Empty expirationTimestamp after parsing output of eks_get_token.py

[peloyeje]

Apache Airflow Provider(s)

amazon

Versions of Apache Airflow Providers

apache-airflow-providers-amazon==9.9.0
apache-airflow-providers-cncf-kubernetes==10.6.0

Apache Airflow version

2.10.5

Operating System

Linux

Deployment

Official Apache Airflow Helm Chart

Deployment details

• On Kubernetes
• Executor: CeleryKubernetesExecutor

Using in_cluster = False for all KubernetesPodOperator instances

What happened

The COMMAND shell snippet (airflow/providers/amazon/aws/hooks/eks.py:81) fails to extract the expirationTimestamp from the output of airflow.providers.amazon.aws.utils.eks_get_token and returns an empty string, which leads to the following (non-blocking) error while trying to parse it here:

{kube_config.py:520} ERROR - 'NoneType' object has no attribute 'groups'

What you think should happen instead

No response

How to reproduce

Minimal reproducible example:

cat <<EOF > output.txt
[2025-07-22T10:33:47.045+0200] {base.py:84} INFO - Retrieving connection 'aws_default'
[2025-07-22T10:33:47.372+0200] {base.py:84} INFO - Retrieving connection 'aws_default'
expirationTimestamp: 2025-07-22T08:47:47Z, token: foo
EOF

cat <<EOF > get_token.py
output=\$(cat output.txt)

status=\$?

if [ "\$status" -ne 0 ]; then
    printf '%s' "\$output" >&2
    exit "\$status"
fi

# Use pure bash below to parse so that it's posix compliant
last_line=\${output##*$'\n'}  # strip everything up to the last newline

timestamp=\${last_line#expirationTimestamp: }  # drop the label
timestamp=\${timestamp%%,*}  # keep up to the first comma

token=\${last_line##*, token: }  # text after ", token: "

json_string=\$(printf '{"kind": "ExecCredential","apiVersion":                 "client.authentication.k8s.io/v1alpha1","spec": {},"status":                 {"expirationTimestamp": "%s","token": "%s"}}' "\$expiration_timestamp" "\$token")
echo \$json_string
EOF

$ /opt/homebrew/bin/dash get_token.py
{"kind": "ExecCredential","apiVersion": "client.authentication.k8s.io/v1alpha1","spec": {},"status": {"expirationTimestamp": "","token": "foo"}}

Output should be:

$ /opt/homebrew/bin/dash get_token.py
{"kind": "ExecCredential","apiVersion": "client.authentication.k8s.io/v1alpha1","spec": {},"status": {"expirationTimestamp": "2025-07-22T08:47:47Z","token": "foo"}}

Anything else

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[nailo2c]

Hi, I'm interested in this, could you assign it to me? Thanks!