Reason: Handshake status 403 Forbidden
Traceback (most recent call last):
File "/usr/local/lib/python3.6/site-packages/kubernetes/stream/ws_client.py", line 249, in websocket_call
client = WSClient(configuration, get_websocket_url(url), headers)
File "/usr/local/lib/python3.6/site-packages/kubernetes/stream/ws_client.py", line 72, in __init__
self.sock.connect(url, header=header)
File "/usr/local/lib/python3.6/site-packages/websocket/_core.py", line 223, in connect
self.handshake_response = handshake(self.sock, *addrs, **options)
File "/usr/local/lib/python3.6/site-packages/websocket/_handshake.py", line 79, in handshake
status, resp = _get_resp_headers(sock)
File "/usr/local/lib/python3.6/site-packages/websocket/_handshake.py", line 152, in _get_resp_headers
raise WebSocketBadStatusException("Handshake status %d %s", status, status_message)
websocket._exceptions.WebSocketBadStatusException: Handshake status 403 Forbidden
DAG配置
最佳答案
因此，我们也遇到了这个问题，我们不得不修改rbac规则，特别是必须添加动词“create”和“get”的资源“pods/exec”
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: airflow-runner
rules:
- apiGroups: [""]
resources: ["deployments", "pods", "pods/log", "pods/exec", "persistentvolumeclaims"]
verbs: ["*"]
- apiGroups: [""]
resources: ["secrets"]
resourceNames: ["singleuser-image-credentials"]
verbs: ["read","list","watch","create","get"]
关于kubernetes - Airflow k8s运算符(operator)XCOM-禁止握手状态403，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/53827345/