Aaryan123456679 opened a new pull request, #70238: URL: https://github.com/apache/airflow/pull/70238
OpenShift assigns `runAsUser`/`fsGroup` automatically via SCC and rejects pods that hard-code them, so users need to null these out in the rendered pod `securityContext`. The Helm chart's `values.schema.json` typed `securityContexts.pod.runAsUser`/`runAsGroup`/`fsGroup` as non-nullable integers (via the vendored `io.k8s.api.core.v1.PodSecurityContext` definition), so setting them to `null` failed schema validation before the templates ever rendered — the templates themselves already pass through explicit nulls correctly. This introduces a new `AirflowPodSecurityContext` schema definition (not `io.k8s.*`-prefixed, so it survives `vendor_k8s_json_schema.py` regeneration) that allows `null` for these three fields, and points all 16 `securityContexts.pod` `$ref`s at it instead of the vendored definition. closes: #41630 ## Test plan - [x] Added `test_main_pod_setting_runasuser_fsgroup_null` verifying `runAsUser`/`fsGroup` render as `None` when explicitly nulled - [x] `breeze testing helm-tests --test-type security` — 188 passed - [x] `breeze testing helm-tests --use-xdist` (full suite) — 2061 passed - [x] Verified via `helm template` that the schema now accepts the null override and the rendered manifest's `spec.template.spec.securityContext` reflects the explicit nulls --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Sonnet 5) Generated-by: Claude Code (Sonnet 5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
