potiuk commented on PR #54582: URL: https://github.com/apache/airflow/pull/54582#issuecomment-3198125901
> If I am not mistaken about the purpose of the `eks_get_token` module, it is designed to be called directly with the Python executable, rather than being initialized through TaskSDK. Since it is executed by Python directly, and not within executor, triggerer, or similar processes, it operates outside the typical Airflow runtime. Well. from what I see this command is executed on the pod within EKS cluster - and it would mean that EKS cluster will have to have DB credentials in order to initialize ORM - and worker does not have those credentials anyway (in Airflow 3). Initialising ORM in this place is just **not going to work** - unless of course EKS cluster has the credentials which is obviously wrong according to the Airflow security model. I think though there is a way better solution - that is also "proper" the credentials of AWS connection should be uploaded to the EKS cluster (temporarily) as secret and the PODs run on EKS should use that secret (and the secret should be deleted after the pod completes. You cannot reallly get the EKS cluster that is used there to communicate with TaskSDK because there will normally be no firewalls opened for the cluster worker to communicate with API server (not mentioning that similarly if you want to run ORM/DB access you will have to have the capability of the EKS cluster to communicate back with Airflow DB. In either case - I think initializing the ORM does not solve the problem at all -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
