xvega commented on PR #71349: URL: https://github.com/apache/airflow/pull/71349#issuecomment-5655726132
> Thanks, that clarifies the 401/403 handling. One follow-up: for a long-running trigger, if a refreshable credential expires and the Kubernetes API returns a 401, can we guarantee that the credential-refresh path is attempted before the 401 is treated as terminal? Ideally, an expected credential refresh should be transparent to the task rather than causing the trigger to fail and relying on a task-level retry. We couldn’t guarantee that before. The regression test I added showed that retries could reuse the rejected token, so I also added a fix. The GKE client now refreshes credentials and retries once after a 401, using the same client. If the refresh or retry fails, the error still propagates. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
