You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by js...@apache.org on 2026/04/20 19:09:23 UTC
(airflow) branch chart/v1-2x-test updated: [chart/v1-2x-test] [Helm-Chart] BugFix: Wrong broker URL secret ref (#65006) (#65564)
This is an automated email from the ASF dual-hosted git repository.
jscheffl pushed a commit to branch chart/v1-2x-test
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/chart/v1-2x-test by this push:
new d3f629b7b4d [chart/v1-2x-test] [Helm-Chart] BugFix: Wrong broker URL secret ref (#65006) (#65564)
d3f629b7b4d is described below
commit d3f629b7b4d78a84cf5e02693e333bfec932ced5
Author: github-actions[bot] <41...@users.noreply.github.com>
AuthorDate: Mon Apr 20 21:09:15 2026 +0200
[chart/v1-2x-test] [Helm-Chart] BugFix: Wrong broker URL secret ref (#65006) (#65564)
* Fix: Helm Chart uses wrong broker url secret ref
* Add test for redis supporting fullnameOverride
* Remove outdated note that was invalidated with #52953
* Add newsfragment
(cherry picked from commit d41310a290106e7a23b629d4159f7e01da254fb0)
Co-authored-by: Desdroid <De...@users.noreply.github.com>
---
chart/newsfragments/65006.bugfix.rst | 1 +
chart/templates/_helpers.yaml | 6 +++-
chart/templates/secrets/redis-secrets.yaml | 4 +--
chart/values.yaml | 3 --
helm-tests/tests/helm_tests/other/test_redis.py | 45 ++++++++++++++++++++++---
5 files changed, 48 insertions(+), 11 deletions(-)
diff --git a/chart/newsfragments/65006.bugfix.rst b/chart/newsfragments/65006.bugfix.rst
new file mode 100644
index 00000000000..0d76979fb74
--- /dev/null
+++ b/chart/newsfragments/65006.bugfix.rst
@@ -0,0 +1 @@
+Fixed broker URL secret name resolution to use ``airflow.fullname`` consistently. This fixes deployments where ``useStandardNaming=True`` and ``airflow.fullname != .Release.Name``, for example when using ``fullnameOverride``, ``nameOverride``, or the Airflow Helm chart as a dependency.
diff --git a/chart/templates/_helpers.yaml b/chart/templates/_helpers.yaml
index ef120699389..53017f7c3ed 100644
--- a/chart/templates/_helpers.yaml
+++ b/chart/templates/_helpers.yaml
@@ -130,7 +130,7 @@ If release name contains chart name it will be used as a full name.
- name: AIRFLOW__CELERY__BROKER_URL
valueFrom:
secretKeyRef:
- name: {{ default (printf "%s-broker-url" .Release.Name) .Values.data.brokerUrlSecretName }}
+ name: {{ template "airflow_broker_url_secret" . }}
key: connection
{{- end }}
{{- end }}
@@ -431,6 +431,10 @@ If release name contains chart name it will be used as a full name.
{{- default (printf "%s-redis-password" (include "airflow.fullname" .)) .Values.redis.passwordSecretName }}
{{- end }}
+{{- define "airflow_broker_url_secret" -}}
+ {{- default (printf "%s-broker-url" (include "airflow.fullname" .)) .Values.data.brokerUrlSecretName }}
+{{- end }}
+
{{- define "airflow_metadata_secret" -}}
{{- default (printf "%s-metadata" (include "airflow.fullname" .)) .Values.data.metadataSecretName }}
{{- end }}
diff --git a/chart/templates/secrets/redis-secrets.yaml b/chart/templates/secrets/redis-secrets.yaml
index 793b5e2e20a..3d248eaebc3 100644
--- a/chart/templates/secrets/redis-secrets.yaml
+++ b/chart/templates/secrets/redis-secrets.yaml
@@ -33,7 +33,7 @@
apiVersion: v1
kind: Secret
metadata:
- name: {{ include "airflow.fullname" . }}-redis-password
+ name: {{ include "redis_password_secret" . }}
labels:
tier: airflow
component: redis
@@ -62,7 +62,7 @@ data:
apiVersion: v1
kind: Secret
metadata:
- name: {{ include "airflow.fullname" . }}-broker-url
+ name: {{ include "airflow_broker_url_secret" . }}
labels:
tier: airflow
component: redis
diff --git a/chart/values.yaml b/chart/values.yaml
index 3bdf20b5161..aad52cb3d62 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -34,9 +34,6 @@ nameOverride: ""
# For existing installations, this will rename and redeploy your resources with the new names. Be aware that
# this will recreate your Deployment/StatefulSets along with their persistent volume claims and data storage
# migration may be needed to keep your old data
-#
-# Note:fernet-key,redis-password and broker-url secrets don't use this logic yet,
-# As this may break existing installations due to how they get installed via pre-install hook.
useStandardNaming: false
# Max number of old replicasets to retain. Can be overridden by each Deployment's revisionHistoryLimit
diff --git a/helm-tests/tests/helm_tests/other/test_redis.py b/helm-tests/tests/helm_tests/other/test_redis.py
index 3527547d601..a89f0468f13 100644
--- a/helm-tests/tests/helm_tests/other/test_redis.py
+++ b/helm-tests/tests/helm_tests/other/test_redis.py
@@ -56,8 +56,10 @@ class TestRedis:
return password_in_obj
@staticmethod
- def get_broker_url_secret_in_deployment(k8s_obj_by_key, kind: str, name: str) -> str:
- deployment_obj = k8s_obj_by_key[(kind, f"{RELEASE_NAME_REDIS}-{name}")]
+ def get_broker_url_secret_in_deployment(
+ k8s_obj_by_key, kind: str, name: str, airflow_fullname: str = RELEASE_NAME_REDIS
+ ) -> str:
+ deployment_obj = k8s_obj_by_key[(kind, f"{airflow_fullname}-{name}")]
containers = deployment_obj["spec"]["template"]["spec"]["containers"]
container = next(obj for obj in containers if obj["name"] == name)
@@ -82,14 +84,17 @@ class TestRedis:
assert REDIS_OBJECTS["SECRET_BROKER_URL"] not in k8s_obj_by_key.keys()
def assert_broker_url_env(
- self, k8s_obj_by_key, expected_broker_url_secret_name=REDIS_OBJECTS["SECRET_BROKER_URL"][1]
+ self,
+ k8s_obj_by_key,
+ expected_broker_url_secret_name=REDIS_OBJECTS["SECRET_BROKER_URL"][1],
+ airflow_fullname: str = RELEASE_NAME_REDIS,
):
broker_url_secret_in_scheduler = self.get_broker_url_secret_in_deployment(
- k8s_obj_by_key, "StatefulSet", "worker"
+ k8s_obj_by_key, "Deployment", "scheduler", airflow_fullname
)
assert broker_url_secret_in_scheduler == expected_broker_url_secret_name
broker_url_secret_in_worker = self.get_broker_url_secret_in_deployment(
- k8s_obj_by_key, "Deployment", "scheduler"
+ k8s_obj_by_key, "StatefulSet", "worker", airflow_fullname
)
assert broker_url_secret_in_worker == expected_broker_url_secret_name
@@ -276,6 +281,36 @@ class TestRedis:
self.assert_broker_url_env(k8s_obj_by_key, expected_broker_url_secret_name)
+ @pytest.mark.parametrize("executor", CELERY_EXECUTORS_PARAMS)
+ def test_redis_secrets_support_fullname_override(self, executor):
+ fullname_override = "redis-fullname-override"
+ fullname_override_objects = {
+ "NETWORK_POLICY": ("NetworkPolicy", f"{fullname_override}-redis-policy"),
+ "SERVICE": ("Service", f"{fullname_override}-redis"),
+ "STATEFUL_SET": ("StatefulSet", f"{fullname_override}-redis"),
+ "SECRET_PASSWORD": ("Secret", f"{fullname_override}-redis-password"),
+ "SECRET_BROKER_URL": ("Secret", f"{fullname_override}-broker-url"),
+ }
+
+ k8s_objects = render_chart(
+ RELEASE_NAME_REDIS,
+ {
+ "fullnameOverride": fullname_override,
+ "useStandardNaming": True,
+ "networkPolicies": {"enabled": True},
+ "executor": executor,
+ "redis": {"enabled": True},
+ },
+ )
+ k8s_obj_by_key = prepare_k8s_lookup_dict(k8s_objects)
+ created_redis_objects = set(fullname_override_objects.values()) & set(k8s_obj_by_key.keys())
+ assert created_redis_objects == set(fullname_override_objects.values())
+ self.assert_broker_url_env(
+ k8s_obj_by_key,
+ expected_broker_url_secret_name=fullname_override_objects["SECRET_BROKER_URL"][1],
+ airflow_fullname=fullname_override,
+ )
+
def test_default_redis_secrets_created_with_non_celery_executor(self):
# We want to make sure default redis secrets (if needed) are still
# created during install, as they are marked "pre-install".