This is an automated email from the ASF dual-hosted git repository.
Miretpl pushed a commit to branch chart/v1-2x-test
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/chart/v1-2x-test by this push:
new dae8772ac53 Add startup probe for Kerberos worker sidecars (#71221)
(#71682)
dae8772ac53 is described below
commit dae8772ac53def3eb68b4d263a2b1822eb5aba49
Author: Aaron Chen <[email protected]>
AuthorDate: Sun Aug 23 04:41:19 2026 +0800
Add startup probe for Kerberos worker sidecars (#71221) (#71682)
* Add startup probe for Kerberos worker sidecars
* Reject invalid Kerberos startup probe settings
---
chart/files/pod-template-file.kubernetes-helm-yaml | 9 +++
chart/templates/workers/worker-deployment.yaml | 9 +++
chart/values.schema.json | 72 ++++++++++++++++++++++
chart/values.yaml | 18 ++++++
.../airflow_aux/test_pod_template_file.py | 70 ++++++++++++++++++++-
.../tests/helm_tests/security/test_kerberos.py | 70 ++++++++++++++++++++-
6 files changed, 246 insertions(+), 2 deletions(-)
diff --git a/chart/files/pod-template-file.kubernetes-helm-yaml
b/chart/files/pod-template-file.kubernetes-helm-yaml
index c077ec82ce6..e3406c53796 100644
--- a/chart/files/pod-template-file.kubernetes-helm-yaml
+++ b/chart/files/pod-template-file.kubernetes-helm-yaml
@@ -171,6 +171,15 @@ spec:
{{- end }}
args: ["kerberos"]
resources: {{- toYaml
(.Values.workers.kubernetes.kerberosSidecar.resources | default
.Values.workers.kerberosSidecar.resources) | nindent 8 }}
+ {{- if .Values.workers.kubernetes.kerberosSidecar.startupProbe.enabled }}
+ startupProbe:
+ exec:
+ command: ["klist", "-s"]
+ timeoutSeconds: {{
.Values.workers.kubernetes.kerberosSidecar.startupProbe.timeoutSeconds }}
+ initialDelaySeconds: {{
.Values.workers.kubernetes.kerberosSidecar.startupProbe.initialDelaySeconds }}
+ periodSeconds: {{
.Values.workers.kubernetes.kerberosSidecar.startupProbe.periodSeconds }}
+ failureThreshold: {{
.Values.workers.kubernetes.kerberosSidecar.startupProbe.failureThreshold }}
+ {{- end }}
volumeMounts:
- name: logs
mountPath: {{ template "airflow_logs" . }}
diff --git a/chart/templates/workers/worker-deployment.yaml
b/chart/templates/workers/worker-deployment.yaml
index dfbc044bf51..c9f8fff22e6 100644
--- a/chart/templates/workers/worker-deployment.yaml
+++ b/chart/templates/workers/worker-deployment.yaml
@@ -417,6 +417,15 @@ spec:
{{- end }}
args: ["kerberos"]
resources: {{- toYaml .Values.workers.kerberosSidecar.resources |
nindent 12 }}
+ {{- if .Values.workers.kerberosSidecar.startupProbe.enabled }}
+ startupProbe:
+ exec:
+ command: ["klist", "-s"]
+ timeoutSeconds: {{
.Values.workers.kerberosSidecar.startupProbe.timeoutSeconds }}
+ initialDelaySeconds: {{
.Values.workers.kerberosSidecar.startupProbe.initialDelaySeconds }}
+ periodSeconds: {{
.Values.workers.kerberosSidecar.startupProbe.periodSeconds }}
+ failureThreshold: {{
.Values.workers.kerberosSidecar.startupProbe.failureThreshold }}
+ {{- end }}
volumeMounts:
- name: logs
mountPath: {{ template "airflow_logs" . }}
diff --git a/chart/values.schema.json b/chart/values.schema.json
index f04ef036c58..011849f7a3c 100644
--- a/chart/values.schema.json
+++ b/chart/values.schema.json
@@ -3401,6 +3401,42 @@
],
"default": null
},
+ "startupProbe": {
+ "description": "Startup probe for the
Kerberos worker sidecar (runs `klist -s`).",
+ "type": "object",
+ "additionalProperties": false,
+ "properties": {
+ "enabled": {
+ "description": "Enable the
Kerberos sidecar startup probe. Disable for custom images without `klist`.",
+ "type": "boolean",
+ "default": true
+ },
+ "timeoutSeconds": {
+ "description": "Number of seconds
after which the probe times out.",
+ "type": "integer",
+ "default": 5,
+ "minimum": 1
+ },
+ "initialDelaySeconds": {
+ "description": "Number of seconds
after the container has started before the startup probe is initiated.",
+ "type": "integer",
+ "default": 0,
+ "minimum": 0
+ },
+ "periodSeconds": {
+ "description": "How often (in
seconds) to perform the probe.",
+ "type": "integer",
+ "default": 10,
+ "minimum": 1
+ },
+ "failureThreshold": {
+ "description": "Number of
consecutive failures required for the startup probe to fail.",
+ "type": "integer",
+ "default": 6,
+ "minimum": 1
+ }
+ }
+ },
"resources": {
"description": "Resources on kerberos
sidecar.",
"type": "object",
@@ -4193,6 +4229,42 @@
],
"default": null
},
+ "startupProbe": {
+ "description": "Startup probe for the
Kerberos worker sidecar (runs `klist -s`).",
+ "type": "object",
+ "additionalProperties": false,
+ "properties": {
+ "enabled": {
+ "description": "Enable the
Kerberos sidecar startup probe. Disable for custom images without `klist`.",
+ "type": "boolean",
+ "default": true
+ },
+ "timeoutSeconds": {
+ "description": "Number of seconds
after which the probe times out.",
+ "type": "integer",
+ "default": 5,
+ "minimum": 1
+ },
+ "initialDelaySeconds": {
+ "description": "Number of seconds
after the container has started before the startup probe is initiated.",
+ "type": "integer",
+ "default": 0,
+ "minimum": 0
+ },
+ "periodSeconds": {
+ "description": "How often (in
seconds) to perform the probe.",
+ "type": "integer",
+ "default": 10,
+ "minimum": 1
+ },
+ "failureThreshold": {
+ "description": "Number of
consecutive failures required for the startup probe to fail.",
+ "type": "integer",
+ "default": 6,
+ "minimum": 1
+ }
+ }
+ },
"resources": {
"description": "Resources on kerberos
sidecar.",
"type": "object",
diff --git a/chart/values.yaml b/chart/values.yaml
index 5fcac27903e..d8793c5b431 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -1477,6 +1477,15 @@ workers:
# Container level lifecycle hooks
containerLifecycleHooks: {}
+ # Startup probe for the kerberos sidecar: `klist -s` succeeds once the
credential
+ # cache holds a valid, unexpired ticket. Disable for custom images
without `klist`.
+ startupProbe:
+ enabled: true
+ timeoutSeconds: 5
+ initialDelaySeconds: 0
+ periodSeconds: 10
+ failureThreshold: 6
+
# Kerberos init container configuration for Airflow Celery workers
# If not set, the values from `workers.kerberosInitContainer` section will
be used.
kerberosInitContainer:
@@ -1730,6 +1739,15 @@ workers:
# Container level lifecycle hooks
containerLifecycleHooks: {}
+ # Startup probe for the kerberos sidecar: `klist -s` succeeds once the
credential
+ # cache holds a valid, unexpired ticket. Disable for custom images
without `klist`.
+ startupProbe:
+ enabled: true
+ timeoutSeconds: 5
+ initialDelaySeconds: 0
+ periodSeconds: 10
+ failureThreshold: 6
+
# Kerberos init container configuration for pods created with
pod-template-file
# If not set, the values from `workers.kerberosInitContainer` section will
be used.
kerberosInitContainer:
diff --git a/helm-tests/tests/helm_tests/airflow_aux/test_pod_template_file.py
b/helm-tests/tests/helm_tests/airflow_aux/test_pod_template_file.py
index b017474f915..df0a50eb832 100644
--- a/helm-tests/tests/helm_tests/airflow_aux/test_pod_template_file.py
+++ b/helm-tests/tests/helm_tests/airflow_aux/test_pod_template_file.py
@@ -22,7 +22,7 @@ from shutil import copyfile, copytree
import jmespath
import pytest
-from chart_utils.helm_template_generator import render_chart
+from chart_utils.helm_template_generator import HelmFailedError, render_chart
@pytest.fixture(scope="class")
@@ -1817,6 +1817,74 @@ class TestPodTemplateFile:
"allowPrivilegeEscalation": False
}
+ @pytest.mark.parametrize(
+ ("override", "expected"),
+ [
+ (
+ {},
+ {
+ "exec": {"command": ["klist", "-s"]},
+ "timeoutSeconds": 5,
+ "initialDelaySeconds": 0,
+ "periodSeconds": 10,
+ "failureThreshold": 6,
+ },
+ ),
+ (
+ {
+ "timeoutSeconds": 11,
+ "initialDelaySeconds": 12,
+ "periodSeconds": 13,
+ "failureThreshold": 14,
+ },
+ {
+ "exec": {"command": ["klist", "-s"]},
+ "timeoutSeconds": 11,
+ "initialDelaySeconds": 12,
+ "periodSeconds": 13,
+ "failureThreshold": 14,
+ },
+ ),
+ ({"enabled": False}, None),
+ ],
+ ids=["default", "custom", "disabled"],
+ )
+ def test_kerberos_sidecar_startup_probe(self, override, expected):
+ docs = render_chart(
+ values={
+ "workers": {"kubernetes": {"kerberosSidecar": {"enabled":
True, "startupProbe": override}}}
+ },
+ show_only=["templates/pod-template-file.yaml"],
+ chart_dir=self.temp_chart_dir,
+ )
+
+ assert (
+ jmespath.search("spec.containers[?name=='worker-kerberos'] |
[0].startupProbe", docs[0])
+ == expected
+ )
+
+ @pytest.mark.parametrize(
+ "override",
+ [
+ {"timeoutSeconds": 0},
+ {"initialDelaySeconds": -1},
+ {"periodSeconds": 0},
+ {"failureThreshold": 0},
+ ],
+ ids=["timeout", "initial-delay", "period", "failure-threshold"],
+ )
+ def test_kerberos_sidecar_startup_probe_rejects_invalid_values(self,
override):
+ with pytest.raises(HelmFailedError):
+ render_chart(
+ values={
+ "workers": {
+ "kubernetes": {"kerberosSidecar": {"enabled": True,
"startupProbe": override}}
+ }
+ },
+ show_only=["templates/pod-template-file.yaml"],
+ chart_dir=self.temp_chart_dir,
+ )
+
def test_kerberos_init_container_default(self):
docs = render_chart(
show_only=["templates/pod-template-file.yaml"],
diff --git a/helm-tests/tests/helm_tests/security/test_kerberos.py
b/helm-tests/tests/helm_tests/security/test_kerberos.py
index 9978ae86591..8840194438c 100644
--- a/helm-tests/tests/helm_tests/security/test_kerberos.py
+++ b/helm-tests/tests/helm_tests/security/test_kerberos.py
@@ -20,7 +20,7 @@ import json
import jmespath
import pytest
-from chart_utils.helm_template_generator import render_chart
+from chart_utils.helm_template_generator import HelmFailedError, render_chart
class TestKerberos:
@@ -184,3 +184,71 @@ class TestKerberos:
)
assert len(docs) == 0
+
+ @pytest.mark.parametrize(
+ ("override", "expected"),
+ [
+ (
+ {},
+ {
+ "exec": {"command": ["klist", "-s"]},
+ "timeoutSeconds": 5,
+ "initialDelaySeconds": 0,
+ "periodSeconds": 10,
+ "failureThreshold": 6,
+ },
+ ),
+ (
+ {
+ "timeoutSeconds": 11,
+ "initialDelaySeconds": 12,
+ "periodSeconds": 13,
+ "failureThreshold": 14,
+ },
+ {
+ "exec": {"command": ["klist", "-s"]},
+ "timeoutSeconds": 11,
+ "initialDelaySeconds": 12,
+ "periodSeconds": 13,
+ "failureThreshold": 14,
+ },
+ ),
+ ({"enabled": False}, None),
+ ],
+ ids=["default", "custom", "disabled"],
+ )
+ def test_kerberos_sidecar_startup_probe(self, override, expected):
+ docs = render_chart(
+ values={
+ "executor": "CeleryExecutor",
+ "workers": {"celery": {"kerberosSidecar": {"enabled": True,
"startupProbe": override}}},
+ },
+ show_only=["templates/workers/worker-deployment.yaml"],
+ )
+
+ assert (
+ jmespath.search(
+ "spec.template.spec.containers[?name=='worker-kerberos'] |
[0].startupProbe", docs[0]
+ )
+ == expected
+ )
+
+ @pytest.mark.parametrize(
+ "override",
+ [
+ {"timeoutSeconds": 0},
+ {"initialDelaySeconds": -1},
+ {"periodSeconds": 0},
+ {"failureThreshold": 0},
+ ],
+ ids=["timeout", "initial-delay", "period", "failure-threshold"],
+ )
+ def test_kerberos_sidecar_startup_probe_rejects_invalid_values(self,
override):
+ with pytest.raises(HelmFailedError):
+ render_chart(
+ values={
+ "executor": "CeleryExecutor",
+ "workers": {"celery": {"kerberosSidecar": {"enabled":
True, "startupProbe": override}}},
+ },
+ show_only=["templates/workers/worker-deployment.yaml"],
+ )
