henry3260 opened a new pull request, #76081: URL: https://github.com/apache/airflow/pull/76081
## Why `AsyncKubernetesHook` translates Kubernetes API errors so `KubernetesPodTrigger` can tell a permission problem apart from an ordinary failure and point the user at the missing RBAC. That translation never ran. The handlers in `get_pod`, `read_logs` and `get_pod_events` caught `urllib3.exceptions.HTTPError`, which belongs to the **synchronous** client. The async hook talks to the cluster through `kubernetes_asyncio` over aiohttp, and its `ApiException` shares no ancestry with `HTTPError`: ```python # kubernetes_asyncio/client/exceptions.py class OpenApiException(Exception): ... class ApiException(OpenApiException): ... ``` So a 403 from `read_namespaced_pod` passed straight through the hook, and `KubernetesPodTrigger`'s `except KubernetesApiPermissionError` branch — along with its message about adding the triggerer's service account to `pod-launcher-role` — was unreachable. The task failed through the trigger's generic `except Exception` with no hint about what to fix. `KubernetesApiError` was likewise never raised from anywhere. ## What `providers/cncf/kubernetes/src/airflow/providers/cncf/kubernetes/hooks/kubernetes.py` - The three handlers now catch `kubernetes_asyncio`'s `ApiException` and translate **only** 403 into `KubernetesApiPermissionError`. `read_logs` gains the same 403 branch the other two already had, so the guidance appears whichever call hits the denial first. - Every other status is re-raised unchanged rather than wrapped. `generic_api_retry` owns the decision about which statuses are transient and inspects `ApiException.status` to make it; wrapping a 503 in `KubernetesApiError` would hide that status from the retry predicate and turn a retryable error into an immediate task failure. That is why this does *not* restore a `KubernetesApiError` path — the class is now unused. - Dropped the `urllib3` `HTTPError` import, which the async code paths cannot produce. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (please specify the tool below) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
