You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "romsharon98 (via GitHub)" <gi...@apache.org> on 2024/11/19 06:58:12 UTC
[PR] Remove scheduler automate serviceaccount token [airflow]
romsharon98 opened a new pull request, #44173:
URL: https://github.com/apache/airflow/pull/44173
closes: https://github.com/apache/airflow/issues/43464
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
<!--
Thank you for contributing! Please make sure that your code changes
are covered with tests. And in case of new features or big changes
remember to adjust the documentation.
Feel free to ping committers for the review!
In case of an existing issue, reference it using one of the following:
closes: #ISSUE
related: #ISSUE
How to write a good git commit message:
http://chris.beams.io/posts/git-commit/
-->
<!-- Please keep an empty line above the dashes. -->
---
**^ Add meaningful description above**
Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information.
In case of fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
In case of a new dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
In case of backwards incompatible changes please leave a note in a newsfragment file, named `{pr_number}.significant.rst` or `{issue_number}.significant.rst`, in [newsfragments](https://github.com/apache/airflow/tree/main/newsfragments).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Remove scheduler automate serviceaccount token [airflow]
Posted by "romsharon98 (via GitHub)" <gi...@apache.org>.
romsharon98 commented on PR #44173:
URL: https://github.com/apache/airflow/pull/44173#issuecomment-2487695577
didn't fully understand what are the cases that we will need it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Remove scheduler automate serviceaccount token [airflow]
Posted by "romsharon98 (via GitHub)" <gi...@apache.org>.
romsharon98 merged PR #44173:
URL: https://github.com/apache/airflow/pull/44173
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Remove scheduler automate serviceaccount token [airflow]
Posted by "amoghrajesh (via GitHub)" <gi...@apache.org>.
amoghrajesh commented on code in PR #44173:
URL: https://github.com/apache/airflow/pull/44173#discussion_r1850269564
##########
chart/templates/scheduler/scheduler-serviceaccount.yaml:
##########
@@ -23,7 +23,6 @@
{{- if and .Values.scheduler.enabled .Values.scheduler.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
-automountServiceAccountToken: {{ .Values.scheduler.serviceAccount.automountServiceAccountToken }}
Review Comment:
These are the possible cases:
1. We can set it to true for cases when it is not CeleryExecutor
2. For other cases it has to be true or the key can be removed entirely.
Two possible approaches. Either control addition or removal of key based on the executor, otherwise allow to override only for CeleryExecutor
##########
chart/templates/scheduler/scheduler-serviceaccount.yaml:
##########
@@ -23,7 +23,6 @@
{{- if and .Values.scheduler.enabled .Values.scheduler.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
-automountServiceAccountToken: {{ .Values.scheduler.serviceAccount.automountServiceAccountToken }}
Review Comment:
These are the possible cases:
1. We can set it to true for cases when it is not CeleryExecutor
2. For other cases it has to be true or the key can be removed entirely.
Two possible approaches. Either control addition or removal of key based on the executor, otherwise allow to override only for CeleryExecutor
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Remove scheduler automate serviceaccount token [airflow]
Posted by "romsharon98 (via GitHub)" <gi...@apache.org>.
romsharon98 commented on code in PR #44173:
URL: https://github.com/apache/airflow/pull/44173#discussion_r1855408919
##########
chart/templates/scheduler/scheduler-serviceaccount.yaml:
##########
@@ -23,7 +23,6 @@
{{- if and .Values.scheduler.enabled .Values.scheduler.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
-automountServiceAccountToken: {{ .Values.scheduler.serviceAccount.automountServiceAccountToken }}
Review Comment:
Change the behavior like your suggestion 🙏🏻
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Remove scheduler automate serviceaccount token [airflow]
Posted by "jedcunningham (via GitHub)" <gi...@apache.org>.
jedcunningham commented on PR #44173:
URL: https://github.com/apache/airflow/pull/44173#issuecomment-2486478294
@potiuk you'd still need it for LocalExecutor and KubernetesPodOperator too.
But yes, with CeleryExecutor it should be fine. Or if you don't care about LE+KPO. Not sure removing completely is the right call.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Remove scheduler automate serviceaccount token [airflow]
Posted by "amoghrajesh (via GitHub)" <gi...@apache.org>.
amoghrajesh commented on code in PR #44173:
URL: https://github.com/apache/airflow/pull/44173#discussion_r1886242145
##########
helm_tests/airflow_core/test_scheduler.py:
##########
@@ -959,27 +959,54 @@ def test_should_add_component_specific_labels(self):
assert "test_label" in jmespath.search("metadata.labels", docs[0])
assert jmespath.search("metadata.labels", docs[0])["test_label"] == "test_label_value"
- def test_default_automount_service_account_token(self):
+ @pytest.mark.parametrize(
+ "executor, default_automount_service_account",
+ [
+ ("LocalExecutor", None),
+ ("CeleryExecutor", True),
+ ("CeleryKubernetesExecutor", None),
+ ("KubernetesExecutor", None),
+ ("LocalKubernetesExecutor", None),
+ ],
+ )
+ def test_default_automount_service_account_token(self, executor, default_automount_service_account):
docs = render_chart(
values={
"scheduler": {
"serviceAccount": {"create": True},
},
+ "executor": executor,
},
show_only=["templates/scheduler/scheduler-serviceaccount.yaml"],
)
- assert jmespath.search("automountServiceAccountToken", docs[0]) is True
+ assert jmespath.search("automountServiceAccountToken", docs[0]) is default_automount_service_account
- def test_overridden_automount_service_account_token(self):
+ @pytest.mark.parametrize(
+ "executor, automount_service_account, shoud_automount_service_account",
Review Comment:
```suggestion
"executor, automount_service_account, should_automount_service_account",
```
nit
##########
chart/templates/scheduler/scheduler-serviceaccount.yaml:
##########
@@ -23,7 +23,9 @@
{{- if and .Values.scheduler.enabled .Values.scheduler.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
+{{- if eq .Values.executor "CeleryExecutor" }}
Review Comment:
Right, for celery executor, we should allow the overriding
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Remove scheduler automate serviceaccount token [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #44173:
URL: https://github.com/apache/airflow/pull/44173#issuecomment-2486380952
Hmm. I wonder.. Looking at #43464 - yes, when you have K8S executor, you will not be able to work without serviceAutomount set to true. But is it generally true for LocalExecutor and CeleryExecutor for example?
I believe should work without automount for those executors?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Remove scheduler automate serviceaccount token [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #44173:
URL: https://github.com/apache/airflow/pull/44173#issuecomment-2486500890
> @potiuk you'd still need it for LocalExecutor and KubernetesPodOperator too.
>
> But yes, with CeleryExecutor it should be fine. Or if you don't care about LE+KPO. Not sure removing completely is the right call.
Yeah. For me it looks like maybe we should detect it when we need it and it is not set and provide a better diagnostics.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org