You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "anmolxlight (via GitHub)" <gi...@apache.org> on 2026/07/17 20:37:38 UTC
[PR] feat: per-component enableBuiltInSecretEnvVars for workers and scheduler [airflow]
anmolxlight opened a new pull request, #70053:
URL: https://github.com/apache/airflow/pull/70053
### Motivation
The Helm chart currently injects all sensitive config values (database connection, broker URL, fernet key, api secret key, celery result backend) into every component's environment via `standard_airflow_environment`. For worker pods that execute untrusted DAG code, this means user tasks can read these secrets with `printenv` or `/proc/self/environ`.
The existing global `enableBuiltInSecretEnvVars` flag lets operators disable these env vars, but it disables them for **all** components (scheduler, api-server, triggerer, worker, etc.), which may break control-plane components that legitimately need them.
### What this PR does
- Adds `workers.celery.enableBuiltInSecretEnvVars` (type: `object | null`, default: `null`)
- Adds `scheduler.enableBuiltInSecretEnvVars` (type: `object | null`, default: `null`)
- When a key is set in a component-level override, it takes precedence over the global value for that component only
- When `null` or a key is absent, the global `enableBuiltInSecretEnvVars` is used (backward compatible)
### Usage
```yaml
workers:
celery:
enableBuiltInSecretEnvVars:
AIRFLOW__DATABASE__SQL_ALCHEMY_CONN: false
AIRFLOW__CELERY__BROKER_URL: false
```
This disables the database connection and broker URL env vars on worker containers only, while other components continue to receive them from the global setting.
### Implementation
The `standard_airflow_environment` template accepts an optional `envOverrides` dict. Each component call site passes its component-level map when available. The template resolves each env var by checking the component override first, then falling back to the global.
### Backward Compatibility
Fully backward compatible. Default values (`null`) produce identical behavior to the existing global-only approach.
Closes #70008
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: per-component enableBuiltInSecretEnvVars for workers and scheduler [airflow]
Posted by "Venture200 (via GitHub)" <gi...@apache.org>.
Venture200 commented on PR #70053:
URL: https://github.com/apache/airflow/pull/70053#issuecomment-5011080445
@anmolxlight can you please also add secret backends credentials from Azure, Vault etc
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: per-component enableBuiltInSecretEnvVars for workers and scheduler [airflow]
Posted by "anmolxlight (via GitHub)" <gi...@apache.org>.
anmolxlight closed pull request #70053: feat: per-component enableBuiltInSecretEnvVars for workers and scheduler
URL: https://github.com/apache/airflow/pull/70053
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org