You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "Nataneljpwd (via GitHub)" <gi...@apache.org> on 2026/07/29 14:21:52 UTC
[PR] fixed helm chart regression with kerberos in kubernetes [airflow]
Nataneljpwd opened a new pull request, #70688:
URL: https://github.com/apache/airflow/pull/70688
<!-- SPDX-License-Identifier: Apache-2.0
https://www.apache.org/licenses/LICENSE-2.0 -->
<!--
Thank you for contributing!
Please provide above a brief description of the changes made in this pull request.
Write a good git commit message following this guide: https://chris.beams.io/posts/git-commit/
Please make sure that your code changes are covered with tests.
And in case of new features or big changes remember to adjust the documentation.
For user-facing UI changes, please attach before/after screenshots (or a short
screen recording) so reviewers can assess the visual impact.
Feel free to ping (in general) for the review if you do not see reaction for a few days
(72 Hours is the minimum reaction time you can expect from volunteers) - we sometimes miss notifications.
In case of an existing issue, reference it using one of the following:
* closes: #ISSUE
* related: #ISSUE
-->
---
##### Was generative AI tooling used to co-author this PR?
<!--
If generative AI tooling has been used in the process of authoring this PR, please
change below checkbox to `[X]` followed by the name of the tool, uncomment the "Generated-by".
-->
- [ ] Yes (please specify the tool below)
- [x] No
<!--
Generated-by: [Tool Name] following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
-->
Fixed helm chart regression introduced in #38815
---
Due to the PR mentioned above, any task that used kerberos and ran kinit by itself has failed due to permission errors, which were caused due to a readonly mount for the kerberos cache on k8s pod template.
The pod template has been adjusted so that when there is a kerberos init container, the mount is readonly for the worker, otherwise, when no kerberos sidecar / init container is set, allow the base container to write to the cache directory
Also added a patch that we use locally for celery to allow for manual kinit per task.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fixed helm chart regression with kerberos in kubernetes [airflow]
Posted by "Nataneljpwd (via GitHub)" <gi...@apache.org>.
Nataneljpwd commented on PR #70688:
URL: https://github.com/apache/airflow/pull/70688#issuecomment-5519076051
> Tests are failing - could you take a look?
Hello, fixed th tests
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix Helm Chart regression with Kerberos in Kubernetes [airflow]
Posted by "Miretpl (via GitHub)" <gi...@apache.org>.
Miretpl merged PR #70688:
URL: https://github.com/apache/airflow/pull/70688
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fixed helm chart regression with kerberos in kubernetes [airflow]
Posted by "Miretpl (via GitHub)" <gi...@apache.org>.
Miretpl commented on code in PR #70688:
URL: https://github.com/apache/airflow/pull/70688#discussion_r3696807739
##########
chart/values.yaml:
##########
@@ -609,6 +609,8 @@ kerberos:
# Airflow Worker Config
workers:
celery:
+ # Should the kerberos-ccache mount be readonly for Celery Workers
+ readonlyKerberosCache: true
Review Comment:
Can you move it closer to the Kerberos-related configs under `workers.celery`?
##########
chart/values.yaml:
##########
@@ -1109,6 +1111,7 @@ workers:
containerLifecycleHooks: {}
# Resource configuration for pods created with pod-template-file
+ readonlyKerberosCache: true
Review Comment:
Same comment as above.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix Helm Chart regression with Kerberos in Kubernetes [airflow]
Posted by "Nataneljpwd (via GitHub)" <gi...@apache.org>.
Nataneljpwd commented on PR #70688:
URL: https://github.com/apache/airflow/pull/70688#issuecomment-5622864369
> @Nataneljpwd could you make a manual backport?
Sure, will do
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fixed helm chart regression with kerberos in kubernetes [airflow]
Posted by "Nataneljpwd (via GitHub)" <gi...@apache.org>.
Nataneljpwd commented on code in PR #70688:
URL: https://github.com/apache/airflow/pull/70688#discussion_r3726872877
##########
chart/values.yaml:
##########
@@ -1109,6 +1111,7 @@ workers:
containerLifecycleHooks: {}
# Resource configuration for pods created with pod-template-file
+ readonlyKerberosCache: true
Review Comment:
done, it is under the kerberos related configurations
##########
chart/values.yaml:
##########
@@ -609,6 +609,8 @@ kerberos:
# Airflow Worker Config
workers:
celery:
+ # Should the kerberos-ccache mount be readonly for Celery Workers
+ readonlyKerberosCache: true
Review Comment:
done, it is under the kerberos related configurations
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix Helm Chart regression with Kerberos in Kubernetes [airflow]
Posted by "Miretpl (via GitHub)" <gi...@apache.org>.
Miretpl commented on PR #70688:
URL: https://github.com/apache/airflow/pull/70688#issuecomment-5622257271
@Nataneljpwd could you make manual backport?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix Helm Chart regression with Kerberos in Kubernetes [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #70688:
URL: https://github.com/apache/airflow/pull/70688#issuecomment-5622036415
### Backport failed to create: chart/v1-2x-test. View the failure log <a href='https://github.com/apache/airflow/actions/runs/34502383176'> Run details </a>
Note: As of [Merging PRs targeted for Airflow 3.X](https://github.com/apache/airflow/blob/main/dev/README_AIRFLOW3_DEV.md#merging-prs-targeted-for-airflow-3x)
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.
In matter of doubt please ask in [#release-management](https://apache-airflow.slack.com/archives/C03G9H97MM2) Slack channel.
<table>
<tr>
<th>Status</th>
<th>Branch</th>
<th>Result</th>
</tr>
<tr>
<td>❌</td>
<td>chart/v1-2x-test</td>
<td><a href="https://github.com/apache/airflow/commit/3817ee64acaac138baf574f80656bc5cd1fcda77"><img src='https://img.shields.io/badge/Commit-3817ee6-red' alt='Commit Link'></a></td>
</tr>
</table>
You can attempt to backport this manually by running:
```bash
cherry_picker 3817ee6 chart/v1-2x-test
```
This should apply the commit to the chart/v1-2x-test branch and leave the commit in conflict state marking
the files that need manual conflict resolution.
After you have resolved the conflicts, you can continue the backport process by running:
```bash
cherry_picker --continue
```
If you don't have cherry-picker installed, see the [installation guide](https://github.com/apache/airflow/blob/main/dev/README.md#how-to-backport-pr-with-cherry-picker-cli).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org