Eason09053360 opened a new pull request, #73472: URL: https://github.com/apache/airflow/pull/73472
## Why `JWKS._should_fetch_jwks()` only consulted `refresh_retry_interval_secs` once a keyset had loaded: `not self._jwks` short-circuits the check, so while the JWKS endpoint is down every incoming request issues its own remote fetch. An IdP outage turns into request-rate traffic against it and the API server stalls on the timeouts, contrary to the docstring's "minimum interval between attempts". Core and Execution API validators share this class. ## What - `airflow-core/src/airflow/api_fastapi/auth/tokens.py`: the retry interval now gates the never-loaded case too, and fetches are single-flight with a per-event-loop lock (`validated_claims()` runs through `async_to_sync` in a throwaway loop) so concurrent cold-start requests share the first fetch instead of failing with no keyset; an in-flight refresh keeps serving the existing keyset, and `status()` requires a loaded keyset before reporting healthy. - `test_tokens.py`: one fetch per retry window against a 500-ing endpoint, one shared fetch for 10 concurrent cold-start calls, and lock reuse across event loops. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5, Fable 5.1) Generated-by: Claude Code (Opus 5, Fable 5.1) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
