spcvalente commented on code in PR #74591:
URL: https://github.com/apache/airflow/pull/74591#discussion_r4281973277
##########
providers/snowflake/docs/connections/snowflake.rst:
##########
@@ -77,6 +77,11 @@ Extra (optional)
* ``token_file_path``: Path to a file holding the OIDC ID token used when
``workload_identity_provider``
is ``OIDC``. The connector reads the token from this file, which suits
projected or rotated tokens
(for example a Kubernetes service-account token).
+ * ``workload_identity_impersonation_path``: The chain of identities to
impersonate, in order, before
+ authenticating with Workload Identity Federation, as a list or a
comma-separated string (not a file path;
+ the name matches the connector parameter). For ``AWS``, IAM role ARNs
that the workload's credentials
+ assume in turn; for ``GCP``, service account emails. Snowflake then
trusts the last identity in the chain
+ instead of the workload's own. Requires
``snowflake-connector-python>=4.0.0``.
Review Comment:
Done in df406201cb: the hook now raises
`AirflowOptionalProviderFeatureException` when the path is set and
`snowflake-connector-python` is older than 4.0.0. Older connectors only warn
about an unknown parameter and then authenticate as the workload itself, so
failing is safer. Bumping the minimum is blocked by the `sqlalchemy>=2.0` TODO
in `pyproject.toml`.
---
Drafted-by: Claude Code (Opus 5.5) (no human review before posting)
##########
providers/snowflake/tests/unit/snowflake/hooks/test_snowflake.py:
##########
@@ -1894,6 +1896,15 @@ def
test_get_connection_form_widgets_exposes_workload_identity_provider(self):
assert "workload_identity_provider" in widgets
+ def
test_connection_form_exposes_workload_identity_impersonation_path(self):
Review Comment:
Added
`test_get_conn_params_omits_workload_identity_impersonation_path_when_empty`,
covering unset, `""`, `" , "` and `[]`. The `" , "` case did forward an empty
list before.
---
Drafted-by: Claude Code (Opus 5.5) (no human review before posting)
##########
providers/snowflake/src/airflow/providers/snowflake/hooks/snowflake.py:
##########
@@ -572,6 +576,13 @@ def _add_workload_identity_config(
if token_file_path:
conn_config["token_file_path"] = token_file_path
+ impersonation_path = self._get_field(extra_dict,
"workload_identity_impersonation_path")
+
+ if impersonation_path:
Review Comment:
Taken as suggested: it accepts a list or a comma-separated string, strips
and drops empty steps either way, and raises `ValueError` otherwise.
---
Drafted-by: Claude Code (Opus 5.5) (no human review before posting)
##########
providers/snowflake/src/airflow/providers/snowflake/hooks/snowflake.py:
##########
@@ -572,6 +576,13 @@ def _add_workload_identity_config(
if token_file_path:
conn_config["token_file_path"] = token_file_path
+ impersonation_path = self._get_field(extra_dict,
"workload_identity_impersonation_path")
+
+ if impersonation_path:
+ if isinstance(impersonation_path, str):
+ impersonation_path = [step.strip() for step in
impersonation_path.split(",") if step.strip()]
+ conn_config["workload_identity_impersonation_path"] =
impersonation_path
Review Comment:
Good catch, confirmed: `_url()` turns the list into a string and the
connector then iterates it character by character. It is now excluded from the
URI and passed through `connect_args`, like `private_key` and
`session_parameters`, with a test on `get_sqlalchemy_engine`.
---
Drafted-by: Claude Code (Opus 5.5) (no human review before posting)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
