You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "Aaryan123456679 (via GitHub)" <gi...@apache.org> on 2026/08/26 15:51:37 UTC
[PR] [chart/v1-2x-test] Add securityContexts.disableDefaults flag for OpenShift SCC compatibility (#70238) [airflow]
Aaryan123456679 opened a new pull request, #72108:
URL: https://github.com/apache/airflow/pull/72108
Manual backport of #70238 to `chart/v1-2x-test` (automated backport failed with cherry-pick conflicts).
`securityContexts.disableDefaults` lets the chart skip its default `runAsUser`/`fsGroup` (pod) and `runAsUser` (container) values when `securityContexts.pod`/`securityContexts.containers` (or per-component overrides) are left empty, so platforms like OpenShift can assign these via SCC instead of the chart hard-coding them.
## Conflict resolution notes
`chart/v1-2x-test` has diverged from `main` in ways unrelated to this PR, so the automatic cherry-pick (`cherry_picker 3ac3851 chart/v1-2x-test`) failed and this was resolved manually:
- `_helpers.yaml`: `localPodSecurityContext` / `localContainerSecurityContext` needed the dual-arg (`list <node> .`) form from `main` to see the global `disableDefaults` flag, while keeping this branch's legacy `<node>.securityContext` (singular) fallback that `main` had already dropped — losing it broke `TestSecurityContext::test_check_local_uid` and three other pre-existing tests until it was restored.
- `worker-deployment.yaml` and friends: adapted `main`'s `.Values.workers.celery.*` values to this branch's flat `.Values.workers.*` (the Celery/Kubernetes worker-set split under `workers.celery` hasn't been backported here).
- `chart/tests/helm_tests/security/test_security_context.py` no longer exists on this branch (its content lives at `helm-tests/tests/helm_tests/security/test_security_context.py` instead); the new `test_disable_defaults_*` coverage was added there, with the same `workers.celery` → `workers` adaptation.
## Test plan
- [x] `helm lint chart/` passes
- [x] `breeze testing helm-tests --test-type security` — 431 passed
- [x] `breeze testing helm-tests --test-type airflow_aux` — 1143 passed
- [x] `breeze testing helm-tests --test-type other` — 433 passed
- [x] `prek run --stage pre-commit` and `prek run --stage manual` against `chart/v1-2x-test` — all passed (including `kubeconform`, `Lint chart/values.schema.json`)
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Sonnet 5)
Generated-by: Claude Code (Sonnet 5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [chart/v1-2x-test] Add securityContexts.disableDefaults flag for OpenShift SCC compatibility (#70238) [airflow]
Posted by "Miretpl (via GitHub)" <gi...@apache.org>.
Miretpl merged PR #72108:
URL: https://github.com/apache/airflow/pull/72108
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org