sokojh opened a new pull request, #72863:
URL: https://github.com/apache/airflow/pull/72863
### Why
#56008 asks how to configure a worker image for `KubernetesExecutor` on
Airflow 3, given that
the `airflow worker` command was removed. `kubernetes_executor.rst` does not
answer it: the page
still opens with "As of Airflow 2.7.0", its `Base image` section only says
the image "must be
specified", and the words Task SDK, api-server and Execution API do not
appear anywhere in it.
The one line that touches the subject — "The worker pod then runs the task,
reports the result,
and terminates" — does not say through what.
So a deployer building their own worker image has nothing to check their
image against.
### How
Adds a `What the worker pod runs` section stating what the executor actually
puts in the pod and
what that requires of the image: the Task SDK must be importable, the pod
must be able to reach
the API server (the workload carries the token it authenticates with), and
the Dag bundle must be
resolvable. It also notes that `command` should stay unset on the `base`
container, and that
`AIRFLOW_IS_K8S_EXECUTOR_POD=True` is injected.
Docs only — no code changes.
### What — every statement is taken from a pod that actually ran
Deployed on a local KinD cluster and captured a live worker pod:
```
breeze k8s create-cluster
breeze k8s build-k8s-image && breeze k8s upload-k8s-image
breeze k8s deploy-airflow --multi-namespace-mode --executor
KubernetesExecutor
airflow dags trigger example_simplest_dag
kubectl get pod example-simplest-dag-my-task-<suffix> -n airflow -o yaml
```
Airflow 3.3.1, provider from `main`, Kubernetes v1.30.13, Python 3.10.
The captured `base` container (token redacted):
```yaml
- args:
- python
- -m
- airflow.sdk.execution_time.execute_workload
- --json-string
- '{"token":"<redacted>","dag_rel_path":"example_simplest_dag.py",
"bundle_info":{"name":"dags-folder","version":null,"version_data":null},
"log_path":"dag_id=example_simplest_dag/run_id=.../attempt=1.log",
"ti":{"id":"...","task_id":"my_task","dag_id":"example_simplest_dag",...},
"type":"ExecuteTask"}'
image: ghcr.io/apache/airflow/main/prod/python3.10-kubernetes:latest
name: base
```
No `command` field is present, so the image entrypoint consumes these `args`.
Decoding the token's payload gives `scope: workload`, `aud:
urn:airflow.apache.org:task`,
`exp - iat = 600` seconds — the values quoted in the new section.
The Task SDK claim was checked against the published image rather than
assumed:
```
$ docker run --rm --entrypoint python \
ghcr.io/apache/airflow/main/prod/python3.10-kubernetes:latest \
-c "import airflow.sdk.execution_time.execute_workload as m;
print(m.__file__)"
/opt/airflow/task-sdk/src/airflow/sdk/execution_time/execute_workload.py
```
Injected env on that container: `AIRFLOW_IS_K8S_EXECUTOR_POD`,
`AIRFLOW__CORE__EXECUTOR`,
`AIRFLOW_HOME`, `AIRFLOW__CORE__FERNET_KEY`, `AIRFLOW__API__SECRET_KEY`,
`DUMB_INIT_SETSID`,
`AIRFLOW__DATABASE__SQL_ALCHEMY_CONN`, `AIRFLOW_CONN_AIRFLOW_DB`.
I deliberately did not write that workers no longer reach the metadata
database: the last two
variables above are still injected today, and #72206 is the change that
removes them. The section
only claims what the captured pod shows.
Docs build and spelling pass:
```
breeze build-docs cncf.kubernetes
# Finished docs building successfully
# Finished spell-checking successfully
```
related: #56008
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (please specify the tool below)
Generated-by: Claude Code (Opus 5) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
