Uh oh!
There was an error while loading. Please reload this page.
Apply impersonation_chain to deferred BigQuery existence checks - #71648
Apply impersonation_chain to deferred BigQuery existence checks#71648SEPURI-SAI-KRISHNA wants to merge 2 commits into
Conversation
The sensors handed the impersonation chain to the trigger inside hook_params, which nothing reads, while the trigger authenticated from an attribute those call sites never set. A deferred existence check therefore ran as the connection's service account, and only in deferrable mode, so disabling deferral appeared to fix the resulting permission error.
Uh oh!
There was an error while loading. Please reload this page.
A reviewer asked for the coverage to live with each sensor's own tests rather than in a standalone parametrized test, so the file keeps one place to look per sensor.
SEPURI-SAI-KRISHNA
commented
Aug 18, 2026
Thanks @SameerMesiah97, moved. The standalone parametrized test is gone. Each sensor now has its own I dropped the Verified locally: 25 passed with the change, and exactly the 2 new tests fail with it reverted (23 pre-existing tests unaffected either way). Drafted-by: Claude Code (Opus 5); reviewed by @SEPURI-SAI-KRISHNA before posting |
SEPURI-SAI-KRISHNA
commented
Aug 27, 2026
Gentle ping, the review feedback here was addressed on 18 August and CI has been green since. Anything else you'd like changed before this can go in? |
BigQueryTableExistenceSensorandBigQueryTablePartitionExistenceSensorhand theirimpersonation chain to the trigger inside
hook_params:but the trigger authenticates from a different attribute entirely:
Nothing ever sets
self.impersonation_chainfrom those call sites, so it staysNoneandthe deferred existence check runs as the connection's service account.
hook_paramsisstored and serialized but never read anywhere in the module — it carries the value and
then drops it.
poke()builds its hook correctly, so the sensor honours impersonation whendeferrable=Falseand ignores it whendeferrable=True. That divergence is the awkwardpart: turning deferrable off appears to "fix" the permissions error, which points
investigation away from the real cause.
The trigger already grew a proper
impersonation_chainparameter in #36341; the sensorswere simply never moved onto it. This change passes it explicitly at both defer sites.
hook_paramsis left untouched here. It is a required argument on the trigger's public__init__, and now that nothing reads it, removing or deprecating it is a separatedecision — happy to follow up if maintainers would like it gone.
For reviewers:
GoogleBaseHook.__init__falls back to the connection'simpersonation_chainextra when the argument is absent, so deployments that configureimpersonation on the connection were never affected. This only bites when impersonation is
set on the sensor, which is the documented parameter.
No newsfragment: this is a provider change, and provider changelogs are regenerated from
git logby the release manager.Was generative AI tooling used to co-author this PR?
Generated-by: Claude Code (Opus 5) following the guidelines