Skip to content

Fix GenAIGenerativeModelHook ignoring Airflow connection credentials#65731

Merged
shahar1 merged 1 commit intoapache:mainfrom
srchilukoori:fix/gen-ai-generative-model-hook-credentials
Apr 24, 2026
Merged

Fix GenAIGenerativeModelHook ignoring Airflow connection credentials#65731
shahar1 merged 1 commit intoapache:mainfrom
srchilukoori:fix/gen-ai-generative-model-hook-credentials

Conversation

@srchilukoori
Copy link
Copy Markdown
Contributor

Description

GenAIGenerativeModelHook.get_genai_client() constructs a genai.Client without passing credentials, causing it to fall back to Application Default Credentials (ADC) even when gcp_conn_id is set to an explicit service-account connection. Users in environments without ADC (e.g. Docker containers, on-premise) receive DefaultCredentialsError at runtime.

The fix passes self.get_credentials() to genai.Client, which is the same pattern used by every other Google provider hook (GCS, BigQuery, Vertex AI, etc.).

Fixes #65709

Changes

  • providers/google/src/airflow/providers/google/cloud/hooks/gen_ai.py: Pass credentials=self.get_credentials() to genai.Client in GenAIGenerativeModelHook.get_genai_client().
  • providers/google/tests/unit/google/cloud/hooks/test_gen_ai.py: Add test_get_genai_client_passes_connection_credentials to assert credentials from the connection are forwarded to the client.

Root Cause

# Before — credentials omitted, ADC used regardless of gcp_conn_id
def get_genai_client(self, project_id: str, location: str):
    return genai.Client(
        vertexai=True,
        project=project_id,
        location=location,
    )

# After — honours the configured Airflow connection
def get_genai_client(self, project_id: str, location: str):
    return genai.Client(
        vertexai=True,
        project=project_id,
        location=location,
        credentials=self.get_credentials(),
    )

Was generative AI tooling used to co-author this PR?
  • Yes Claude

  • Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
  • For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
  • When adding dependency, check compliance with the ASF 3rd Party License Policy.
  • For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

@srchilukoori srchilukoori requested a review from shahar1 as a code owner April 23, 2026 15:35
@boring-cyborg boring-cyborg Bot added area:providers provider:google Google (including GCP) related issues labels Apr 23, 2026
@boring-cyborg
Copy link
Copy Markdown

boring-cyborg Bot commented Apr 23, 2026

Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide
Here are some useful points:

  • Pay attention to the quality of your code (ruff, mypy and type annotations). Our prek-hooks will help you with that.
  • In case of a new feature add useful documentation (in docstrings or in docs/ directory). Adding a new operator? Check this short guide Consider adding an example DAG that shows how users should use it.
  • Consider using Breeze environment for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
  • Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
  • Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
  • Be sure to read the Airflow Coding style.
  • Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
    Apache Airflow is a community-driven project and together we are making it better 🚀.
    In case of doubts contact the developers at:
    Mailing List: dev@airflow.apache.org
    Slack: https://s.apache.org/airflow-slack

Copy link
Copy Markdown
Contributor

@shahar1 shahar1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great catch, thank you!

get_genai_client() was constructing genai.Client without credentials,
causing it to fall back to Application Default Credentials (ADC) even
when gcp_conn_id pointed to an explicit service-account connection.
Users in environments without ADC (e.g. Docker without workload identity)
received DefaultCredentialsError at runtime.

Pass self.get_credentials() to genai.Client so the hook honours the
configured Airflow connection, consistent with every other Google provider
hook (GCS, BigQuery, etc.).

Fixes: apache#65709
@srchilukoori srchilukoori force-pushed the fix/gen-ai-generative-model-hook-credentials branch from 71df93a to ee67d41 Compare April 23, 2026 18:12
@srchilukoori
Copy link
Copy Markdown
Contributor Author

@shahar1 please approve again, I pushed an empty rebase to rerun a failing provider test

@srchilukoori srchilukoori requested a review from shahar1 April 23, 2026 18:29
@srchilukoori
Copy link
Copy Markdown
Contributor Author

@shahar1 please approve again, I pushed an empty rebase to rerun a failing provider test

@shahar1 I don't see an option to merge, could you start it please. Thank you.

@shahar1 shahar1 merged commit 86511d6 into apache:main Apr 24, 2026
93 checks passed
@boring-cyborg
Copy link
Copy Markdown

boring-cyborg Bot commented Apr 24, 2026

Awesome work, congrats on your first merged pull request! You are invited to check our Issue Tracker for additional contributions.

@shahar1
Copy link
Copy Markdown
Contributor

shahar1 commented Apr 24, 2026

@shahar1 please approve again, I pushed an empty rebase to rerun a failing provider test

@shahar1 I don't see an option to merge, could you start it please. Thank you.

Merging is enabled only for committers :)
I merged it, thanks for your contribution!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:providers provider:google Google (including GCP) related issues

Projects

None yet

Development

Successfully merging this pull request may close these issues.

GenAIGenerativeModelHook.get_genai_client() ignores Airflow connection credentials — falls back to ADC

2 participants