Skip to content

Remove JWT secrets from triggerer, worker and dag-processor #63204

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jscheffl merged 3 commits into from
Mar 15, 2026
Merged

Remove JWT secrets from triggerer, worker and dag-processor #63204

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e3b3193
Add missing checksum/jwt-secret annotation to dag-processor, triggere…
deepujain Mar 9, 2026
7d6a5e8
Only inject JWT secret into api-server and scheduler; update test exp…
deepujain Mar 11, 2026
5422c54
Do not inject JWT secret into wait-for-migrations init container (api…
deepujain Mar 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion chart/templates/_helpers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,7 @@ If release name contains chart name it will be used as a full name.
name: {{ template "api_secret_key_secret" . }}
key: api-secret-key
{{- end }}
{{- if and (semverCompare ">=3.0.0" .Values.airflowVersion) .Values.enableBuiltInSecretEnvVars.AIRFLOW__API_AUTH__JWT_SECRET }}
{{- if and .IncludeJwtSecret (semverCompare ">=3.0.0" .Values.airflowVersion) .Values.enableBuiltInSecretEnvVars.AIRFLOW__API_AUTH__JWT_SECRET }}
- name: AIRFLOW__API_AUTH__JWT_SECRET
valueFrom:
secretKeyRef:
Expand Down
4 changes: 2 additions & 2 deletions chart/templates/api-server/api-server-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,7 @@ spec:
envFrom: {{- include "custom_airflow_environment_from" . | default "\n []" | indent 10 }}
env:
{{- include "custom_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" (merge (dict "IncludeJwtSecret" false) .) | indent 10 }}
Comment thread
jscheffl marked this conversation as resolved.
{{- if .Values.apiServer.waitForMigrations.env }}
{{- tpl (toYaml .Values.apiServer.waitForMigrations.env) $ | nindent 12 }}
{{- end }}
Expand Down Expand Up @@ -221,7 +221,7 @@ spec:
envFrom: {{- include "custom_airflow_environment_from" . | default "\n []" | indent 10 }}
env:
{{- include "custom_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" (merge (dict "IncludeJwtSecret" true) .) | indent 10 }}
{{- include "container_extra_envs" (list . .Values.apiServer.env) | indent 10 }}
{{- if .Values.apiServer.extraContainers }}
{{- tpl (toYaml .Values.apiServer.extraContainers) . | nindent 8 }}
Expand Down
4 changes: 2 additions & 2 deletions chart/templates/dag-processor/dag-processor-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,7 @@ spec:
envFrom: {{- include "custom_airflow_environment_from" . | default "\n []" | indent 10 }}
env:
{{- include "custom_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" (merge (dict "IncludeJwtSecret" false) .) | indent 10 }}
{{- if .Values.dagProcessor.waitForMigrations.env }}
{{- tpl (toYaml .Values.dagProcessor.waitForMigrations.env) $ | nindent 12 }}
{{- end }}
Expand Down Expand Up @@ -180,7 +180,7 @@ spec:
envFrom: {{- include "custom_airflow_environment_from" . | default "\n []" | indent 10 }}
env:
{{- include "custom_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" (merge (dict "IncludeJwtSecret" false) .) | indent 10 }}
{{- include "container_extra_envs" (list . .Values.dagProcessor.env) | indent 10 }}
livenessProbe:
initialDelaySeconds: {{ .Values.dagProcessor.livenessProbe.initialDelaySeconds }}
Expand Down
4 changes: 2 additions & 2 deletions chart/templates/scheduler/scheduler-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,7 @@ spec:
envFrom: {{- include "custom_airflow_environment_from" . | default "\n []" | indent 10 }}
env:
{{- include "custom_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" (merge (dict "IncludeJwtSecret" false) .) | indent 10 }}
{{- if .Values.scheduler.waitForMigrations.env }}
{{- tpl (toYaml .Values.scheduler.waitForMigrations.env) $ | nindent 12 }}
{{- end }}
Expand Down Expand Up @@ -204,7 +204,7 @@ spec:
envFrom: {{- include "custom_airflow_environment_from" . | default "\n []" | indent 10 }}
env:
{{- include "custom_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" (merge (dict "IncludeJwtSecret" true) .) | indent 10 }}
{{- include "container_extra_envs" (list . .Values.scheduler.env) | indent 10 }}
livenessProbe:
initialDelaySeconds: {{ .Values.scheduler.livenessProbe.initialDelaySeconds }}
Expand Down
4 changes: 2 additions & 2 deletions chart/templates/triggerer/triggerer-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,7 +157,7 @@ spec:
envFrom: {{- include "custom_airflow_environment_from" . | default "\n []" | indent 10 }}
env:
{{- include "custom_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" (merge (dict "IncludeJwtSecret" false) .) | indent 10 }}
{{- if .Values.triggerer.waitForMigrations.env }}
{{- tpl (toYaml .Values.triggerer.waitForMigrations.env) $ | nindent 12 }}
{{- end }}
Expand Down Expand Up @@ -205,7 +205,7 @@ spec:
envFrom: {{- include "custom_airflow_environment_from" . | default "\n []" | indent 10 }}
env:
{{- include "custom_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" (merge (dict "IncludeJwtSecret" false) .) | indent 10 }}
{{- include "container_extra_envs" (list . .Values.triggerer.env) | nindent 10 }}
livenessProbe:
initialDelaySeconds: {{ .Values.triggerer.livenessProbe.initialDelaySeconds }}
Expand Down
8 changes: 4 additions & 4 deletions chart/templates/workers/worker-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -223,7 +223,7 @@ spec:
- name: KRB5CCNAME
value: {{ include "kerberos_ccache_path" . | quote }}
{{- include "custom_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" (merge (dict "IncludeJwtSecret" false) .) | indent 10 }}
{{- end }}
{{- if .Values.workers.waitForMigrations.enabled }}
- name: wait-for-airflow-migrations
Expand Down Expand Up @@ -251,7 +251,7 @@ spec:
envFrom: {{- include "custom_airflow_environment_from" . | default "\n []" | indent 10 }}
env:
{{- include "custom_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" (merge (dict "IncludeJwtSecret" false) .) | indent 10 }}
{{- if .Values.workers.waitForMigrations.env }}
{{- tpl (toYaml .Values.workers.waitForMigrations.env) $ | nindent 12 }}
{{- end }}
Expand Down Expand Up @@ -337,7 +337,7 @@ spec:
- name: DUMB_INIT_SETSID
value: "0"
{{- include "custom_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" (merge (dict "IncludeJwtSecret" false) .) | indent 10 }}
{{- include "container_extra_envs" (list . .Values.workers.env) | indent 10 }}
{{- if .Values.workers.kerberosSidecar.enabled }}
- name: KRB5_CONFIG
Expand Down Expand Up @@ -449,7 +449,7 @@ spec:
- name: KRB5CCNAME
value: {{ include "kerberos_ccache_path" . | quote }}
{{- include "custom_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" . | indent 10 }}
{{- include "standard_airflow_environment" (merge (dict "IncludeJwtSecret" false) .) | indent 10 }}
{{- end }}
{{- if .Values.workers.extraContainers }}
{{- tpl (toYaml .Values.workers.extraContainers) . | nindent 8 }}
Expand Down
17 changes: 14 additions & 3 deletions helm-tests/tests/helm_tests/airflow_aux/test_airflow_common.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -439,7 +439,9 @@ def test_have_all_variables(self):
"templates/dag-processor/dag-processor-deployment.yaml",
],
)
expected_vars = [
# JWT secret is only injected into scheduler (and api-server); not into workers,
# webserver, triggerer, dag-processor (security: no JWT where not needed).
expected_vars_with_jwt = [
"AIRFLOW__CORE__FERNET_KEY",
"AIRFLOW_HOME",
"AIRFLOW__DATABASE__SQL_ALCHEMY_CONN",
Expand All @@ -448,10 +450,19 @@ def test_have_all_variables(self):
"AIRFLOW__API_AUTH__JWT_SECRET",
"AIRFLOW__CELERY__BROKER_URL",
]
expected_vars_in_worker = ["DUMB_INIT_SETSID"] + expected_vars
expected_vars_no_jwt = [
"AIRFLOW__CORE__FERNET_KEY",
"AIRFLOW_HOME",
"AIRFLOW__DATABASE__SQL_ALCHEMY_CONN",
"AIRFLOW_CONN_AIRFLOW_DB",
"AIRFLOW__API__SECRET_KEY",
"AIRFLOW__CELERY__BROKER_URL",
]
for doc in docs:
component = doc["metadata"]["labels"]["component"]
variables = expected_vars_in_worker if component == "worker" else expected_vars
expected = expected_vars_with_jwt if component == "scheduler" else expected_vars_no_jwt
expected_in_worker = ["DUMB_INIT_SETSID"] + expected
variables = expected_in_worker if component == "worker" else expected
assert variables == jmespath.search("spec.template.spec.containers[0].env[*].name", doc), (
f"Wrong vars in {component}"
)
Expand Down
Loading