Skip to content

Cap kubernetes client to <36 to fix cluster auth 401 regression #69025

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
shahar1 wants to merge 1 commit into from
Closed

Cap kubernetes client to <36 to fix cluster auth 401 regression #69025

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions providers/cncf/kubernetes/README.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,9 +59,9 @@ PIP package Version required
``asgiref`` ``>=3.5.2; python_version < "3.14"``
``asgiref`` ``>=3.11.1; python_version >= "3.14"``
``cryptography`` ``>=44.0.3``
``kubernetes`` ``>=35.0.0,!=36.0.0,<37.0.0``
``kubernetes`` ``>=35.0.0,<36.0.0``
``urllib3`` ``>=2.1.0,!=2.6.0``
``kubernetes_asyncio`` ``>=32.0.0,<37.0.0``
``kubernetes_asyncio`` ``>=32.0.0,<36.0.0``
========================================== ======================================

Cross provider package dependencies
Expand Down
4 changes: 2 additions & 2 deletions providers/cncf/kubernetes/docs/index.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,9 +117,9 @@ PIP package Version required
``asgiref`` ``>=3.5.2; python_version < "3.14"``
``asgiref`` ``>=3.11.1; python_version >= "3.14"``
``cryptography`` ``>=44.0.3``
``kubernetes`` ``>=35.0.0,!=36.0.0,<37.0.0``
``kubernetes`` ``>=35.0.0,<36.0.0``
``urllib3`` ``>=2.1.0,!=2.6.0``
``kubernetes_asyncio`` ``>=32.0.0,<37.0.0``
``kubernetes_asyncio`` ``>=32.0.0,<36.0.0``
========================================== ======================================

Cross provider package dependencies
Expand Down
16 changes: 10 additions & 6 deletions providers/cncf/kubernetes/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,17 +77,21 @@ dependencies = [
# limiting minimum airflow version supported in cncf.kubernetes provider, due to the
# potential breaking changes in Airflow Core as well (kubernetes is added as extra, so Airflow
# core is not hard-limited via install-requirements, only by extra).
# 36.0.0 is excluded because it shipped an in-cluster auth regression
# (https://github.com/kubernetes-client/python/issues/2582), fixed in 36.0.1. 35.0.0 is the only
# 35.x release and ignores NO_PROXY (https://github.com/kubernetes-client/python/issues/2520),
# fixed in the 36.x line, so a proxied install resolves to 36.0.1+.
"kubernetes>=35.0.0,!=36.0.0,<37.0.0",
# 36.x is capped out. Client 36.x renamed the bearer-token auth key from 'authorization' to
# 'BearerToken' (https://github.com/kubernetes-client/python/issues/2582); code that hand-builds
# a Configuration with api_key={'authorization': ...} (e.g. the google GKE hook) then loses the
# "Bearer " prefix and sends the raw token, so the cluster rejects requests with 401. 36.0.1
# fixed only the load_incluster_config/load_kube_config loaders, not that path. (The same 36.x
# Configuration change is also behind the in-cluster pickling crash, #68827.) 35.x is the last
# known-good line; re-enable 36.x only after the provider auth paths are fixed and validated.
# Tracked at https://github.com/apache/airflow/issues/69023
"kubernetes>=35.0.0,<36.0.0",
# Urllib 2.6.0 breaks kubernetes client because kubernetes client uses deprecated in 2.0.0 and
# removed in 2.6.0 `getheaders()` call (instead of `headers` property.
# Tracked in https://github.com/kubernetes-client/python/issues/2477
"urllib3>=2.1.0,!=2.6.0",
# the version is limited to the next MAJOR version and should by synced with the kubernetes version
"kubernetes_asyncio>=32.0.0,<37.0.0",
"kubernetes_asyncio>=32.0.0,<36.0.0",
]

[dependency-groups]
Expand Down
Loading