From b5879911fc70028d31b56c15cfd3044bc2f1a5d3 Mon Sep 17 00:00:00 2001
From: Jarek Potiuk <jarek@potiuk.com>
Date: Tue, 23 Mar 2021 01:52:31 +0100
Subject: [PATCH] Fixes default group of Airflow user.

The production image did not have root group set as default for
the airflow user. This was not a big problem unless you extended
the image - in which case you had to change the group manually
when copying the images in order to keep the image OpenShift
compatible (i.e. runnable with any user and root group).

This PR fixes it by changing default group of airflow user
to root, which also works when you extend the image.

```
Connected.
airflow@53f70b1e3675:/opt/airflow$ ls
dags  logs
airflow@53f70b1e3675:/opt/airflow$ cd dags/
airflow@53f70b1e3675:/opt/airflow/dags$ ls -l
total 4
-rw-r--r-- 1 airflow root 1648 Mar 22 23:16 test_dag.py
airflow@53f70b1e3675:/opt/airflow/dags$
```
---
 Dockerfile                            |  2 ++
 docs/helm-chart/manage-dags-files.rst | 16 ++++++++++++++++
 scripts/ci/libraries/_kind.sh         |  8 ++------
 3 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 693c1ab8ef4d5..482e2254376ab 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -483,6 +483,8 @@ WORKDIR ${AIRFLOW_HOME}
 
 EXPOSE 8080
 
+RUN usermod -g 0 airflow
+
 USER ${AIRFLOW_UID}
 
 # Having the variable in final image allows to disable providers manager warnings when
diff --git a/docs/helm-chart/manage-dags-files.rst b/docs/helm-chart/manage-dags-files.rst
index 4a297467ed9b3..1f8ec8a574fb6 100644
--- a/docs/helm-chart/manage-dags-files.rst
+++ b/docs/helm-chart/manage-dags-files.rst
@@ -25,6 +25,21 @@ Bake DAGs in Docker image
 
 The recommended way to update your DAGs with this chart is to build a new docker image with the latest DAG code:
 
+.. code-block:: bash
+
+    docker build --tag "my-company/airflow:8a0da78" . -f - <<EOF
+    FROM apache/airflow
+
+    COPY ./dags/ \${AIRFLOW_HOME}/dags/
+
+    EOF
+
+.. note::
+
+   In airflow images prior to version 2.0.2, there was a bug that required you to use
+   a bit longer Dockerfile, to make sure the image remains OpenShift-compatible (i.e dag
+   has root group similarly as other files). In 2.0.2 this has been fixed.
+
 .. code-block:: bash
 
     docker build --tag "my-company/airflow:8a0da78" . -f - <<EOF
@@ -38,6 +53,7 @@ The recommended way to update your DAGs with this chart is to build a new docker
 
     EOF
 
+
 Then publish it in the accessible registry:
 
 .. code-block:: bash
diff --git a/scripts/ci/libraries/_kind.sh b/scripts/ci/libraries/_kind.sh
index f6be3754c7fc9..4fbfee166124a 100644
--- a/scripts/ci/libraries/_kind.sh
+++ b/scripts/ci/libraries/_kind.sh
@@ -255,13 +255,9 @@ function kind::build_image_for_kubernetes_tests() {
     docker build --tag "${AIRFLOW_PROD_IMAGE_KUBERNETES}" . -f - <<EOF
 FROM ${AIRFLOW_PROD_IMAGE}
 
-USER root
+COPY airflow/example_dags/ \${AIRFLOW_HOME}/dags/
 
-COPY --chown=airflow:root airflow/example_dags/ \${AIRFLOW_HOME}/dags/
-
-COPY --chown=airflow:root airflow/kubernetes_executor_templates/ \${AIRFLOW_HOME}/pod_templates/
-
-USER airflow
+COPY airflow/kubernetes_executor_templates/ \${AIRFLOW_HOME}/pod_templates/
 
 EOF
     echo "The ${AIRFLOW_PROD_IMAGE_KUBERNETES} is prepared for test kubernetes deployment."