Make conn_type optional in task SDK Connection datamodel - #61728
Merged
Conversation
jroachgolf84
approved these changes
Feb 10, 2026
1 task
Nataneljpwd
approved these changes
Feb 10, 2026
Lee-W
reviewed
Feb 11, 2026
Lee-W
approved these changes
Feb 11, 2026
ashb
approved these changes
Feb 11, 2026
kaxil
approved these changes
Feb 11, 2026
Contributor
Author
|
Actually this is a bug fix, which we can get into 3.1.8 as well |
vatsrahul1001
pushed a commit
that referenced
this pull request
Feb 13, 2026
Ratasa143
pushed a commit
to Ratasa143/airflow
that referenced
this pull request
Feb 15, 2026
choo121600
pushed a commit
to choo121600/airflow
that referenced
this pull request
Feb 22, 2026
Subham-KRLX
pushed a commit
to Subham-KRLX/airflow
that referenced
this pull request
Mar 4, 2026
vatsrahul1001
pushed a commit
that referenced
this pull request
Mar 4, 2026
dominikhei
pushed a commit
to dominikhei/airflow
that referenced
this pull request
Mar 11, 2026
Ankurdeewan
pushed a commit
to Ankurdeewan/airflow
that referenced
this pull request
Mar 15, 2026
radhwene
pushed a commit
to radhwene/airflow
that referenced
this pull request
Mar 21, 2026
1 task
henry3260
added a commit
to henry3260/airflow
that referenced
this pull request
Jul 22, 2026
Review on the PR pointed out that rejecting JSON connection secrets without a conn_type would regress the Airflow 2 -> 3 migration compatibility deliberately established in apache#61728: secrets stored by Airflow 2-era backends (e.g. AWS Secrets Manager) commonly omit both conn_type and uri, and the worker-local secrets backend path must keep resolving them. Replace the rejection with a comment at the deserialization site and a regression test, so the compatibility guarantee is visible to future readers and enforced by CI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
henry3260
added a commit
to henry3260/airflow
that referenced
this pull request
Jul 23, 2026
Review on the PR pointed out that rejecting JSON connection secrets without a conn_type would regress the Airflow 2 -> 3 migration compatibility deliberately established in apache#61728: secrets stored by Airflow 2-era backends (e.g. AWS Secrets Manager) commonly omit both conn_type and uri, and the worker-local secrets backend path must keep resolving them. Replace the rejection with a comment at the deserialization site and a regression test, so the compatibility guarantee is visible to future readers and enforced by CI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
henry3260
added a commit
to henry3260/airflow
that referenced
this pull request
Jul 23, 2026
Review on the PR pointed out that rejecting JSON connection secrets without a conn_type would regress the Airflow 2 -> 3 migration compatibility deliberately established in apache#61728: secrets stored by Airflow 2-era backends (e.g. AWS Secrets Manager) commonly omit both conn_type and uri, and the worker-local secrets backend path must keep resolving them. Replace the rejection with a comment at the deserialization site and a regression test, so the compatibility guarantee is visible to future readers and enforced by CI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
henry3260
added a commit
that referenced
this pull request
Jul 23, 2026
…69780) * Reject connection secrets without a connection type Prevent malformed JSON secrets from being reported as missing connections at runtime. * Keep Airflow 2-era connection secrets working and document why Review on the PR pointed out that rejecting JSON connection secrets without a conn_type would regress the Airflow 2 -> 3 migration compatibility deliberately established in #61728: secrets stored by Airflow 2-era backends (e.g. AWS Secrets Manager) commonly omit both conn_type and uri, and the worker-local secrets backend path must keep resolving them. Replace the rejection with a comment at the deserialization site and a regression test, so the compatibility guarantee is visible to future readers and enforced by CI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Simplify Airflow 2 compatibility comments and add removal TODO Apply review suggestions: tighten the migration-compatibility comment and test docstring, and mark the compatibility path for removal once the minimum supported Airflow version in providers is 3.0. --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
dabla
pushed a commit
to dabla/airflow
that referenced
this pull request
Aug 14, 2026
…pache#69780) * Reject connection secrets without a connection type Prevent malformed JSON secrets from being reported as missing connections at runtime. * Keep Airflow 2-era connection secrets working and document why Review on the PR pointed out that rejecting JSON connection secrets without a conn_type would regress the Airflow 2 -> 3 migration compatibility deliberately established in apache#61728: secrets stored by Airflow 2-era backends (e.g. AWS Secrets Manager) commonly omit both conn_type and uri, and the worker-local secrets backend path must keep resolving them. Replace the rejection with a comment at the deserialization site and a regression test, so the compatibility guarantee is visible to future readers and enforced by CI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Simplify Airflow 2 compatibility comments and add removal TODO Apply review suggestions: tighten the migration-compatibility comment and test docstring, and mark the compatibility path for removal once the minimum supported Airflow version in providers is 3.0. --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Was generative AI tooling used to co-author this PR?
closes: #58529
Why?
When workers retrieve connections from secrets backends like AWS Secrets Manager that don't include
conn_type, theConnection.from_json()method fails during deserialization with error:Simple test to show an example for this:
Before:
After:
What
Making
conn_typeoptional in task SDK Connection datamodel to restore backward compatibility with Airflow 2 for connections stored in secrets backends withoutconn_type.For example: connections in AWS Secrets Manager (and other external secrets backends) fail to load on workers when
conn_typefield is missing and that breaks compat with Airflow 3 for certain providers.This will later block users migrating from Airflow 2 to Airflow 3 who have hundreds/thousands of secrets stored without conn_type (which worked fine in Airflow 2).
Solution
Make
conn_typeoptional in task SDKConnectionclass. Let me explain why this is safe.conn_typeexist only in worker context, never sent via Execution APIConnectionResponsedoesn't need changes at all (cadwyn migration etc)For testing, I have added one scenario that would break earlier but doesn't anymore.
{pr_number}.significant.rstor{issue_number}.significant.rst, in airflow-core/newsfragments.