You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "potiuk (via GitHub)" <gi...@apache.org> on 2026/08/01 12:20:30 UTC
[PR] Apply the ambiguous-id refusal to get_config in the Key Vault backend [airflow]
potiuk opened a new pull request, #70899:
URL: https://github.com/apache/airflow/pull/70899
Follow-up to #70876.
The ambiguous-id check used to live in `_get_secret`, which all three getters
share. Moving it up into `get_conn_value` and `get_variable` left `get_config`
reaching `_get_secret` unguarded, so `_names_a_team_namespace`'s claim that such
an id is refused for *every* lookup stopped being true the moment it was written —
two getters and the docstring disagreed with the third.
**Not a cross-team read.** `get_config` never receives a `team_name`, so no team
namespace is reachable through it. The defect is the inconsistency and the false
docstring, not an exposure.
@shahar1 found this while reviewing the Amazon sibling (#70878), where it is
already fixed. Azure had the same shape and had merged by then, so this is the
other half.
`_names_a_team_namespace` stays an **instance** method here, unlike Amazon's,
because it builds the candidate path with `self.build_path` and `self.sep`.
### Test plan
- [x] `test_refusing_an_ambiguous_id_is_logged` extended to `get_config`; verified
it fails without the guard
- [x] Assertion reworked off the rendered sentence — Airflow logs through
structlog, which renders format args into `msg` before the stdlib record
exists, so `record.args` is empty and there is no structured payload to
assert on; it now asserts level, logger and the refused id
- [x] `test_key_vault.py` — 20 passed
- [x] `ruff check` / `ruff format` clean
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Opus 5 (1M context)
Generated-by: Claude Opus 5 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Apply the ambiguous-id refusal to get_config in the Key Vault backend [airflow]
Posted by "Miretpl (via GitHub)" <gi...@apache.org>.
Miretpl merged PR #70899:
URL: https://github.com/apache/airflow/pull/70899
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Apply the ambiguous-id refusal to get_config in the Key Vault backend [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #70899:
URL: https://github.com/apache/airflow/pull/70899#issuecomment-5153618247
### Backport failed to create: v3-3-test. View the failure log <a href='https://github.com/apache/airflow/actions/runs/30720059661'> Run details </a>
Note: As of [Merging PRs targeted for Airflow 3.X](https://github.com/apache/airflow/blob/main/dev/README_AIRFLOW3_DEV.md#merging-prs-targeted-for-airflow-3x)
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.
In matter of doubt please ask in [#release-management](https://apache-airflow.slack.com/archives/C03G9H97MM2) Slack channel.
<table>
<tr>
<th>Status</th>
<th>Branch</th>
<th>Result</th>
</tr>
<tr>
<td>❌</td>
<td>v3-3-test</td>
<td><a href="https://github.com/apache/airflow/commit/cfe3f0bbd707af63f9ca64c563a1a695a974d3f8"><img src='https://img.shields.io/badge/Commit-cfe3f0b-red' alt='Commit Link'></a></td>
</tr>
</table>
You can attempt to backport this manually by running:
```bash
cherry_picker cfe3f0b v3-3-test
```
This should apply the commit to the v3-3-test branch and leave the commit in conflict state marking
the files that need manual conflict resolution.
After you have resolved the conflicts, you can continue the backport process by running:
```bash
cherry_picker --continue
```
If you don't have cherry-picker installed, see the [installation guide](https://github.com/apache/airflow/blob/main/dev/README.md#how-to-backport-pr-with-cherry-picker-cli).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Apply the ambiguous-id refusal to get_config in the Key Vault backend [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #70899:
URL: https://github.com/apache/airflow/pull/70899#issuecomment-5151544083
CI fixed, and the fix reaches beyond this PR — **the Amazon tests already on `main` were failing the same way**, so this now repairs those too.
The failures were `Compat 2.11.1:P3.10` and `Compat 3.0.6:P3.10`, all three backends, `assert 0 == 1`. Cause: the assertions read `record.msg` directly, and how a record carries its payload depends on the Airflow version.
```python
# main — structlog renders the args before the stdlib record exists
LogRecord(msg="Connection id 'prod--x' contains '--'", args=())
"prod--x" in r.msg -> True
# compat targets — plain stdlib logging keeps the template
LogRecord(msg="%s id %r contains %r", args=("Connection", "prod--x", "--"))
"prod--x" in r.msg -> False <- the failure
"prod--x" in r.getMessage() -> True
```
`getMessage()` renders in both shapes, so the assertion is now version-portable. It still targets the refused **id** rather than the wording, which was the point of moving off the rendered sentence in the first place.
This is my own regression: I switched those assertions from `getMessage()` to `msg` in #70878 while addressing @shahar1's review, verified only against `main`, and merged. Compat runs on provider PRs, so it surfaced on the next provider PR rather than on the one that introduced it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Apply the ambiguous-id refusal to get_config in the Key Vault backend [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #70899:
URL: https://github.com/apache/airflow/pull/70899#issuecomment-5151564666
Rewritten to Azure only — the repair to `main` moved to **#70905**.
I had folded the Amazon test fix in here because it was the same one-line cause, but that conflated two things: this PR is a follow-up guard for Key Vault, whereas `main` being red on the compat jobs is a regression that should land on its own and not wait behind a review of unrelated code.
This branch is now:
```
providers/microsoft/azure/src/.../secrets/key_vault.py +11/-3
providers/microsoft/azure/tests/.../secrets/test_key_vault.py +16/-3
```
The `getMessage()` change remains in the Azure test here, since that test is added by this PR and would otherwise land already broken for the compat jobs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org