You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by po...@apache.org on 2024/06/20 14:40:10 UTC
(airflow) branch main updated: Support disabling helm hooks on extraConfigMaps and extraSecrets (#40294)
This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new c3752e29dd Support disabling helm hooks on extraConfigMaps and extraSecrets (#40294)
c3752e29dd is described below
commit c3752e29dd22682fcb7395ef79e28bb074cafd8b
Author: ItaiMeushar <52...@users.noreply.github.com>
AuthorDate: Thu Jun 20 17:40:03 2024 +0300
Support disabling helm hooks on extraConfigMaps and extraSecrets (#40294)
---
chart/templates/configmaps/extra-configmaps.yaml | 16 ++++++------
chart/templates/secrets/extra-secrets.yaml | 16 ++++++------
chart/values.schema.json | 10 ++++++++
docs/helm-chart/index.rst | 17 +++++++++++++
.../security/test_extra_configmaps_secrets.py | 29 ++++++++++++++++++++++
5 files changed, 74 insertions(+), 14 deletions(-)
diff --git a/chart/templates/configmaps/extra-configmaps.yaml b/chart/templates/configmaps/extra-configmaps.yaml
index 2a50a31b82..a24a2b5148 100644
--- a/chart/templates/configmaps/extra-configmaps.yaml
+++ b/chart/templates/configmaps/extra-configmaps.yaml
@@ -37,13 +37,15 @@ metadata:
{{- if $configMapContent.labels }}
{{- toYaml $configMapContent.labels | nindent 4 }}
{{- end }}
- annotations:
- "helm.sh/hook": "pre-install,pre-upgrade"
- "helm.sh/hook-delete-policy": "before-hook-creation"
- "helm.sh/hook-weight": "0"
- {{- if $configMapContent.annotations }}
- {{- toYaml $configMapContent.annotations | nindent 4 }}
- {{- end }}
+ {{- $annotations := dict }}
+ {{- if or $configMapContent.useHelmHooks (not (hasKey $configMapContent "useHelmHooks")) }}
+ {{- $_ := set $annotations "helm.sh/hook" "pre-install,pre-upgrade" }}
+ {{- $_ := set $annotations "helm.sh/hook-weight" "0" }}
+ {{- $_ := set $annotations "helm.sh/hook-delete-policy" "before-hook-creation" }}
+ {{- end }}
+ {{- with $annotations := merge $annotations ($configMapContent.annotations | default dict) }}
+ annotations: {{- $annotations | toYaml | nindent 4 }}
+ {{- end }}
{{- if $configMapContent.data }}
data:
{{- with $configMapContent.data }}
diff --git a/chart/templates/secrets/extra-secrets.yaml b/chart/templates/secrets/extra-secrets.yaml
index 7d8bda50b3..f4a010b149 100644
--- a/chart/templates/secrets/extra-secrets.yaml
+++ b/chart/templates/secrets/extra-secrets.yaml
@@ -37,13 +37,15 @@ metadata:
{{- if $secretContent.labels }}
{{- toYaml $secretContent.labels | nindent 4 }}
{{- end }}
- annotations:
- "helm.sh/hook": "pre-install,pre-upgrade"
- "helm.sh/hook-delete-policy": "before-hook-creation"
- "helm.sh/hook-weight": "0"
- {{- if $secretContent.annotations }}
- {{- toYaml $secretContent.annotations | nindent 4 }}
- {{- end }}
+ {{- $annotations := dict }}
+ {{- if or $secretContent.useHelmHooks (not (hasKey $secretContent "useHelmHooks")) }}
+ {{- $_ := set $annotations "helm.sh/hook" "pre-install,pre-upgrade" }}
+ {{- $_ := set $annotations "helm.sh/hook-weight" "0" }}
+ {{- $_ := set $annotations "helm.sh/hook-delete-policy" "before-hook-creation" }}
+ {{- end }}
+ {{- with $annotations := merge $annotations ($secretContent.annotations | default dict) }}
+ annotations: {{- $annotations | toYaml | nindent 4 }}
+ {{- end }}
{{- if $secretContent.type }}
type: {{ $secretContent.type }}
{{- end }}
diff --git a/chart/values.schema.json b/chart/values.schema.json
index d2d90341c8..4b4b8af381 100644
--- a/chart/values.schema.json
+++ b/chart/values.schema.json
@@ -1026,6 +1026,11 @@
"type": "string"
}
},
+ "useHelmHooks": {
+ "description": "Specify if you want to use the default Helm Hook annotations",
+ "type": "boolean",
+ "default": true
+ },
"data": {
"description": "Content **as string** for the 'data' item of the secret (can be templated)",
"type": "string"
@@ -1072,6 +1077,11 @@
"type": "string"
}
},
+ "useHelmHooks": {
+ "description": "Specify if you want to use the default Helm Hook annotations",
+ "type": "boolean",
+ "default": true
+ },
"data": {
"description": "Content **as string** for the 'data' item of the configmap (can be templated)",
"type": "string"
diff --git a/docs/helm-chart/index.rst b/docs/helm-chart/index.rst
index ff9073bf37..aa18efa01d 100644
--- a/docs/helm-chart/index.rst
+++ b/docs/helm-chart/index.rst
@@ -157,6 +157,23 @@ This will run database migrations every time there is a ``Sync`` event in Argo C
If you use the Celery(Kubernetes)Executor with the built-in Redis, it is recommended that you set up a static Redis password either by supplying ``redis.passwordSecretName`` and ``data.brokerUrlSecretName`` or ``redis.password``.
+By default, Helm hooks are also enabled for ``extraSecrets`` or ``extraConfigMaps``. When using the above CI/CD tools, you might encounter issues due to these default hooks.
+
+To avoid potential problems, it is recommended to disable these hooks by setting ``useHelmHooks=false`` as shown in the following examples:
+
+.. code-block:: yaml
+
+ extraSecrets:
+ '{{ .Release.Name }}-example':
+ useHelmHooks: false
+ data: |
+ AIRFLOW_VAR_HELLO_MESSAGE: "Hi!"
+
+ extraConfigMaps:
+ '{{ .Release.Name }}-example':
+ useHelmHooks: false
+ data: |
+ AIRFLOW_VAR_HELLO_MESSAGE: "Hi!"
Naming Conventions
------------------
diff --git a/helm_tests/security/test_extra_configmaps_secrets.py b/helm_tests/security/test_extra_configmaps_secrets.py
index 8e50adab5a..b7057ffa3c 100644
--- a/helm_tests/security/test_extra_configmaps_secrets.py
+++ b/helm_tests/security/test_extra_configmaps_secrets.py
@@ -217,3 +217,32 @@ class TestExtraConfigMapsSecrets:
for k8s_object in k8s_objects:
assert k8s_object["metadata"]["annotations"] == expected_annotations
+
+ def test_extra_configmaps_secrets_disable_helm_hooks(self):
+ k8s_objects = render_chart(
+ name=RELEASE_NAME,
+ values={
+ "extraSecrets": {
+ "{{ .Release.Name }}-extra-secret-1": {
+ "useHelmHooks": False,
+ "annotations": {"test_annotation": "test_annotation_value"},
+ "stringData": "data: secretData",
+ }
+ },
+ "extraConfigMaps": {
+ "{{ .Release.Name }}-extra-configmap-1": {
+ "useHelmHooks": False,
+ "annotations": {"test_annotation": "test_annotation_value"},
+ "data": "data: configData",
+ }
+ },
+ },
+ show_only=["templates/configmaps/extra-configmaps.yaml", "templates/secrets/extra-secrets.yaml"],
+ )
+
+ expected_annotations = {
+ "test_annotation": "test_annotation_value",
+ }
+
+ for k8s_object in k8s_objects:
+ assert k8s_object["metadata"]["annotations"] == expected_annotations