Skip to content

Fix KubernetesPodOperator dry_run requiring live Kubernetes API client - #70234

Merged
potiuk merged 1 commit into
apache:mainfrom
Aaryan123456679:fix/kpo-dry-run-kube-client-45812
Jul 30, 2026
Merged

Fix KubernetesPodOperator dry_run requiring live Kubernetes API client#70234
potiuk merged 1 commit into
apache:mainfrom
Aaryan123456679:fix/kpo-dry-run-kube-client-45812

Conversation

@Aaryan123456679

Copy link
Copy Markdown
Contributor

airflow dags test (and calling KubernetesPodOperator.dry_run() directly) failed outside a real cluster because build_pod_request_obj() unconditionally read hook.is_in_cluster to set the airflow_kpo_in_cluster label. That property instantiates a Kubernetes API client, which requires kube credentials/config to be available — something a dry run must not need.

This adds a keyword-only dry_run parameter to build_pod_request_obj() (default False, so existing callers are unaffected) and has dry_run() skip the is_in_cluster lookup when set.

closes: #45812

@Miretpl

Miretpl commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

There are couple of unrelated changes in the PR + conflics - could you resolve it?

@Aaryan123456679
Aaryan123456679 force-pushed the fix/kpo-dry-run-kube-client-45812 branch from e540c09 to e91dc6e Compare July 24, 2026 16:08
@Aaryan123456679

Copy link
Copy Markdown
Contributor Author

Thanks for flagging this. The branch had two extra commits that were unrelated to this fix (a check_provider_yaml_files.py namespaced-provider crash fix and a Jira provider.yaml conn-field fix) — those were already merged into main separately via #70224 and #70261, which is what caused the conflicts. I dropped both commits and rebased the actual KubernetesPodOperator dry_run fix cleanly onto latest main. The branch now only contains the two files relevant to this PR (pod.py and its test) and is mergeable.

airflow dags test and dry_run() failed outside a cluster because
build_pod_request_obj() unconditionally read hook.is_in_cluster to
set the airflow_kpo_in_cluster label, which instantiates a Kubernetes
API client and requires kube credentials/config to be available. A
dry run should not need cluster access at all.

closes: apache#45812
@Aaryan123456679
Aaryan123456679 force-pushed the fix/kpo-dry-run-kube-client-45812 branch from e91dc6e to 910515b Compare July 24, 2026 18:09
@potiuk potiuk added the ready for maintainer review Set after triaging when all criteria pass. label Jul 28, 2026

@potiuk potiuk left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks — real usability bug. dry_run() existing to show what would be submitted shouldn't require working kube credentials, and self.hook.is_in_cluster instantiates an API client purely to compute a label value. Threading a keyword-only dry_run flag through build_pod_request_obj is the minimal way to fix it, and keyword-only keeps it backward compatible for the many subclasses that override or call this method.

The tests are the right shape: making is_in_cluster raise and asserting the dry-run path survives and the normal path still raises proves the flag actually gates the client instantiation, rather than just that dry_run happens to work.

One consequence worth deciding on inline.


Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting

@potiuk
potiuk merged commit 9481c8e into apache:main Jul 30, 2026
108 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:providers provider:cncf-kubernetes Kubernetes (k8s) provider related issues ready for maintainer review Set after triaging when all criteria pass.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

KubernetesPodOperator dry_run failure

3 participants