When using the Octavia CLI to update the Airbyte instance wi Airbyte #replication-ask-ai

When using the Octavia CLI to update the Airbyte i...

Anthony Smart

06/20/2023, 4:02 PM

When using the Octavia CLI to update the Airbyte instance with

octavia apply -f <file>

I notice that no authentication is required. Does this mean the Web UI username / password is only on the Web App side and that there's no API authentication? That would allow anybody to modify the connections on the Airbyte instance.

kapa.ai

06/20/2023, 4:02 PM

A message from kapa.ai

kapa.ai

06/20/2023, 4:03 PM

When using Octavia CLI with Airbyte version 0.40.16 or above, which comes with Basic Authentication for the web app, API, and CLI, you need to add the

AIRBYTE_USERNAME

and

AIRBYTE_PASSWORD

environment variables in the

.octavia

file. This means that there is indeed API authentication, and not just anyone can modify the connections on the Airbyte instance. Here's an example of how to add the authentication variables to the

.octavia

file:

Copy code

OCTAVIA_ENABLE_TELEMETRY=True AIRBYTE_USERNAME=airbyte AIRBYTE_PASSWORD=password

(Source: [Version control Airbyte configurations with Octavia CLI](https://airbyte.com/tutorials/version-control-airbyte-configurations))

Anthony Smart

06/20/2023, 4:04 PM

Yeah, that would make sense. But I'm running the octavia cli without those env variables configured and it's updating the Airybyte instance. Security bug?

Anthony Smart

06/20/2023, 4:05 PM

image.png

Anthony Smart

06/20/2023, 4:06 PM

No API credentials configured and yet octavia apply sends a POST.

Open in Slack

Previous Next