You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by js...@apache.org on 2026/05/01 21:31:01 UTC
(airflow) branch chart/v1-2x-test updated: [chart/v1-2x-test] Fix launcher RBAC for executor class paths (#66208) (#66240)
This is an automated email from the ASF dual-hosted git repository.
jscheffl pushed a commit to branch chart/v1-2x-test
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/chart/v1-2x-test by this push:
new f43c67949b6 [chart/v1-2x-test] Fix launcher RBAC for executor class paths (#66208) (#66240)
f43c67949b6 is described below
commit f43c67949b6f3be04dee177049c091ca1d994375
Author: github-actions[bot] <41...@users.noreply.github.com>
AuthorDate: Fri May 1 23:30:53 2026 +0200
[chart/v1-2x-test] Fix launcher RBAC for executor class paths (#66208) (#66240)
(cherry picked from commit 8f5ac08c439758289fa236df958def266a5b312c)
Co-authored-by: Henry Chen <he...@gmail.com>
---
chart/templates/rbac/job-launcher-rolebinding.yaml | 6 ++++--
chart/templates/rbac/pod-launcher-rolebinding.yaml | 6 ++++--
.../helm_tests/airflow_aux/test_job_launcher_role.py | 19 +++++++++++++++++++
.../helm_tests/airflow_aux/test_pod_launcher_role.py | 19 +++++++++++++++++++
4 files changed, 46 insertions(+), 4 deletions(-)
diff --git a/chart/templates/rbac/job-launcher-rolebinding.yaml b/chart/templates/rbac/job-launcher-rolebinding.yaml
index 6b80e319646..7fd321d1ce6 100644
--- a/chart/templates/rbac/job-launcher-rolebinding.yaml
+++ b/chart/templates/rbac/job-launcher-rolebinding.yaml
@@ -59,7 +59,8 @@ roleRef:
{{- end }}
subjects:
{{- range $executor := $executors }}
- {{- if has $executor $schedulerLaunchExecutors }}
+ {{- $executorClass := last (splitList "." ($executor | trim)) }}
+ {{- if has $executorClass $schedulerLaunchExecutors }}
- kind: ServiceAccount
name: {{ include "scheduler.serviceAccountName" $ }}
namespace: "{{ $.Release.Namespace }}"
@@ -67,7 +68,8 @@ subjects:
{{- end }}
{{- end }}
{{- range $executor := $executors }}
- {{- if has $executor $workerLaunchExecutors }}
+ {{- $executorClass := last (splitList "." ($executor | trim)) }}
+ {{- if has $executorClass $workerLaunchExecutors }}
- kind: ServiceAccount
name: {{ include "worker.serviceAccountName" $ }}
namespace: "{{ $.Release.Namespace }}"
diff --git a/chart/templates/rbac/pod-launcher-rolebinding.yaml b/chart/templates/rbac/pod-launcher-rolebinding.yaml
index d4eb37af051..f3f772c4f76 100644
--- a/chart/templates/rbac/pod-launcher-rolebinding.yaml
+++ b/chart/templates/rbac/pod-launcher-rolebinding.yaml
@@ -59,7 +59,8 @@ roleRef:
{{- end }}
subjects:
{{- range $executor := $executors }}
- {{- if has $executor $schedulerLaunchExecutors }}
+ {{- $executorClass := last (splitList "." ($executor | trim)) }}
+ {{- if has $executorClass $schedulerLaunchExecutors }}
- kind: ServiceAccount
name: {{ include "scheduler.serviceAccountName" $ }}
namespace: "{{ $.Release.Namespace }}"
@@ -67,7 +68,8 @@ subjects:
{{- end }}
{{- end }}
{{- range $executor := $executors }}
- {{- if has $executor $workerLaunchExecutors }}
+ {{- $executorClass := last (splitList "." ($executor | trim)) }}
+ {{- if has $executorClass $workerLaunchExecutors }}
- kind: ServiceAccount
name: {{ include "worker.serviceAccountName" $ }}
namespace: "{{ $.Release.Namespace }}"
diff --git a/helm-tests/tests/helm_tests/airflow_aux/test_job_launcher_role.py b/helm-tests/tests/helm_tests/airflow_aux/test_job_launcher_role.py
index 5557f2c2c67..056cc81d239 100644
--- a/helm-tests/tests/helm_tests/airflow_aux/test_job_launcher_role.py
+++ b/helm-tests/tests/helm_tests/airflow_aux/test_job_launcher_role.py
@@ -29,10 +29,29 @@ class TestJobLauncher:
[
("CeleryKubernetesExecutor", True, True, ["scheduler", "worker"]),
("KubernetesExecutor", True, True, ["scheduler", "worker"]),
+ (
+ "airflow.providers.cncf.kubernetes.executors.kubernetes_executor.KubernetesExecutor",
+ True,
+ True,
+ ["scheduler", "worker"],
+ ),
("CeleryExecutor", True, True, ["worker"]),
+ (
+ "airflow.providers.celery.executors.celery_executor.CeleryExecutor",
+ True,
+ True,
+ ["worker"],
+ ),
("LocalExecutor", True, True, ["scheduler"]),
+ ("airflow.executors.local_executor.LocalExecutor", True, True, ["scheduler"]),
("LocalExecutor", False, False, []),
("CeleryExecutor,KubernetesExecutor", True, True, ["scheduler", "worker"]),
+ (
+ "CeleryExecutor,airflow.providers.cncf.kubernetes.executors.kubernetes_executor.KubernetesExecutor",
+ True,
+ True,
+ ["scheduler", "worker"],
+ ),
],
)
def test_job_launcher_rolebinding(self, executor, rbac, allow, expected_accounts):
diff --git a/helm-tests/tests/helm_tests/airflow_aux/test_pod_launcher_role.py b/helm-tests/tests/helm_tests/airflow_aux/test_pod_launcher_role.py
index f51b7f0d6a9..744d2d2ede4 100644
--- a/helm-tests/tests/helm_tests/airflow_aux/test_pod_launcher_role.py
+++ b/helm-tests/tests/helm_tests/airflow_aux/test_pod_launcher_role.py
@@ -29,10 +29,29 @@ class TestPodLauncher:
[
("CeleryKubernetesExecutor", True, True, ["scheduler", "worker"]),
("KubernetesExecutor", True, True, ["scheduler", "worker"]),
+ (
+ "airflow.providers.cncf.kubernetes.executors.kubernetes_executor.KubernetesExecutor",
+ True,
+ True,
+ ["scheduler", "worker"],
+ ),
("CeleryExecutor", True, True, ["worker"]),
+ (
+ "airflow.providers.celery.executors.celery_executor.CeleryExecutor",
+ True,
+ True,
+ ["worker"],
+ ),
("LocalExecutor", True, True, ["scheduler"]),
+ ("airflow.executors.local_executor.LocalExecutor", True, True, ["scheduler"]),
("LocalExecutor", False, False, []),
("CeleryExecutor,KubernetesExecutor", True, True, ["scheduler", "worker"]),
+ (
+ "CeleryExecutor,airflow.providers.cncf.kubernetes.executors.kubernetes_executor.KubernetesExecutor",
+ True,
+ True,
+ ["scheduler", "worker"],
+ ),
],
)
def test_pod_launcher_role(self, executor, rbac, allow, expected_accounts):