This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new e2a5dbf8b4 allow multiple elements in impersonation chain (#35694)
e2a5dbf8b4 is described below
commit e2a5dbf8b47b35f2d836c81f8e9e7190a7f66d38
Author: Mehul Goyal <mehul.go...@astronomer.io>
AuthorDate: Fri Nov 24 17:17:36 2023 -0800
allow multiple elements in impersonation chain (#35694)
---
airflow/providers/google/common/hooks/base_google.py | 2 ++
docs/apache-airflow-providers-google/connections/gcp.rst | 2 +-
tests/providers/google/common/hooks/test_base_google.py | 14 ++++++++++++++
3 files changed, 17 insertions(+), 1 deletion(-)
diff --git a/airflow/providers/google/common/hooks/base_google.py
b/airflow/providers/google/common/hooks/base_google.py
index 77fd9394cf..3bde53571a 100644
--- a/airflow/providers/google/common/hooks/base_google.py
+++ b/airflow/providers/google/common/hooks/base_google.py
@@ -267,6 +267,8 @@ class GoogleBaseHook(BaseHook):
if not self.impersonation_chain:
self.impersonation_chain = self._get_field("impersonation_chain",
None)
+ if isinstance(self.impersonation_chain, str) and "," in
self.impersonation_chain:
+ self.impersonation_chain = [s.strip() for s in
self.impersonation_chain.split(",")]
target_principal, delegates =
_get_target_principal_and_delegates(self.impersonation_chain)
diff --git a/docs/apache-airflow-providers-google/connections/gcp.rst
b/docs/apache-airflow-providers-google/connections/gcp.rst
index 79422fb2f0..9ebe21efe3 100644
--- a/docs/apache-airflow-providers-google/connections/gcp.rst
+++ b/docs/apache-airflow-providers-google/connections/gcp.rst
@@ -131,7 +131,7 @@ Impersonation Chain
of the last account in the list, which will be impersonated in all
requests leveraging this connection.
If set as a string, the account must grant the originating account
the Service Account Token Creator IAM role.
- If set as a sequence, the identities from the list must grant
+ If set as a comma-separated list, the identities from the list must grant
Service Account Token Creator IAM role to the directly preceding identity,
with first
account from the list granting this role to the originating account.
diff --git a/tests/providers/google/common/hooks/test_base_google.py
b/tests/providers/google/common/hooks/test_base_google.py
index 06d04f6318..bd4342ec66 100644
--- a/tests/providers/google/common/hooks/test_base_google.py
+++ b/tests/providers/google/common/hooks/test_base_google.py
@@ -683,6 +683,20 @@ class TestGoogleBaseHook:
["ACCOUNT_2", "ACCOUNT_3"],
id="multiple_elements_list_with_override",
),
+ pytest.param(
+ None,
+ "ACCOUNT_1,ACCOUNT_2,ACCOUNT_3",
+ "ACCOUNT_3",
+ ["ACCOUNT_1", "ACCOUNT_2"],
+ id="multiple_elements_list_as_string",
+ ),
+ pytest.param(
+ None,
+ "ACCOUNT_1, ACCOUNT_2, ACCOUNT_3",
+ "ACCOUNT_3",
+ ["ACCOUNT_1", "ACCOUNT_2"],
+ id="multiple_elements_list_as_string_with_space",
+ ),
],
)
@mock.patch(MODULE_NAME + ".get_credentials_and_project_id")
