Secrets not being masked in Rendered Templates view with KubernetesPodOperator

[juan-pablo-guereca]

Under which category would you file this issue?

Task SDK

Apache Airflow version

Airflow 3.x

What happened and how to reproduce it?

In a DAG using KubernetesPodOperator if you pass a secret via env vars, they don't get masked in the "Rendered templates" view, leaking the secrets to any user with access to Airflow UI.

Example DAG to reproduce it

from airflow import DAG
from airflow.operators.bash import BashOperator
from airflow.providers.cncf.kubernetes.operators.pod import (
    KubernetesPodOperator,
)

DAG_ID = "test_secrets_masking"

ENVS = {
    "some_password": "{{ var.value.some_password }}",
    "some_password_json": "{{ var.json.some_password }}",
    "some_password_json.secret": "{{ var.json.some_password.secret }}",
    "some_password_json.foo": "{{ var.json.some_password.foo }}",
}

with DAG(
    dag_id=DAG_ID,
    schedule=None,
    description="just a dummy dag to test secrets masking",
    max_active_runs=1,
):
    command = "echo hi there; env; echo bye"

    BashOperator(task_id="some_bash_pod_operator", bash_command=command, env=ENVS)

    KubernetesPodOperator(
        task_id="some_k8s_pod_operator",
        cmds=["/bin/bash", "-c", command],
        env_vars=ENVS,
        is_delete_operator_pod=True,
        in_cluster=True,
        get_logs=True,
    )

What you think should happen instead?

The Secrets should be masked so the don't get leaked to Airflow UI.

Example:

Operating System

Debian GNU/Linux 12 (bookworm) (from official airflow image 3.2.2)

Deployment

None

Apache Airflow Provider(s)

cncf-kubernetes

Versions of Apache Airflow Providers

apache-airflow-providers-amazon==9.29.0
apache-airflow-providers-celery==3.20.0
apache-airflow-providers-cncf-kubernetes==10.17.1
apache-airflow-providers-common-compat==1.15.0
apache-airflow-providers-common-io==1.7.2
apache-airflow-providers-common-messaging==2.0.3
apache-airflow-providers-common-sql==2.0.0
apache-airflow-providers-docker==4.5.6
apache-airflow-providers-elasticsearch==6.5.4
apache-airflow-providers-fab==3.6.4
apache-airflow-providers-ftp==3.15.0
apache-airflow-providers-git==0.4.0
apache-airflow-providers-google==22.0.0
apache-airflow-providers-grpc==3.9.4
apache-airflow-providers-hashicorp==4.6.0
apache-airflow-providers-http==6.0.2
apache-airflow-providers-microsoft-azure==13.3.0
apache-airflow-providers-mysql==6.6.0
apache-airflow-providers-odbc==4.12.2
apache-airflow-providers-openlineage==2.17.0
apache-airflow-providers-postgres==6.7.0
apache-airflow-providers-redis==4.4.4
apache-airflow-providers-sendgrid==4.2.3
apache-airflow-providers-sftp==5.8.0
apache-airflow-providers-slack==9.10.0
apache-airflow-providers-smtp==3.0.1
apache-airflow-providers-snowflake==6.13.0
apache-airflow-providers-ssh==5.0.2
apache-airflow-providers-standard==1.13.1

Official Helm Chart version

1.21.0

Kubernetes Version

It happens on Helm chart and running Airflow docker image in standalone mode

Helm Chart configuration

Not applicable because it happens when testing it locally via docker compose or using airflow docker image in standalone mode.

Docker Image customizations

No response

Anything else?

Always when using KubernetesPodOperator

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[boring-cyborg]

Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.

[juan-pablo-guereca]

PR with the fix #68975

[juan-pablo-guereca]

Fix PR merged: #68975