himanshuchawla0807-gif commented on code in PR #74912:
URL: https://github.com/apache/airflow/pull/74912#discussion_r4302540343
##########
chart/files/pod-template-file.kubernetes-helm-yaml:
##########
@@ -122,7 +122,7 @@ spec:
- name: KRB5CCNAME
value: {{ include "kerberos_ccache_path" . | quote }}
{{- end }}
- {{- include "standard_airflow_environment" . | indent 6}}
+ {{- include "standard_airflow_environment" (merge (dict
"ExcludeDatabase" true) .) | indent 6 }}
Review Comment:
[P2] Exclude database references from the worker Kerberos containers too
This excludes the two database variables from `base`, but the same pod's
`kerberos-init` and `worker-kerberos` containers still call
`standard_airflow_environment` without `ExcludeDatabase`. With
`kerberos.enabled=true` and either
`workers.kubernetes.kerberosInitContainer.enabled=true` or
`workers.kubernetes.kerberosSidecar.enabled=true`, the enabled Kerberos
container still renders both mandatory references to `review-metadata`. A
worker in the separate namespace therefore still depends on the metadata Secret
even after this change.
Reproduced at `bfb190e59436331b1f86f7f9e82db1086cedccdb` with:
```sh
helm template review chart --show-only templates/configmaps/configmap.yaml \
--set executor=KubernetesExecutor --set kerberos.enabled=true \
--set workers.kubernetes.kerberosInitContainer.enabled=true
```
The references are inside the ConfigMap's `pod_template_file.yaml`. The
sidecar-only configuration has the same result. Passing the same
`ExcludeDatabase` context to the other two helper calls removes them. Extending
the regression to check every regular/init container with Kerberos disabled,
init-only, sidecar-only and both gives six failures and two passes before that
correction; all 122 pod-template tests pass afterward in local Breeze. This is
Helm-rendering validation, not a live-cluster test.
---
Drafted-by: OpenAI Codex (no human review before posting)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
