This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 688dff54a08 Flag deprecated expose_config=non-sensitive-only in config
lint (#72507)
688dff54a08 is described below
commit 688dff54a085e2a5d22eb3c1d8460252a8a2c5d6
Author: PoAn Yang <[email protected]>
AuthorDate: Tue Sep 8 03:58:02 2026 +0900
Flag deprecated expose_config=non-sensitive-only in config lint (#72507)
Signed-off-by: PoAn Yang <[email protected]>
---
.../src/airflow/cli/commands/config_command.py | 7 ++++
.../tests/unit/cli/commands/test_config_command.py | 16 ++++++++++
.../src/airflowctl/ctl/commands/config_command.py | 7 ++++
.../ctl/commands/test_config_command.py | 37 ++++++++++++++++++++++
4 files changed, 67 insertions(+)
diff --git a/airflow-core/src/airflow/cli/commands/config_command.py
b/airflow-core/src/airflow/cli/commands/config_command.py
index 77b187b5899..4dc38a38cc7 100644
--- a/airflow-core/src/airflow/cli/commands/config_command.py
+++ b/airflow-core/src/airflow/cli/commands/config_command.py
@@ -657,6 +657,13 @@ CONFIGS_CHANGES = [
config=ConfigParameter("api", "page_size"),
renamed_to=ConfigParameter("api", "fallback_page_limit"),
),
+ ConfigChange(
+ config=ConfigParameter("api", "expose_config"),
+ was_removed=False,
+ is_invalid_if="non-sensitive-only",
+ suggestion="This value is deprecated and treated as `True`. Set
`expose_config` to `True` instead; "
+ "sensitive configuration values are always masked.",
+ ),
# scheduler
ConfigChange(
config=ConfigParameter("scheduler", "dependency_detector"),
diff --git a/airflow-core/tests/unit/cli/commands/test_config_command.py
b/airflow-core/tests/unit/cli/commands/test_config_command.py
index 3e3913d6947..5d634bb13bf 100644
--- a/airflow-core/tests/unit/cli/commands/test_config_command.py
+++ b/airflow-core/tests/unit/cli/commands/test_config_command.py
@@ -531,6 +531,22 @@ class TestConfigLint:
assert "Invalid value" not in normalized_output
+ @pytest.mark.parametrize(
+ ("expose_config", "expect_issue"),
+ [
+ pytest.param("non-sensitive-only", True, id="deprecated-value"),
+ pytest.param("True", False, id="boolean-value"),
+ ],
+ )
+ def test_lint_detects_deprecated_expose_config_value(self, expose_config,
expect_issue, stdout_capture):
+ with conf_vars({("api", "expose_config"): expose_config}),
stdout_capture as temp_stdout:
+
config_command.lint_config(cli_parser.get_parser().parse_args(["config",
"lint"]))
+
+ normalized_output = re.sub(r"\s+", " ", temp_stdout.getvalue().strip())
+ expected_message = "Invalid value `non-sensitive-only` set for
`expose_config` configuration parameter in `api` section."
+
+ assert (expected_message in normalized_output) is expect_issue
+
@pytest.mark.parametrize(
("remove_if_equals", "config_value", "expect_issue"),
[
diff --git a/airflow-ctl/src/airflowctl/ctl/commands/config_command.py
b/airflow-ctl/src/airflowctl/ctl/commands/config_command.py
index b83600697ad..8d5b4324519 100644
--- a/airflow-ctl/src/airflowctl/ctl/commands/config_command.py
+++ b/airflow-ctl/src/airflowctl/ctl/commands/config_command.py
@@ -259,6 +259,13 @@ CONFIGS_CHANGES = [
config=ConfigParameter("api", "auth_backends"),
renamed_to=ConfigParameter("fab", "auth_backends"),
),
+ ConfigChange(
+ config=ConfigParameter("api", "expose_config"),
+ was_removed=False,
+ is_invalid_if="non-sensitive-only",
+ suggestion="This value is deprecated and treated as `True`. Set
`expose_config` to `True` instead; "
+ "sensitive configuration values are always masked.",
+ ),
# logging
ConfigChange(
config=ConfigParameter("logging", "enable_task_context_logger"),
diff --git a/airflow-ctl/tests/airflow_ctl/ctl/commands/test_config_command.py
b/airflow-ctl/tests/airflow_ctl/ctl/commands/test_config_command.py
index 77705a4c63c..af694eb51fc 100644
--- a/airflow-ctl/tests/airflow_ctl/ctl/commands/test_config_command.py
+++ b/airflow-ctl/tests/airflow_ctl/ctl/commands/test_config_command.py
@@ -384,6 +384,43 @@ class TestCliConfigCommands:
in calls[1]
)
+ @pytest.mark.parametrize(
+ ("expose_config", "expect_issue"),
+ [
+ pytest.param("non-sensitive-only", True, id="deprecated-value"),
+ pytest.param("True", False, id="boolean-value"),
+ ],
+ )
+ @patch("rich.print")
+ def test_lint_detects_deprecated_expose_config_value(
+ self, mock_rich_print, expose_config, expect_issue, api_client_maker
+ ):
+ response_config = Config(
+ sections=[
+ ConfigSection(
+ name="api",
+ options=[ConfigOption(key="expose_config",
value=expose_config)],
+ )
+ ]
+ )
+
+ api_client = api_client_maker(
+ path="/api/v2/config",
+ response_json=response_config.model_dump(),
+ expected_http_status_code=200,
+ kind=ClientKind.CLI,
+ )
+
+ config_command.lint(
+ self.parser.parse_args(["config", "lint"]),
+ api_client=api_client,
+ )
+
+ calls = [call[0][0] for call in mock_rich_print.call_args_list]
+ expected_message = "Invalid value `non-sensitive-only` set for
`expose_config` configuration parameter in `api` section."
+
+ assert any(expected_message in call for call in calls) is expect_issue
+
@patch("airflowctl.api.client.Credentials.load")
@patch.dict(os.environ, {"AIRFLOW_CLI_TOKEN": "TEST_TOKEN"})
@patch.dict(os.environ, {"AIRFLOW_CLI_ENVIRONMENT": "TEST_CONFIG"})
