RehanAhmad25 commented on PR #72499: URL: https://github.com/apache/airflow/pull/72499#issuecomment-6439459930
@ashb thanks, fair points. On the false sense of security: agreed, this is not a security boundary. The conf is still stored as plain JSON in the metadata DB and shown in XCom if a task pushes it, and the docs say so. What this does is keep a trigger-time value out of logs, rendered templates, and the Dag Run endpoints, so it doesn't show up casually. As far as I can tell from the code, the UI response models don't return conf, and the execution API only hands it to the worker running the task, which needs the real value. On api_token: you're right, it was a bad example, and copying code without reading the prose is exactly how it would spread. I replaced it with a non-credential example (one_time_code) in the docs and tests, and added a warning at the top of the section saying credentials belong in a Connection or Variable. If you think masking in the API gives the wrong impression and would rather keep this PR to logs and rendered templates, I'm fine narrowing it. Just let me know. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
