You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by po...@apache.org on 2024/06/07 06:19:49 UTC
(airflow) branch main updated: Fix credentials intialization revealed by mypy version of google auth (#40108)
This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 013523e5d3 Fix credentials intialization revealed by mypy version of google auth (#40108)
013523e5d3 is described below
commit 013523e5d32dd4169f0535804e94762bd4463f79
Author: Jarek Potiuk <ja...@potiuk.com>
AuthorDate: Fri Jun 7 08:19:41 2024 +0200
Fix credentials intialization revealed by mypy version of google auth (#40108)
---
.../hooks/vertex_ai/hyperparameter_tuning_job.py | 2 +-
.../google/cloud/utils/credentials_provider.py | 19 +++++++++++++------
.../google/common/utils/id_token_credentials.py | 2 +-
3 files changed, 15 insertions(+), 8 deletions(-)
diff --git a/airflow/providers/google/cloud/hooks/vertex_ai/hyperparameter_tuning_job.py b/airflow/providers/google/cloud/hooks/vertex_ai/hyperparameter_tuning_job.py
index e3b819b5f0..62103e24ce 100644
--- a/airflow/providers/google/cloud/hooks/vertex_ai/hyperparameter_tuning_job.py
+++ b/airflow/providers/google/cloud/hooks/vertex_ai/hyperparameter_tuning_job.py
@@ -126,7 +126,7 @@ class HyperparameterTuningJobHook(GoogleBaseHook):
base_output_dir=base_output_dir,
project=project,
location=location,
- credentials=self.get_credentials,
+ credentials=self.get_credentials(),
labels=labels,
encryption_spec_key_name=encryption_spec_key_name,
staging_bucket=staging_bucket,
diff --git a/airflow/providers/google/cloud/utils/credentials_provider.py b/airflow/providers/google/cloud/utils/credentials_provider.py
index b3140c2da0..ef9f50743f 100644
--- a/airflow/providers/google/cloud/utils/credentials_provider.py
+++ b/airflow/providers/google/cloud/utils/credentials_provider.py
@@ -239,7 +239,8 @@ class _CredentialProvider(LoggingMixin):
:return: Google Auth Credentials
"""
if self.is_anonymous:
- credentials, project_id = AnonymousCredentials(), ""
+ credentials: Credentials = AnonymousCredentials()
+ project_id = ""
else:
if self.key_path:
credentials, project_id = self._get_credentials_using_key_path()
@@ -273,10 +274,12 @@ class _CredentialProvider(LoggingMixin):
return credentials, project_id
- def _get_credentials_using_keyfile_dict(self):
+ def _get_credentials_using_keyfile_dict(self) -> tuple[Credentials, str]:
self._log_debug("Getting connection using JSON Dict")
# Depending on how the JSON was formatted, it may contain
# escaped newlines. Convert those to actual newlines.
+ if self.keyfile_dict is None:
+ raise ValueError("The keyfile_dict field is None, and we need it for keyfile_dict auth.")
self.keyfile_dict["private_key"] = self.keyfile_dict["private_key"].replace("\\n", "\n")
credentials = google.oauth2.service_account.Credentials.from_service_account_info(
self.keyfile_dict, scopes=self.scopes
@@ -284,7 +287,9 @@ class _CredentialProvider(LoggingMixin):
project_id = credentials.project_id
return credentials, project_id
- def _get_credentials_using_key_path(self):
+ def _get_credentials_using_key_path(self) -> tuple[Credentials, str]:
+ if self.key_path is None:
+ raise ValueError("The ky_path field is None, and we need it for keyfile_dict auth.")
if self.key_path.endswith(".p12"):
raise AirflowException("Legacy P12 key file are not supported, use a JSON key file.")
@@ -298,13 +303,15 @@ class _CredentialProvider(LoggingMixin):
project_id = credentials.project_id
return credentials, project_id
- def _get_credentials_using_key_secret_name(self):
+ def _get_credentials_using_key_secret_name(self) -> tuple[Credentials, str]:
self._log_debug("Getting connection using JSON key data from GCP secret: %s", self.key_secret_name)
# Use ADC to access GCP Secret Manager.
adc_credentials, adc_project_id = google.auth.default(scopes=self.scopes)
secret_manager_client = _SecretManagerClient(credentials=adc_credentials)
+ if self.key_secret_name is None:
+ raise ValueError("The key_secret_name field is None, and we need it for keyfile_dict auth.")
if not secret_manager_client.is_valid_secret_name(self.key_secret_name):
raise AirflowException("Invalid secret name specified for fetching JSON key data.")
@@ -326,7 +333,7 @@ class _CredentialProvider(LoggingMixin):
project_id = credentials.project_id
return credentials, project_id
- def _get_credentials_using_credential_config_file(self):
+ def _get_credentials_using_credential_config_file(self) -> tuple[Credentials, str]:
if isinstance(self.credential_config_file, str) and os.path.exists(self.credential_config_file):
self._log_info(
f"Getting connection using credential configuration file: `{self.credential_config_file}`"
@@ -350,7 +357,7 @@ class _CredentialProvider(LoggingMixin):
return credentials, project_id
- def _get_credentials_using_adc(self):
+ def _get_credentials_using_adc(self) -> tuple[Credentials, str]:
self._log_info(
"Getting connection using `google.auth.default()` since no explicit credentials are provided."
)
diff --git a/airflow/providers/google/common/utils/id_token_credentials.py b/airflow/providers/google/common/utils/id_token_credentials.py
index fb1bb25cca..683023a6a2 100644
--- a/airflow/providers/google/common/utils/id_token_credentials.py
+++ b/airflow/providers/google/common/utils/id_token_credentials.py
@@ -190,7 +190,7 @@ def _get_gce_credentials(
def get_default_id_token_credentials(
- target_audience: str | None, request: google.auth.transport.Request = None
+ target_audience: str | None, request: google.auth.transport.Request | None = None
) -> google_auth_credentials.Credentials:
"""Get the default ID Token credentials for the current environment.