Fix impersonation_chain ignored by deferrable Beam Dataflow pipelines - #72146
Draft
rjgoyln wants to merge 1 commit into
Draft
Fix impersonation_chain ignored by deferrable Beam Dataflow pipelines#72146rjgoyln wants to merge 1 commit into
rjgoyln wants to merge 1 commit into
Conversation
Once a Beam pipeline on the Dataflow runner defers, the trigger polls the job through a hook of its own. It was built only from operator-level fields, so the service account the user asked for in dataflow_config never reached it and polling fell back to the connection's own identity — pipelines that depend on impersonation failed with permission errors the moment they deferred, even though the synchronous path worked. The configured poll interval was dropped the same way.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A Beam pipeline on the Dataflow runner honours the service account chain from
dataflow_configonly until it defers: the trigger polls through a hook of its own, and neitherimpersonation_chainnorpoll_sleepever reached it. Impersonating deployments watch the job launch and then fail with a permission error the moment the task defers, which reads as a Dataflow problem rather than an Airflow one.The report names the Java operator; the Python one builds its trigger the same way. Both trigger classes have accepted these arguments since before the
DataflowJobStateCompleteTriggercompatibility branch existed, so the older-provider fallback is safe.closes: #72135
Was generative AI tooling used to co-author this PR?
Generated-by: Claude Code (Opus 5) following the guidelines