Uh oh!
There was an error while loading. Please reload this page.
Fix GKE provider 401 on kubernetes client 36.x - #69032
Merged
Merged
Conversation
kubernetes-client 36.x renamed the bearer-token auth key from 'authorization' to 'BearerToken'. The GKE connection hand-builds a Configuration and registered the token/prefix only under 'authorization', so on 36.x the 'Bearer' prefix is dropped and requests go out with the raw token, which the cluster rejects with 401. Register the token and prefix under both keys so authentication works on client 35.x and 36.x alike, which lets the provider support 36.x without downgrading the kubernetes client (and reintroducing the NO_PROXY issue 36.x fixed).
1 task
shahar1
commented
Jun 26, 2026
ContributorAuthor
CC: @molcay@VladaZakharova@MaksYermak |
vatsrahul1001
approved these changes
Jun 26, 2026
Uh oh!
There was an error while loading. Please reload this page.
MaksYermak
left a comment
Contributor
There was a problem hiding this comment.
@shahar1 what about backward compatibility with the previous version of cncf-provider before 18.0.0? Have you tested it with old one?
shahar1 added a commit
to shahar1/airflow
that referenced
this pull request
Jun 26, 2026
cncf.kubernetes (10.18.1) and apache.spark (6.2.0) were excluded from the 2026-06-16 wave after binding -1 votes; their blockers are now resolved, so re-cut the same versions with the fixes folded in. fab and keycloak need corrective patch releases (3.7.1, 0.8.1) after the airflowctl CLI client integration was reverted from core (apache#68856) and a Keycloak access-denied bug fix (apache#68951). celery (3.21.0) adds a Python 3.14 worker start-method config (apache#69015), and google (22.2.1) ships the GKE 401 fix for kubernetes client 36.x (apache#69032).
shahar1
commented
Jun 26, 2026
ContributorAuthor
It should be fine - cncf-kubernetes before v10.18.0 (and after v10.12.2) uses kubernetes client v35.x, which reads the authorization key that this PR leaves untouched (it only adds BearerToken alongside), so the old path is unchanged and the extra key is just ignored. |
shahar1 added a commit
to shahar1/airflow
that referenced
this pull request
Jun 26, 2026
cncf.kubernetes (10.18.1) and apache.spark (6.2.0) were excluded from the 2026-06-16 wave after binding -1 votes; their blockers are now resolved, so re-cut the same versions with the fixes folded in. fab and keycloak need corrective patch releases (3.7.1, 0.8.1) after the airflowctl CLI client integration was reverted from core (apache#68856) and a Keycloak access-denied bug fix (apache#68951). celery (3.21.0) adds a Python 3.14 worker start-method config (apache#69015), and google (22.2.1) ships the GKE 401 fix for kubernetes client 36.x (apache#69032).
shahar1 added a commit
that referenced
this pull request
Jun 26, 2026
cncf.kubernetes (10.18.1) and apache.spark (6.2.0) were excluded from the 2026-06-16 wave after binding -1 votes; their blockers are now resolved, so re-cut the same versions with the fixes folded in. fab and keycloak need corrective patch releases (3.7.1, 0.8.1) after the airflowctl CLI client integration was reverted from core (#68856) and a Keycloak access-denied bug fix (#68951). celery (3.21.0) adds a Python 3.14 worker start-method config (#69015), and google (22.2.1) ships the GKE 401 fix for kubernetes client 36.x (#69032).
15 tasks
75 tasks
karenbraganz pushed a commit
to karenbraganz/airflow
that referenced
this pull request
Jun 30, 2026
kubernetes-client 36.x renamed the bearer-token auth key from 'authorization' to 'BearerToken'. The GKE connection hand-builds a Configuration and registered the token/prefix only under 'authorization', so on 36.x the 'Bearer' prefix is dropped and requests go out with the raw token, which the cluster rejects with 401. Register the token and prefix under both keys so authentication works on client 35.x and 36.x alike, which lets the provider support 36.x without downgrading the kubernetes client (and reintroducing the NO_PROXY issue 36.x fixed).
karenbraganz pushed a commit
to karenbraganz/airflow
that referenced
this pull request
Jun 30, 2026
cncf.kubernetes (10.18.1) and apache.spark (6.2.0) were excluded from the 2026-06-16 wave after binding -1 votes; their blockers are now resolved, so re-cut the same versions with the fixes folded in. fab and keycloak need corrective patch releases (3.7.1, 0.8.1) after the airflowctl CLI client integration was reverted from core (apache#68856) and a Keycloak access-denied bug fix (apache#68951). celery (3.21.0) adds a Python 3.14 worker start-method config (apache#69015), and google (22.2.1) ships the GKE 401 fix for kubernetes client 36.x (apache#69032).
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
related: #69023
Human Summary
Kubernetes client 36.x renamed the bearer auth key, which breaks GKE integration.
This PR fixes this behavior by providing both keys for compatibility.
AI Summary
Click here
Addresses the GKE 401 regression reported on the cncf.kubernetes 2026-06-16 RC by fixing the **google provider** rather than capping the kubernetes client to `<36` (which would reintroduce the NO_PROXY issue that 36.x fixed).Problem
kubernetes-client 36.x renamed the bearer-token auth key from
authorizationtoBearerToken(kubernetes-client/python#2582).GKEClusterConnectionhand-builds aConfigurationand registered the token/prefix only underauthorization. On 36.x,auth_settings()resolves the bearer value viaget_api_key_with_prefix("BearerToken", alias="authorization"): the token is found through theauthorizationalias, but the prefix is looked up by the primary identifierBearerToken(absent), so theBearerprefix is dropped. Requests then go out asAuthorization: <raw token>and the cluster rejects them with 401. (36.0.1 fixed this only forload_incluster_config/load_kube_config, not hand-built configs.)Fix
Register the bearer token and prefix under both
authorization(client 35.x) andBearerToken(client 36.x), in_get_configand the token-refresh hook. Authentication now works on both client lines, so the provider supports 36.x without a downgrade. The refresh-on-expiry behavior is preserved.Test
TestGKEClusterConnection.test_auth_settings_send_bearer_prefixed_tokenasserts the realauth_settings()["BearerToken"]["value"]isBearer <token>(both valid and expiring credentials). Verified it fails on the pre-fix code under client 36.0.2 and passes after.Was generative AI tooling used to co-author this PR?
Generated-by: Claude Code (Opus 4.8) following the guidelines