anmolxlight opened a new pull request, #65335:
URL: https://github.com/apache/airflow/pull/65335
## Fix: EksPodOperator 401 with Cross-Account AssumeRole via aws_conn_id
Fixes apache/airflow#64657
## Problem
When using `EksPodOperator` with `aws_conn_id` pointing to a cross-account
IAM role (via `AssumeRole`),
pods fail with `401 Unauthorized`:
```
pods "simple-http-server" is forbidden: User "" cannot create resource
"pods" in API group "" in the namespace "default"
```
Audit log shows empty user identity: `"user":{}`.
## Root Cause
Two critical fragility points in the kubeconfig exec plugin `COMMAND`
template in `EksHook`:
1. **stderr merged into stdout** via `2>&1` — Python warnings, deprecation
notices, or log output from `eks_get_token` contaminated stdout that bash token
parsing relies on, causing `last_line` extraction to grab wrong line ->
empty/invalid timestamp and token values
2. **No token validation** — If parsing failed, malformed `ExecCredential`
JSON with empty token was sent to EKS API server -> 401 with empty user identity
## Changes
### `airflow/providers/amazon/aws/hooks/eks.py`
- Redirect stderr to `/dev/null` instead of merging with stdout (`2>&1`) to
ensure clean token output for bash parsing
- Add token validation: exit with error if token extraction fails, rather
than sending a malformed ExecCredential with empty token
- **Security fix**: Remove EKS bearer token from error output when token
validation fails (prevents token leakage into task logs)
- Keep `` in non-zero exit diagnostics for troubleshooting
### `tests/unit/amazon/aws/hooks/test_eks.py`
- Add `test_command_template_redirects_stderr`: verifies stderr is
redirected to `/dev/null` and not merged with stdout
- Add `test_command_template_validates_token`: verifies the token validation
check and error exit
## Review Notes
This supersedes PR #64749. The following genuine review concerns have been
addressed:
1. **Copilot security flag**: The empty-token error branch previously
printed `` which includes the EKS bearer token. This has been removed to
prevent credential leakage into task logs.
2. **Copilot diagnostic regression**: Non-zero exit now includes `` for
troubleshooting (was lost in original PR).
3. **o-nikolas concern**: The `/dev/null` approach is intentional and
correct — the stderr output we discard (Python warnings, botocore debug
messages) is not actionable for users. The non-zero exit diagnostics cover the
actionable failures.
4. **Copilot test assertion tightening**: Test assertions have been improved
to check for absence of `2>&1` (core correctness requirement) rather than just
presence of `/dev/null`, and the `exit 1` assertion is now unambiguous.
## Testing
```bash
python3 -c "
content =
open('providers/amazon/src/airflow/providers/amazon/aws/hooks/eks.py').read()
assert '2>&1' not in content
assert '2>/dev/null' in content
assert 'if [ -z "\" ]' in content
assert 'exit 1' in content
print('All checks passed')
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
