Replies: 3 comments 4 replies
-
|
Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval. |
Beta Was this translation helpful? Give feedback.
-
|
I think you misunderstood how it works. Jinja templates that you mention are resolved on the worker (which is Linux - based) not windows. PSRP operator will execute PowerShell code that is result of this Jinja template processing. |
Beta Was this translation helpful? Give feedback.
-
|
No, that is correct and follows my assumptions. According to the documentation operator includes a jinja template filter that should be applied at the worker during pre-processing of the task to tag an argument or parameter dictionary value going to the operator so the operator can pass the argument/paramter to the remote machine as a SecureString, thus allowing secure parameters/arguments to be passed. @potiuk if somehow I'm misunderstanding things, how can the minimal example I provided that throws an error be modified to demonstrate how to pass in a parameter/argument in the operator and tag it as a SecureString as indicated in the operator's documentation? Again, here's the minimal failing example: import datetime
from airflow import DAG
from airflow.providers.microsoft.psrp.operators.psrp import PsrpOperator
with DAG(
dag_id="psrpoperator_securestring_error_reproduction",
start_date=None,
schedule=None,
render_template_as_native_obj=True,
):
PsrpOperator(
task_id = "psrp_task",
psrp_conn_id = "SomeConnection",
cmdlet = "Write-Output",
arguments = [ "{{ 'foo' | securestring }}" ] # Attempt to pass 'foo' to remote machine as a SecureString. Fails with error: jinja2.exceptions.TemplateAssertionError: No filter named 'securestring'
) |
Beta Was this translation helpful? Give feedback.
-
|
Ah. then I have no idea. Maybe @malthe would know ? |
Beta Was this translation helpful? Give feedback.
-
|
The template filter is registered here: Perhaps you can check if you're hitting that method? Since I'm not complete sure why it's not working for you to be honest. |
Beta Was this translation helpful? Give feedback.
-
|
I can't find a situation where the airflow/airflow/models/baseoperator.py Lines 759 to 760 in 47cdb84 The only other case of an operator adding extra jinja filters I could find was the sql to slack webhook and it instead extends Can this be converted back into an issue, please? |
Beta Was this translation helpful? Give feedback.
-
|
I'm pretty sure this is a bug and that this operator extends the wrong method on BaseOperator to add the template filter. I tossed this together and it looks like it fixes things, but since I'm not all that familiar with Airflow and this is my first attempt at doing any kind of Airflow work I'll leave this snippet to the experts to decide if it is indeed a bug and if this is the correct resolution: def render_template_fields(
self,
context: Context,
jinja_env: jinja2.Environment | None = None,
) -> None:
if not jinja_env:
jinja_env = self.get_template_env()
native = isinstance(jinja_env, NativeEnvironment)
def securestring(value: str):
if not native:
raise AirflowException(
"Filter 'securestring' not applicable to non-native templating environment"
)
return TaggedValue("SS", value)
jinja_env.filters["securestring"] = securestring
self._do_render_template_fields(self, self.template_fields, context, jinja_env, set()) |
Beta Was this translation helpful? Give feedback.
-
Apache Airflow Provider(s)
microsoft-psrp
Versions of Apache Airflow Providers
apache-airflow-providers-microsoft-psrp==2.8.0
Apache Airflow version
2.10.2
Operating System
Debian GNU/Linux 12 (bookworm)
Deployment
Official Apache Airflow Helm Chart
Deployment details
Using official helm chart and the following slightly extended Dockerfile:
What happened
jinja2.exceptions.TemplateAssertionError: No filter named 'securestring'It appears the securestring template filter is not working as intended.
Summarized Error:
Full execution log including the redacted stack trace:
What you think should happen instead
The minimal example provided should return through XCom the ToString representation of a powershell SecureString which would be
"System.Security.SecureString"How to reproduce
The following DAG can be used to reproduce the issue and does not require a remote connection as the task fails before attempting any connection:
Anything else
No response
Are you willing to submit PR?
Code of Conduct
Beta Was this translation helpful? Give feedback.
All reactions