[PR] Apply Default Security Context to OTel Collector Container [airflow]

["deepnemesis (via GitHub)" <gi...@apache.org>]

deepnemesis opened a new pull request, #74268:
URL: https://github.com/apache/airflow/pull/74268

   Apply the chart's existing external-container security-context defaults to the
   OTel Collector.
   
   By default, the rendered collector container now:
   
   - sets `allowPrivilegeEscalation: false`
   - drops all Linux capabilities
   
   Explicit `otelCollector.securityContexts.container` values remain authoritative.
   Setting `securityContexts.disableDefaults: true` continues to omit the defaults.
   The OTel Collector pod security context is unchanged.
   
   Helm rendering tests cover the default context and disabled-default behavior.
   The values documentation and schema description have also been updated.
   
   `git diff --check` passes and `values.schema.json` is valid. The targeted tests
   could not run locally because Windows dependency setup requires Microsoft Visual
   C++ to build `python-ldap`; CI will execute the chart test suite.
   
   closes: #74265


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Apply Default Security Context to OTel Collector Container [airflow]

["boring-cyborg[bot] (via GitHub)" <gi...@apache.org>]

boring-cyborg[bot] commented on PR #74268:
URL: https://github.com/apache/airflow/pull/74268#issuecomment-5997131626

   Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our [Contributors' Guide](https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
   Here are some useful points:
   - Pay attention to the quality of your code (ruff, mypy and type annotations). Our [prek-hooks]( https://github.com/apache/airflow/blob/main/contributing-docs/08_static_code_checks.rst#prerequisites-for-prek-hooks) will help you with that.
   - In case of a new feature add useful documentation (in docstrings or in `docs/` directory). Adding a new operator? Check this short [guide](https://github.com/apache/airflow/blob/main/airflow-core/docs/howto/custom-operator.rst) Consider adding an example Dag that shows how users should use it.
   - Consider using [Breeze environment](https://github.com/apache/airflow/blob/main/dev/breeze/doc/README.rst) for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
   - Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
   - Please follow [ASF Code of Conduct](https://www.apache.org/foundation/policies/conduct) for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
   - Be sure to read the [Airflow Coding style]( https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#coding-style-and-best-practices).
   - Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
   Apache Airflow is a community-driven project and together we are making it better 🚀.
   In case of doubts contact the developers at:
   Mailing List: dev@airflow.apache.org
   Slack: https://s.apache.org/airflow-slack
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org