Skip to content

Conversation

@Dev-iL
Copy link
Collaborator

@Dev-iL Dev-iL commented Jan 8, 2026

- This PR was created with the help of AI

Related: #60270, #60387

Context

When using Git DAG bundles with user impersonation (run_as_user), tasks fail due to permission conflicts. The bundle is cloned by the main airflow user, but the impersonated user needs to access the repository files during task execution.

This PR provides early warning to help users diagnose these issues before they cause task failures.

Changes

_verify_bundle_access(bundle_instance, log)

New helper function in task_runner.py that:

  • Uses os.access() to verify actual read/execute permissions (works with Unix permissions, ACLs, SELinux, etc.)
  • Raises AirflowException with a clear error message if the bundle is not accessible
  • Includes a link to documentation for troubleshooting

The helper is called in parse() after bundle_instance.initialize(), which means it runs after impersonation occurs. This ensures the check reflects the impersonated user's actual access rights.


^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

@potiuk potiuk added this to the Airflow 3.1.7 milestone Jan 13, 2026
@potiuk potiuk added the backport-to-v3-1-test Mark PR with this label to backport to v3-1-test branch label Jan 13, 2026
@Dev-iL Dev-iL changed the title Add warning when Bundle path may not be accessible to impersonated user Add warning when bundle path isn't accessible to impersonated user Jan 14, 2026
@Dev-iL Dev-iL force-pushed the 2601/permission_warning branch from 6af414d to 7107045 Compare January 15, 2026 10:11
@potiuk potiuk merged commit 0e0fceb into apache:main Jan 15, 2026
99 checks passed
@Dev-iL Dev-iL deleted the 2601/permission_warning branch January 15, 2026 11:32
@github-actions
Copy link

Backport failed to create: v3-1-test. View the failure log Run details

Status Branch Result
v3-1-test Commit Link

You can attempt to backport this manually by running:

cherry_picker 0e0fceb v3-1-test

This should apply the commit to the v3-1-test branch and leave the commit in conflict state marking
the files that need manual conflict resolution.

After you have resolved the conflicts, you can continue the backport process by running:

cherry_picker --continue

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:task-sdk backport-to-v3-1-test Mark PR with this label to backport to v3-1-test branch type:bug-fix Changelog: Bug Fixes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants