diff --git a/chart/files/pod-template-file.kubernetes-helm-yaml b/chart/files/pod-template-file.kubernetes-helm-yaml index 26b1b8505d0c1..3c1ad7ee5859e 100644 --- a/chart/files/pod-template-file.kubernetes-helm-yaml +++ b/chart/files/pod-template-file.kubernetes-helm-yaml @@ -236,7 +236,7 @@ spec: terminationGracePeriodSeconds: {{ .Values.workers.kubernetes.terminationGracePeriodSeconds | default .Values.workers.terminationGracePeriodSeconds }} tolerations: {{- toYaml $tolerations | nindent 4 }} topologySpreadConstraints: {{- toYaml $topologySpreadConstraints | nindent 4 }} - {{- if .Values.workers.kubernetes.serviceAccount.create }} + {{- if has .Values.workers.kubernetes.serviceAccount.create (list true false) }} serviceAccountName: {{ include "worker.kubernetes.serviceAccountName" . }} {{- else }} serviceAccountName: {{ include "worker.serviceAccountName" . }} diff --git a/chart/templates/workers/worker-serviceaccount.yaml b/chart/templates/workers/worker-serviceaccount.yaml index cbcf95381e834..a3da9f639cec5 100644 --- a/chart/templates/workers/worker-serviceaccount.yaml +++ b/chart/templates/workers/worker-serviceaccount.yaml @@ -32,7 +32,8 @@ {{- $workers := (include "workersMergeValues" (list $mergedWorkers $workerSet "" list) | fromYaml) -}} {{- $_ := set $globals.Values "workers" $workers -}} {{- with $globals -}} -{{- if and .Values.workers.serviceAccount.create (include "airflow.podLaunchingExecutor" .) }} +{{- $useKubernetesServiceAccount := and (contains "KubernetesExecutor" .Values.executor) (has .Values.workers.kubernetes.serviceAccount.create (list true false)) -}} +{{- if and .Values.workers.serviceAccount.create (include "airflow.podLaunchingExecutor" .) (or (contains "CeleryExecutor" .Values.executor) (not $useKubernetesServiceAccount)) }} --- apiVersion: v1 kind: ServiceAccount diff --git a/helm-tests/tests/helm_tests/airflow_aux/test_pod_template_file.py b/helm-tests/tests/helm_tests/airflow_aux/test_pod_template_file.py index 45b4570047152..b86380403dd50 100644 --- a/helm-tests/tests/helm_tests/airflow_aux/test_pod_template_file.py +++ b/helm-tests/tests/helm_tests/airflow_aux/test_pod_template_file.py @@ -2127,3 +2127,22 @@ def test_dedicated_service_account_name_default(self): ) assert jmespath.search("spec.serviceAccountName", docs[0]) == "test-release-airflow-worker-kubernetes" + + def test_dedicated_service_account_name_when_creation_disabled(self): + docs = render_chart( + name="test-release", + values={ + "workers": { + "kubernetes": { + "serviceAccount": { + "create": False, + "name": "airflow", + } + } + } + }, + show_only=["templates/pod-template-file.yaml"], + chart_dir=self.temp_chart_dir, + ) + + assert jmespath.search("spec.serviceAccountName", docs[0]) == "airflow" diff --git a/helm-tests/tests/helm_tests/airflow_core/test_worker.py b/helm-tests/tests/helm_tests/airflow_core/test_worker.py index 5c4f07fddf000..6568e15b52388 100644 --- a/helm-tests/tests/helm_tests/airflow_core/test_worker.py +++ b/helm-tests/tests/helm_tests/airflow_core/test_worker.py @@ -3034,6 +3034,24 @@ def test_should_create_service_account_when_enabled(self): assert len(docs) == 1 + def test_should_not_create_legacy_service_account_when_k8s_service_account_disabled(self): + docs = render_chart( + values={ + "executor": "KubernetesExecutor", + "workers": { + "kubernetes": { + "serviceAccount": { + "create": False, + "name": "airflow", + } + } + }, + }, + show_only=["templates/workers/worker-serviceaccount.yaml"], + ) + + assert len(docs) == 0 + @pytest.mark.parametrize( "executor", [