moomindani commented on code in PR #69509:
URL: https://github.com/apache/airflow/pull/69509#discussion_r3575243998
##########
providers/databricks/src/airflow/providers/databricks/hooks/databricks_base.py:
##########
@@ -1167,6 +1233,9 @@ def _get_token(self, raise_error: bool = False) -> str |
None:
if self.databricks_conn.extra_dejson.get("federated_token_provider"):
self.log.debug("Using OIDC token federation with a supplied token
provider.")
return
self._get_federated_databricks_token(self._get_oidc_token_service_url())
+ if self._is_aws_federation():
Review Comment:
Non-blocking: this fixup correctly reorders the dispatch so AWS wins over
Kubernetes when both `federated_k8s` and `federated_aws` are configured — but
there's no regression test for it. Since this is exactly the precedence bug
from my earlier comment, a test asserting AWS takes precedence when both extras
are set (e.g. `login="federated_k8s"` + `extra={"federated_aws": True}` →
subject token comes from STS, not the pod) would guard against this silently
regressing in a future refactor.
---
Drafted-by: Claude Code (Sonnet 5); reviewed by @moomindani before posting
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
