Connection password not being masked in default logging

from airflow.hooks.base_hook import BaseHook
Basehook.get_connection('my_connection_id')

The second line prints out my connection details including the connection password in Airflow logs. Earlier connection passwords were masked by default.

https://airflow.apache.org/docs/apache-airflow/stable/_modules/airflow/hooks/base.html

The above statement is run for logging. Is there a way to disable to logging to not print Connection password in my logs?

[potiuk]

Glad that you sorted it out.

I gotta say I am surprised by this behavior. I did not expect the secrets to show up in the pytest logs by default.

The logs are redacted specifically to account for task logs for users and UI visibility. This is by design, deliberate and documented.

Comment in our code:

# By default this is off, but is automatically configured on when running task
# instances
MASK_SECRETS_IN_LOGS = False

Our documentation is very clear about this behaviour:

https://airflow.apache.org/docs/apache-airflow/stable/security/secrets/mask-sensitive-values.html

Airflow will by default mask Connection passwords and sensitive Variables and keys from a Connection’s extra (JSON) field when they appear in Task logs, in the Variable and in the Rendered fields views of the UI.

So I do not find it surprising really.

Also It would be quite unreasonble and possibly even not possible to expect that secret masking is “general feature” enabled whenever you run python interpreter and perform an entrypoint that might or might not initialize secret masking (this is what your expectation is about pretty much). This is a feature of “airflow” application, and not “running arbitrary part of airflow code”.

[JonnyWaffles]

Sorry last follow up, adding the following code to my pytest conftest.py resolves the above

from airflow import settings
settings.MASK_SECRETS_IN_LOGS = True

I gotta say I am surprised by this behavior. I did not expect the secrets to show up in the pytest logs by default.