Skip to content

Add workers.celery.securityContexts & workers.kubernetes.securityContexts #60396

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jscheffl merged 10 commits into from
Jan 12, 2026
Merged

Add workers.celery.securityContexts & workers.kubernetes.securityContexts #60396

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
1b58ea2
Seperate security context tests per Airflow version
Miretpl Jan 11, 2026
f30c665
Add overwrite securityContext tests
Miretpl Jan 11, 2026
6542709
Rewrite airflowPodSecurityContext
Miretpl Jan 11, 2026
294db3e
Rewrite containerSecurityContext
Miretpl Jan 11, 2026
1023f5f
Combine persistence securityContext
Miretpl Jan 11, 2026
4ae2c6c
Misc
Miretpl Jan 11, 2026
2e64852
Add workers.celery.securityContexts & workers.kubernetes.securityCont…
Miretpl Jan 11, 2026
c0b9773
Misc
Miretpl Jan 11, 2026
5ce46d8
Add clarifing comments
Miretpl Jan 11, 2026
72b77c4
Add docsSection for securityContexts
Miretpl Jan 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Rewrite airflowPodSecurityContext
  • Loading branch information
@Miretpl
Miretpl committed Jan 12, 2026
commit 6542709f073b792aff21228a9c2e0b20dfb0984f
2 changes: 1 addition & 1 deletion chart/files/pod-template-file.kubernetes-helm-yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
{{- $affinity := or .Values.workers.affinity .Values.affinity }}
{{- $tolerations := or .Values.workers.tolerations .Values.tolerations }}
{{- $topologySpreadConstraints := or .Values.workers.topologySpreadConstraints .Values.topologySpreadConstraints }}
{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.workers) }}
{{- $securityContext := include "airflowPodSecurityContext" (list .Values.workers .Values) }}
{{- $containerSecurityContextKerberosSidecar := include "containerSecurityContext" (list . .Values.workers.kerberosSidecar) }}
{{- $containerLifecycleHooksKerberosSidecar := or .Values.workers.kerberosSidecar.containerLifecycleHooks .Values.containerLifecycleHooks }}
{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.workers) }}
Expand Down
36 changes: 20 additions & 16 deletions chart/templates/_helpers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -941,26 +941,30 @@ Values are not accumulated meaning that if runAsUser is set to 10 in <node>.secu
any extra values set to securityContext or uid+gid will be ignored.

The template can be called like so:
include "airflowPodSecurityContext" (list . .Values.webserver)
include "airflowPodSecurityContext" (list .Values.webserver .Values)

Where `.` is the global variables scope and `.Values.webserver` the local variables scope for the webserver template.
Where `.Values` is the global variables scope and `.Values.webserver` the local variables scope for the webserver template.
Priority of values are from left to right, meaning if first value is not empty, the rest will not be evaluated.
*/}}
{{- define "airflowPodSecurityContext" -}}
{{- $ := index . 0 -}}
{{- with index . 1 }}
{{- if .securityContexts.pod -}}
{{ toYaml .securityContexts.pod | print }}
{{- else if .securityContext -}}
{{ toYaml .securityContext | print }}
{{- else if $.Values.securityContexts.pod -}}
{{ toYaml $.Values.securityContexts.pod | print }}
{{- else if $.Values.securityContext -}}
{{ toYaml $.Values.securityContext | print }}
{{- else -}}
runAsUser: {{ $.Values.uid }}
fsGroup: {{ $.Values.gid }}
{{- define "airflowPodSecurityContext" }}
{{- $ := last . }}
{{- $result := dict }}
{{- range . }}
{{- if and (hasKey . "securityContexts") (hasKey .securityContexts "pod") .securityContexts.pod }}
{{- $result = .securityContexts.pod }}
{{- break }}
{{- end }}
{{- if and (hasKey . "securityContext") .securityContext }}
{{- $result = .securityContext }}
{{- break }}
{{- end }}
{{- end }}
{{- if $result }}
{{- toYaml $result | print }}
{{- else }}
runAsUser: {{ $.uid }}
fsGroup: {{ $.gid }}
{{- end }}
{{- end }}

{{/*
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/api-server/api-server-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@
{{- $tolerations := or .Values.apiServer.tolerations .Values.tolerations }}
{{- $topologySpreadConstraints := or .Values.apiServer.topologySpreadConstraints .Values.topologySpreadConstraints }}
{{- $revisionHistoryLimit := include "airflow.revisionHistoryLimit" (list .Values.apiServer.revisionHistoryLimit .Values.revisionHistoryLimit) }}
{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.apiServer) }}
{{- $securityContext := include "airflowPodSecurityContext" (list .Values.apiServer .Values) }}
{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.apiServer) }}
{{- $containerSecurityContextWaitForMigrations := include "containerSecurityContext" (list . .Values.apiServer.waitForMigrations) }}
{{- $containerLifecycleHooks := or .Values.apiServer.containerLifecycleHooks .Values.containerLifecycleHooks }}
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/cleanup/cleanup-cronjob.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@
{{- $affinity := or .Values.cleanup.affinity .Values.affinity }}
{{- $tolerations := or .Values.cleanup.tolerations .Values.tolerations }}
{{- $topologySpreadConstraints := or .Values.cleanup.topologySpreadConstraints .Values.topologySpreadConstraints }}
{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.cleanup) }}
{{- $securityContext := include "airflowPodSecurityContext" (list .Values.cleanup .Values) }}
{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.cleanup) }}
apiVersion: batch/v1
kind: CronJob
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/dag-processor/dag-processor-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@
{{- $tolerations := or .Values.dagProcessor.tolerations .Values.tolerations }}
{{- $topologySpreadConstraints := or .Values.dagProcessor.topologySpreadConstraints .Values.topologySpreadConstraints }}
{{- $revisionHistoryLimit := include "airflow.revisionHistoryLimit" (list .Values.dagProcessor.revisionHistoryLimit .Values.revisionHistoryLimit) }}
{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.dagProcessor) }}
{{- $securityContext := include "airflowPodSecurityContext" (list .Values.dagProcessor .Values) }}
{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.dagProcessor) }}
{{- $containerSecurityContextLogGroomerSidecar := include "containerSecurityContext" (list . .Values.dagProcessor.logGroomerSidecar) }}
{{- $containerSecurityContextWaitForMigrations := include "containerSecurityContext" (list . .Values.dagProcessor.waitForMigrations) }}
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/database-cleanup/database-cleanup-cronjob.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@
{{- $affinity := or .Values.databaseCleanup.affinity .Values.affinity }}
{{- $tolerations := or .Values.databaseCleanup.tolerations .Values.tolerations }}
{{- $topologySpreadConstraints := or .Values.databaseCleanup.topologySpreadConstraints .Values.topologySpreadConstraints }}
{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.databaseCleanup) }}
{{- $securityContext := include "airflowPodSecurityContext" (list .Values.databaseCleanup .Values) }}
{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.databaseCleanup) }}
apiVersion: batch/v1
kind: CronJob
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/flower/flower-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
{{- $tolerations := or .Values.flower.tolerations .Values.tolerations }}
{{- $topologySpreadConstraints := or .Values.flower.topologySpreadConstraints .Values.topologySpreadConstraints }}
{{- $revisionHistoryLimit := include "airflow.revisionHistoryLimit" (list .Values.flower.revisionHistoryLimit .Values.revisionHistoryLimit) }}
{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.flower) }}
{{- $securityContext := include "airflowPodSecurityContext" (list .Values.flower .Values) }}
{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.flower) }}
{{- $containerLifecycleHooks := or .Values.flower.containerLifecycleHooks .Values.containerLifecycleHooks }}
apiVersion: apps/v1
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/jobs/create-user-job.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@
{{- $affinity := or .Values.createUserJob.affinity .Values.affinity }}
{{- $tolerations := or .Values.createUserJob.tolerations .Values.tolerations }}
{{- $topologySpreadConstraints := or .Values.createUserJob.topologySpreadConstraints .Values.topologySpreadConstraints }}
{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.createUserJob) }}
{{- $securityContext := include "airflowPodSecurityContext" (list .Values.createUserJob .Values) }}
{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.createUserJob) }}
{{- $containerLifecycleHooks := or .Values.createUserJob.containerLifecycleHooks .Values.containerLifecycleHooks }}
apiVersion: batch/v1
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/jobs/migrate-database-job.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@
{{- $affinity := or .Values.migrateDatabaseJob.affinity .Values.affinity }}
{{- $tolerations := or .Values.migrateDatabaseJob.tolerations .Values.tolerations }}
{{- $topologySpreadConstraints := or .Values.migrateDatabaseJob.topologySpreadConstraints .Values.topologySpreadConstraints }}
{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.migrateDatabaseJob) }}
{{- $securityContext := include "airflowPodSecurityContext" (list .Values.migrateDatabaseJob .Values) }}
{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.migrateDatabaseJob) }}
{{- $containerLifecycleHooks := or .Values.migrateDatabaseJob.containerLifecycleHooks .Values.containerLifecycleHooks }}
apiVersion: batch/v1
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/scheduler/scheduler-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@
{{- $tolerations := or .Values.scheduler.tolerations .Values.tolerations }}
{{- $topologySpreadConstraints := or .Values.scheduler.topologySpreadConstraints .Values.topologySpreadConstraints }}
{{- $revisionHistoryLimit := include "airflow.revisionHistoryLimit" (list .Values.scheduler.revisionHistoryLimit .Values.revisionHistoryLimit) }}
{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.scheduler) }}
{{- $securityContext := include "airflowPodSecurityContext" (list .Values.scheduler .Values) }}
{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.scheduler) }}
{{- $containerSecurityContextWaitForMigrations := include "containerSecurityContext" (list . .Values.scheduler.waitForMigrations) }}
{{- $containerSecurityContextLogGroomerSidecar := include "containerSecurityContext" (list . .Values.scheduler.logGroomerSidecar) }}
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/triggerer/triggerer-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
{{- $tolerations := or .Values.triggerer.tolerations .Values.tolerations }}
{{- $topologySpreadConstraints := or .Values.triggerer.topologySpreadConstraints .Values.topologySpreadConstraints }}
{{- $revisionHistoryLimit := include "airflow.revisionHistoryLimit" (list .Values.triggerer.revisionHistoryLimit .Values.revisionHistoryLimit) }}
{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.triggerer) }}
{{- $securityContext := include "airflowPodSecurityContext" (list .Values.triggerer .Values) }}
{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.triggerer) }}
{{- $containerSecurityContextWaitForMigrations := include "containerSecurityContext" (list . .Values.triggerer.waitForMigrations) }}
{{- $containerSecurityContextLogGroomer := include "containerSecurityContext" (list . .Values.triggerer.logGroomerSidecar) }}
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/webserver/webserver-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@
{{- $tolerations := or .Values.webserver.tolerations .Values.tolerations }}
{{- $topologySpreadConstraints := or .Values.webserver.topologySpreadConstraints .Values.topologySpreadConstraints }}
{{- $revisionHistoryLimit := include "airflow.revisionHistoryLimit" (list .Values.webserver.revisionHistoryLimit .Values.revisionHistoryLimit) }}
{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.webserver) }}
{{- $securityContext := include "airflowPodSecurityContext" (list .Values.webserver .Values) }}
{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.webserver) }}
{{- $containerSecurityContextWaitForMigrations := include "containerSecurityContext" (list . .Values.webserver.waitForMigrations) }}
{{- $containerLifecycleHooks := or .Values.webserver.containerLifecycleHooks .Values.containerLifecycleHooks }}
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/workers/worker-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@
{{- $tolerations := or .Values.workers.tolerations .Values.tolerations }}
{{- $topologySpreadConstraints := or .Values.workers.topologySpreadConstraints .Values.topologySpreadConstraints }}
{{- $revisionHistoryLimit := include "airflow.revisionHistoryLimit" (list .Values.workers.celery.revisionHistoryLimit .Values.workers.revisionHistoryLimit .Values.revisionHistoryLimit) }}
{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.workers) }}
{{- $securityContext := include "airflowPodSecurityContext" (list .Values.workers .Values) }}
{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.workers) }}
{{- $containerSecurityContextPersistence := include "containerSecurityContext" (list . .Values.workers.persistence) }}
{{- $containerSecurityContextCeleryPersistence := include "containerSecurityContext" (list . .Values.workers.celery.persistence) }}
Expand Down