Fix incorrect protocol selection when use_tls is provided as string in VaultHook - #62641
Merged
Merged
Conversation
Ensure use_tls extras provided as strings (e.g. "false") are correctly interpreted instead of being treated as truthy, preventing incorrect HTTPS selection and SSL errors. Existing tests were updated to cover string inputs in addition to boolean values.
boring-cyborg
Bot
added
area:providers
provider:hashicorp
Contributor
Author
|
Requesting review for this. |
potiuk
approved these changes
Mar 10, 2026
dominikhei
pushed a commit
to dominikhei/airflow
that referenced
this pull request
Mar 11, 2026
Ensure use_tls extras provided as strings (e.g. "false") are correctly interpreted instead of being treated as truthy, preventing incorrect HTTPS selection and SSL errors. Existing tests were updated to cover string inputs in addition to boolean values. Co-authored-by: Sameer Mesiah <smesiah971@gmail.com>
Pyasma
pushed a commit
to Pyasma/airflow
that referenced
this pull request
Mar 13, 2026
Ensure use_tls extras provided as strings (e.g. "false") are correctly interpreted instead of being treated as truthy, preventing incorrect HTTPS selection and SSL errors. Existing tests were updated to cover string inputs in addition to boolean values. Co-authored-by: Sameer Mesiah <smesiah971@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fix incorrect handling of the
use_tlsconnection extra inVaultHook. Previously, protocol selection usedbool(use_tls), causing string values like"false"to be treated as truthy and incorrectly select HTTPS. This could lead to SSL handshake failures when connections were provisioned with string-based extras.The fix preserves native boolean values and applies
to_boolean()only when needed, ensuring correct handling of both boolean and string representations.Rationale
The Vault connection documentation defines
use_tlsas an extra JSON parameter (please refer to this link.) Since connections may be provisioned via environment variables, Helm, Terraform, or other systems that serialize values as strings, the hook must defensively interpret string booleans. This change ensures consistent protocol resolution regardless of how the connection is configured.Tests
Extended the existing
test_protocol_via_use_tlsparametrized test to include"true"and"false"string inputs.Backwards Compatibility
No behavior changes for valid boolean inputs i.e
TrueorFalse. The fix only corrects handling of string-baseduse_tlsvalues.