https://prefect.io logo
Title
j

Jeff Brainerd

06/25/2020, 5:23 PM
Hi team, a Prefect mystery (at least for me 😬) — I’m using Prefect Cloud and Prefect Core 0.11.4, also Fargate Agent and docker storage. My goal is to call the Prefect API from a state handler, so I can report flow stats to Slack like flow duration when a flow finishes. Problem is I am getting an unauthenticated error. I can see from
agent.py
that the container env should include the env var:
"PREFECT__CLOUD__AUTH_TOKEN": config.cloud.agent.auth_token,
So at this point I’m not sure if that value is not set, or it is set correctly but the agent token doesn’t have the correct auth. PS — I am open to doing this another way, such as a dedicated SlackTask, but the state handler seems somehow more semantically correct, and the CloudHook doesn’t seem to provide that kind of detailed info. (Sorry for the long post.) Thanks! 🙏
Here’s the error I see:
AuthorizationError([{'path': ['switch_tenant'], 'message': 'Unauthenticated', 'extensions': {'code': 'UNAUTHENTICATED'}}])
c

Chris White

06/25/2020, 5:31 PM
Hi Jeff! Could you share your state handler code? Specifically how you are making the API request? The env var must be working because your state updates from your Flow are making it to Cloud, so it’s hopefully just a minor tweak
j

Jeff Brainerd

06/25/2020, 5:51 PM
Thanks Chris. The following code is getting called from the state handler:
api_token = os.getenv('PREFECT__CLOUD__AUTH_TOKEN')
_prefect_client = Client(api_token=api_token)
_prefect_client.login_to_tenant(tenant_slug="jellyfish")
There’s more code, of course, but I think this is the relevant stuff. LMK if there’s something else of interest.
c

Chris White

06/25/2020, 5:52 PM
ah ha! so this might seem counterintuitive but could you try
_prefect_client = Client()
and don’t call the
login_to_tenant
route at all; let me know if that works, and if it does, I’ll explain what’s happening
j

Jeff Brainerd

06/25/2020, 5:53 PM
Yes, I will try that and report back. Thanks!
👍 1
Yes, that worked. Many thanks for the quick and helpful response! 🙏
c

Chris White

06/25/2020, 11:13 PM
Awesome! Purely for reference: -
login_to_tenant
is a route that is only supported for Personal Access tokens (these are tokens that identify you as a user, but do not identify the tenant that you want to work within) - RUNNER tokens (which are the ones present in your environment anytime an agent submits your flow run) already have a tenant associated with them, but no user (they’re kind of like “service account” tokens) - because the
Client
infers auth info from the environment, and because agents ensure your environment is Cloud-compatible, instantiating a Client within a Flow will “do the right thing” and begin using the RUNNER token
@Marvin archive “Issue using a Prefect Client within a state handler”
j

Jeff Brainerd

06/26/2020, 1:06 AM
Yes, that totally makes sense. Thanks for the help and extra info!