Skip to content

Commit 4dbe9b2

Browse files
henry3260henry3260
authored
Add workers.celery.kerberosInitContainer field (#60427)
1 parent e70963e commit 4dbe9b2

5 files changed

Lines changed: 177 additions & 3 deletions

File tree

‎chart/templates/NOTES.txt‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,14 @@ DEPRECATION WARNING:
204204

205205
{{- end }}
206206

207+
{{- if not (empty .Values.workers.kerberosInitContainer) }}
208+
209+
DEPRECATION WARNING:
210+
`workers.kerberosInitContainer` has been renamed to `workers.celery.kerberosInitContainer`.
211+
Please change your values as support for the old name will be dropped in a future release.
212+
213+
{{- end }}
214+
207215
{{- if ne (.Values.workers.args | toJson) (list "bash" "-c" "exec \\\nairflow {{ semverCompare \">=2.0.0\" .Values.airflowVersion | ternary \"celery worker\" \"worker\" }}" | toJson) }}
208216

209217
DEPRECATION WARNING:

‎chart/templates/workers/worker-deployment.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -191,12 +191,14 @@ spec:
191191
subPath: {{ .Values.logs.persistence.subPath }}
192192
{{- end }}
193193
{{- end }}
194-
{{- if and (semverCompare ">=2.8.0" .Values.airflowVersion) .Values.workers.kerberosInitContainer.enabled }}
194+
{{- $kerberosInitContainerEnabled := or (.Values.workers.celery.kerberosInitContainer).enabled (.Values.workers.kerberosInitContainer).enabled }}
195+
{{- $kerberosInitContainerResources := (.Values.workers.celery.kerberosInitContainer).resources | default (.Values.workers.kerberosInitContainer).resources | default dict }}
196+
{{- if and (semverCompare ">=2.8.0" .Values.airflowVersion) $kerberosInitContainerEnabled }}
195197
- name: kerberos-init
196198
image: {{ template "airflow_image" . }}
197199
imagePullPolicy: {{ .Values.images.airflow.pullPolicy }}
198200
args: ["kerberos", "-o"]
199-
resources: {{- toYaml .Values.workers.kerberosInitContainer.resources | nindent 12 }}
201+
resources: {{- toYaml $kerberosInitContainerResources | nindent 12 }}
200202
volumeMounts:
201203
- name: logs
202204
mountPath: {{ template "airflow_logs" . }}

‎chart/values.schema.json‎

Lines changed: 84 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2171,7 +2171,7 @@
21712171
}
21722172
},
21732173
"kerberosInitContainer": {
2174-
"description": "Kerberos init container for Airflow Celery workers and pods created with pod-template-file.",
2174+
"description": "Kerberos init container for Airflow Celery workers and pods created with pod-template-file (deprecated, use `workers.celery.kerberosInitContainer` instead).",
21752175
"type": "object",
21762176
"additionalProperties": false,
21772177
"properties": {
@@ -2958,6 +2958,89 @@
29582958
}
29592959
}
29602960
}
2961+
},
2962+
"kerberosInitContainer": {
2963+
"description": "Kerberos init container for Airflow Celery workers.",
2964+
"type": "object",
2965+
"additionalProperties": false,
2966+
"properties": {
2967+
"enabled": {
2968+
"description": "Enable Kerberos init container.",
2969+
"type": "boolean",
2970+
"default": false
2971+
},
2972+
"resources": {
2973+
"description": "Resources on kerberos init container.",
2974+
"type": "object",
2975+
"default": {},
2976+
"examples": [
2977+
{
2978+
"limits": {
2979+
"cpu": "100m",
2980+
"memory": "128Mi"
2981+
},
2982+
"requests": {
2983+
"cpu": "100m",
2984+
"memory": "128Mi"
2985+
}
2986+
}
2987+
],
2988+
"$ref": "#/definitions/io.k8s.api.core.v1.ResourceRequirements"
2989+
},
2990+
"containerLifecycleHooks": {
2991+
"description": "Container Lifecycle Hooks definition for the kerberos init container. If not set, the values from global `containerLifecycleHooks` will be used.",
2992+
"type": "object",
2993+
"$ref": "#/definitions/io.k8s.api.core.v1.Lifecycle",
2994+
"default": {},
2995+
"x-docsSection": "Kubernetes",
2996+
"examples": [
2997+
{
2998+
"postStart": {
2999+
"exec": {
3000+
"command": [
3001+
"/bin/sh",
3002+
"-c",
3003+
"echo postStart handler > /usr/share/message"
3004+
]
3005+
}
3006+
},
3007+
"preStop": {
3008+
"exec": {
3009+
"command": [
3010+
"/bin/sh",
3011+
"-c",
3012+
"echo preStop handler > /usr/share/message"
3013+
]
3014+
}
3015+
}
3016+
}
3017+
]
3018+
},
3019+
"securityContexts": {
3020+
"description": "Security context definition for the kerberos init container. If not set, the values from global `securityContexts` will be used.",
3021+
"type": "object",
3022+
"x-docsSection": "Kubernetes",
3023+
"properties": {
3024+
"container": {
3025+
"description": "Container security context definition for the kerberos init container.",
3026+
"type": "object",
3027+
"$ref": "#/definitions/io.k8s.api.core.v1.SecurityContext",
3028+
"default": {},
3029+
"x-docsSection": "Kubernetes",
3030+
"examples": [
3031+
{
3032+
"allowPrivilegeEscalation": false,
3033+
"capabilities": {
3034+
"drop": [
3035+
"ALL"
3036+
]
3037+
}
3038+
}
3039+
]
3040+
}
3041+
}
3042+
}
3043+
}
29613044
}
29623045
}
29633046
},

‎chart/values.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -873,6 +873,7 @@ workers:
873873
containerLifecycleHooks: {}
874874

875875
# Kerberos init container configuration for Airflow Celery workers and pods created with pod-template-file
876+
# (deprecated, use `workers.celery.kerberosInitContainer` instead)
876877
kerberosInitContainer:
877878
# Enable kerberos init container
878879
enabled: false
@@ -1161,6 +1162,25 @@ workers:
11611162
securityContexts:
11621163
container: {}
11631164

1165+
# Kerberos init container configuration for Airflow Celery workers
1166+
kerberosInitContainer:
1167+
# Enable kerberos init container
1168+
enabled: false
1169+
resources: {}
1170+
# limits:
1171+
# cpu: 100m
1172+
# memory: 128Mi
1173+
# requests:
1174+
# cpu: 100m
1175+
# memory: 128Mi
1176+
1177+
# Detailed default security context for kerberos init container on container level
1178+
securityContexts:
1179+
container: {}
1180+
1181+
# Container level lifecycle hooks
1182+
containerLifecycleHooks: {}
1183+
11641184
kubernetes:
11651185
# Command to use in pod-template-file (templated)
11661186
command: ~

‎helm-tests/tests/helm_tests/airflow_core/test_worker.py‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -968,6 +968,67 @@ def test_airflow_kerberos_init_container(
968968
assert initContainers[1]["name"] == "kerberos-init"
969969
assert initContainers[1]["args"] == ["kerberos", "-o"]
970970

971+
@pytest.mark.parametrize(
972+
"workers_values",
973+
[
974+
{"kerberosInitContainer": {"enabled": True}},
975+
{"celery": {"kerberosInitContainer": {"enabled": True}}},
976+
{
977+
"kerberosInitContainer": {"enabled": False},
978+
"celery": {"kerberosInitContainer": {"enabled": True}},
979+
},
980+
],
981+
)
982+
def test_airflow_kerberos_init_container_celery_values(self, workers_values):
983+
"""Test that workers.celery.kerberosInitContainer configuration works and takes precedence."""
984+
docs = render_chart(
985+
values={
986+
"airflowVersion": "2.8.0",
987+
"workers": {
988+
**workers_values,
989+
"celery": {
990+
**workers_values.get("celery", {}),
991+
"persistence": {"fixPermissions": True},
992+
},
993+
},
994+
},
995+
show_only=["templates/workers/worker-deployment.yaml"],
996+
)
997+
998+
initContainers = jmespath.search("spec.template.spec.initContainers", docs[0])
999+
# Should have 3 init containers: wait-for-migrations, kerberos-init, volume-permissions
1000+
assert len(initContainers) == 3
1001+
assert initContainers[1]["name"] == "kerberos-init"
1002+
assert initContainers[1]["args"] == ["kerberos", "-o"]
1003+
1004+
def test_airflow_kerberos_init_container_resources(self):
1005+
"""Test that kerberos init container resources can be configured via workers.celery.kerberosInitContainer."""
1006+
docs = render_chart(
1007+
values={
1008+
"airflowVersion": "2.8.0",
1009+
"workers": {
1010+
"celery": {
1011+
"kerberosInitContainer": {
1012+
"enabled": True,
1013+
"resources": {
1014+
"limits": {"cpu": "100m", "memory": "128Mi"},
1015+
"requests": {"cpu": "50m", "memory": "64Mi"},
1016+
},
1017+
},
1018+
},
1019+
},
1020+
},
1021+
show_only=["templates/workers/worker-deployment.yaml"],
1022+
)
1023+
1024+
initContainers = jmespath.search("spec.template.spec.initContainers", docs[0])
1025+
kerberos_init = next((c for c in initContainers if c["name"] == "kerberos-init"), None)
1026+
assert kerberos_init is not None
1027+
assert kerberos_init["resources"]["limits"]["cpu"] == "100m"
1028+
assert kerberos_init["resources"]["limits"]["memory"] == "128Mi"
1029+
assert kerberos_init["resources"]["requests"]["cpu"] == "50m"
1030+
assert kerberos_init["resources"]["requests"]["memory"] == "64Mi"
1031+
9711032
@pytest.mark.parametrize(
9721033
("airflow_version", "expected_arg"),
9731034
[

0 commit comments

Comments
 (0)