jroachgolf84 commented on code in PR #74591:
URL: https://github.com/apache/airflow/pull/74591#discussion_r4249012669
##########
providers/snowflake/tests/unit/snowflake/hooks/test_snowflake.py:
##########
@@ -1916,6 +1916,28 @@ def
test_get_conn_params_omits_oidc_token_when_unset(self):
assert "token" not in conn_params
assert "token_file_path" not in conn_params
+ @pytest.mark.parametrize(
+ "impersonation_path",
+ [
+ ["arn:aws:iam::123456789012:role/a",
"arn:aws:iam::123456789012:role/b"],
+ "arn:aws:iam::123456789012:role/a,
arn:aws:iam::123456789012:role/b",
Review Comment:
Can you update the spacing a bit? It's a little confusing.
##########
providers/snowflake/docs/connections/snowflake.rst:
##########
@@ -77,6 +77,10 @@ Extra (optional)
* ``token_file_path``: Path to a file holding the OIDC ID token used when
``workload_identity_provider``
is ``OIDC``. The connector reads the token from this file, which suits
projected or rotated tokens
(for example a Kubernetes service-account token).
+ * ``workload_identity_impersonation_path``: Identities to impersonate, in
order, before authenticating with
Review Comment:
I think in GCP it's something like `_chain`. Does that make more sense?
##########
providers/snowflake/src/airflow/providers/snowflake/hooks/snowflake.py:
##########
@@ -572,6 +572,13 @@ def _add_workload_identity_config(
if token_file_path:
conn_config["token_file_path"] = token_file_path
+ impersonation_path = self._get_field(extra_dict,
"workload_identity_impersonation_path")
Review Comment:
Did you validate that adding `workload_identity_impersonation_path` to
`extra` doesn't already propagate it through?
##########
providers/snowflake/docs/connections/snowflake.rst:
##########
@@ -77,6 +77,10 @@ Extra (optional)
* ``token_file_path``: Path to a file holding the OIDC ID token used when
``workload_identity_provider``
is ``OIDC``. The connector reads the token from this file, which suits
projected or rotated tokens
(for example a Kubernetes service-account token).
+ * ``workload_identity_impersonation_path``: Identities to impersonate, in
order, before authenticating with
Review Comment:
Should this have `_path` at the end of it? I would assume anything with a
`_path` at the end is pointing to a path to a file itself.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
