arkadiuszbach opened a new issue, #76743:
URL: https://github.com/apache/airflow/issues/76743
### Under which category would you file this issue?
Helm chart
### Apache Airflow version
3.2.2
### What happened and how to reproduce it?
The chart's default PgBouncer image (`airflow-pgbouncer-*-1.23.1`, and the
1.25.2 image from #74647) cannot use a backend password longer than 2047
characters. PgBouncer before 1.26.0 stores `auth_file` passwords in a fixed
2048-byte buffer (`MAX_PASSWORD`, including the trailing NUL). Longer entries
are rejected, the user ends up with an empty password, and every new server
connection fails:
LOG RELOAD command issued
ERROR password too long in auth file
WARNING server login failed: FATAL Password returned by client is empty.
WARNING C-0x...: airflow-metadata/<user>@<ip>:<port> pooler error:
Password returned by client is empty.
We run the chart on AKS against Azure Database for PostgreSQL Flexible
Server with Microsoft Entra ID authentication only (password auth disabled).
PgBouncer authenticates to the server with a short-lived Entra access token,
which a sidecar writes into `auth_file` and refreshes with `RELOAD` before it
expires. Entra token length varies between issuances and sometimes exceeds 2047
characters, so the failure is intermittent: connections break after one refresh
and recover after a later one.
This is not specific to Azure. Any `auth_file` password or cloud IAM token
longer than 2047 characters triggers it.
### What you think should happen instead?
PgBouncer 1.26.0 raised the password limit to 65530 bytes, matching libpq
(pgbouncer/pgbouncer#1310, pgbouncer/pgbouncer#1520,
[changelog](https://www.pgbouncer.org/changelog.html)). Bumping the chart's
default PgBouncer image to **1.26.1** fixes this, and also fixes
CVE-2026-19888, CVE-2026-6668, CVE-2026-107348, CVE-2026-107349 and
CVE-2026-107350, which 1.25.2 is still affected by.
@stegololz, in #74647 you mentioned you plan to open a follow-up PR moving
the chart to PgBouncer 1.26.1 once jbub/pgbouncer_exporter#35 is released.
Could that PR reference this issue? Happy to help test it with Entra ID tokens.
### Operating System
_No response_
### Deployment
Official Apache Airflow Helm Chart
### Apache Airflow Provider(s)
_No response_
### Versions of Apache Airflow Providers
_No response_
### Official Helm Chart version
1.21.0
### Kubernetes Version
_No response_
### Helm Chart configuration
_No response_
### Docker Image customizations
Not applicable
### Anything else?
- #74647: bumped PgBouncer to 1.25.2 and announced the 1.26.1 follow-up.
- jbub/pgbouncer_exporter#35: exporter support for the new `SHOW STATS`
columns in PgBouncer 1.26 (still open). Exporter 0.21.0 returns only
`build_info` against 1.26.x, so PgBouncer and the exporter have to be bumped
together.
- As a workaround we currently build PgBouncer 1.26.1 ourselves from
`chart/dockerfiles/pgbouncer/Dockerfile`.
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of
Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
