I am deploying Airflow 1.10.10 on Kubernetes using the official Helm Chart (v.7.0.0) but I am running into issues with Oauth.

Here's my setup:

• Airflow Webserver with RBAC enabled. Airflow uses Flask Appabuilder in this case.
• Server runs behind an Nginx reverse proxy that does https termination.
• I try to authenticate against an Azure AD tenant using OAuth

my problem - When I try to login with the Microsoft account I get the error message "The reply URL specified in the request does not match the reply URLs configured for the application". - The error is caused by Airflow setting the redirect URL to http://airflow.example.com/oauth_authorized/azure instead of httpS://airflow.example.com/oauhth_authorized/azure

what I think the issue is

Since nginx sends http requests to Flask, flask generates an http url for the redirect url instead of https. So from what I understand, I need to find a way to tell Airflow/Flask that it should use https to generate the redirect URL instead.

What I tried:

I have two angles of attack:

1. setting the base URL to https explicitly in the webserver_config.py file

I tried putting environ['wsgi.url_scheme'] = 'https' in the config file, but I get a "environ is not defined" error. Can I even set this in in the config.py file? What would I need to import for it to work?

2. Setting proxy headers in nginx

I tried to set multiple headers in Nginx using Kubernetes annotations, my current settings are:

        proxy_set_header   X-Forwarded-Proto    $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;

I also tried to set

proxy_set_header Host $host;

but this leads to all traffic being redirected to a comma separated list of domains

airflow.example.com,airflow.example.com

which obviously does not work.

I based these settings on the Flask documentation.

The rest of the Nginx config is the default of the official Nginx ingress controller I have running in my cluster.

Does anybody have an idea what the issue could be? Are my two angles of attack valid or is there a third one that I am missing?

Thanks a lot, any help is appreciated!