apache / apache/airflow

BeamRunJavaPipelineOperator deferrable impersonation chain issue

Open Beginner friendly
#72,135 1 comment 0 reactions 0 assignees View on GitHub
area:providers kind:bug needs-triage provider:apache-beam
Dominant language
Python
Stars
46.9k
Forks
17.8k
Avg merge
2d 9h
Merged PRs (30d)
472

Description

### Under which category would you file this issue?

Airflow Core

### Apache Airflow version

Airflow 2.11.1

### What happened and how to reproduce it?

"When running _BeamRunJavaPipelineOperator_ with `deferrable=True `and `impersonation_chain='target_service_account',` I get an 'access denied' / 'permission denied' error."

### What you think should happen instead?

You have to add "impersonation_chain": self.dataflow_config.impersonation_chain, to

```
if self.deferrable:
trigger_args = {
"job_id": self.dataflow_job_id,
"project_id": self.dataflow_config.project_id,
"location": self.dataflow_config.location,
"gcp_conn_id": self.gcp_conn_id,
"impersonation_chain": self.dataflow_config.impersonation_chain,
}
```

### Operating System

_No response_

### Deployment

Google Managed Service for Apache Airflow

### Apache Airflow Provider(s)

apache-beam

### Versions of Apache Airflow Providers

apache-airflow-providers-apache-beam==6.2.3

### Official Helm Chart version

Not Applicable

### Kubernetes Version

_No response_

### Helm Chart configuration

_No response_

### Docker Image customizations

_No response_

### Anything else?

_No response_

### Are you willing to submit PR?

- [ ] Yes I am willing to submit a PR!

### Code of Conduct

- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)

Contributor guide

Open the contributing guide

Research direction

Start at BeamRunJavaPipelineOperator's deferrable execution path and inspect how trigger_args are built. Reproduce the permission-denied case with deferrable=True and target_service_account, then verify that the configured impersonation chain reaches the trigger and that regression coverage passes.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
data-engineering
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.