Add opt-in append_blob write mode for WASB task logs

[bujjibabukatta]

Summary
WASB task logs are rewritten from scratch on every upload -- the whole
existing blob is downloaded, the new segment appended in memory, and the
full result re-uploaded. For a long-running task this means O(N^2) traffic
across N log writes instead of O(N).

Root cause
WasbRemoteLogIO.write() always calls hook.load_string(..., overwrite=True),
which replaces the entire blob object regardless of how much of it is
actually new.

Fix
Added an opt-in write_mode="append_blob" that uses Azure's native AppendBlob
API (append_block() with a position guard) to append only the new segment,
instead of rewriting the whole object. Falls back to the existing
block-blob rewrite path for any blob already written as a block blob, since
Azure doesn't support converting a blob's type in place. Segments over the
4 MiB per-block limit are chunked automatically, and a concurrent-writer
position mismatch fails safely rather than writing at the wrong offset.

closes: #70867

Was generative AI tooling used ?

• Yes - Claude

Generated-by: Claude following the guidelines

[bmanan7]

Thanks for picking this up. Nice to see it go straight to append_block() with appendpos_condition rather than upload_blob(blob_type="AppendBlob"), since that distinction is easy to miss, and the block-blob fallback for existing objects is exactly right.

One thing I think is worth handling before this lands: the chunk loop can leave a lifecycle partially applied, and nothing records how much of it landed.

Take a segment larger than the 4 MiB block limit, say 10 MiB split into A1, A2, A3:

1. append_block(A1, offset=0) commits. The blob is now 4 MiB.
2. append_block(A2, offset=4MiB) hits a transient error, so write() returns False.
3. upload() sees has_uploaded=False and correctly leaves the local file intact so the segment can be retried (the behaviour added in Fix duplicated task logs in the WASB log handler #70860).

The blob now holds A1, while the local file still holds A1+A2+A3. On the next upload to the same key, offset is read as properties.size, which is 4 MiB, and the whole local file is appended from there. A1 ends up stored twice.

appendpos_condition does not catch this: the blob really is 4 MiB at that point, so the guard passes. It protects against writing at the wrong offset, not against re-sending content that already landed. The block-blob path never had this problem because its single overwrite=True PUT is atomic, so a lifecycle could not end half-applied.

It needs a second upload against the same key to surface, so in practice a deferrable resume or a reschedule poke whose individual lifecycle writes more than 4 MiB. Rare, but it is the same class of duplication that #70860 just fixed, which is why I thought it worth raising.

The awkward part is that write() receives the log string and returns a bool, so it has no way to tell upload() "4 of 10 MiB committed" or to trim the local file itself. A few directions that might work:

• Retry the remaining chunks in place before giving up, which narrows the window without closing it.
• Return bytes written, or move the chunking up into upload(), so the committed prefix can be trimmed from the local file and the "local file is exactly what has not been uploaded" invariant holds again.
• Simplest option: do not chunk, and fall back to the block-blob path for segments over the limit, keeping the append path atomic.

---

Drafted-by: Claude Code (Opus 5); reviewed by @bmanan7 before posting

[bujjibabukatta]

Hi @bmanan7 — good catch. Went with your second option: _write_append_blob
now returns bytes committed, and upload() trims the local file to just
the uncommitted part on a partial failure, so a retry doesn't resend what
already landed. Also caught that chunk boundaries could split a multi-byte
character, so fixed that too. Added tests for both.

[aaron-y-chen]

Thanks for the contribution! :)

Could you help resolve the conflict before we get into the review process?

[potiuk]

Hello @bujjibabukatta - thank you for your contributions to Apache Airflow!

The Airflow community has introduced a limit of 5 open pull requests at a time for contributors without write access to the repository. You currently have 16 open pull requests, so - as a one-time step of introducing the limit - we closed the ones where maintainers have not engaged yet:

• Fix airflowctl always using production creds when --env is passed #70584 - Fix airflowctl always using production creds when --env is passed
• Skip redundant dag.exceeds_max_non_backfill writes to reduce scheduler/DAG-processor lock contention #70712 - Skip redundant dag.exceeds_max_non_backfill writes to reduce scheduler/DAG-processor lock contention
• Allow temporal partition mappers to accept already-normalized keys #70781 - Allow temporal partition mappers to accept already-normalized keys
• Skip file-based dag processor logs when dag_processor_log_target=stdout #71052 - Skip file-based dag processor logs when dag_processor_log_target=stdout
• Add opt-in append_blob write mode for WASB task logs #71064 - Add opt-in append_blob write mode for WASB task logs
• deny unknown backfill_id directly instead of falling back to body dag_id #71114 - deny unknown backfill_id directly instead of falling back to body dag_id
• Fix DAG processor treating non-.zip files as DAG bundles (#71125) #71166 - Fix DAG processor treating non-.zip files as DAG bundles (DAG processor treats any zip-format file (.jar, .pptx, .docx, .xlsx, etc.) as a potential DAG bundle, not just .zip #71125)
• Surface hasMappedDependants on ts-sdk TaskContext #71191 - Surface hasMappedDependants on ts-sdk TaskContext
• fix: FAB get_application_builder should use create_metadata_engine hook #71673 - fix: FAB get_application_builder should use create_metadata_engine hook
• Task SDK: Fix executor_config aliasing across tasks sharing default_args #72556 - Task SDK: Fix executor_config aliasing across tasks sharing default_args
• Add job_name support to DataflowJobStatusSensor and DataflowJobStatusTrigger #72879 - Add job_name support to DataflowJobStatusSensor and DataflowJobStatusTrigger

These pull requests stay open because maintainers are already engaged in them - they count towards your limit:

• fix(amazon): include deferred-task trigger logs when reading from Clo… #70635 - fix(amazon): include deferred-task trigger logs when reading from Clo…
• Fix ReDoS in SparkSubmitHook._mask_cmd on adversarial input #70716 - Fix ReDoS in SparkSubmitHook._mask_cmd on adversarial input
• Point mask_secret deprecation warning at the module it actually uses #70883 - Point mask_secret deprecation warning at the module it actually uses
• Build DataprocCreateClusterOperator cluster_config from legacy kwargs after rendering #70922 - Build DataprocCreateClusterOperator cluster_config from legacy kwargs after rendering
• Anchor run_id to logical_date when create_cron_data_intervals is enab… #71480 - Anchor run_id to logical_date when create_cron_data_intervals is enab…

This is not a judgement of you or of your changes. We never told contributors before that opening many pull requests at once was a problem, so there is nothing to feel bad about - and nothing is lost: your branches, commits and the review history stay where they are.

What we ask you to do is to make your first prioritization decision: choose which of the pull requests above matter most to you, and reopen them (up to 5 open at a time, including the ones still open) with the "Reopen pull request" button or gh pr reopen <PR_NUMBER> --repo apache/airflow. Reopen the ones you are ready to follow through - keep them rebased, respond to review comments and fix failing checks.

While your pull requests are waiting for review, the most valuable thing you can do is help in other ways - reviewing other contributors' pull requests, helping with issues, and taking part in the discussions on the devlist and Slack.

Why we introduced the limit, what it means for you and how to reopen or restore a pull request is explained in https://github.com/apache/airflow/blob/main/contributing-docs/32_open_pull_request_limit.rst.

---

Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting