diff --git a/airflow/providers/google/common/hooks/base_google.py b/airflow/providers/google/common/hooks/base_google.py
index bee2798267610..f45caeba5dad4 100644
--- a/airflow/providers/google/common/hooks/base_google.py
+++ b/airflow/providers/google/common/hooks/base_google.py
@@ -674,7 +674,10 @@ async def acquire_access_token(self, timeout: int = 10) -> None:
self.access_token = cast(str, self.credentials.token)
self.access_token_duration = 3600
- self.access_token_acquired_at = datetime.datetime.now(tz=datetime.timezone.utc)
+ # access_token_acquired_at is specific to gcloud-aio's Token. On subsequent calls of `get` it will be used
+ # with `datetime.datetime.utcnow()`. Therefore we have to use an offset-naive datetime.
+ # https://github.com/talkiq/gcloud-aio/blob/f1132b005ba35d8059229a9ca88b90f31f77456d/auth/gcloud/aio/auth/token.py#L204
+ self.access_token_acquired_at = datetime.datetime.now(tz=datetime.timezone.utc).replace(tzinfo=None)
self.acquiring = None
diff --git a/airflow/providers/google/provider.yaml b/airflow/providers/google/provider.yaml
index 317dc0e9410c8..7edc6e137c7c7 100644
--- a/airflow/providers/google/provider.yaml
+++ b/airflow/providers/google/provider.yaml
@@ -19,14 +19,14 @@
package-name: apache-airflow-providers-google
name: Google
description: |
- Google services including:
+ Google services including:
- - `Google Ads `__
- - `Google Cloud (GCP) `__
- - `Google Firebase `__
- - `Google LevelDB `__
- - `Google Marketing Platform `__
- - `Google Workspace `__ (formerly Google Suite)
+ - `Google Ads `__
+ - `Google Cloud (GCP) `__
+ - `Google Firebase `__
+ - `Google LevelDB `__
+ - `Google Marketing Platform `__
+ - `Google Workspace `__ (formerly Google Suite)
state: ready
source-date-epoch: 1707636385
@@ -89,6 +89,12 @@ dependencies:
- apache-airflow>=2.6.0
- apache-airflow-providers-common-sql>=1.7.2
- asgiref>=3.5.2
+ # When upgrading the major version of gcloud-aio-auth we want to make sure to
+ # 1. use at least version 5.2, which uses offset-aware datetime internally
+ # 2. override Token's new `refresh` method instead of `acquire_access_token`, which allows us to avoid
+ # dealing with internals like `access_token_acquired_at`
+ # 3. continue to `subclass gcloud.aio.auth.token.Token` instead of `BaseToken`, since instances of
+ # `_CredentialsToken` are instances of `Token` and used as such
- gcloud-aio-auth>=4.0.0,<5.0.0
- gcloud-aio-bigquery>=6.1.2
- gcloud-aio-storage>=9.0.0
@@ -677,7 +683,6 @@ operators:
python-modules:
- airflow.providers.google.cloud.operators.cloud_batch
-
sensors:
- integration-name: Google BigQuery
python-modules:
diff --git a/tests/providers/google/common/hooks/test_base_google.py b/tests/providers/google/common/hooks/test_base_google.py
index fd53930c5c1ff..c251dbdb05636 100644
--- a/tests/providers/google/common/hooks/test_base_google.py
+++ b/tests/providers/google/common/hooks/test_base_google.py
@@ -892,6 +892,10 @@ async def test_get(self):
token = hook._CredentialsToken(mock_credentials, project=PROJECT_ID, scopes=SCOPES)
assert await token.get() == "ACCESS_TOKEN"
mock_credentials.refresh.assert_called_once()
+ # ensure token caching works on subsequent calls of `get`
+ mock_credentials.reset_mock()
+ assert await token.get() == "ACCESS_TOKEN"
+ mock_credentials.refresh.assert_not_called()
@pytest.mark.asyncio
@mock.patch(f"{MODULE_NAME}.get_credentials_and_project_id", return_value=("CREDENTIALS", "PROJECT_ID"))