(airflow) branch main updated: Remove global from kerberos (#57702)

[jscheffl]

This is an automated email from the ASF dual-hosted git repository.

jscheffl pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git


The following commit(s) were added to refs/heads/main by this push:
     new 8f15ec960bf Remove global from kerberos (#57702)
8f15ec960bf is described below

commit 8f15ec960bf38020a29d2e0d987c1b03d6396a34
Author: Jens Scheffler <95105677+jsche...@users.noreply.github.com>
AuthorDate: Sat Nov 8 13:01:06 2025 +0100

    Remove global from kerberos (#57702)
    
    * Remove global from kerberos
    
    * Review feedback to adjust pytest using a fixture
    
    * Apply suggestion from @potiuk
    
    Co-authored-by: Jarek Potiuk <ja...@potiuk.com>
    
    ---------
    
    Co-authored-by: Jarek Potiuk <ja...@potiuk.com>
---
 airflow-core/src/airflow/security/kerberos.py     |  9 +++------
 airflow-core/tests/unit/security/test_kerberos.py | 11 ++++++-----
 2 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/airflow-core/src/airflow/security/kerberos.py 
b/airflow-core/src/airflow/security/kerberos.py
index 81d627fdbac..fa0cdc84491 100644
--- a/airflow-core/src/airflow/security/kerberos.py
+++ b/airflow-core/src/airflow/security/kerberos.py
@@ -40,12 +40,11 @@ import shlex
 import subprocess
 import sys
 import time
+from functools import cache
 
 from airflow.configuration import conf
 from airflow.utils.net import get_hostname
 
-NEED_KRB181_WORKAROUND: bool | None = None
-
 log = logging.getLogger(__name__)
 
 
@@ -124,10 +123,7 @@ def renew_from_kt(principal: str | None, keytab: str, 
exit_on_fail: bool = True)
             else:
                 return subp.returncode
 
-    global NEED_KRB181_WORKAROUND
-    if NEED_KRB181_WORKAROUND is None:
-        NEED_KRB181_WORKAROUND = detect_conf_var()
-    if NEED_KRB181_WORKAROUND:
+    if detect_conf_var():
         # (From: HUE-640). Kerberos clock have seconds level granularity. Make 
sure we
         # renew the ticket after the initial valid time.
         time.sleep(1.5)
@@ -173,6 +169,7 @@ def perform_krb181_workaround(principal: str):
     return ret
 
 
+@cache
 def detect_conf_var() -> bool:
     """
     Autodetect the Kerberos ticket configuration.
diff --git a/airflow-core/tests/unit/security/test_kerberos.py 
b/airflow-core/tests/unit/security/test_kerberos.py
index 3fcc05c22f9..f591768b528 100644
--- a/airflow-core/tests/unit/security/test_kerberos.py
+++ b/airflow-core/tests/unit/security/test_kerberos.py
@@ -24,7 +24,7 @@ from unittest import mock
 import pytest
 
 from airflow.security import kerberos
-from airflow.security.kerberos import get_kerberos_principal, renew_from_kt
+from airflow.security.kerberos import detect_conf_var, get_kerberos_principal, 
renew_from_kt
 
 from tests_common.test_utils.config import conf_vars
 
@@ -32,6 +32,11 @@ pytestmark = pytest.mark.db_test
 
 
 class TestKerberos:
+    @pytest.fixture(autouse=True)
+    def fresh_detect_conf_var(self):
+        """Clear cache of kerberos detection function."""
+        detect_conf_var.cache_clear()
+
     @pytest.mark.parametrize(
         ("kerberos_config", "expected_cmd"),
         [
@@ -87,7 +92,6 @@ class TestKerberos:
     )
     @mock.patch("time.sleep", return_value=None)
     @mock.patch("airflow.security.kerberos.open", 
mock.mock_open(read_data=b"X-CACHECONF:"))
-    @mock.patch("airflow.security.kerberos.NEED_KRB181_WORKAROUND", None)
     @mock.patch("airflow.security.kerberos.subprocess")
     def test_renew_from_kt(self, mock_subprocess, mock_sleep, kerberos_config, 
expected_cmd, caplog):
         expected_cmd_text = " ".join(shlex.quote(f) for f in expected_cmd)
@@ -120,7 +124,6 @@ class TestKerberos:
         ]
 
     @mock.patch("airflow.security.kerberos.subprocess")
-    @mock.patch("airflow.security.kerberos.NEED_KRB181_WORKAROUND", None)
     @mock.patch("airflow.security.kerberos.open", 
mock.mock_open(read_data=b""))
     def test_renew_from_kt_without_workaround(self, mock_subprocess, caplog):
         mock_subprocess.Popen.return_value.__enter__.return_value.returncode = 0
@@ -161,7 +164,6 @@ class TestKerberos:
         ]
 
     @mock.patch("airflow.security.kerberos.subprocess")
-    @mock.patch("airflow.security.kerberos.NEED_KRB181_WORKAROUND", None)
     def test_renew_from_kt_failed(self, mock_subprocess, caplog):
         mock_subp = mock_subprocess.Popen.return_value.__enter__.return_value
         mock_subp.returncode = 1
@@ -209,7 +211,6 @@ class TestKerberos:
         ]
 
     @mock.patch("airflow.security.kerberos.subprocess")
-    @mock.patch("airflow.security.kerberos.NEED_KRB181_WORKAROUND", None)
     @mock.patch("airflow.security.kerberos.open", 
mock.mock_open(read_data=b"X-CACHECONF:"))
     @mock.patch("airflow.security.kerberos.get_hostname", return_value="HOST")
     @mock.patch("time.sleep", return_value=None)