rjgoyln opened a new pull request, #71674: URL: https://github.com/apache/airflow/pull/71674
## Summary `airflow users create` — the Helm chart's create-user job — fails on deployments that authenticate to the metadata database with short-lived credentials, while the migrate job and the API server of the same release succeed: ``` psycopg2.OperationalError: connection to server at "...rds.amazonaws.com" failed: fe_sendauth: no password supplied ``` Such deployments leave the password out of `sql_alchemy_conn` and override `create_metadata_engine` in `airflow_local_settings.py` to mint an RDS IAM token per physical connection. Only `configure_orm()` calls that hook, so the second engine Flask-SQLAlchemy builds from the bare URI connects with no credentials at all. The DB manager and the auth manager's Flask app have the same gap — the API server escapes it only because deployments fall back to registering a global `Engine` listener. FAB now takes its default bind from the engine Airflow already built, so connect args, pool settings and `do_connect` handlers configured for the metadata database reach it too. Secondary `SQLALCHEMY_BINDS` keep their own engines. Note that `create_app()` already routed every ORM query through `settings.Session`, so its own engine only ever created the `session` table. ## Behavior change `SQLALCHEMY_DATABASE_URI` and `SQLALCHEMY_ENGINE_OPTIONS` set in `webserver_config.py` no longer steer the default bind; FAB's tables live in the metadata database. closes: #71664 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5) Generated-by: Claude Code (Opus 5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
