gitPratikSingh opened a new pull request, #76241:
URL: https://github.com/apache/airflow/pull/76241
Workers that connect to a cluster behind a private or corporate CA currently
have no supported way to trust that CA. The Kubernetes hook offers
`disable_verify_ssl` (which turns verification off entirely) or whatever
the kubeconfig itself carries — and a kubeconfig without a
certificate-authority entry silently resets an explicitly configured CA to
`None` during loading, so the worker's own API client fails TLS when it
lists pods. This is the failure reported in #53192.
This change adds `ssl_ca_cert` to `KubernetesHook` (as a constructor
argument and as a connection extra, with the constructor argument winning)
and to `KubernetesPodOperator` (passed through to the hook). The value is
applied to the API client configuration after kubeconfig loading, so it
survives the loader overwrite on every configuration route (in-cluster,
kubeconfig path, kubeconfig content, config dict, and default client).
The Kubernetes connection documentation gains a matching entry.
Out of scope: `AsyncKubernetesHook` is not covered here — its client does
not handle even `disable_verify_ssl` today, so async parity is a separate
follow-up. Prior attempts at this (PR #71831, #55403) were closed without
review, not on the merits.
closes: #53192
---
##### Was generative AI tooling used to co-author this PR?
- [ ] Yes (please specify the tool below)
---
## How it was tested
- Full `providers/cncf/kubernetes` unit suite: 1468 passed, 19 skipped.
The 4 failures (async log-timestamp tests) and 28 setup errors are
identical on clean main — no regressions. The branch run passes exactly
10 more tests than main, which are the 10 new tests below.
-
`providers/cncf/kubernetes/tests/unit/cncf/kubernetes/hooks/test_kubernetes.py`:
187 passed.
- `providers/cncf/kubernetes/tests/unit/cncf/kubernetes/decorators/`: 58
passed.
-
`providers/cncf/kubernetes/tests/unit/cncf/kubernetes/operators/test_pod.py`:
263 passed; the async write-logs failures in that file are pre-existing
(identical on clean main).
- All new tests fail without the fix (verified via a stash round-trip), as
do the updated call-argument expectations.
- `ruff format` and `ruff check` pass on all changed files.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
