You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by ep...@apache.org on 2025/01/30 12:34:59 UTC
(airflow) branch main updated: Add StrictHostKeyChecking option to GitDagBundle (#46241)
This is an automated email from the ASF dual-hosted git repository.
ephraimanierobi pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 38b8f78a412 Add StrictHostKeyChecking option to GitDagBundle (#46241)
38b8f78a412 is described below
commit 38b8f78a412bd8601ab170099b908edc7b5c2c49
Author: Ephraim Anierobi <sp...@gmail.com>
AuthorDate: Thu Jan 30 13:34:52 2025 +0100
Add StrictHostKeyChecking option to GitDagBundle (#46241)
* Add StrictHostKeyChecking option to GitDagBundle
This adds an option to enable or disable StrictHostKeyChecking in
GitDagBundle. Host key is not checked by default. You have to enable
host key checking in the connection extra.
* fixup! Add StrictHostKeyChecking option to GitDagBundle
---
airflow/dag_processing/bundles/git.py | 5 ++++-
tests/dag_processing/test_dag_bundles.py | 25 +++++++++++++++++++++----
2 files changed, 25 insertions(+), 5 deletions(-)
diff --git a/airflow/dag_processing/bundles/git.py b/airflow/dag_processing/bundles/git.py
index fb478baa536..1ad544ec7bd 100644
--- a/airflow/dag_processing/bundles/git.py
+++ b/airflow/dag_processing/bundles/git.py
@@ -71,9 +71,12 @@ class GitHook(BaseHook):
self.repo_url = connection.host
self.auth_token = connection.password
self.key_file = connection.extra_dejson.get("key_file")
+ strict_host_key_checking = connection.extra_dejson.get("strict_host_key_checking", "no")
self.env: dict[str, str] = {}
if self.key_file:
- self.env["GIT_SSH_COMMAND"] = f"ssh -i {self.key_file} -o IdentitiesOnly=yes"
+ self.env["GIT_SSH_COMMAND"] = (
+ f"ssh -i {self.key_file} -o IdentitiesOnly=yes -o StrictHostKeyChecking={strict_host_key_checking}"
+ )
self._process_git_auth_url()
def _process_git_auth_url(self):
diff --git a/tests/dag_processing/test_dag_bundles.py b/tests/dag_processing/test_dag_bundles.py
index 331a215df7d..4135359e988 100644
--- a/tests/dag_processing/test_dag_bundles.py
+++ b/tests/dag_processing/test_dag_bundles.py
@@ -121,6 +121,7 @@ class TestGitHook:
conn_id=CONN_DEFAULT,
host=AIRFLOW_GIT,
conn_type="git",
+ extra='{"key_file": "/files/pkey.pem"}',
)
)
db.merge_conn(
@@ -133,10 +134,7 @@ class TestGitHook:
)
db.merge_conn(
Connection(
- conn_id=CONN_HTTPS_PASSWORD,
- host=AIRFLOW_HTTPS_URL,
- conn_type="git",
- password=ACCESS_TOKEN,
+ conn_id=CONN_HTTPS_PASSWORD, host=AIRFLOW_HTTPS_URL, conn_type="git", password=ACCESS_TOKEN
)
)
db.merge_conn(
@@ -160,6 +158,25 @@ class TestGitHook:
hook = GitHook(git_conn_id=conn_id)
assert hook.repo_url == expected_repo_url
+ def test_env_var(self, session):
+ hook = GitHook(git_conn_id=CONN_DEFAULT)
+ assert hook.env == {
+ "GIT_SSH_COMMAND": "ssh -i /files/pkey.pem -o IdentitiesOnly=yes -o StrictHostKeyChecking=no"
+ }
+ db.merge_conn(
+ Connection(
+ conn_id="my_git_conn_strict",
+ host=AIRFLOW_GIT,
+ conn_type="git",
+ extra='{"key_file": "/files/pkey.pem", "strict_host_key_checking": "yes"}',
+ )
+ )
+
+ hook = GitHook(git_conn_id="my_git_conn_strict")
+ assert hook.env == {
+ "GIT_SSH_COMMAND": "ssh -i /files/pkey.pem -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes"
+ }
+
class TestGitDagBundle:
@classmethod