Add warning when bundle path isn't accessible to impersonated user #60278
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
- This PR was created with the help of AIRelated: #60270, #60387
Context
When using Git DAG bundles with user impersonation (
run_as_user), tasks fail due to permission conflicts. The bundle is cloned by the main airflow user, but the impersonated user needs to access the repository files during task execution.This PR provides early warning to help users diagnose these issues before they cause task failures.
Changes
_verify_bundle_access(bundle_instance, log)New helper function in
task_runner.pythat:The helper is called in
parse()afterbundle_instance.initialize(), which means it runs after impersonation occurs. This ensures the check reflects the impersonated user's actual access rights.^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named
{pr_number}.significant.rstor{issue_number}.significant.rst, in airflow-core/newsfragments.