Skip to content

Commit be189c1

Browse files
MiretplMiretpl
committed
Add workers.celery.serviceAccount & workers.kubernetes.serviceAccount
1 parent d42b0bd commit be189c1

10 files changed

Lines changed: 673 additions & 59 deletions

File tree

‎chart/files/pod-template-file.kubernetes-helm-yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -236,7 +236,11 @@ spec:
236236
terminationGracePeriodSeconds: {{ .Values.workers.kubernetes.terminationGracePeriodSeconds | default .Values.workers.terminationGracePeriodSeconds }}
237237
tolerations: {{- toYaml $tolerations | nindent 4 }}
238238
topologySpreadConstraints: {{- toYaml $topologySpreadConstraints | nindent 4 }}
239+
{{- if .Values.workers.kubernetes.serviceAccount.create }}
240+
serviceAccountName: {{ include "worker.kubernetes.serviceAccountName" . }}
241+
{{- else }}
239242
serviceAccountName: {{ include "worker.serviceAccountName" . }}
243+
{{- end }}
240244
volumes:
241245
{{- if .Values.dags.persistence.enabled }}
242246
- name: dags

‎chart/templates/NOTES.txt‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -413,6 +413,38 @@ DEPRECATION WARNING:
413413

414414
{{- end }}
415415

416+
{{- if not .Values.workers.serviceAccount.automountServiceAccountToken }}
417+
418+
DEPRECATION WARNING:
419+
`workers.serviceAccount.automountServiceAccountToken` has been renamed to `workers.celery.serviceAccount.automountServiceAccountToken`/`workers.kubernetes.serviceAccount.automountServiceAccountToken`.
420+
Please change your values as support for the old name will be dropped in a future release.
421+
422+
{{- end }}
423+
424+
{{- if not .Values.workers.serviceAccount.create }}
425+
426+
DEPRECATION WARNING:
427+
`workers.serviceAccount.create` has been renamed to `workers.celery.serviceAccount.create`/`workers.kubernetes.serviceAccount.create`.
428+
Please change your values as support for the old name will be dropped in a future release.
429+
430+
{{- end }}
431+
432+
{{- if not (empty .Values.workers.serviceAccount.name) }}
433+
434+
DEPRECATION WARNING:
435+
`workers.serviceAccount.name` has been renamed to `workers.celery.serviceAccount.name`/`workers.kubernetes.serviceAccount.name`.
436+
Please change your values as support for the old name will be dropped in a future release.
437+
438+
{{- end }}
439+
440+
{{- if not (empty .Values.workers.serviceAccount.annotations) }}
441+
442+
DEPRECATION WARNING:
443+
`workers.serviceAccount.annotations` has been renamed to `workers.celery.serviceAccount.annotations`/`workers.kubernetes.serviceAccount.annotations`.
444+
Please change your values as support for the old name will be dropped in a future release.
445+
446+
{{- end }}
447+
416448
{{- if .Values.workers.keda.enabled }}
417449

418450
DEPRECATION WARNING:

‎chart/templates/_helpers.yaml‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -641,13 +641,23 @@ server_tls_key_file = /etc/pgbouncer/server.key
641641
{{- end }}
642642
{{- end }}
643643

644-
{{/* Helper to generate service account name respecting .Values.$section.serviceAccount flags */}}
644+
{{/* Helper for service account name generation */}}
645+
{{- define "_serviceAccountNameGen" -}}
646+
{{- if .sa.create }}
647+
{{- default (printf "%s-%s" (include "airflow.serviceAccountName" .) (default .key .nameSuffix )) .sa.name | quote }}
648+
{{- else }}
649+
{{- default "default" .sa.name | quote }}
650+
{{- end }}
651+
{{- end }}
652+
653+
{{/* Helper to generate service account name respecting .Values.$section.serviceAccount or .Values.$section.$subSection.serviceAccount flags */}}
645654
{{- define "_serviceAccountName" -}}
646-
{{- $sa := get (get .Values .key) "serviceAccount" }}
647-
{{- if $sa.create }}
648-
{{- default (printf "%s-%s" (include "airflow.serviceAccountName" .) (default .key .nameSuffix )) $sa.name | quote }}
655+
{{- if .subKey }}
656+
{{- $sa := get (get (get .Values .key) .subKey) "serviceAccount" -}}
657+
{{- include "_serviceAccountNameGen" (merge (dict "sa" $sa "key" .key "nameSuffix" .nameSuffix) .) }}
649658
{{- else }}
650-
{{- default "default" $sa.name | quote }}
659+
{{- $sa := get (get .Values .key) "serviceAccount" }}
660+
{{- include "_serviceAccountNameGen" (merge (dict "sa" $sa "key" .key "nameSuffix" .nameSuffix) .) }}
651661
{{- end }}
652662
{{- end }}
653663

@@ -700,6 +710,11 @@ server_tls_key_file = /etc/pgbouncer/server.key
700710
{{- end }}
701711
{{- end }}
702712

713+
{{/* Create the name of the worker kubernetes service account to use */}}
714+
{{- define "worker.kubernetes.serviceAccountName" -}}
715+
{{- include "_serviceAccountName" (merge (dict "key" "workers" "subKey" "kubernetes" "nameSuffix" "worker-kubernetes") .) -}}
716+
{{- end }}
717+
703718
{{/* Create the name of the triggerer service account to use */}}
704719
{{- define "triggerer.serviceAccountName" -}}
705720
{{- include "_serviceAccountName" (merge (dict "key" "triggerer") .) -}}

‎chart/templates/workers/worker-kubernetes-serviceaccount.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{{/*
2+
Licensed to the Apache Software Foundation (ASF) under one
3+
or more contributor license agreements. See the NOTICE file
4+
distributed with this work for additional information
5+
regarding copyright ownership. The ASF licenses this file
6+
to you under the Apache License, Version 2.0 (the
7+
"License"); you may not use this file except in compliance
8+
with the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing,
13+
software distributed under the License is distributed on an
14+
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
KIND, either express or implied. See the License for the
16+
specific language governing permissions and limitations
17+
under the License.
18+
*/}}
19+
20+
###########################################
21+
## Airflow Worker Kubernetes ServiceAccount
22+
###########################################
23+
{{- if and .Values.workers.kubernetes.serviceAccount.create (contains "KubernetesExecutor" .Values.executor) }}
24+
apiVersion: v1
25+
kind: ServiceAccount
26+
automountServiceAccountToken: {{ or .Values.workers.kubernetes.serviceAccount.automountServiceAccountToken (and (not (has .Values.workers.kubernetes.serviceAccount.automountServiceAccountToken (list true false))) .Values.workers.serviceAccount.automountServiceAccountToken) }}
27+
metadata:
28+
name: {{ include "worker.kubernetes.serviceAccountName" . }}
29+
labels:
30+
tier: airflow
31+
component: worker
32+
release: {{ .Release.Name }}
33+
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
34+
heritage: {{ .Release.Service }}
35+
{{- if or .Values.labels .Values.workers.labels }}
36+
{{- mustMerge .Values.workers.labels .Values.labels | toYaml | nindent 4 }}
37+
{{- end }}
38+
{{- with (.Values.workers.kubernetes.serviceAccount.annotations | default .Values.workers.serviceAccount.annotations) }}
39+
annotations: {{- toYaml . | nindent 4 }}
40+
{{- end }}
41+
{{- end }}

‎chart/values.schema.json‎

Lines changed: 81 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1848,29 +1848,29 @@
18481848
}
18491849
},
18501850
"serviceAccount": {
1851-
"description": "Create ServiceAccount for Airflow Celery workers and pods created with pod-template-file.",
1851+
"description": "Create ServiceAccount for Airflow Celery workers and pods created with pod-template-file (deprecated, use ``workers.celery.serviceAccount`` and/or ``workers.kubernetes.serviceAccount`` instead).",
18521852
"type": "object",
18531853
"properties": {
18541854
"automountServiceAccountToken": {
1855-
"description": "Specifies if ServiceAccount's API credentials should be mounted onto Pods",
1855+
"description": "Specifies if ServiceAccount's API credentials should be mounted onto Pods (deprecated, use ``workers.celery.serviceAccount.automountServiceAccountToken`` and/or ``workers.kubernetes.serviceAccount.automountServiceAccountToken`` instead)",
18561856
"type": "boolean",
18571857
"default": true
18581858
},
18591859
"create": {
1860-
"description": "Specifies whether a ServiceAccount should be created.",
1860+
"description": "Specifies whether a ServiceAccount should be created (deprecated, use ``workers.celery.serviceAccount.create`` and/or ``workers.kubernetes.serviceAccount.create`` instead).",
18611861
"type": "boolean",
18621862
"default": true
18631863
},
18641864
"name": {
1865-
"description": "The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.",
1865+
"description": "The name of the ServiceAccount to use (deprecated, use ``workers.celery.serviceAccount.name`` and/or ``workers.kubernetes.serviceAccount.name`` instead). If not set and create is true, a name is generated using the release name.",
18661866
"type": [
18671867
"string",
18681868
"null"
18691869
],
18701870
"default": null
18711871
},
18721872
"annotations": {
1873-
"description": "Annotations to add to the worker Kubernetes ServiceAccount.",
1873+
"description": "Annotations to add to the worker Kubernetes ServiceAccount (deprecated, use ``workers.celery.serviceAccount.annotations`` and/or ``workers.kubernetes.serviceAccount.annotations`` instead).",
18741874
"type": "object",
18751875
"default": {},
18761876
"additionalProperties": {
@@ -2921,6 +2921,44 @@
29212921
}
29222922
}
29232923
},
2924+
"serviceAccount": {
2925+
"description": "Create ServiceAccount for Airflow Celery workers.",
2926+
"type": "object",
2927+
"properties": {
2928+
"automountServiceAccountToken": {
2929+
"description": "Specifies if ServiceAccount's API credentials should be mounted onto Pods.",
2930+
"type": [
2931+
"boolean",
2932+
"null"
2933+
],
2934+
"default": null
2935+
},
2936+
"create": {
2937+
"description": "Specifies whether a ServiceAccount should be created.",
2938+
"type": [
2939+
"boolean",
2940+
"null"
2941+
],
2942+
"default": null
2943+
},
2944+
"name": {
2945+
"description": "The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.",
2946+
"type": [
2947+
"string",
2948+
"null"
2949+
],
2950+
"default": null
2951+
},
2952+
"annotations": {
2953+
"description": "Annotations to add to the worker Kubernetes ServiceAccount.",
2954+
"type": "object",
2955+
"default": {},
2956+
"additionalProperties": {
2957+
"type": "string"
2958+
}
2959+
}
2960+
}
2961+
},
29242962
"keda": {
29252963
"description": "KEDA configuration of Airflow Celery workers.",
29262964
"type": "object",
@@ -3431,6 +3469,44 @@
34313469
}
34323470
]
34333471
},
3472+
"serviceAccount": {
3473+
"description": "Create ServiceAccount for pods created with pod-template-file. When this section is specified, the Service Account is created from 'templates/workers/worker-kubernetes-serviceaccount.yaml' file.",
3474+
"type": "object",
3475+
"properties": {
3476+
"automountServiceAccountToken": {
3477+
"description": "Specifies if ServiceAccount's API credentials should be mounted onto Pods. If not specified, the ``workers.serviceAccount.automountServiceAccountToken`` value will be taken.",
3478+
"type": [
3479+
"boolean",
3480+
"null"
3481+
],
3482+
"default": null
3483+
},
3484+
"create": {
3485+
"description": "Specifies whether a ServiceAccount should be created. If not specified, the ServiceAccount will be generated and used from 'templates/workers/worker-serviceaccount.yaml' file if `workers.serviceAccount.create` will be 'true'.",
3486+
"type": [
3487+
"boolean",
3488+
"null"
3489+
],
3490+
"default": null
3491+
},
3492+
"name": {
3493+
"description": "The name of the ServiceAccount to use. If not set and ``create`` is 'true', a name is generated using the release name with kubernetes dedicated name.",
3494+
"type": [
3495+
"string",
3496+
"null"
3497+
],
3498+
"default": null
3499+
},
3500+
"annotations": {
3501+
"description": "Annotations to add to the worker Kubernetes ServiceAccount. If not specified, the ``workers.serviceAccount.annotations`` value will be taken.",
3502+
"type": "object",
3503+
"default": {},
3504+
"additionalProperties": {
3505+
"type": "string"
3506+
}
3507+
}
3508+
}
3509+
},
34343510
"kerberosSidecar": {
34353511
"description": "Kerberos sidecar for pods created with pod-template-file.",
34363512
"type": "object",

‎chart/values.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -771,18 +771,35 @@ workers:
771771
# minAvailable: 1
772772

773773
# Create ServiceAccount for Airflow Celery workers and pods created with pod-template-file
774+
# (deprecated, use `workers.celery.serviceAccount` and/or `workers.kubernetes.serviceAccount` instead)
774775
serviceAccount:
775776
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
777+
# (deprecated, use
778+
# `workers.celery.serviceAccount.automountServiceAccountToken` and/or
779+
# `workers.kubernetes.serviceAccount.automountServiceAccountToken`
780+
# instead)
776781
automountServiceAccountToken: true
777782

778783
# Specifies whether a ServiceAccount should be created
784+
# (deprecated, use
785+
# `workers.celery.serviceAccount.create` and/or
786+
# `workers.kubernetes.serviceAccount.create`
787+
# instead)
779788
create: true
780789

781790
# The name of the ServiceAccount to use.
782791
# If not set and `create` is 'true', a name is generated using the release name
792+
# (deprecated, use
793+
# `workers.celery.serviceAccount.name` and/or
794+
# `workers.kubernetes.serviceAccount.name`
795+
# instead)
783796
name: ~
784797

785798
# Annotations to add to worker Kubernetes Service Account.
799+
# (deprecated, use
800+
# `workers.celery.serviceAccount.annotations` and/or
801+
# `workers.kubernetes.serviceAccount.annotations`
802+
# instead)
786803
annotations: {}
787804

788805
# Allow KEDA autoscaling for Airflow Celery workers
@@ -1256,6 +1273,21 @@ workers:
12561273
maxUnavailable: ~
12571274
# minAvailable: ~
12581275

1276+
# Create ServiceAccount for Airflow Celery workers
1277+
serviceAccount:
1278+
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
1279+
automountServiceAccountToken: ~
1280+
1281+
# Specifies whether a ServiceAccount should be created
1282+
create: ~
1283+
1284+
# The name of the ServiceAccount to use.
1285+
# If not set and `create` is 'true', a name is generated using the release name
1286+
name: ~
1287+
1288+
# Annotations to add to worker Kubernetes Service Account.
1289+
annotations: {}
1290+
12591291
# Allow KEDA autoscaling for Airflow Celery workers
12601292
keda:
12611293
enabled: ~
@@ -1413,6 +1445,29 @@ workers:
14131445
# Container level Lifecycle Hooks definition for pods created with pod-template-file
14141446
containerLifecycleHooks: {}
14151447

1448+
# Create ServiceAccount for pods created with pod-template-file
1449+
# When this section is specified, the Service Account is created from
1450+
# 'templates/workers/worker-kubernetes-serviceaccount.yaml' file
1451+
serviceAccount:
1452+
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
1453+
# If not specified, the `workers.serviceAccount.automountServiceAccountToken` value will be taken
1454+
automountServiceAccountToken: ~
1455+
1456+
# Specifies whether a ServiceAccount should be created.
1457+
# If not specified, the ServiceAccount will be generated and used from
1458+
# 'templates/workers/worker-serviceaccount.yaml' file if `workers.serviceAccount.create`
1459+
# will be 'true'
1460+
create: ~
1461+
1462+
# The name of the ServiceAccount to use.
1463+
# If not set and `create` is 'true', a name is generated using the release name
1464+
# with kubernetes dedicated name
1465+
name: ~
1466+
1467+
# Annotations to add to worker Kubernetes Service Account.
1468+
# If not specified, the `workers.serviceAccount.annotations` value will be taken
1469+
annotations: {}
1470+
14161471
# Kerberos sidecar configuration for pods created with pod-template-file
14171472
kerberosSidecar:
14181473
# Enable kerberos sidecar

0 commit comments

Comments
 (0)