anmolxlight opened a new pull request, #70053:
URL: https://github.com/apache/airflow/pull/70053
### Motivation
The Helm chart currently injects all sensitive config values (database
connection, broker URL, fernet key, api secret key, celery result backend) into
every component's environment via `standard_airflow_environment`. For worker
pods that execute untrusted DAG code, this means user tasks can read these
secrets with `printenv` or `/proc/self/environ`.
The existing global `enableBuiltInSecretEnvVars` flag lets operators disable
these env vars, but it disables them for **all** components (scheduler,
api-server, triggerer, worker, etc.), which may break control-plane components
that legitimately need them.
### What this PR does
- Adds `workers.celery.enableBuiltInSecretEnvVars` (type: `object | null`,
default: `null`)
- Adds `scheduler.enableBuiltInSecretEnvVars` (type: `object | null`,
default: `null`)
- When a key is set in a component-level override, it takes precedence over
the global value for that component only
- When `null` or a key is absent, the global `enableBuiltInSecretEnvVars` is
used (backward compatible)
### Usage
```yaml
workers:
celery:
enableBuiltInSecretEnvVars:
AIRFLOW__DATABASE__SQL_ALCHEMY_CONN: false
AIRFLOW__CELERY__BROKER_URL: false
```
This disables the database connection and broker URL env vars on worker
containers only, while other components continue to receive them from the
global setting.
### Implementation
The `standard_airflow_environment` template accepts an optional
`envOverrides` dict. Each component call site passes its component-level map
when available. The template resolves each env var by checking the component
override first, then falling back to the global.
### Backward Compatibility
Fully backward compatible. Default values (`null`) produce identical
behavior to the existing global-only approach.
Closes #70008
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
