juan-pablo-guereca commented on PR #68975: URL: https://github.com/apache/airflow/pull/68975#issuecomment-4912664763
@potiuk totally agree passing secrets via pod env vars isn't safe practice, and this doesn't change that guidance at all, k8s level visibility stays the same either way. The reason I'd still love to see this merged: this masking already works fine in Airflow 2. In AF3 it quietly stopped working for var.json values in some cases, so **this is really just restoring existing behavior, not adding anything new**. I worry that teams who tested and trusted this on AF2 might not realize it's silently different on AF3. One more bit of context in case it's useful: I'm working on an AF2 to AF3 migration with a lot of existing DAGs, some of which already use this pattern (not by choice, just the reality of a large existing codebase). Losing masking silently on upgrade is a real regression for that kind of migration, not just a hypothetical, but happy to defer to whatever the security team decides either way. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
