This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 2c8925e33af Fix cloudsql query proxy iam system test (#72141)
2c8925e33af is described below
commit 2c8925e33afd8e9bec6a90893e7b2fcae6b33fc1
Author: Marcin <[email protected]>
AuthorDate: Thu Aug 27 13:00:48 2026 +0200
Fix cloudsql query proxy iam system test (#72141)
* Fix fallback value for CLOUD_IAM service account
* Update docs
---
providers/google/docs/connections/gcp_sql.rst | 7 ++---
.../cloud_sql/example_cloud_sql_query_proxy_iam.py | 31 +++++++++++++++++-----
2 files changed, 27 insertions(+), 11 deletions(-)
diff --git a/providers/google/docs/connections/gcp_sql.rst
b/providers/google/docs/connections/gcp_sql.rst
index f0d675b0172..c7280b33ea3 100644
--- a/providers/google/docs/connections/gcp_sql.rst
+++ b/providers/google/docs/connections/gcp_sql.rst
@@ -98,11 +98,8 @@ The Google provider supports two IAM authentication paths:
Configure Service Accounts on Google Cloud IAM side
"""""""""""""""""""""""""""""""""""""""""""""""""""
-For connecting via IAM you need to use Service Account. It can be the same
service account which you use for
-the ``gcloud`` authentication or an another account. If you decide to use a
different account then this
-account should be impersonated from the account which used for ``gcloud``
authentication and granted
-a ``Service Account Token Creator`` role. More information how to grant a role
`here
-<https://cloud.google.com/iam/docs/manage-access-service-accounts?hl=en&_gl=1*3bsv5i*_ga*NDY4NDIyNTcxLjE3MjkxNzQ4MTM.*_ga_WH2QY8WWF5*MTcyOTE5MzU1OS4yLjEuMTcyOTE5NTM0My4wLjAuMA..#single-role>`_.
+For connecting via IAM you need to use Service Account. It must be the same
service account which you use for
+the ``gcloud`` authentication.
Also the Service Account should be configured for working with IAM.
Here are links describing what should be done before the start: `PostgreSQL
diff --git
a/providers/google/tests/system/google/cloud/cloud_sql/example_cloud_sql_query_proxy_iam.py
b/providers/google/tests/system/google/cloud/cloud_sql/example_cloud_sql_query_proxy_iam.py
index 9ecb597119a..aeb60a6e059 100644
---
a/providers/google/tests/system/google/cloud/cloud_sql/example_cloud_sql_query_proxy_iam.py
+++
b/providers/google/tests/system/google/cloud/cloud_sql/example_cloud_sql_query_proxy_iam.py
@@ -43,6 +43,7 @@ from airflow.providers.google.cloud.operators.cloud_sql
import (
CloudSQLDeleteInstanceOperator,
CloudSQLExecuteQueryOperator,
)
+from airflow.providers.google.common.hooks.base_google import GoogleBaseHook
try:
from airflow.sdk import TriggerRule
@@ -61,8 +62,7 @@ IS_COMPOSER = bool(os.environ.get("COMPOSER_ENVIRONMENT", ""))
CLOUD_SQL_INSTANCE_NAME = f"{ENV_ID}-{DAG_ID}-postgres".replace("_", "-")
CLOUD_SQL_DATABASE_NAME = "test_db"
-CLOUD_IAM_SA = os.environ.get("SYSTEM_TESTS_CLOUDSQL_SA", "test_iam_sa")
-CLOUD_SQL_IAM_SA = CLOUD_IAM_SA.split(".gserviceaccount.com")[0]
+CLOUD_IAM_SA = os.environ.get("SYSTEM_TESTS_CLOUDSQL_SA")
CLOUD_SQL_IP_ADDRESS = "127.0.0.1"
CLOUD_SQL_PUBLIC_PORT = 5432
CONNECTION_PROXY_IAM_ID = f"{DAG_ID}_{ENV_ID}_proxy_iam"
@@ -110,6 +110,14 @@ def cloud_sql_database_create_body(instance: str) ->
dict[str, Any]:
}
+def get_gcp_service_account_email():
+ if CLOUD_IAM_SA is not None:
+ return CLOUD_IAM_SA
+ gcp_hook = GoogleBaseHook()
+ credentials = gcp_hook.get_credentials()
+ return credentials.service_account_email
+
+
with DAG(
dag_id=DAG_ID,
start_date=datetime(2026, 1, 1),
@@ -130,24 +138,34 @@ with DAG(
instance=CLOUD_SQL_INSTANCE_NAME,
)
+ @task(task_id="get_service_account_email")
+ def get_service_account_email() -> str:
+ return get_gcp_service_account_email()
+
+ service_account_email_val = get_service_account_email()
+
@task(task_id="create_user_postgres")
- def create_user(instance: str, service_account: str) -> None:
+ def create_user(instance: str, service_account_email: str) -> None:
+ service_account_name =
service_account_email.split(".gserviceaccount.com")[0]
with discovery.build("sqladmin", "v1beta4") as service:
request = service.users().insert(
project=PROJECT_ID,
instance=instance,
body={
- "name": service_account,
+ "name": service_account_name,
"type": "CLOUD_IAM_SERVICE_ACCOUNT",
},
)
request.execute()
- create_user_task = create_user(instance=CLOUD_SQL_INSTANCE_NAME,
service_account=CLOUD_SQL_IAM_SA)
+ create_user_task = create_user(
+ instance=CLOUD_SQL_INSTANCE_NAME,
service_account_email=service_account_email_val
+ )
@task(task_id="create_connection_postgres")
- def create_connection(connection_id: str, instance: str) -> str:
+ def create_connection(connection_id: str, instance: str,
service_account_email: str) -> str:
connection: dict[str, Any] = deepcopy(CONNECTION_WITH_PROXY_IAM_KWARGS)
+ connection["login"] = service_account_email
connection["extra"]["instance"] = instance
connection["extra"] = json.dumps(connection["extra"])
create_airflow_connection(
@@ -158,6 +176,7 @@ with DAG(
create_connection_task = create_connection(
connection_id=CONNECTION_PROXY_IAM_ID,
instance=CLOUD_SQL_INSTANCE_NAME,
+ service_account_email=service_account_email_val,
)
query_task = CloudSQLExecuteQueryOperator(
