This is an automated email from the ASF dual-hosted git repository.
vatsrahul1001 pushed a commit to branch v3-3-test
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/v3-3-test by this push:
new a54d73007af [v3-3-test] Document that Dag bundle kwargs should
reference a Connection, not inline credentials (#68373) (#69105)
a54d73007af is described below
commit a54d73007aff0825c3941c063e75f071aca715a3
Author: github-actions[bot]
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Sun Jun 28 19:34:34 2026 +0530
[v3-3-test] Document that Dag bundle kwargs should reference a Connection,
not inline credentials (#68373) (#69105)
* Document that Dag bundle kwargs should reference a Connection, not inline
credentials
Generated-by: Claude Opus 4.8 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
* Fix docs spelling: reword 'inlined' (sphinx spellcheck)
(cherry picked from commit 8c74f8e99dbe0ade70354644aa1a1f0b017f2e1e)
Generated-by: Claude Opus 4.8 (1M context)
Co-authored-by: Jarek Potiuk <[email protected]>
---
.../docs/administration-and-deployment/dag-bundles.rst | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/airflow-core/docs/administration-and-deployment/dag-bundles.rst
b/airflow-core/docs/administration-and-deployment/dag-bundles.rst
index 7e1eaf0123b..354e6ecda16 100644
--- a/airflow-core/docs/administration-and-deployment/dag-bundles.rst
+++ b/airflow-core/docs/administration-and-deployment/dag-bundles.rst
@@ -61,6 +61,24 @@ Configuring Dag bundles
Dag bundles are configured in
:ref:`config:dag_processor__dag_bundle_config_list`. You can add one or more
Dag bundles here.
+.. warning:: Reference credentials through a Connection — do not inline them
+
+ Bundle ``kwargs`` are stored in the ``[dag_processor]
dag_bundle_config_list``
+ configuration, which Airflow exposes through the Config API when
+ :ref:`config:api__expose_config` is enabled. Any user authorized to read
the
+ configuration can read these values verbatim, so they must not contain
secrets.
+
+ Do **not** embed credentials directly in bundle ``kwargs`` — for example a
+ token placed directly in a ``repo_url`` like
+ ``https://x-access-token:<token>@github.com/org/repo.git``. Instead
reference
+ an Airflow :doc:`Connection <../authoring-and-scheduling/connections>`
+ (``git_conn_id`` for Git, ``aws_conn_id`` for S3, ``gcp_conn_id`` for GCS)
and
+ keep the credential in your
+ :doc:`secrets backend <../security/secrets/secrets-backend/index>`.
Connection
+ fields are resolved at runtime and are not written into
+ ``dag_bundle_config_list``.
+
+
By default, Airflow adds a ``LocalDagBundle`` pointing at the configured Dags
folder, maintaining the same behaviour as Airflow 2's Dags folder. The only
kwarg is ``path``, which defaults to the value of
:ref:`config:core__dags_folder` when omitted:
.. code-block:: ini
