You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "rjgoyln (via GitHub)" <gi...@apache.org> on 2026/03/24 04:16:53 UTC
[PR] document missing secret name keys [airflow]
rjgoyln opened a new pull request, #64135:
URL: https://github.com/apache/airflow/pull/64135
### Summary
This PR adds missing documentation for several secret name parameters in values.yaml. These parameters were previously undocumented or lacked specific details regarding their required internal Kubernetes Secret keys and fallback behaviors.
* closes: #64106
##### Was generative AI tooling used to co-author this PR?
<!--
If generative AI tooling has been used in the process of authoring this PR, please
change below checkbox to `[X]` followed by the name of the tool, uncomment the "Generated-by".
-->
- [ ] Yes (please specify the tool below)
<!--
Generated-by: [Tool Name] following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
-->
---
* Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
* For fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
* When adding dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
* For significant user-facing changes create newsfragment: `{pr_number}.significant.rst`, in [airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments). You can add this file in a follow-up commit after the PR is created so you know the PR number.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] document missing secret name keys [airflow]
Posted by "jscheffl (via GitHub)" <gi...@apache.org>.
jscheffl commented on code in PR #64135:
URL: https://github.com/apache/airflow/pull/64135#discussion_r3005416974
##########
chart/values.yaml:
##########
@@ -498,19 +498,14 @@ extraEnvFrom: ~
# Airflow database & redis config
data:
- # If secret names are provided, use those secrets
- # These secrets must be created manually, eg:
- #
- # kind: Secret
- # apiVersion: v1
- # metadata:
- # name: custom-airflow-metadata-secret
- # type: Opaque
- # data:
- # connection: base64_encoded_connection_string
-
+ # Must contain a 'connection' key (e.g., postgresql://user:pass@host:5432/db).
+ # Optional: 'kedaConnection'. Note: URL-encode special characters in passwords.
Review Comment:
I am not sure if and why your description is now better than the example before. The example before which you now are removing had an example. Yes it was not mentioning that the `connection` key is needed.
I'd favor keeping the example and marking the note that key(s) are needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] document missing secret name keys [airflow]
Posted by "plaes (via GitHub)" <gi...@apache.org>.
plaes commented on code in PR #64135:
URL: https://github.com/apache/airflow/pull/64135#discussion_r2980309766
##########
chart/values.yaml:
##########
@@ -553,18 +552,24 @@ fernetKeySecretAnnotations: {}
apiSecretKey: ~
# Add custom annotations to the api secret
apiSecretAnnotations: {}
+# Must contain an 'api-secret-key' key (suggested: random 32-char string).
+# Note: Values in K8s Secrets must be Base64 encoded.
Review Comment:
This is somewhat confusing. It kinda tells me that I should base64 the value before adding it to secret...
```bash
kubectl create --dry-run=client secret generic \
admin --from-literal=api-secret-key=$(echo -n really-secret | base64) -oyaml
```
And k8s re-encodes it in base64:
```yaml
data:
api-secret-key: Y21WaGJHeDVMWE5sWTNKbGRBPT0=
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] document missing secret name keys [airflow]
Posted by "plaes (via GitHub)" <gi...@apache.org>.
plaes commented on code in PR #64135:
URL: https://github.com/apache/airflow/pull/64135#discussion_r2980965810
##########
chart/values.yaml:
##########
@@ -553,18 +552,24 @@ fernetKeySecretAnnotations: {}
apiSecretKey: ~
# Add custom annotations to the api secret
apiSecretAnnotations: {}
+# Must contain an 'api-secret-key' key (suggested: random 32-char string).
+# Note: Values in K8s Secrets must be Base64 encoded.
Review Comment:
This is excellent! :+1:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] document missing secret name keys [airflow]
Posted by "rjgoyln (via GitHub)" <gi...@apache.org>.
rjgoyln commented on code in PR #64135:
URL: https://github.com/apache/airflow/pull/64135#discussion_r2980916936
##########
chart/values.yaml:
##########
@@ -553,18 +552,24 @@ fernetKeySecretAnnotations: {}
apiSecretKey: ~
# Add custom annotations to the api secret
apiSecretAnnotations: {}
+# Must contain an 'api-secret-key' key (suggested: random 32-char string).
+# Note: Values in K8s Secrets must be Base64 encoded.
Review Comment:
OK, got it. Thank you so much🙏🙏.
I’ve removed the comments that might cause confusion. Please let me know if there’s anything else I should change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] document missing secret name keys [airflow]
Posted by "plaes (via GitHub)" <gi...@apache.org>.
plaes commented on code in PR #64135:
URL: https://github.com/apache/airflow/pull/64135#discussion_r2980309766
##########
chart/values.yaml:
##########
@@ -553,18 +552,24 @@ fernetKeySecretAnnotations: {}
apiSecretKey: ~
# Add custom annotations to the api secret
apiSecretAnnotations: {}
+# Must contain an 'api-secret-key' key (suggested: random 32-char string).
+# Note: Values in K8s Secrets must be Base64 encoded.
Review Comment:
This is somewhat confusing. It kinda tells me that I should base64 the value before adding it to secret...
```bash
kubectl create --dry-run=client secret generic \
admin --from-literal=api-secret-key=$(echo -n really-secret | base64) -oyaml
```
And k8s re-encodes it in base64:
```yaml
data:
api-secret-key: Y21WaGJHeDVMWE5sWTNKbGRBPT0=
```
It probably should mention to create a "generic" secret within `data` field, instead of `stringData`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] document missing secret name keys [airflow]
Posted by "jscheffl (via GitHub)" <gi...@apache.org>.
jscheffl commented on code in PR #64135:
URL: https://github.com/apache/airflow/pull/64135#discussion_r3005417454
##########
chart/values.yaml:
##########
@@ -498,19 +498,14 @@ extraEnvFrom: ~
# Airflow database & redis config
data:
- # If secret names are provided, use those secrets
- # These secrets must be created manually, eg:
- #
- # kind: Secret
- # apiVersion: v1
- # metadata:
- # name: custom-airflow-metadata-secret
- # type: Opaque
- # data:
- # connection: base64_encoded_connection_string
-
+ # Must contain a 'connection' key (e.g., postgresql://user:pass@host:5432/db).
+ # Optional: 'kedaConnection'. Note: URL-encode special characters in passwords.
metadataSecretName: ~
+
+ # Must contain a 'connection' key. If not provided, it falls back to 'metadataSecretName'.
resultBackendSecretName: ~
+
+ # Must contain a 'connection' key (e.g., redis://:pass@host:6379/0).
Review Comment:
...and also I'd not repeat it here but propose to add this to the note that the key is relevant for all options below.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] document missing secret name keys [airflow]
Posted by "jscheffl (via GitHub)" <gi...@apache.org>.
jscheffl closed pull request #64135: document missing secret name keys
URL: https://github.com/apache/airflow/pull/64135
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] document missing secret name keys [airflow]
Posted by "jscheffl (via GitHub)" <gi...@apache.org>.
jscheffl commented on PR #64135:
URL: https://github.com/apache/airflow/pull/64135#issuecomment-4148950240
PR https://github.com/apache/airflow/pull/64136 was merged which is redundant to this one.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org