seanghaeli commented on code in PR #76332:
URL: https://github.com/apache/airflow/pull/76332#discussion_r4529596763
##########
providers/amazon/src/airflow/providers/amazon/aws/executors/eks/_client_factory.py:
##########
@@ -138,14 +175,21 @@ def _configure_eks_auth(
def refresh_api_key(config: client.Configuration |
async_client.Configuration) -> None:
nonlocal token, refresh_at
if token is None or time.monotonic() >= refresh_at:
+ # Sign with the credentials the connection resolves to now: only a
new session picks up
+ # static keys rotated outside the process, such as in a rewritten
credentials file.
token = fetch_access_token_for_cluster(
- cluster_name, sts_url, region_name=session.region_name,
session=session
+ cluster_name, sts_url, region_name=session.region_name,
session=eks_hook.get_session()
Review Comment:
Ah, was missing something here: keys stored in the connection itself weren't
re-read, so if they were rotated it would keep signing with the stale keys and
every request would get a 401. It now re-reads the connection after a 401.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
