Skip to content

Commit 59ddf56

Browse files
MiretplMiretpl
authored
Add workers.celery.serviceAccount & workers.kubernetes.serviceAccount (#64730)
* Refactor Service Account workers tests * Add workers.celery.serviceAccount & workers.kubernetes.serviceAccount * Fix spellcheck * Separate ServiceAccount names * Add newsfragment * Misc
1 parent a02fbaa commit 59ddf56

11 files changed

Lines changed: 742 additions & 112 deletions

File tree

‎chart/files/pod-template-file.kubernetes-helm-yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -236,7 +236,11 @@ spec:
236236
terminationGracePeriodSeconds: {{ .Values.workers.kubernetes.terminationGracePeriodSeconds | default .Values.workers.terminationGracePeriodSeconds }}
237237
tolerations: {{- toYaml $tolerations | nindent 4 }}
238238
topologySpreadConstraints: {{- toYaml $topologySpreadConstraints | nindent 4 }}
239+
{{- if .Values.workers.kubernetes.serviceAccount.create }}
240+
serviceAccountName: {{ include "worker.kubernetes.serviceAccountName" . }}
241+
{{- else }}
239242
serviceAccountName: {{ include "worker.serviceAccountName" . }}
243+
{{- end }}
240244
volumes:
241245
{{- if .Values.dags.persistence.enabled }}
242246
- name: dags

‎chart/newsfragments/64730.significant.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
``workers.serviceAccount`` section is now deprecated in favor of ``workers.celery.serviceAccount`` and ``workers.kubernetes.serviceAccount``. Please update your configuration accordingly.

‎chart/templates/NOTES.txt‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -413,6 +413,38 @@ DEPRECATION WARNING:
413413

414414
{{- end }}
415415

416+
{{- if not .Values.workers.serviceAccount.automountServiceAccountToken }}
417+
418+
DEPRECATION WARNING:
419+
`workers.serviceAccount.automountServiceAccountToken` has been renamed to `workers.celery.serviceAccount.automountServiceAccountToken`/`workers.kubernetes.serviceAccount.automountServiceAccountToken`.
420+
Please change your values as support for the old name will be dropped in a future release.
421+
422+
{{- end }}
423+
424+
{{- if not .Values.workers.serviceAccount.create }}
425+
426+
DEPRECATION WARNING:
427+
`workers.serviceAccount.create` has been renamed to `workers.celery.serviceAccount.create`/`workers.kubernetes.serviceAccount.create`.
428+
Please change your values as support for the old name will be dropped in a future release.
429+
430+
{{- end }}
431+
432+
{{- if not (empty .Values.workers.serviceAccount.name) }}
433+
434+
DEPRECATION WARNING:
435+
`workers.serviceAccount.name` has been renamed to `workers.celery.serviceAccount.name`/`workers.kubernetes.serviceAccount.name`.
436+
Please change your values as support for the old name will be dropped in a future release.
437+
438+
{{- end }}
439+
440+
{{- if not (empty .Values.workers.serviceAccount.annotations) }}
441+
442+
DEPRECATION WARNING:
443+
`workers.serviceAccount.annotations` has been renamed to `workers.celery.serviceAccount.annotations`/`workers.kubernetes.serviceAccount.annotations`.
444+
Please change your values as support for the old name will be dropped in a future release.
445+
446+
{{- end }}
447+
416448
{{- if .Values.workers.keda.enabled }}
417449

418450
DEPRECATION WARNING:

‎chart/templates/_helpers.yaml‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -641,13 +641,23 @@ server_tls_key_file = /etc/pgbouncer/server.key
641641
{{- end }}
642642
{{- end }}
643643

644-
{{/* Helper to generate service account name respecting .Values.$section.serviceAccount flags */}}
644+
{{/* Helper for service account name generation */}}
645+
{{- define "_serviceAccountNameGen" -}}
646+
{{- if .sa.create }}
647+
{{- default (printf "%s-%s" (include "airflow.serviceAccountName" .) (default .key .nameSuffix)) .sa.name | quote }}
648+
{{- else }}
649+
{{- default "default" .sa.name | quote }}
650+
{{- end }}
651+
{{- end }}
652+
653+
{{/* Helper to generate service account name respecting .Values.$section.serviceAccount or .Values.$section.$subSection.serviceAccount flags */}}
645654
{{- define "_serviceAccountName" -}}
646-
{{- $sa := get (get .Values .key) "serviceAccount" }}
647-
{{- if $sa.create }}
648-
{{- default (printf "%s-%s" (include "airflow.serviceAccountName" .) (default .key .nameSuffix )) $sa.name | quote }}
655+
{{- if .subKey }}
656+
{{- $sa := get (get (get .Values .key) .subKey) "serviceAccount" -}}
657+
{{- include "_serviceAccountNameGen" (merge (dict "sa" $sa "key" .key "nameSuffix" .nameSuffix) .) }}
649658
{{- else }}
650-
{{- default "default" $sa.name | quote }}
659+
{{- $sa := get (get .Values .key) "serviceAccount" }}
660+
{{- include "_serviceAccountNameGen" (merge (dict "sa" $sa "key" .key "nameSuffix" .nameSuffix) .) }}
651661
{{- end }}
652662
{{- end }}
653663

@@ -700,6 +710,11 @@ server_tls_key_file = /etc/pgbouncer/server.key
700710
{{- end }}
701711
{{- end }}
702712

713+
{{/* Create the name of the worker kubernetes service account to use */}}
714+
{{- define "worker.kubernetes.serviceAccountName" -}}
715+
{{- include "_serviceAccountName" (merge (dict "key" "workers" "subKey" "kubernetes" "nameSuffix" "worker-kubernetes") .) -}}
716+
{{- end }}
717+
703718
{{/* Create the name of the triggerer service account to use */}}
704719
{{- define "triggerer.serviceAccountName" -}}
705720
{{- include "_serviceAccountName" (merge (dict "key" "triggerer") .) -}}

‎chart/templates/workers/worker-kubernetes-serviceaccount.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{{/*
2+
Licensed to the Apache Software Foundation (ASF) under one
3+
or more contributor license agreements. See the NOTICE file
4+
distributed with this work for additional information
5+
regarding copyright ownership. The ASF licenses this file
6+
to you under the Apache License, Version 2.0 (the
7+
"License"); you may not use this file except in compliance
8+
with the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing,
13+
software distributed under the License is distributed on an
14+
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
KIND, either express or implied. See the License for the
16+
specific language governing permissions and limitations
17+
under the License.
18+
*/}}
19+
20+
###########################################
21+
## Airflow Worker Kubernetes ServiceAccount
22+
###########################################
23+
{{- if and .Values.workers.kubernetes.serviceAccount.create (contains "KubernetesExecutor" .Values.executor) }}
24+
apiVersion: v1
25+
kind: ServiceAccount
26+
automountServiceAccountToken: {{ or .Values.workers.kubernetes.serviceAccount.automountServiceAccountToken (and (not (has .Values.workers.kubernetes.serviceAccount.automountServiceAccountToken (list true false))) .Values.workers.serviceAccount.automountServiceAccountToken) }}
27+
metadata:
28+
name: {{ include "worker.kubernetes.serviceAccountName" . }}
29+
labels:
30+
tier: airflow
31+
component: worker
32+
release: {{ .Release.Name }}
33+
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
34+
heritage: {{ .Release.Service }}
35+
{{- if or .Values.labels .Values.workers.labels }}
36+
{{- mustMerge .Values.workers.labels .Values.labels | toYaml | nindent 4 }}
37+
{{- end }}
38+
{{- with (.Values.workers.kubernetes.serviceAccount.annotations | default .Values.workers.serviceAccount.annotations) }}
39+
annotations: {{- toYaml . | nindent 4 }}
40+
{{- end }}
41+
{{- end }}

‎chart/values.schema.json‎

Lines changed: 81 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1848,29 +1848,29 @@
18481848
}
18491849
},
18501850
"serviceAccount": {
1851-
"description": "Create ServiceAccount for Airflow Celery workers and pods created with pod-template-file.",
1851+
"description": "Create ServiceAccount for Airflow Celery workers and pods created with pod-template-file (deprecated, use ``workers.celery.serviceAccount`` and/or ``workers.kubernetes.serviceAccount`` instead).",
18521852
"type": "object",
18531853
"properties": {
18541854
"automountServiceAccountToken": {
1855-
"description": "Specifies if ServiceAccount's API credentials should be mounted onto Pods",
1855+
"description": "Specifies if ServiceAccount's API credentials should be mounted onto Pods (deprecated, use ``workers.celery.serviceAccount.automountServiceAccountToken`` and/or ``workers.kubernetes.serviceAccount.automountServiceAccountToken`` instead)",
18561856
"type": "boolean",
18571857
"default": true
18581858
},
18591859
"create": {
1860-
"description": "Specifies whether a ServiceAccount should be created.",
1860+
"description": "Specifies whether a ServiceAccount should be created (deprecated, use ``workers.celery.serviceAccount.create`` and/or ``workers.kubernetes.serviceAccount.create`` instead).",
18611861
"type": "boolean",
18621862
"default": true
18631863
},
18641864
"name": {
1865-
"description": "The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.",
1865+
"description": "The name of the ServiceAccount to use (deprecated, use ``workers.celery.serviceAccount.name`` and/or ``workers.kubernetes.serviceAccount.name`` instead). If not set and create is true, a name is generated using the release name.",
18661866
"type": [
18671867
"string",
18681868
"null"
18691869
],
18701870
"default": null
18711871
},
18721872
"annotations": {
1873-
"description": "Annotations to add to the worker Kubernetes ServiceAccount.",
1873+
"description": "Annotations to add to the worker Kubernetes ServiceAccount (deprecated, use ``workers.celery.serviceAccount.annotations`` and/or ``workers.kubernetes.serviceAccount.annotations`` instead).",
18741874
"type": "object",
18751875
"default": {},
18761876
"additionalProperties": {
@@ -2921,6 +2921,44 @@
29212921
}
29222922
}
29232923
},
2924+
"serviceAccount": {
2925+
"description": "Create ServiceAccount for Airflow Celery workers.",
2926+
"type": "object",
2927+
"properties": {
2928+
"automountServiceAccountToken": {
2929+
"description": "Specifies if ServiceAccount's API credentials should be mounted onto Pods.",
2930+
"type": [
2931+
"boolean",
2932+
"null"
2933+
],
2934+
"default": null
2935+
},
2936+
"create": {
2937+
"description": "Specifies whether a ServiceAccount should be created.",
2938+
"type": [
2939+
"boolean",
2940+
"null"
2941+
],
2942+
"default": null
2943+
},
2944+
"name": {
2945+
"description": "The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.",
2946+
"type": [
2947+
"string",
2948+
"null"
2949+
],
2950+
"default": null
2951+
},
2952+
"annotations": {
2953+
"description": "Annotations to add to the worker Kubernetes ServiceAccount.",
2954+
"type": "object",
2955+
"default": {},
2956+
"additionalProperties": {
2957+
"type": "string"
2958+
}
2959+
}
2960+
}
2961+
},
29242962
"keda": {
29252963
"description": "KEDA configuration of Airflow Celery workers.",
29262964
"type": "object",
@@ -3534,6 +3572,44 @@
35343572
}
35353573
]
35363574
},
3575+
"serviceAccount": {
3576+
"description": "Create ServiceAccount for pods created with pod-template-file. When this section is specified, the Service Account is created from ``templates/workers/worker-kubernetes-serviceaccount.yaml`` file.",
3577+
"type": "object",
3578+
"properties": {
3579+
"automountServiceAccountToken": {
3580+
"description": "Specifies if ServiceAccount's API credentials should be mounted onto Pods. If not specified, the ``workers.serviceAccount.automountServiceAccountToken`` value will be taken.",
3581+
"type": [
3582+
"boolean",
3583+
"null"
3584+
],
3585+
"default": null
3586+
},
3587+
"create": {
3588+
"description": "Specifies whether a ServiceAccount should be created. If not specified, the ServiceAccount will be generated and used from ``templates/workers/worker-serviceaccount.yaml`` file if ``workers.serviceAccount.create`` will be 'true'.",
3589+
"type": [
3590+
"boolean",
3591+
"null"
3592+
],
3593+
"default": null
3594+
},
3595+
"name": {
3596+
"description": "The name of the ServiceAccount to use. If not set and ``create`` is 'true', a name is generated using the release name with kubernetes dedicated name.",
3597+
"type": [
3598+
"string",
3599+
"null"
3600+
],
3601+
"default": null
3602+
},
3603+
"annotations": {
3604+
"description": "Annotations to add to the worker Kubernetes ServiceAccount. If not specified, the ``workers.serviceAccount.annotations`` value will be taken.",
3605+
"type": "object",
3606+
"default": {},
3607+
"additionalProperties": {
3608+
"type": "string"
3609+
}
3610+
}
3611+
}
3612+
},
35373613
"kerberosSidecar": {
35383614
"description": "Kerberos sidecar for pods created with pod-template-file.",
35393615
"type": "object",

0 commit comments

Comments
 (0)