This is an automated email from the ASF dual-hosted git repository.
Miretpl pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new e420143333a Support image digest in worker pod template image (#69776)
e420143333a is described below
commit e420143333a6eab368c678ec766f712f686054d7
Author: Preetham Sanji <[email protected]>
AuthorDate: Wed Jul 22 20:37:57 2026 +0530
Support image digest in worker pod template image (#69776)
The pod_template_image helper only rendered repository:tag, ignoring
digests, while airflow_image supports repository@digest with digest
taking precedence over tag. Add images.pod_template.digest (falling
back to defaultAirflowDigest) so worker pods can pin images by digest.
Closes: #58625
Co-authored-by: Przemysław Mirowski
<[email protected]>
---
chart/templates/_helpers.yaml | 9 +++++-
.../airflow_aux/test_pod_template_file.py | 33 ++++++++++++++++++++++
chart/values.schema.json | 8 ++++++
chart/values.yaml | 8 ++++--
4 files changed, 54 insertions(+), 4 deletions(-)
diff --git a/chart/templates/_helpers.yaml b/chart/templates/_helpers.yaml
index 2fefc497905..b069c38f97c 100644
--- a/chart/templates/_helpers.yaml
+++ b/chart/templates/_helpers.yaml
@@ -372,7 +372,14 @@ If release name contains chart name it will be used as a
full name.
{{- end }}
{{- define "pod_template_image" -}}
- {{- printf "%s:%s" (.Values.images.pod_template.repository | default
.Values.defaultAirflowRepository) (.Values.images.pod_template.tag | default
.Values.defaultAirflowTag) }}
+ {{- $repository := .Values.images.pod_template.repository | default
.Values.defaultAirflowRepository -}}
+ {{- $tag := .Values.images.pod_template.tag | default
.Values.defaultAirflowTag -}}
+ {{- $digest := .Values.images.pod_template.digest | default
.Values.defaultAirflowDigest -}}
+ {{- if $digest }}
+ {{- printf "%s@%s" $repository $digest -}}
+ {{- else }}
+ {{- printf "%s:%s" $repository $tag -}}
+ {{- end }}
{{- end }}
{{/* This helper is used for airflow containers that do not need the users
code */}}
diff --git a/chart/tests/helm_tests/airflow_aux/test_pod_template_file.py
b/chart/tests/helm_tests/airflow_aux/test_pod_template_file.py
index 34d03fe7762..42a776b5fb6 100644
--- a/chart/tests/helm_tests/airflow_aux/test_pod_template_file.py
+++ b/chart/tests/helm_tests/airflow_aux/test_pod_template_file.py
@@ -356,6 +356,39 @@ class TestPodTemplateFile:
assert jmespath.search("spec.containers[0].imagePullPolicy", docs[0])
== "Always"
assert jmespath.search("spec.containers[0].name", docs[0]) == "base"
+ @pytest.mark.parametrize(
+ ("expected_image", "tag", "digest"),
+ [
+ ("dummy_image:user-tag", "user-tag", None),
+ ("dummy_image@user-digest", None, "user-digest"),
+ ("dummy_image@user-digest", "user-tag", "user-digest"),
+ ],
+ )
+ def test_should_use_correct_pod_template_image(self, expected_image, tag,
digest):
+ docs = render_chart(
+ values={
+ "images": {
+ "pod_template": {"repository": "dummy_image", "tag": tag,
"digest": digest},
+ },
+ },
+ show_only=["templates/pod-template-file.yaml"],
+ chart_dir=self.temp_chart_dir,
+ )
+
+ assert jmespath.search("spec.containers[0].image", docs[0]) ==
expected_image
+
+ def test_should_use_default_airflow_digest_in_pod_template(self):
+ docs = render_chart(
+ values={
+ "defaultAirflowRepository": "test-repo",
+ "defaultAirflowDigest": "user-digest",
+ },
+ show_only=["templates/pod-template-file.yaml"],
+ chart_dir=self.temp_chart_dir,
+ )
+
+ assert jmespath.search("spec.containers[0].image", docs[0]) ==
"test-repo@user-digest"
+
def test_mount_airflow_cfg(self):
docs = render_chart(
show_only=["templates/pod-template-file.yaml"],
diff --git a/chart/values.schema.json b/chart/values.schema.json
index 7eb865997c7..3513f073e12 100644
--- a/chart/values.schema.json
+++ b/chart/values.schema.json
@@ -801,6 +801,14 @@
],
"default": null
},
+ "digest": {
+ "description": "The pod_template image digest. If
set, it will override the tag. If
``config.kubernetes_executor.worker_container_repository`` and
``config.kubernetes_executor.worker_container_tag`` are set, the k8s executor
will use those instead.",
+ "type": [
+ "string",
+ "null"
+ ],
+ "default": null
+ },
"pullPolicy": {
"description": "The pod_template image pull
policy.",
"type": "string",
diff --git a/chart/values.yaml b/chart/values.yaml
index 890f9976d97..299e21386b5 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -83,12 +83,14 @@ images:
# timeout (in seconds) for airflow-migrations to complete
migrationsWaitTimeout: 60
pod_template:
- # Note that `images.pod_template.repository` and `images.pod_template.tag`
parameters can be overridden
- # in `config.kubernetes_executor` section. So for these parameters to have
effect
- # `config.kubernetes_executor.worker_container_repository` and
+ # Note that `images.pod_template.repository`, `images.pod_template.tag`
and `images.pod_template.digest`
+ # parameters can be overridden in `config.kubernetes_executor` section. So
for these parameters
+ # to have effect `config.kubernetes_executor.worker_container_repository`
and
# `config.kubernetes_executor.worker_container_tag` must be not set .
repository: ~
tag: ~
+ # Specifying digest takes precedence over tag.
+ digest: ~
pullPolicy: IfNotPresent
flower:
repository: ~
