sfirke opened a new pull request, #65320:
URL: https://github.com/apache/airflow/pull/65320
Fix #65319
I have experienced the above bug for two years, blocking me from launching
Azure Containers on the AzureUSGovernment cloud from Airflow. I used AI to
isolate the cause of the bug and develop this patch. I have deployed this patch
in production and verified that it allows me to spin up Azure Container
Instances on Azure. And I have reviewed the code.
Here's the AI-generated summary - I don't have anything to change about it,
so leaving it as-is, but acknowledging that this is not drive-by slop 😅
## Summary
The `AzureContainerInstanceHook` and `AzureBaseHook` always constructed
Azure SDK clients
pointing at the public cloud management endpoint (`management.azure.com`),
regardless of
what a connection's `cloud_environment` extra said. The key was accepted
and stored but
never read—silently discarded at connection time. For subscriptions that
exist only on
`AzureUSGovernment` or `AzureChinaCloud`, this produced a
`ResourceNotFoundError: (SubscriptionNotFound)` with no clue that the
wrong cloud endpoint
was being called.
This patch makes `cloud_environment` meaningful:
- Adds `_AZURE_CLOUD_ENVIRONMENTS` to `base_azure.py`—a module-level
mapping from the
three supported cloud names to their `AzureAuthorityHosts` authority,
management
`base_url`, and `credential_scopes`.
- Reads `cloud_environment` in
`AzureBaseHook._get_client_secret_credential()` and passes
`authority` to `ClientSecretCredential`.
- Reads `cloud_environment` in `AzureContainerInstanceHook.get_conn()` and
passes
`authority` to `ClientSecretCredential` along with `base_url` and
`credential_scopes` to
`ContainerInstanceManagementClient`.
- Exposes the `cloud_environment` field in the connection form UI with a
placeholder
documenting the three accepted values.
Default behavior is unchanged: when `cloud_environment` is absent or set to
`"AzurePublicCloud"`, the same public cloud endpoints that were always
used continue to
be used.
**Supported values**
| `cloud_environment` | Authority | Management endpoint |
|---|---|---|
| `AzurePublicCloud` (default) | `login.microsoftonline.com` |
`management.azure.com` |
| `AzureUSGovernment` | `login.microsoftonline.us` |
`management.usgovcloudapi.net` |
| `AzureChinaCloud` | `login.chinacloudapi.cn` |
`management.chinacloudapi.cn` |
## Test plan
- Parameterized tests in `test_container_instance.py` cover all three
clouds plus the
absent-key default, asserting correct `authority`, `base_url`, and
`credential_scopes`
on construction.
- Parameterized tests in `test_base_azure.py` cover the same four cases for
`_get_client_secret_credential()`.
- Existing tests updated where the new `authority` and `base_url` kwargs
are now part of
the call signature.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Sonnet 4.6
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
