Repository navigation
Warning about invisible connections/variable in the Web UI #10867
Description
Hello,
Currently, you can define a new connection/variable in several ways.
- Metabase
- Environment variable
- Secret backend
However, only the connections defined with the Metabase are visible from the Web UI. This is surprising among users because a natural way to check connection/variable configuration is to use the Web UI, which may not show complete information.
I would be happy if there was a warning stating that not all connections / variables are visible when the user has a configured secret backend or when the AIRFLOW__CONN_* /AIRFLOW__VAR_* environment variable is defined. This should appear above the list of connections/variables.
This change is intended to improve the user experience.
Best regards,
Kamil Breguła
Activity
JeffryMAC commentedon Sep 11, 2020
If a connection defined in one of those hidden options.
What will happen if I will try to define a new connection in the UI with the exact name?
randr97 commentedon Sep 11, 2020
But based on suggested changes, we should jus warn the user and nothing more.
@mik-laj Should we consider having the env conn/vars displayed in UI or jus show a warning?
mik-laj commentedon Sep 11, 2020
@randr97 For security reasons, we should only display database entries in the Web UI. The entries that are configured in the database are user-controlled entries and the user can fully manage them.
@JeffryMAC will be created but never used, because backend entries with higher priority will be used.
airflow/airflow/configuration.py
Lines 985 to 1001 in c58d606
airflow/airflow/secrets/__init__.py
Lines 29 to 32 in c58d606
airflow/airflow/models/connection.py
Lines 386 to 397 in c58d606
kaxil commentedon Sep 11, 2020
Yes we should definitely not display Connections and Variable coming from Secrets Backend, I am happy with us showing just the keys for debugging but not values
potiuk commentedon Sep 11, 2020
+1. It would be nice to prevent creating one if there is a secret backend one already but it's not really necessary
kaxil commentedon Dec 29, 2021
@blag will take care of it for 2.3.0 if no-one does it by then
[-]Warning about invisible connections/variable in the Web UI.[/-][+]Warning about invisible connections/variable in the Web UI[/+]rino0601 commentedon Aug 20, 2026
Still reproducing on Airflow 3.3.0 (the report in #65784 was on 3.2.1), and the surface is wider
than the UI now — the REST API and the CLI have the same gap.
GET /api/v2/connections, GET /api/v2/variables, and airflow connections list all run a plain
select(Connection) / select(Variable), so they return metastore rows only. Neither the response
nor the OpenAPI schema carries any hint that the list may be incomplete, so generated clients can't
surface it either.
Two things make the confusion sharper than it was in 2020:
Single-item lookups disagree with the lists. airflow connections get resolves through
the backend chain, but GET /api/v2/connections/{id} returns 404 for that same id. Someone
comparing the two has no signal that the difference is intentional.
It keeps getting filed as a bug. #65784 (reported on 3.2.1, April 2026) is the most recent,
closed with "This is by design" and linking a Stack Overflow question about the same confusion.
#24679 implemented exactly what this issue asks for — CLI warnings plus a banner on the list views —
but was closed without being merged, so the gap is still open.
Would a banner on the Airflow 3 list views, plus a note in the CLI output and in the REST API docs,
still be welcome here? Happy to pick it up if so.
Warn when connections/variables list output may be incomplete (#72484)