Skip to content

Commit 23d955d

Browse files
MiretplMiretpl
authored
Separate workers service accounts (#52357)
* Seperate workers service accounts for kubernetes and celery workers * Add tests for new values * Add better description of some fields
1 parent 72cfa64 commit 23d955d

14 files changed

Lines changed: 613 additions & 35 deletions

‎chart/files/pod-template-file.kubernetes-helm-yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,7 +211,11 @@ spec:
211211
terminationGracePeriodSeconds: {{ .Values.workers.terminationGracePeriodSeconds }}
212212
tolerations: {{- toYaml $tolerations | nindent 4 }}
213213
topologySpreadConstraints: {{- toYaml $topologySpreadConstraints | nindent 4 }}
214+
{{- if .Values.workers.useWorkerDedicatedServiceAccounts }}
215+
serviceAccountName: {{ include "worker.kubernetes.serviceAccountName" . }}
216+
{{- else }}
214217
serviceAccountName: {{ include "worker.serviceAccountName" . }}
218+
{{- end }}
215219
volumes:
216220
{{- if .Values.dags.persistence.enabled }}
217221
- name: dags

‎chart/templates/_helpers.yaml‎

Lines changed: 25 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -636,13 +636,23 @@ server_tls_key_file = /etc/pgbouncer/server.key
636636
{{- end }}
637637
{{- end }}
638638

639-
{{/* Helper to generate service account name respecting .Values.$section.serviceAccount flags */}}
639+
{{/* Helper for service account name generation */}}
640+
{{- define "_serviceAccountNameGen" -}}
641+
{{- if .sa.create }}
642+
{{- default (printf "%s-%s" (include "airflow.serviceAccountName" .) (default .key .nameSuffix )) .sa.name | quote }}
643+
{{- else }}
644+
{{- default "default" .sa.name | quote }}
645+
{{- end }}
646+
{{- end }}
647+
648+
{{/* Helper to generate service account name respecting .Values.$section.serviceAccount or .Values.$section.$subSection.serviceAccount flags */}}
640649
{{- define "_serviceAccountName" -}}
641-
{{- $sa := get (get .Values .key) "serviceAccount" }}
642-
{{- if $sa.create }}
643-
{{- default (printf "%s-%s" (include "airflow.serviceAccountName" .) (default .key .nameSuffix )) $sa.name | quote }}
650+
{{- if .subKey }}
651+
{{- $sa := get (get (get .Values .key) .subKey) "serviceAccount" -}}
652+
{{- include "_serviceAccountNameGen" (merge (dict "sa" $sa "key" .key "nameSuffix" .nameSuffix) .) }}
644653
{{- else }}
645-
{{- default "default" $sa.name | quote }}
654+
{{- $sa := get (get .Values .key) "serviceAccount" }}
655+
{{- include "_serviceAccountNameGen" (merge (dict "sa" $sa "key" .key "nameSuffix" .nameSuffix) .) }}
646656
{{- end }}
647657
{{- end }}
648658

@@ -692,6 +702,16 @@ server_tls_key_file = /etc/pgbouncer/server.key
692702
{{- include "_serviceAccountName" (merge (dict "key" "workers" "nameSuffix" "worker") .) -}}
693703
{{- end }}
694704

705+
{{/* Create the name of the worker celery service account to use */}}
706+
{{- define "worker.celery.serviceAccountName" -}}
707+
{{- include "_serviceAccountName" (merge (dict "key" "workers" "subKey" "celery" "nameSuffix" "worker-celery") .) -}}
708+
{{- end }}
709+
710+
{{/* Create the name of the worker kubernetes service account to use */}}
711+
{{- define "worker.kubernetes.serviceAccountName" -}}
712+
{{- include "_serviceAccountName" (merge (dict "key" "workers" "subKey" "kubernetes" "nameSuffix" "worker-kubernetes") .) -}}
713+
{{- end }}
714+
695715
{{/* Create the name of the triggerer service account to use */}}
696716
{{- define "triggerer.serviceAccountName" -}}
697717
{{- include "_serviceAccountName" (merge (dict "key" "triggerer") .) -}}

‎chart/templates/rbac/pod-launcher-rolebinding.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,12 +68,22 @@ subjects:
6868
{{- end }}
6969
{{- end }}
7070
{{- $workerAdded := false }}
71+
{{- $workersDedicatedSA := .Values.workers.useWorkerDedicatedServiceAccounts -}}
7172
{{- range $executor := $executors }}
7273
{{- if and (has $executor $workerLaunchExecutors) (not $workerAdded) }}
7374
{{- $workerAdded = true }}
75+
{{- if $workersDedicatedSA }}
76+
- kind: ServiceAccount
77+
name: {{ include "worker.celery.serviceAccountName" $ }}
78+
namespace: "{{ $.Release.Namespace }}"
79+
- kind: ServiceAccount
80+
name: {{ include "worker.kubernetes.serviceAccountName" $ }}
81+
namespace: "{{ $.Release.Namespace }}"
82+
{{- else }}
7483
- kind: ServiceAccount
7584
name: {{ include "worker.serviceAccountName" $ }}
7685
namespace: "{{ $.Release.Namespace }}"
7786
{{- end }}
7887
{{- end }}
88+
{{- end }}
7989
{{- end }}

‎chart/templates/rbac/security-context-constraint-rolebinding.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,10 +55,19 @@ subjects:
5555
name: {{ include "webserver.serviceAccountName" . }}
5656
namespace: "{{ .Release.Namespace }}"
5757
{{- if $hasWorkers }}
58+
{{- if .Values.workers.useWorkerDedicatedServiceAccounts }}
59+
- kind: ServiceAccount
60+
name: {{ include "worker.celery.serviceAccountName" . }}
61+
namespace: "{{ .Release.Namespace }}"
62+
- kind: ServiceAccount
63+
name: {{ include "worker.kubernetes.serviceAccountName" . }}
64+
namespace: "{{ .Release.Namespace }}"
65+
{{- else }}
5866
- kind: ServiceAccount
5967
name: {{ include "worker.serviceAccountName" . }}
6068
namespace: "{{ .Release.Namespace }}"
6169
{{- end }}
70+
{{- end }}
6271
- kind: ServiceAccount
6372
name: {{ include "scheduler.serviceAccountName" . }}
6473
namespace: "{{ .Release.Namespace }}"

‎chart/templates/workers/worker-celery-serviceaccount.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{{/*
2+
Licensed to the Apache Software Foundation (ASF) under one
3+
or more contributor license agreements. See the NOTICE file
4+
distributed with this work for additional information
5+
regarding copyright ownership. The ASF licenses this file
6+
to you under the Apache License, Version 2.0 (the
7+
"License"); you may not use this file except in compliance
8+
with the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing,
13+
software distributed under the License is distributed on an
14+
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
KIND, either express or implied. See the License for the
16+
specific language governing permissions and limitations
17+
under the License.
18+
*/}}
19+
20+
#######################################
21+
## Airflow Worker Celery ServiceAccount
22+
#######################################
23+
{{- if and .Values.workers.celery.serviceAccount.create .Values.workers.useWorkerDedicatedServiceAccounts (or (contains "CeleryExecutor" .Values.executor) (contains "CeleryKubernetesExecutor" .Values.executor)) }}
24+
apiVersion: v1
25+
kind: ServiceAccount
26+
automountServiceAccountToken: {{ .Values.workers.celery.serviceAccount.automountServiceAccountToken }}
27+
metadata:
28+
name: {{ include "worker.celery.serviceAccountName" . }}
29+
labels:
30+
tier: airflow
31+
component: worker
32+
release: {{ .Release.Name }}
33+
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
34+
heritage: {{ .Release.Service }}
35+
{{- if or .Values.labels .Values.workers.labels .Values.workers.celery.labels }}
36+
{{- mustMerge .Values.workers.celery.labels .Values.workers.labels .Values.labels | toYaml | nindent 4 }}
37+
{{- end }}
38+
{{- with .Values.workers.celery.serviceAccount.annotations }}
39+
annotations: {{- toYaml . | nindent 4 }}
40+
{{- end }}
41+
{{- end }}

‎chart/templates/workers/worker-deployment.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,11 @@ spec:
135135
{{- end }}
136136
terminationGracePeriodSeconds: {{ .Values.workers.terminationGracePeriodSeconds }}
137137
restartPolicy: Always
138+
{{- if .Values.workers.useWorkerDedicatedServiceAccounts }}
139+
serviceAccountName: {{ include "worker.celery.serviceAccountName" . }}
140+
{{- else }}
138141
serviceAccountName: {{ include "worker.serviceAccountName" . }}
142+
{{- end }}
139143
securityContext: {{ $securityContext | nindent 8 }}
140144
{{- if or .Values.registry.secretName .Values.registry.connection }}
141145
imagePullSecrets:

‎chart/templates/workers/worker-kubernetes-serviceaccount.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{{/*
2+
Licensed to the Apache Software Foundation (ASF) under one
3+
or more contributor license agreements. See the NOTICE file
4+
distributed with this work for additional information
5+
regarding copyright ownership. The ASF licenses this file
6+
to you under the Apache License, Version 2.0 (the
7+
"License"); you may not use this file except in compliance
8+
with the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing,
13+
software distributed under the License is distributed on an
14+
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
KIND, either express or implied. See the License for the
16+
specific language governing permissions and limitations
17+
under the License.
18+
*/}}
19+
20+
###########################################
21+
## Airflow Worker Kubernetes ServiceAccount
22+
###########################################
23+
{{- if and .Values.workers.kubernetes.serviceAccount.create .Values.workers.useWorkerDedicatedServiceAccounts (or (contains "CeleryKubernetesExecutor" .Values.executor) (contains "KubernetesExecutor" .Values.executor) (contains "LocalKubernetesExecutor" .Values.executor)) }}
24+
apiVersion: v1
25+
kind: ServiceAccount
26+
automountServiceAccountToken: {{ .Values.workers.kubernetes.serviceAccount.automountServiceAccountToken }}
27+
metadata:
28+
name: {{ include "worker.kubernetes.serviceAccountName" . }}
29+
labels:
30+
tier: airflow
31+
component: worker
32+
release: {{ .Release.Name }}
33+
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
34+
heritage: {{ .Release.Service }}
35+
{{- if or .Values.labels .Values.workers.labels .Values.workers.kubernetes.labels }}
36+
{{- mustMerge .Values.workers.kubernetes.labels .Values.workers.labels .Values.labels | toYaml | nindent 4 }}
37+
{{- end }}
38+
{{- with .Values.workers.kubernetes.serviceAccount.annotations }}
39+
annotations: {{- toYaml . | nindent 4 }}
40+
{{- end }}
41+
{{- end }}

‎chart/templates/workers/worker-serviceaccount.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
################################
2121
## Airflow Worker ServiceAccount
2222
#################################
23-
{{- if and .Values.workers.serviceAccount.create (or (contains "CeleryExecutor" .Values.executor) (contains "CeleryKubernetesExecutor" .Values.executor) (contains "KubernetesExecutor" .Values.executor) (contains "LocalKubernetesExecutor" .Values.executor)) }}
23+
{{- if and .Values.workers.serviceAccount.create (not .Values.workers.useWorkerDedicatedServiceAccounts) (or (contains "CeleryExecutor" .Values.executor) (contains "CeleryKubernetesExecutor" .Values.executor) (contains "KubernetesExecutor" .Values.executor) (contains "LocalKubernetesExecutor" .Values.executor)) }}
2424
apiVersion: v1
2525
kind: ServiceAccount
2626
automountServiceAccountToken: {{ .Values.workers.serviceAccount.automountServiceAccountToken }}

‎chart/values.schema.json‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2530,6 +2530,89 @@
25302530
}
25312531
}
25322532
]
2533+
},
2534+
"useWorkerDedicatedServiceAccounts": {
2535+
"description": "One common Service Account for all workers will be created if flag is set to false. If true, dedicated Service Accounts for every worker type will be created.",
2536+
"type": "boolean",
2537+
"default": false
2538+
},
2539+
"celery": {
2540+
"description": "Airflow Celery Workers configuration.",
2541+
"type": "object",
2542+
"x-docsSection": "Workers",
2543+
"properties": {
2544+
"serviceAccount": {
2545+
"description": "Create ServiceAccount.",
2546+
"type": "object",
2547+
"properties": {
2548+
"automountServiceAccountToken": {
2549+
"description": "Specifies if ServiceAccount's API credentials should be mounted onto Pods.",
2550+
"type": "boolean",
2551+
"default": true
2552+
},
2553+
"create": {
2554+
"description": "Specifies whether a ServiceAccount should be created.",
2555+
"type": "boolean",
2556+
"default": true
2557+
},
2558+
"name": {
2559+
"description": "The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.",
2560+
"type": [
2561+
"string",
2562+
"null"
2563+
],
2564+
"default": null
2565+
},
2566+
"annotations": {
2567+
"description": "Annotations to add to the Airflow Celery worker Kubernetes ServiceAccount.",
2568+
"type": "object",
2569+
"default": {},
2570+
"additionalProperties": {
2571+
"type": "string"
2572+
}
2573+
}
2574+
}
2575+
}
2576+
}
2577+
},
2578+
"kubernetes": {
2579+
"description": "Airflow pod-template-file configuration.",
2580+
"type": "object",
2581+
"x-docsSection": "Workers",
2582+
"properties": {
2583+
"serviceAccount": {
2584+
"description": "Create ServiceAccount.",
2585+
"type": "object",
2586+
"properties": {
2587+
"automountServiceAccountToken": {
2588+
"description": "Specifies if ServiceAccount's API credentials should be mounted onto Pods.",
2589+
"type": "boolean",
2590+
"default": true
2591+
},
2592+
"create": {
2593+
"description": "Specifies whether a ServiceAccount should be created.",
2594+
"type": "boolean",
2595+
"default": true
2596+
},
2597+
"name": {
2598+
"description": "The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.",
2599+
"type": [
2600+
"string",
2601+
"null"
2602+
],
2603+
"default": null
2604+
},
2605+
"annotations": {
2606+
"description": "Annotations to add to the worker Kubernetes ServiceAccount.",
2607+
"type": "object",
2608+
"default": {},
2609+
"additionalProperties": {
2610+
"type": "string"
2611+
}
2612+
}
2613+
}
2614+
}
2615+
}
25332616
}
25342617
}
25352618
},

‎chart/values.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -985,6 +985,38 @@ workers:
985985
# requests:
986986
# storage: "20Gi"
987987

988+
# One common Service Account for all workers will be created if flag is set to false.
989+
# If true, dedicated Service Accounts for every worker type will be created.
990+
useWorkerDedicatedServiceAccounts: false
991+
992+
celery:
993+
# Create ServiceAccount for Airflow Celery workers
994+
serviceAccount:
995+
# default value is true
996+
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
997+
automountServiceAccountToken: true
998+
# Specifies whether a ServiceAccount should be created
999+
create: true
1000+
# The name of the ServiceAccount to use.
1001+
# If not set and create is true, a name is generated using the release name
1002+
name: ~
1003+
# Annotations to add to worker kubernetes service account.
1004+
annotations: {}
1005+
1006+
kubernetes:
1007+
# Create ServiceAccount for pods created with pod-template-file
1008+
serviceAccount:
1009+
# Auto mount service account token into the pod. Default value is true.
1010+
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
1011+
automountServiceAccountToken: true
1012+
# Specifies whether a ServiceAccount should be created
1013+
create: true
1014+
# The name of the ServiceAccount to use.
1015+
# If not set and create is true, a name is generated using the release name.
1016+
name: ~
1017+
# Annotations to add to worker kubernetes service account
1018+
annotations: {}
1019+
9881020
# Airflow scheduler settings
9891021
scheduler:
9901022
enabled: true

0 commit comments

Comments
 (0)