AnushreeKasturi opened a new pull request, #74535: URL: https://github.com/apache/airflow/pull/74535
The async Kubernetes client used for pod creation (`async_pod_creation = True`) is built once and cached. When the kubeconfig authenticates through an exec credential plugin (e.g. EKS), the token expires, but the client keeps sending the first token, so pod creation fails with 401 until the scheduler restarts. The sync client is not affected because the `kubernetes` package installs a `refresh_api_key_hook` on its configuration. `kubernetes_asyncio` does not, so this PR registers an equivalent hook in `get_async_kube_client`: - The hook reloads the kubeconfig through the loader returned by `load_kube_config`, so exec-plugin credentials are re-run when they expire. - Reloads are serialized with an `asyncio.Lock`, so concurrent requests trigger at most one refresh at a time. - The client's `verify_ssl` and `ssl_ca_cert` overrides are preserved across reloads, since reloading the kubeconfig would otherwise overwrite them. Tests: - `test_refreshes_exec_token` (parametrized with 1 and 5 concurrent requests) checks that an expired exec token is refreshed on the next request, that concurrent requests share one refresh, and that the TLS overrides survive it. - `test_refresh_failure_can_be_retried` checks that a failed refresh raises and that a later request retries the refresh instead of getting stuck. Both new tests fail on `main` and pass with this change. `test_kube_client.py` and the `executors/` test suite pass locally. closes: #74306 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — AI coding assistant Generated-by: AI coding assistant following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
