SEPURI-SAI-KRISHNA opened a new pull request, #71644:
URL: https://github.com/apache/airflow/pull/71644
`CloudBuildCreateBuildTrigger` accepts an `impersonation_chain`, stores it,
and
serializes it — but built its hook without it:
```python
def _get_async_hook(self) -> CloudBuildAsyncHook:
return CloudBuildAsyncHook(gcp_conn_id=self.gcp_conn_id)
```
So the value travels correctly from `CloudBuildCreateBuildOperator` all the
way into the
triggerer and is then discarded at the point of use. Once a
`CloudBuildCreateBuildOperator`
task defers, its polling calls authenticate as the connection's service
account rather than
the impersonated one.
Two ways this surfaces:
- where impersonation exists because the base account deliberately lacks
permission, the
deferred poll fails with a 403 that does not mention impersonation;
- where the base account has broader rights, the poll quietly succeeds under
an identity
the Dag author did not select.
The non-deferrable path is unaffected, so switching `deferrable` off appears
to "fix" it.
Worth noting for reviewers: `GoogleBaseHook.__init__` falls back to the
connection's
`impersonation_chain` extra when the argument is absent, so deployments that
configure
impersonation on the *connection* were never affected. The bug is limited to
impersonation
configured on the operator — which is the documented parameter on every
Google operator.
No newsfragment: this is a provider change, and provider changelogs are
regenerated from
`git log` by the release manager.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Opus 5)
Generated-by: Claude Code (Opus 5) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
