submit_options in task details shows sensitive values in clear text

[swasenius]

Apache Airflow version

Other Airflow 2 version (please specify below)

If "Other Airflow 2 version" selected, which one?

2.9.1

What happened?

If you go to a DAG and choose a task and click "More Details" and scroll down to "submit_options" the values are shown in UI as clear text ie key's and secrets. Is there a way to mask these and how? Or is it a bug?

What you think should happen instead?

No response

How to reproduce

Spark / S3 submit_options are visible always in the task details.

Operating System

Debian 12

Versions of Apache Airflow Providers

apache-airflow-providers-amazon==7.4.1
apache-airflow-providers-celery==3.6.2
apache-airflow-providers-cncf-kubernetes==8.0.0
apache-airflow-providers-common-compat==1.3.0
apache-airflow-providers-common-io==1.3.1
apache-airflow-providers-common-sql==1.21.0
apache-airflow-providers-docker==3.10.0
apache-airflow-providers-elasticsearch==5.3.4
apache-airflow-providers-fab==1.0.4
apache-airflow-providers-ftp==3.8.0
apache-airflow-providers-google==10.17.0
apache-airflow-providers-grpc==3.4.1
apache-airflow-providers-hashicorp==3.6.4
apache-airflow-providers-http==4.10.1
apache-airflow-providers-imap==3.5.0
apache-airflow-providers-jdbc==4.2.2
apache-airflow-providers-microsoft-azure==10.0.0
apache-airflow-providers-microsoft-mssql==3.6.1
apache-airflow-providers-mysql==5.5.4
apache-airflow-providers-odbc==4.5.0
apache-airflow-providers-openlineage==1.14.0
apache-airflow-providers-postgres==5.10.2
apache-airflow-providers-redis==3.6.1
apache-airflow-providers-sendgrid==3.4.0
apache-airflow-providers-sftp==4.9.1
apache-airflow-providers-slack==8.6.2
apache-airflow-providers-smtp==1.6.1
apache-airflow-providers-snowflake==5.4.0
apache-airflow-providers-sqlite==3.7.1
apache-airflow-providers-ssh==3.10.1
apache-airflow-providers-vertica==3.9.0

Deployment

Official Apache Airflow Helm Chart

Deployment details

No response

Anything else?

Always

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[tirkarthi]

Can you please try to set the option sensitive_var_conn_names in airflow.cfg with submit_options as additional value.

https://airflow.apache.org/docs/apache-airflow/stable/security/secrets/mask-sensitive-values.html#sensitive-field-names

[potiuk]

Converting it to a discussion on "how to make some values masked".

FYI -> @swasenius as @tirkarthi helpfully explained the documentation has very detailed explanations which values are treated as sensitive and masked and explain the ways how you can mask other values - so please follow those and let's discuss the outcome of your checks here.

[swasenius]

Hi, thanks for the input. I was not aware that submit_options would be one of the values that can be hidden, so I just did a test and it works!