This is an automated email from the ASF dual-hosted git repository.
amoghrajesh pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 2d0ec09fe45 Fix some docs and test gaps following up multi team secret
refusal (#71106)
2d0ec09fe45 is described below
commit 2d0ec09fe4533ce17ea9624ee543c123f2afe9ba
Author: Amogh Desai <[email protected]>
AuthorDate: Wed Aug 5 19:59:57 2026 +0530
Fix some docs and test gaps following up multi team secret refusal (#71106)
---
.../tests/unit/amazon/aws/secrets/test_systems_manager.py | 14 ++++++++------
.../google-cloud-secret-manager-backend.rst | 8 ++++++--
.../tests/unit/microsoft/azure/secrets/test_key_vault.py | 4 ++++
3 files changed, 18 insertions(+), 8 deletions(-)
diff --git
a/providers/amazon/tests/unit/amazon/aws/secrets/test_systems_manager.py
b/providers/amazon/tests/unit/amazon/aws/secrets/test_systems_manager.py
index 990ac613598..8795eeb53ea 100644
--- a/providers/amazon/tests/unit/amazon/aws/secrets/test_systems_manager.py
+++ b/providers/amazon/tests/unit/amazon/aws/secrets/test_systems_manager.py
@@ -31,6 +31,8 @@ from airflow.providers.amazon.aws.secrets.systems_manager
import (
from tests_common.test_utils.config import conf_vars
+multi_team_enabled = conf_vars({("core", "multi_team"): "True"})
+
URI_CONNECTION = pytest.param(
"postgres://my-login:my-pass@my-host:5432/my-schema?param1=val1¶m2=val2",
id="uri-connection"
)
@@ -116,7 +118,7 @@ class TestSsmSecrets:
returned_uri = ssm_backend.get_conn_value(conn_id="test_postgres",
team_name="my_team")
assert returned_uri == "postgresql://airflow:airflow@host:5432/airflow"
- @conf_vars({("core", "multi_team"): "True"})
+ @multi_team_enabled
@mock_aws
def test_global_caller_cannot_access_team_scoped_connection(self):
param = {
@@ -128,7 +130,7 @@ class TestSsmSecrets:
ssm_backend.client.put_parameter(**param)
assert ssm_backend.get_conn_value(conn_id="my_team--test_postgres") is
None
- @conf_vars({("core", "multi_team"): "True"})
+ @multi_team_enabled
@mock_aws
def test_another_teams_secret_is_not_reachable(self):
"""A caller scoped to one team must not reach another team's parameter
by naming it."""
@@ -142,7 +144,7 @@ class TestSsmSecrets:
assert ssm_backend.get_conn_value(conn_id="my_team--test_postgres",
team_name="other_team") is None
- @conf_vars({("core", "multi_team"): "True"})
+ @multi_team_enabled
@mock_aws
def test_team_whose_name_extends_the_callers_is_not_reachable(self):
"""A prefix match on the caller's own namespace is not proof of
ownership."""
@@ -156,7 +158,7 @@ class TestSsmSecrets:
assert
ssm_backend.get_conn_value(conn_id="my_team--prod--test_postgres",
team_name="my_team") is None
- @conf_vars({("core", "multi_team"): "True"})
+ @multi_team_enabled
@mock_aws
def test_team_scoped_lookup_cannot_reach_a_longer_teams_namespace(self):
"""The team scoped name is not safe by construction -- the id can
extend it.
@@ -176,7 +178,7 @@ class TestSsmSecrets:
assert ssm_backend.get_conn_value(conn_id="prod--test_postgres",
team_name="my_team") is None
- @conf_vars({("core", "multi_team"): "True"})
+ @multi_team_enabled
@mock_aws
def test_refusing_an_ambiguous_id_is_logged(self, caplog):
"""A silent ``None`` is indistinguishable from a missing secret, so
the refusal is logged.
@@ -288,7 +290,7 @@ class TestSsmSecrets:
assert ssm_backend.get_variable(key="hello", team_name="my_team") ==
"world"
- @conf_vars({("core", "multi_team"): "True"})
+ @multi_team_enabled
@mock_aws
def test_global_caller_cannot_access_team_scoped_variable(self):
param = {"Name": "/airflow/variables/my_team--hello", "Type":
"String", "Value": "world"}
diff --git
a/providers/google/docs/secrets-backends/google-cloud-secret-manager-backend.rst
b/providers/google/docs/secrets-backends/google-cloud-secret-manager-backend.rst
index 7a4328ad3c2..091fa90a5bf 100644
---
a/providers/google/docs/secrets-backends/google-cloud-secret-manager-backend.rst
+++
b/providers/google/docs/secrets-backends/google-cloud-secret-manager-backend.rst
@@ -233,8 +233,12 @@ secret. Avoid ``--`` in connection ids and variable keys.
.. warning::
- This refusal applies whether or not you use teams. If you already store a
connection or
- variable whose id contains ``--``, it stops resolving after upgrading and
you must rename it.
+ This refusal only applies when ``[core] multi_team`` is enabled — with
multi-team support
+ off, no team-scoped name can exist for a ``--``-containing id to collide
with, so it resolves
+ normally. If you already store a connection or variable whose id contains
``--``, it keeps
+ working until multi-team support is enabled, at which point it silently
stops resolving (a
+ warning is logged, but lookups do not raise) instead of raising outright.
Check for ids
+ containing ``--`` before turning on ``multi_team``.
``get_config`` is not team-scoped and is unaffected by any of the above.
diff --git
a/providers/microsoft/azure/tests/unit/microsoft/azure/secrets/test_key_vault.py
b/providers/microsoft/azure/tests/unit/microsoft/azure/secrets/test_key_vault.py
index 0d869bf8b19..26903998acd 100644
---
a/providers/microsoft/azure/tests/unit/microsoft/azure/secrets/test_key_vault.py
+++
b/providers/microsoft/azure/tests/unit/microsoft/azure/secrets/test_key_vault.py
@@ -235,6 +235,10 @@ class TestAzureKeyVaultBackend:
assert backend.get_variable("prod__hello") == "world"
assert backend.get_config("prod--sql_alchemy_conn") == "world"
+
mock_client.get_secret.assert_any_call(name="airflow-connections-prod--my-db")
+
mock_client.get_secret.assert_any_call(name="airflow-variables-prod--hello")
+
mock_client.get_secret.assert_any_call(name="airflow-config-prod--sql-alchemy-conn")
+
@mock.patch(f"{KEY_VAULT_MODULE}.AzureKeyVaultBackend._get_secret")
def test_variable_prefix_none_value(self, mock_get_secret):
"""
