Skip to content

Add workers.celery.kerberosSidecar & workers.kubernetes.kerberosSidecar sections #61881

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jscheffl merged 10 commits into from
Mar 6, 2026
Merged

Add workers.celery.kerberosSidecar & workers.kubernetes.kerberosSidecar sections #61881

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
2bb0b47
Add workers.celery.kerberosSidecar & workers.kubernetes.kerberosSidecar
Miretpl Feb 13, 2026
08c8ac3
Misc
Miretpl Feb 13, 2026
62867db
Merge branch 'main' into add-workers-celery-k8s-kerberos-sidecar
Miretpl Mar 2, 2026
2160e43
Merge branch 'main' into add-workers-celery-k8s-kerberos-sidecar
Miretpl Mar 2, 2026
18f34a6
Merge branch 'main' into add-workers-celery-k8s-kerberos-sidecar
Miretpl Mar 4, 2026
4a82f46
Merge branch 'main' into add-workers-celery-k8s-kerberos-sidecar
Miretpl Mar 4, 2026
abe3e4b
Merge branch 'main' into add-workers-celery-k8s-kerberos-sidecar
Miretpl Mar 5, 2026
4996cbd
Merge branch 'main' into add-workers-celery-k8s-kerberos-sidecar
Miretpl Mar 5, 2026
5b14b2f
Merge branch 'main' into add-workers-celery-k8s-kerberos-sidecar
Miretpl Mar 6, 2026
198fb4c
Merge branch 'main' into add-workers-celery-k8s-kerberos-sidecar
Miretpl Mar 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions chart/files/pod-template-file.kubernetes-helm-yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,8 @@
{{- $tolerations := or .Values.workers.tolerations .Values.tolerations }}
{{- $topologySpreadConstraints := or .Values.workers.topologySpreadConstraints .Values.topologySpreadConstraints }}
{{- $securityContext := include "airflowPodSecurityContext" (list .Values.workers.kubernetes .Values.workers .Values) }}
{{- $containerSecurityContextKerberosSidecar := include "containerSecurityContext" (list .Values.workers.kerberosSidecar .Values) }}
{{- $containerLifecycleHooksKerberosSidecar := or .Values.workers.kerberosSidecar.containerLifecycleHooks .Values.containerLifecycleHooks }}
{{- $containerSecurityContextKerberosSidecar := include "containerSecurityContext" (list .Values.workers.kubernetes.kerberosSidecar .Values.workers.kerberosSidecar .Values) }}
{{- $containerLifecycleHooksKerberosSidecar := or .Values.workers.kubernetes.kerberosSidecar.containerLifecycleHooks .Values.workers.kerberosSidecar.containerLifecycleHooks .Values.containerLifecycleHooks }}
{{- $containerSecurityContextKerberosInitContainer := include "containerSecurityContext" (list .Values.workers.kubernetes.kerberosInitContainer .Values.workers.kerberosInitContainer .Values) }}
{{- $containerLifecycleHooksKerberosInitContainer := or .Values.workers.kubernetes.kerberosInitContainer.containerLifecycleHooks .Values.workers.kerberosInitContainer.containerLifecycleHooks .Values.containerLifecycleHooks }}
{{- $containerSecurityContext := include "containerSecurityContext" (list .Values.workers.kubernetes .Values.workers .Values) }}
Expand Down Expand Up @@ -112,7 +112,7 @@ spec:
env:
- name: AIRFLOW__CORE__EXECUTOR
value: {{ .Values.executor | quote }}
{{- if or .Values.workers.kerberosSidecar.enabled .Values.workers.kubernetes.kerberosInitContainer.enabled .Values.workers.kerberosInitContainer.enabled }}
{{- if or .Values.workers.kubernetes.kerberosSidecar.enabled .Values.workers.kerberosSidecar.enabled .Values.workers.kubernetes.kerberosInitContainer.enabled .Values.workers.kerberosInitContainer.enabled }}
- name: KRB5_CONFIG
value: {{ .Values.kerberos.configPath | quote }}
- name: KRB5CCNAME
Expand Down Expand Up @@ -161,7 +161,7 @@ spec:
mountPath: {{ .Values.kerberos.ccacheMountPath | quote }}
readOnly: true
{{- end }}
{{- if .Values.workers.kerberosSidecar.enabled }}
{{- if or .Values.workers.kubernetes.kerberosSidecar.enabled .Values.workers.kerberosSidecar.enabled }}
- name: worker-kerberos
image: {{ template "airflow_image" . }}
imagePullPolicy: {{ .Values.images.airflow.pullPolicy }}
Expand All @@ -170,7 +170,7 @@ spec:
lifecycle: {{- tpl (toYaml $containerLifecycleHooksKerberosSidecar) . | nindent 8 }}
{{- end }}
args: ["kerberos"]
resources: {{- toYaml .Values.workers.kerberosSidecar.resources | nindent 8 }}
resources: {{- toYaml (.Values.workers.kubernetes.kerberosSidecar.resources | default .Values.workers.kerberosSidecar.resources) | nindent 8 }}
volumeMounts:
- name: logs
mountPath: {{ template "airflow_logs" . }}
Expand Down Expand Up @@ -261,13 +261,13 @@ spec:
name: {{ include "airflow_config" . }}
name: config
{{- if semverCompare ">=3.0.0" .Values.airflowVersion }}
{{- if and (or .Values.apiServer.apiServerConfig .Values.apiServer.apiServerConfigConfigMapName) (or .Values.workers.kubernetes.kerberosInitContainer.enabled .Values.workers.kerberosInitContainer.enabled .Values.workers.kerberosSidecar.enabled) }}
{{- if and (or .Values.apiServer.apiServerConfig .Values.apiServer.apiServerConfigConfigMapName) (or .Values.workers.kubernetes.kerberosInitContainer.enabled .Values.workers.kerberosInitContainer.enabled .Values.workers.kubernetes.kerberosSidecar.enabled .Values.workers.kerberosSidecar.enabled) }}
- name: api-server-config
configMap:
name: {{ template "airflow_api_server_config_configmap_name" . }}
{{- end }}
{{- else }}
{{- if and (or .Values.webserver.webserverConfig .Values.webserver.webserverConfigConfigMapName) (or .Values.workers.kubernetes.kerberosInitContainer.enabled .Values.workers.kerberosInitContainer.enabled .Values.workers.kerberosSidecar.enabled) }}
{{- if and (or .Values.webserver.webserverConfig .Values.webserver.webserverConfigConfigMapName) (or .Values.workers.kubernetes.kerberosInitContainer.enabled .Values.workers.kerberosInitContainer.enabled .Values.workers.kubernetes.kerberosSidecar.enabled .Values.workers.kerberosSidecar.enabled) }}
- name: webserver-config
configMap:
name: {{ template "airflow_webserver_config_configmap_name" . }}
Expand Down
13 changes: 6 additions & 7 deletions chart/templates/_helpers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -646,7 +646,6 @@ server_tls_key_file = /etc/pgbouncer/server.key
{{- include "_serviceAccountName" (merge (dict "key" "webserver") .) -}}
{{- end }}


{{/* Create the name of the API server service account to use */}}
{{- define "apiServer.serviceAccountName" -}}
{{- include "_serviceAccountName" (merge (dict "key" "apiServer" "nameSuffix" "api-server" ) .) -}}
Expand Down Expand Up @@ -902,9 +901,9 @@ Where `.` is the global variables scope and `.Values.workers` the local variable
Set the default value for container securityContext
If no value is passed for securityContexts.container or <node>.securityContexts.container, defaults to deny privileges escallation and dropping all POSIX capabilities.

+-----------------------------------+ +----------------------------+ +-----------------------------------------------------------+
| <node>.securityContexts.container | -> | securityContexts.containers | -> | allowPrivilegesEscalation: false, capabilities.drop: [ALL]|
+-----------------------------------+ +----------------------------+ +-----------------------------------------------------------+
+-----------------------------------+ +-----------------------------+ +------------------------------------------------------------+
| <node>.securityContexts.container | -> | securityContexts.containers | -> | allowPrivilegesEscalation: false, capabilities.drop: [ALL] |
+-----------------------------------+ +-----------------------------+ +------------------------------------------------------------+

The template can be called like so:
include "containerSecurityContext" (list .Values.webserver .Values)
Expand Down Expand Up @@ -937,9 +936,9 @@ capabilities:
Set the default value for external container securityContext(redis and statsd).
If no value is passed for <node>.securityContexts.container, defaults to deny privileges escallation and dropping all POSIX capabilities.

+-----------------------------------+ +-----------------------------------------------------------+
| <node>.securityContexts.container | -> | allowPrivilegesEscalation: false, capabilities.drop: [ALL]|
+-----------------------------------+ +-----------------------------------------------------------+
+-----------------------------------+ +------------------------------------------------------------+
| <node>.securityContexts.container | -> | allowPrivilegesEscalation: false, capabilities.drop: [ALL] |
+-----------------------------------+ +------------------------------------------------------------+

The template can be called like so:
include "externalContainerSecurityContext" .Values.statsd
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/workers/worker-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
#################################
{{- $globals := deepCopy . -}}
{{- $filteredCelery := include "removeNilFields" .Values.workers.celery | fromYaml -}}
{{- $mergedWorkers := (include "workersMergeValues" (list .Values.workers $filteredCelery "" (list "kerberosInitContainer")) | fromYaml) -}}
{{- $mergedWorkers := (include "workersMergeValues" (list .Values.workers $filteredCelery "" (list "kerberosInitContainer" "kerberosSidecar")) | fromYaml) -}}
{{- $_ := unset $mergedWorkers "celery" -}}
{{- $workerSets := .Values.workers.celery.sets | default list -}}
{{- if .Values.workers.celery.enableDefault -}}
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/workers/worker-hpa.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
#################################
{{- $globals := deepCopy . -}}
{{- $filteredCelery := include "removeNilFields" .Values.workers.celery | fromYaml -}}
{{- $mergedWorkers := (include "workersMergeValues" (list .Values.workers $filteredCelery "" (list "kerberosInitContainer")) | fromYaml) -}}
{{- $mergedWorkers := (include "workersMergeValues" (list .Values.workers $filteredCelery "" (list "kerberosInitContainer" "kerberosSidecar")) | fromYaml) -}}
{{- $_ := unset $mergedWorkers "celery" -}}
{{- $workerSets := .Values.workers.celery.sets | default list -}}
{{- if .Values.workers.celery.enableDefault -}}
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/workers/worker-kedaautoscaler.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
#################################
{{- $globals := deepCopy . -}}
{{- $filteredCelery := include "removeNilFields" .Values.workers.celery | fromYaml -}}
{{- $mergedWorkers := (include "workersMergeValues" (list .Values.workers $filteredCelery "" (list "kerberosInitContainer")) | fromYaml) -}}
{{- $mergedWorkers := (include "workersMergeValues" (list .Values.workers $filteredCelery "" (list "kerberosInitContainer" "kerberosSidecar")) | fromYaml) -}}
{{- $_ := unset $mergedWorkers "celery" -}}
{{- $workerSets := .Values.workers.celery.sets | default list -}}
{{- if .Values.workers.celery.enableDefault -}}
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/workers/worker-networkpolicy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
#################################
{{- $globals := deepCopy . -}}
{{- $filteredCelery := include "removeNilFields" .Values.workers.celery | fromYaml -}}
{{- $mergedWorkers := (include "workersMergeValues" (list .Values.workers $filteredCelery "" (list "kerberosInitContainer")) | fromYaml) -}}
{{- $mergedWorkers := (include "workersMergeValues" (list .Values.workers $filteredCelery "" (list "kerberosInitContainer" "kerberosSidecar")) | fromYaml) -}}
{{- $_ := unset $mergedWorkers "celery" -}}
{{- $workerSets := .Values.workers.celery.sets | default list -}}
{{- if .Values.workers.celery.enableDefault -}}
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/workers/worker-poddisruptionbudget.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
#################################
{{- $globals := deepCopy . -}}
{{- $filteredCelery := include "removeNilFields" .Values.workers.celery | fromYaml -}}
{{- $mergedWorkers := (include "workersMergeValues" (list .Values.workers $filteredCelery "" (list "kerberosInitContainer")) | fromYaml) -}}
{{- $mergedWorkers := (include "workersMergeValues" (list .Values.workers $filteredCelery "" (list "kerberosInitContainer" "kerberosSidecar")) | fromYaml) -}}
{{- $_ := unset $mergedWorkers "celery" -}}
{{- $workerSets := .Values.workers.celery.sets | default list -}}
{{- if .Values.workers.celery.enableDefault -}}
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/workers/worker-service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
#################################
{{- $globals := deepCopy . -}}
{{- $filteredCelery := include "removeNilFields" .Values.workers.celery | fromYaml -}}
{{- $mergedWorkers := (include "workersMergeValues" (list .Values.workers $filteredCelery "" (list "kerberosInitContainer")) | fromYaml) -}}
{{- $mergedWorkers := (include "workersMergeValues" (list .Values.workers $filteredCelery "" (list "kerberosInitContainer" "kerberosSidecar")) | fromYaml) -}}
{{- $_ := unset $mergedWorkers "celery" -}}
{{- $workerSets := .Values.workers.celery.sets | default list -}}
{{- if .Values.workers.celery.enableDefault -}}
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/workers/worker-serviceaccount.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
#################################
{{- $globals := deepCopy . -}}
{{- $filteredCelery := include "removeNilFields" .Values.workers.celery | fromYaml -}}
{{- $mergedWorkers := (include "workersMergeValues" (list .Values.workers $filteredCelery "" (list "kerberosInitContainer")) | fromYaml) -}}
{{- $mergedWorkers := (include "workersMergeValues" (list .Values.workers $filteredCelery "" (list "kerberosInitContainer" "kerberosSidecar")) | fromYaml) -}}
{{- $_ := unset $mergedWorkers "celery" -}}
{{- $workerSets := .Values.workers.celery.sets | default list -}}
{{- if .Values.workers.celery.enableDefault -}}
Expand Down
Loading
Loading