Arjit-Sharma001 opened a new issue, #45916: URL: https://github.com/apache/airflow/issues/45916
### Apache Airflow Provider(s) cncf-kubernetes ### Versions of Apache Airflow Providers apache-airflow-providers-cncf-kubernetes 4.3.0 ### Apache Airflow version 2.3.4 ### Operating System Linux ### Deployment Official Apache Airflow Helm Chart ### Deployment details _No response_ ### What happened We are upgrading from apache-airflow-providers-cncf-kubernetes version 3.0.0 to 4.3.0, gradually moving through releases. Our current setup includes a custom script that, during the Docker image build for Airflow, tests all DAGs and tasks in dry_run mode. This script is essential for detecting issues such as Python syntax errors, DAG cycles, duplicate tasks, import errors, and template rendering issues. This process was functioning seamlessly with our existing Airflow version. However, as part of our upgrade to a newer version of Airflow (and its providers), we encountered an issue with the KubernetesPodOperator's dry_run functionality after addressing several other compatibility challenges. Problem Description The new dry_run implementation introduced in [this commit](https://github.com/apache/airflow/commit/d56ff765e15f9fcd582bc6d1ec0e83b0fedf476a) invokes the build_pod_request_obj method. This method calls the self.hook.is_in_cluster property, which attempts to construct a Kubernetes API client object and requires kube client credentials. ``` pod.metadata.labels.update( { 'airflow_version': airflow_version.replace('+', '-'), 'airflow_kpo_in_cluster': str(self.hook.is_in_cluster), } ) ``` The issue lies in the is_in_cluster property: ``` @property def is_in_cluster(self): """Expose whether the hook is configured with ``load_incluster_config`` or not""" if self._is_in_cluster is not None: return self._is_in_cluster self.api_client # so we can determine if we are in_cluster or not return self._is_in_cluster ``` This behavior causes the dry_run to fail in an isolated test environment without valid kube config or credentials. Error Traceback When running in this environment, the following error occurs: `kubernetes.config.config_exception.ConfigException: Invalid kube-config file. No configuration found. ` Desired Behavior We want to continue using dry_run to test DAGs without requiring Kubernetes credentials or kube config. The tests don't need to be fully accurate but should bypass unnecessary configurations. Proposed Solutions Introduce an Environment Variable Add an environment variable to bypass the airflow_kpo_in_cluster label setting in dry_run mode when explicitly requested by the user. Modify build_pod_request_obj Signature Change the method signature of build_pod_request_obj to include a dry_run: bool = False keyword argument. In the KubernetesPodOperator.dry_run method, invoke build_pod_request_obj(dry_run=True). Skip setting the airflow_kpo_in_cluster label if dry_run=True. Implement Both Options Combine both approaches to provide flexibility. These changes would enable dry_run functionality to work in isolated environments without requiring kube config or credentials while maintaining compatibility with the operator's primary functionality. ### What you think should happen instead The KubernetesPodOperator.dry_run should allow testing DAGs and tasks without requiring Kubernetes credentials or kube config. This would ensure that the dry_run functionality can execute in isolated or non-production environments without unnecessary dependencies. It does not need to fully mimic runtime behavior but should bypass features dependent on Kubernetes API calls, such as the airflow_kpo_in_cluster label. What Went Wrong The new dry_run implementation attempts to evaluate self.hook.is_in_cluster, which requires constructing a Kubernetes API client. This step fails when no kube config or credentials are provided in the test environment, leading to a ConfigException. Supporting Evidence Error Log Fragment `kubernetes.config.config_exception.ConfigException: Invalid kube-config file. No configuration found. ` Root Cause The build_pod_request_obj method in dry_run mode invokes self.hook.is_in_cluster as part of adding metadata labels: `'airflow_kpo_in_cluster': str(self.hook.is_in_cluster),` This property requires access to Kubernetes credentials, which are not available in the testing environment. ### How to reproduce Set Up the Environment Use Apache Airflow 2.10.4 and upgrade the apache-airflow-providers-cncf-kubernetes package to version 4.3.0. Ensure Kubernetes credentials (kube config) are not provided in the environment. Prepare a DAG with KubernetesPodOperator Create a DAG that uses the KubernetesPodOperator. Run Dry Run Test Verify the Error Confirm that the dry run fails with a kubernetes.config.config_exception.ConfigException error due to missing kube config or credentials. ### Anything else _No response_ ### Are you willing to submit PR? - [x] Yes I am willing to submit a PR! ### Code of Conduct - [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: commits-unsubscr...@airflow.apache.org.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org
