From 1e8107e35cdcee2790281b0d8daa88407de6b1c7 Mon Sep 17 00:00:00 2001 From: Paul Kagiri Date: Fri, 8 May 2026 17:32:14 +0300 Subject: [PATCH 1/2] Fix Kubernetes worker service account values --- .../pod-template-file.kubernetes-helm-yaml | 2 +- .../workers/worker-serviceaccount.yaml | 3 +- .../airflow_aux/test_pod_template_file.py | 19 +++++++++ .../helm_tests/airflow_core/test_worker.py | 42 +++++++++++++------ 4 files changed, 52 insertions(+), 14 deletions(-) diff --git a/chart/files/pod-template-file.kubernetes-helm-yaml b/chart/files/pod-template-file.kubernetes-helm-yaml index 33da1d48eb972..bbb764937d7f5 100644 --- a/chart/files/pod-template-file.kubernetes-helm-yaml +++ b/chart/files/pod-template-file.kubernetes-helm-yaml @@ -224,7 +224,7 @@ spec: terminationGracePeriodSeconds: {{ .Values.workers.kubernetes.terminationGracePeriodSeconds | default .Values.workers.terminationGracePeriodSeconds }} tolerations: {{- toYaml $tolerations | nindent 4 }} topologySpreadConstraints: {{- toYaml $topologySpreadConstraints | nindent 4 }} - {{- if .Values.workers.kubernetes.serviceAccount.create }} + {{- if has .Values.workers.kubernetes.serviceAccount.create (list true false) }} serviceAccountName: {{ include "worker.kubernetes.serviceAccountName" . }} {{- else }} serviceAccountName: {{ include "worker.serviceAccountName" . }} diff --git a/chart/templates/workers/worker-serviceaccount.yaml b/chart/templates/workers/worker-serviceaccount.yaml index cbcf95381e834..a3da9f639cec5 100644 --- a/chart/templates/workers/worker-serviceaccount.yaml +++ b/chart/templates/workers/worker-serviceaccount.yaml @@ -32,7 +32,8 @@ {{- $workers := (include "workersMergeValues" (list $mergedWorkers $workerSet "" list) | fromYaml) -}} {{- $_ := set $globals.Values "workers" $workers -}} {{- with $globals -}} -{{- if and .Values.workers.serviceAccount.create (include "airflow.podLaunchingExecutor" .) }} +{{- $useKubernetesServiceAccount := and (contains "KubernetesExecutor" .Values.executor) (has .Values.workers.kubernetes.serviceAccount.create (list true false)) -}} +{{- if and .Values.workers.serviceAccount.create (include "airflow.podLaunchingExecutor" .) (or (contains "CeleryExecutor" .Values.executor) (not $useKubernetesServiceAccount)) }} --- apiVersion: v1 kind: ServiceAccount diff --git a/chart/tests/helm_tests/airflow_aux/test_pod_template_file.py b/chart/tests/helm_tests/airflow_aux/test_pod_template_file.py index b65ef577d4596..579235cf7bfe8 100644 --- a/chart/tests/helm_tests/airflow_aux/test_pod_template_file.py +++ b/chart/tests/helm_tests/airflow_aux/test_pod_template_file.py @@ -2107,3 +2107,22 @@ def test_dedicated_service_account_name_default(self): ) assert jmespath.search("spec.serviceAccountName", docs[0]) == "test-release-airflow-worker-kubernetes" + + def test_dedicated_service_account_name_when_creation_disabled(self): + docs = render_chart( + name="test-release", + values={ + "workers": { + "kubernetes": { + "serviceAccount": { + "create": False, + "name": "airflow", + } + } + } + }, + show_only=["templates/pod-template-file.yaml"], + chart_dir=self.temp_chart_dir, + ) + + assert jmespath.search("spec.serviceAccountName", docs[0]) == "airflow" diff --git a/chart/tests/helm_tests/airflow_core/test_worker.py b/chart/tests/helm_tests/airflow_core/test_worker.py index e9997e9be89ac..291414edab4ad 100644 --- a/chart/tests/helm_tests/airflow_core/test_worker.py +++ b/chart/tests/helm_tests/airflow_core/test_worker.py @@ -263,9 +263,9 @@ def test_logs_mount_on_wait_for_migrations_initcontainer(self, logs_values, expe "spec.template.spec.initContainers[?name=='wait-for-airflow-migrations'] | [0].volumeMounts", docs[0], ) - assert mounts is not None, ( - "wait-for-airflow-migrations initContainer not found or has no volumeMounts" - ) + assert ( + mounts is not None + ), "wait-for-airflow-migrations initContainer not found or has no volumeMounts" assert any(m.get("name") == "logs" and m.get("mountPath") == "/opt/airflow/logs" for m in mounts) if expect_sub_path is not None: assert any( @@ -2007,9 +2007,9 @@ def test_should_add_extra_volume_claim_templates_with_logs_persistence_enabled(s (t for t in volume_claim_templates if t.get("metadata", {}).get("name") == "logs"), None, ) - assert logs_template is None, ( - "Logs should not be in volumeClaimTemplates when logs.persistence.enabled is true" - ) + assert ( + logs_template is None + ), "Logs should not be in volumeClaimTemplates when logs.persistence.enabled is true" @pytest.mark.parametrize( ( @@ -2102,9 +2102,9 @@ def test_volume_claim_templates_conditional_logic( (t for t in volume_claim_templates if t.get("metadata", {}).get("name") == "logs"), None, ) - assert logs_template is not None, ( - "Logs should be in volumeClaimTemplates when logs.persistence.enabled is false" - ) + assert ( + logs_template is not None + ), "Logs should be in volumeClaimTemplates when logs.persistence.enabled is false" # If custom templates provided, they should be in volumeClaimTemplates if custom_templates: @@ -2118,9 +2118,9 @@ def test_volume_claim_templates_conditional_logic( ), None, ) - assert found_template is not None, ( - f"Custom template '{template_name}' should be in volumeClaimTemplates" - ) + assert ( + found_template is not None + ), f"Custom template '{template_name}' should be in volumeClaimTemplates" else: assert volume_claim_templates is None or len(volume_claim_templates) == 0 @@ -2982,6 +2982,24 @@ def test_should_create_service_account_when_enabled(self): assert len(docs) == 1 + def test_should_not_create_legacy_service_account_when_k8s_service_account_disabled(self): + docs = render_chart( + values={ + "executor": "KubernetesExecutor", + "workers": { + "kubernetes": { + "serviceAccount": { + "create": False, + "name": "airflow", + } + } + }, + }, + show_only=["templates/workers/worker-serviceaccount.yaml"], + ) + + assert len(docs) == 0 + @pytest.mark.parametrize( "executor", [ From 7c41d7c0d8b08d4a5f74a90b284f6b48322f986f Mon Sep 17 00:00:00 2001 From: Jens Scheffler Date: Sun, 10 May 2026 17:27:08 +0200 Subject: [PATCH 2/2] Fix static checks --- .../helm_tests/airflow_core/test_worker.py | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/chart/tests/helm_tests/airflow_core/test_worker.py b/chart/tests/helm_tests/airflow_core/test_worker.py index 291414edab4ad..1e561d2029d16 100644 --- a/chart/tests/helm_tests/airflow_core/test_worker.py +++ b/chart/tests/helm_tests/airflow_core/test_worker.py @@ -263,9 +263,9 @@ def test_logs_mount_on_wait_for_migrations_initcontainer(self, logs_values, expe "spec.template.spec.initContainers[?name=='wait-for-airflow-migrations'] | [0].volumeMounts", docs[0], ) - assert ( - mounts is not None - ), "wait-for-airflow-migrations initContainer not found or has no volumeMounts" + assert mounts is not None, ( + "wait-for-airflow-migrations initContainer not found or has no volumeMounts" + ) assert any(m.get("name") == "logs" and m.get("mountPath") == "/opt/airflow/logs" for m in mounts) if expect_sub_path is not None: assert any( @@ -2007,9 +2007,9 @@ def test_should_add_extra_volume_claim_templates_with_logs_persistence_enabled(s (t for t in volume_claim_templates if t.get("metadata", {}).get("name") == "logs"), None, ) - assert ( - logs_template is None - ), "Logs should not be in volumeClaimTemplates when logs.persistence.enabled is true" + assert logs_template is None, ( + "Logs should not be in volumeClaimTemplates when logs.persistence.enabled is true" + ) @pytest.mark.parametrize( ( @@ -2102,9 +2102,9 @@ def test_volume_claim_templates_conditional_logic( (t for t in volume_claim_templates if t.get("metadata", {}).get("name") == "logs"), None, ) - assert ( - logs_template is not None - ), "Logs should be in volumeClaimTemplates when logs.persistence.enabled is false" + assert logs_template is not None, ( + "Logs should be in volumeClaimTemplates when logs.persistence.enabled is false" + ) # If custom templates provided, they should be in volumeClaimTemplates if custom_templates: @@ -2118,9 +2118,9 @@ def test_volume_claim_templates_conditional_logic( ), None, ) - assert ( - found_template is not None - ), f"Custom template '{template_name}' should be in volumeClaimTemplates" + assert found_template is not None, ( + f"Custom template '{template_name}' should be in volumeClaimTemplates" + ) else: assert volume_claim_templates is None or len(volume_claim_templates) == 0