anmolxlight commented on code in PR #64749:
URL: https://github.com/apache/airflow/pull/64749#discussion_r3089221461
##########
providers/amazon/src/airflow/providers/amazon/aws/hooks/eks.py:
##########
@@ -82,20 +82,24 @@ class NodegroupStates(Enum):
# Load credentials from secure file using (POSIX-compliant dot
operator)
. {credentials_file}
+ # Redirect stderr to /dev/null to prevent Python warnings,
deprecation
+ # notices, or other log output from contaminating stdout. The token
+ # output must be the ONLY thing on stdout for bash parsing to work.
output=$({python_executable} -m
airflow.providers.amazon.aws.utils.eks_get_token \
- --cluster-name {eks_cluster_name} --sts-url '{sts_url}' {args}
2>&1)
+ --cluster-name {eks_cluster_name} --sts-url '{sts_url}' {args}
2>/dev/null)
status=$?
# Clear environment variables after use (defense in depth)
unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN
if [ "$status" -ne 0 ]; then
- printf '%s' "$output" >&2
+ printf 'eks_get_token failed with exit code %s' "$status" >&2
Review Comment:
Thanks for the review! You're right that `/dev/null` loses some diagnostic
info, but I've kept it for two reasons:
1. The stderr output we'd discard (Python warnings, botocore debug messages,
deprecation notices) is not actionable for users in this context — it doesn't
help them understand what's gone wrong with their credential configuration.
2. The non-zero exit path now preserves all diagnostic output from the
command (``) in the error message, so credential/STS failures are still fully
troubleshootable.
The key insight is that the stderr contamination problem only affects the
**success** path (when eks_get_token outputs a valid token but with extra noise
on stderr that gets merged into stdout and breaks parsing). On the failure
path, we now capture and report everything.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
