Skip to content

Use kubeconfig file to auth to GKE instead of oauth2 token - #32333

Closed
hussein-awala wants to merge 1 commit into
apache:mainfrom
hussein-awala:fix/gke_creds_timeout
Closed

Use kubeconfig file to auth to GKE instead of oauth2 token#32333
hussein-awala wants to merge 1 commit into
apache:mainfrom
hussein-awala:fix/gke_creds_timeout

Conversation

@hussein-awala

Copy link
Copy Markdown
Member

closes: #31648

Before the PR #29266, we used to create a temporary configuration file by running the command gcloud container clusters get-credentials. We would then use this file in the Kubernetes client. The get-credentials command configures kubectl to automatically refresh its credentials using the same identity as gcloud.

However, the #29266 introduced a new pod GKE hook that uses the following client code:

ApiClient(
    configuration,
    header_name="Authorization",
    header_value=f"Bearer {access_token}",
)

This client uses static oauth2 credentials and cannot refresh them when they expire. Since the default lifetime for GCP credentials is 3600 seconds, the operator fails with an Unauthorized exception after one hour.


^ Add meaningful description above

Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in newsfragments.

Signed-off-by: Hussein Awala <hussein@awala.fr>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:providers provider:cncf-kubernetes Kubernetes (k8s) provider related issues provider:google Google (including GCP) related issues

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Getting Unauthorized error messages with GKEStartPodOperator if pod execution is over 1 hour

2 participants