taehwoi opened a new pull request, #72139: URL: https://github.com/apache/airflow/pull/72139
Secrets backends receive `team_name` during task execution, but during dag file parsing it was always `None`, so team-scoped connections and variables did not resolve in top-level dag code (see #65530). What changes: - The dag processor manager gives each parsing process an in-process API client whose requests carry the bundle name (`airflow-dag-bundle-name` header). - `InProcessExecutionAPI` reads that header into a new `TIClaims.bundle_name` claim. `get_team_name_dep` resolves the team from `DagBundleModel` when the claim is set, and from the task instance otherwise, so variables and connections routes need no changes. - Only the in-process app reads the header. The API server takes identity from the signed token and ignores it, so a worker cannot use it to reach another team's secrets. - Parse-time variable writes and key listing become team-scoped as well, matching task execution. Design note, feedback welcome: the in-process app is shared by every parsing process in the manager, so the bundle identity has to travel with each request. A header read only by the in-process auth override was the smallest carrier I found. Alternatives considered: a query parameter honored by the real server (spoofable from a task token), resolving secrets directly in the manager (bypasses the execution API), a signed token minted by the dag processor (needs the JWT key there). If another carrier fits the AIP-92 direction better, I am glad to switch. Not included: the triggerer has the same gap (`TriggerRunnerSupervisor.team_name` is known but not passed); it can reuse this mechanism through its `make_client` seam in a follow-up. closes: #70495 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes - Claude Code (Claude Fable 5) Generated-by: Claude Code (Claude Fable 5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
