This is an automated email from the ASF dual-hosted git repository. potiuk pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push: new e2a5dbf8b4 allow multiple elements in impersonation chain (#35694) e2a5dbf8b4 is described below commit e2a5dbf8b47b35f2d836c81f8e9e7190a7f66d38 Author: Mehul Goyal <mehul.go...@astronomer.io> AuthorDate: Fri Nov 24 17:17:36 2023 -0800 allow multiple elements in impersonation chain (#35694) --- airflow/providers/google/common/hooks/base_google.py | 2 ++ docs/apache-airflow-providers-google/connections/gcp.rst | 2 +- tests/providers/google/common/hooks/test_base_google.py | 14 ++++++++++++++ 3 files changed, 17 insertions(+), 1 deletion(-) diff --git a/airflow/providers/google/common/hooks/base_google.py b/airflow/providers/google/common/hooks/base_google.py index 77fd9394cf..3bde53571a 100644 --- a/airflow/providers/google/common/hooks/base_google.py +++ b/airflow/providers/google/common/hooks/base_google.py @@ -267,6 +267,8 @@ class GoogleBaseHook(BaseHook): if not self.impersonation_chain: self.impersonation_chain = self._get_field("impersonation_chain", None) + if isinstance(self.impersonation_chain, str) and "," in self.impersonation_chain: + self.impersonation_chain = [s.strip() for s in self.impersonation_chain.split(",")] target_principal, delegates = _get_target_principal_and_delegates(self.impersonation_chain) diff --git a/docs/apache-airflow-providers-google/connections/gcp.rst b/docs/apache-airflow-providers-google/connections/gcp.rst index 79422fb2f0..9ebe21efe3 100644 --- a/docs/apache-airflow-providers-google/connections/gcp.rst +++ b/docs/apache-airflow-providers-google/connections/gcp.rst @@ -131,7 +131,7 @@ Impersonation Chain of the last account in the list, which will be impersonated in all requests leveraging this connection. If set as a string, the account must grant the originating account the Service Account Token Creator IAM role. - If set as a sequence, the identities from the list must grant + If set as a comma-separated list, the identities from the list must grant Service Account Token Creator IAM role to the directly preceding identity, with first account from the list granting this role to the originating account. diff --git a/tests/providers/google/common/hooks/test_base_google.py b/tests/providers/google/common/hooks/test_base_google.py index 06d04f6318..bd4342ec66 100644 --- a/tests/providers/google/common/hooks/test_base_google.py +++ b/tests/providers/google/common/hooks/test_base_google.py @@ -683,6 +683,20 @@ class TestGoogleBaseHook: ["ACCOUNT_2", "ACCOUNT_3"], id="multiple_elements_list_with_override", ), + pytest.param( + None, + "ACCOUNT_1,ACCOUNT_2,ACCOUNT_3", + "ACCOUNT_3", + ["ACCOUNT_1", "ACCOUNT_2"], + id="multiple_elements_list_as_string", + ), + pytest.param( + None, + "ACCOUNT_1, ACCOUNT_2, ACCOUNT_3", + "ACCOUNT_3", + ["ACCOUNT_1", "ACCOUNT_2"], + id="multiple_elements_list_as_string_with_space", + ), ], ) @mock.patch(MODULE_NAME + ".get_credentials_and_project_id")