This is an automated email from the ASF dual-hosted git repository.
Miretpl pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 3817ee64aca Fix Helm Chart regression with Kerberos in Kubernetes
(#70688)
3817ee64aca is described below
commit 3817ee64acaac138baf574f80656bc5cd1fcda77
Author: Nataneljpwd <[email protected]>
AuthorDate: Thu Sep 10 09:29:05 2026 -0700
Fix Helm Chart regression with Kerberos in Kubernetes (#70688)
* fixed helm chart regression with kerberos
* done for kubernetes executor as well
* moved the value around
* address cr comments
* changed the tests
* added tests
* fixed typo
* fix tests
* fixed tests
* fixed the tests
* fixed failing test
---------
Co-authored-by: Przemysław Mirowski
<[email protected]>
---
chart/files/pod-template-file.kubernetes-helm-yaml | 2 +-
chart/templates/workers/worker-deployment.yaml | 2 +-
.../airflow_aux/test_pod_template_file.py | 24 ++++++++++++++++++++++
chart/tests/helm_tests/airflow_core/test_worker.py | 19 +++++++++++++++++
chart/values.schema.json | 10 +++++++++
chart/values.yaml | 6 ++++++
6 files changed, 61 insertions(+), 2 deletions(-)
diff --git a/chart/files/pod-template-file.kubernetes-helm-yaml
b/chart/files/pod-template-file.kubernetes-helm-yaml
index e9ffea6e0fb..c157a415c2c 100644
--- a/chart/files/pod-template-file.kubernetes-helm-yaml
+++ b/chart/files/pod-template-file.kubernetes-helm-yaml
@@ -163,7 +163,7 @@ spec:
readOnly: true
- name: kerberos-ccache
mountPath: {{ .Values.kerberos.ccacheMountPath | quote }}
- readOnly: true
+ readOnly: {{ .Values.workers.kubernetes.readonlyKerberosCache }}
{{- end }}
{{- if .Values.workers.kubernetes.kerberosSidecar.enabled }}
- name: worker-kerberos
diff --git a/chart/templates/workers/worker-deployment.yaml
b/chart/templates/workers/worker-deployment.yaml
index 6caa54703df..d5e2dcde962 100644
--- a/chart/templates/workers/worker-deployment.yaml
+++ b/chart/templates/workers/worker-deployment.yaml
@@ -325,7 +325,7 @@ spec:
readOnly: true
- name: kerberos-ccache
mountPath: {{ .Values.kerberos.ccacheMountPath | quote }}
- readOnly: true
+ readOnly: {{ .Values.workers.celery.readonlyKerberosCache }}
{{- end }}
{{- if or .Values.dags.persistence.enabled
.Values.dags.gitSync.enabled }}
{{- include "airflow_dags_mount" . | nindent 12 }}
diff --git a/chart/tests/helm_tests/airflow_aux/test_pod_template_file.py
b/chart/tests/helm_tests/airflow_aux/test_pod_template_file.py
index a071933010b..6897086f797 100644
--- a/chart/tests/helm_tests/airflow_aux/test_pod_template_file.py
+++ b/chart/tests/helm_tests/airflow_aux/test_pod_template_file.py
@@ -1491,6 +1491,30 @@ class TestPodTemplateFile:
assert initContainers["name"] == "kerberos-init"
assert initContainers["args"] == ["kerberos", "-o"]
+ @pytest.mark.parametrize("readonly_cache", [False, True])
+ def test_kerberos_readonly_cache(self, readonly_cache: bool):
+ docs = render_chart(
+ name="test-release",
+ values={
+ "workers": {
+ "kubernetes": {
+ "readonlyKerberosCache": readonly_cache,
+ },
+ },
+ "kerberos": {"enabled": True},
+ },
+ show_only=["templates/pod-template-file.yaml"],
+ chart_dir=self.temp_chart_dir,
+ )
+
+ assert (
+ jmespath.search(
+ "spec.containers[?name=='base'].volumeMounts | [] |
[?name=='kerberos-ccache'] | [0].readOnly",
+ docs[0],
+ )
+ == readonly_cache
+ )
+
@pytest.mark.parametrize(
("workers_values", "expected"),
[
diff --git a/chart/tests/helm_tests/airflow_core/test_worker.py
b/chart/tests/helm_tests/airflow_core/test_worker.py
index bc3c9673c6e..1ad6c5e3bb5 100644
--- a/chart/tests/helm_tests/airflow_core/test_worker.py
+++ b/chart/tests/helm_tests/airflow_core/test_worker.py
@@ -924,6 +924,25 @@ class TestWorker:
"spec.template.spec.initContainers[?name=='kerberos-init'] |
[0].lifecycle", docs[0]
) == {"postStart": {"exec": {"command": ["echo", "test-release"]}}}
+ @pytest.mark.parametrize("readonly_cache", [False, True])
+ def test_kerberos_readonly_cache(self, readonly_cache: bool):
+ docs = render_chart(
+ name="test-release",
+ values={
+ "workers": {"celery": {"readonlyKerberosCache":
readonly_cache}},
+ "kerberos": {"enabled": True},
+ },
+ show_only=["templates/workers/worker-deployment.yaml"],
+ )
+
+ assert (
+ jmespath.search(
+ "spec.template.spec.containers[?name=='worker'] |
[0].volumeMounts[?name=='kerberos-ccache'] | [0].readOnly",
+ docs[0],
+ )
+ == readonly_cache
+ )
+
def test_default_command_and_args_airflow_version(self):
docs = render_chart(
show_only=["templates/workers/worker-deployment.yaml"],
diff --git a/chart/values.schema.json b/chart/values.schema.json
index a0e8815a2c3..f6f13b94e98 100644
--- a/chart/values.schema.json
+++ b/chart/values.schema.json
@@ -1661,6 +1661,11 @@
"type": "integer",
"default": 1
},
+ "readonlyKerberosCache": {
+ "description": "Should the celery kerberos cache
be readonly for the workers.",
+ "type": "boolean",
+ "default": true
+ },
"revisionHistoryLimit": {
"description": "Max number of old Airflow Celery
workers ReplicaSets to retain.",
"type": [
@@ -3093,6 +3098,11 @@
}
}
},
+ "readonlyKerberosCache": {
+ "description": "Should the kubernetes kerberos
cache be readonly for the workers.",
+ "type": "boolean",
+ "default": true
+ },
"resources": {
"description": "Resource configuration for pods
created with pod-template-file.",
"type": "object",
diff --git a/chart/values.yaml b/chart/values.yaml
index 7c20b431f82..b06454d54b1 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -875,6 +875,9 @@ workers:
# Container level lifecycle hooks
containerLifecycleHooks: {}
+ # Should the kerberos-ccache mount be readonly for Celery Workers
+ readonlyKerberosCache: true
+
# Resource configuration for Airflow Celery workers
resources: {}
# limits:
@@ -1131,6 +1134,9 @@ workers:
# Container level lifecycle hooks
containerLifecycleHooks: {}
+ # Should the kerberos-ccache mount be readonly for Celery Workers
+ readonlyKerberosCache: true
+
# Resource configuration for pods created with pod-template-file
resources: {}
# limits:
