You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "throwawayaccount11111 (via GitHub)" <gi...@apache.org> on 2023/04/12 21:38:39 UTC

[GitHub] [airflow] throwawayaccount11111 opened a new issue, #30611: Airflow fetching too many tokens from Vault

throwawayaccount11111 opened a new issue, #30611:
URL: https://github.com/apache/airflow/issues/30611

   ### Apache Airflow Provider(s)
   
   hashicorp
   
   ### Versions of Apache Airflow Providers
   
   3.3.0
   
   ### Apache Airflow version
   
   2.5.3
   
   ### Operating System
   
   linux
   
   ### Deployment
   
   Official Apache Airflow Helm Chart
   
   ### Deployment details
   
   _No response_
   
   ### What happened
   
   We use Vault as the secrets backend for Airflow. And we have noticed quite an abnormal pattern where Airflow asks for 400 tokens every 10 minutes. This is when all the DAGs are disabled/paused. When the DAGs, totaling 300ish, are enabled and running, the number of tokens spikes to 40K. The TTL on the tokens is 15 minutes. Most of our DAGs finish within 10 minutes. 
   
   We initially thought it was due to a typical pattern in the code related to how DAGs access secrets. But upon further troubleshooting, this happens during the auth, which is probably when the pod comes up. (We use Kubernetes Executor).
   
   ### What you think should happen instead
   
   The token should be cached and Airflow should not be requesting a new token for every DAG execution. Even without any DAG executing, Airflow is asking for tokens.
   
   ### How to reproduce
   
   Start Airflow with Kubernetes Executor and Vault as the secrets backend. Observe the number of tokens/leases in Vault. 
   
   ### Anything else
   
   _No response_
   
   ### Are you willing to submit PR?
   
   - [ ] Yes I am willing to submit a PR!
   
   ### Code of Conduct
   
   - [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [airflow] potiuk closed issue #30611: Airflow fetching too many tokens from Vault

Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk closed issue #30611: Airflow fetching too many tokens from Vault
URL: https://github.com/apache/airflow/issues/30611


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [airflow] throwawayaccount11111 commented on issue #30611: Airflow fetching too many tokens from Vault

Posted by "throwawayaccount11111 (via GitHub)" <gi...@apache.org>.
throwawayaccount11111 commented on issue #30611:
URL: https://github.com/apache/airflow/issues/30611#issuecomment-1505999848

   ![vault-leases](https://user-images.githubusercontent.com/108699169/231593288-725956bd-5c91-4b4f-9544-02452f1adf23.png)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [airflow] boring-cyborg[bot] commented on issue #30611: Airflow fetching too many tokens from Vault

Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on issue #30611:
URL: https://github.com/apache/airflow/issues/30611#issuecomment-1505986823

   Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org