You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "ashb (via GitHub)" <gi...@apache.org> on 2026/01/15 14:14:54 UTC
Re: [PR] Two-token mechanism for task execution to prevent token expiration while tasks wait in executor queues [airflow]
ashb commented on code in PR #60108:
URL: https://github.com/apache/airflow/pull/60108#discussion_r2694560832
##########
airflow-core/src/airflow/api_fastapi/auth/tokens.py:
##########
@@ -458,6 +474,21 @@ def generate(self, extras: dict[str, Any] | None = None, headers: dict[str, Any]
headers["kid"] = self.kid
return jwt.encode(claims, self.signing_arg, algorithm=self.algorithm, headers=headers)
+ def generate_workload_token(self, sub: str) -> str:
+ """
+ Generate a long-lived workload token for task execution.
+
+ Workload tokens have a special 'scope' claim that restricts them to the /run endpoint only.
+ They are valid for longer (default 24h) to survive executor queue wait times.
+ """
+ from airflow.configuration import conf
+
+ workload_expiry = conf.getint("execution_api", "jwt_workload_token_expiration_time", fallback=86400)
Review Comment:
This default should come from a config option, probablu in the `execution_api` section to go alongside the `jwt_expiration_time` there.
##########
airflow-core/src/airflow/api_fastapi/auth/tokens.py:
##########
@@ -458,6 +474,21 @@ def generate(self, extras: dict[str, Any] | None = None, headers: dict[str, Any]
headers["kid"] = self.kid
return jwt.encode(claims, self.signing_arg, algorithm=self.algorithm, headers=headers)
+ def generate_workload_token(self, sub: str) -> str:
+ """
+ Generate a long-lived workload token for task execution.
+
+ Workload tokens have a special 'scope' claim that restricts them to the /run endpoint only.
+ They are valid for longer (default 24h) to survive executor queue wait times.
+ """
+ from airflow.configuration import conf
+
+ workload_expiry = conf.getint("execution_api", "jwt_workload_token_expiration_time", fallback=86400)
Review Comment:
This default should come from a config option, probablu in the `execution_api` section to go alongside the `jwt_expiration_time` there.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org