This is an automated email from the ASF dual-hosted git repository.
jscheffl pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new d41310a2901 [Helm-Chart] BugFix: Wrong broker URL secret ref (#65006)
d41310a2901 is described below
commit d41310a290106e7a23b629d4159f7e01da254fb0
Author: Desdroid <[email protected]>
AuthorDate: Mon Apr 20 21:05:35 2026 +0200
[Helm-Chart] BugFix: Wrong broker URL secret ref (#65006)
* Fix: Helm Chart uses wrong broker url secret ref
* Add test for redis supporting fullnameOverride
* Remove outdated note that was invalidated with #52953
* Add newsfragment
---
chart/newsfragments/65006.bugfix.rst | 1 +
chart/templates/_helpers.yaml | 6 +++-
chart/templates/secrets/redis-secrets.yaml | 4 +--
chart/values.yaml | 3 --
helm-tests/tests/helm_tests/other/test_redis.py | 45 ++++++++++++++++++++++---
5 files changed, 48 insertions(+), 11 deletions(-)
diff --git a/chart/newsfragments/65006.bugfix.rst
b/chart/newsfragments/65006.bugfix.rst
new file mode 100644
index 00000000000..0d76979fb74
--- /dev/null
+++ b/chart/newsfragments/65006.bugfix.rst
@@ -0,0 +1 @@
+Fixed broker URL secret name resolution to use ``airflow.fullname``
consistently. This fixes deployments where ``useStandardNaming=True`` and
``airflow.fullname != .Release.Name``, for example when using
``fullnameOverride``, ``nameOverride``, or the Airflow Helm chart as a
dependency.
diff --git a/chart/templates/_helpers.yaml b/chart/templates/_helpers.yaml
index ef120699389..53017f7c3ed 100644
--- a/chart/templates/_helpers.yaml
+++ b/chart/templates/_helpers.yaml
@@ -130,7 +130,7 @@ If release name contains chart name it will be used as a
full name.
- name: AIRFLOW__CELERY__BROKER_URL
valueFrom:
secretKeyRef:
- name: {{ default (printf "%s-broker-url" .Release.Name)
.Values.data.brokerUrlSecretName }}
+ name: {{ template "airflow_broker_url_secret" . }}
key: connection
{{- end }}
{{- end }}
@@ -431,6 +431,10 @@ If release name contains chart name it will be used as a
full name.
{{- default (printf "%s-redis-password" (include "airflow.fullname" .))
.Values.redis.passwordSecretName }}
{{- end }}
+{{- define "airflow_broker_url_secret" -}}
+ {{- default (printf "%s-broker-url" (include "airflow.fullname" .))
.Values.data.brokerUrlSecretName }}
+{{- end }}
+
{{- define "airflow_metadata_secret" -}}
{{- default (printf "%s-metadata" (include "airflow.fullname" .))
.Values.data.metadataSecretName }}
{{- end }}
diff --git a/chart/templates/secrets/redis-secrets.yaml
b/chart/templates/secrets/redis-secrets.yaml
index 793b5e2e20a..3d248eaebc3 100644
--- a/chart/templates/secrets/redis-secrets.yaml
+++ b/chart/templates/secrets/redis-secrets.yaml
@@ -33,7 +33,7 @@
apiVersion: v1
kind: Secret
metadata:
- name: {{ include "airflow.fullname" . }}-redis-password
+ name: {{ include "redis_password_secret" . }}
labels:
tier: airflow
component: redis
@@ -62,7 +62,7 @@ data:
apiVersion: v1
kind: Secret
metadata:
- name: {{ include "airflow.fullname" . }}-broker-url
+ name: {{ include "airflow_broker_url_secret" . }}
labels:
tier: airflow
component: redis
diff --git a/chart/values.yaml b/chart/values.yaml
index 35620dae410..6a0314a38cc 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -34,9 +34,6 @@ nameOverride: ""
# For existing installations, this will rename and redeploy your resources
with the new names. Be aware that
# this will recreate your Deployment/StatefulSets along with their persistent
volume claims and data storage
# migration may be needed to keep your old data
-#
-# Note:fernet-key,redis-password and broker-url secrets don't use this logic
yet,
-# As this may break existing installations due to how they get installed via
pre-install hook.
useStandardNaming: false
# Max number of old replicasets to retain. Can be overridden by each
Deployment's revisionHistoryLimit
diff --git a/helm-tests/tests/helm_tests/other/test_redis.py
b/helm-tests/tests/helm_tests/other/test_redis.py
index 3527547d601..a89f0468f13 100644
--- a/helm-tests/tests/helm_tests/other/test_redis.py
+++ b/helm-tests/tests/helm_tests/other/test_redis.py
@@ -56,8 +56,10 @@ class TestRedis:
return password_in_obj
@staticmethod
- def get_broker_url_secret_in_deployment(k8s_obj_by_key, kind: str, name:
str) -> str:
- deployment_obj = k8s_obj_by_key[(kind, f"{RELEASE_NAME_REDIS}-{name}")]
+ def get_broker_url_secret_in_deployment(
+ k8s_obj_by_key, kind: str, name: str, airflow_fullname: str =
RELEASE_NAME_REDIS
+ ) -> str:
+ deployment_obj = k8s_obj_by_key[(kind, f"{airflow_fullname}-{name}")]
containers = deployment_obj["spec"]["template"]["spec"]["containers"]
container = next(obj for obj in containers if obj["name"] == name)
@@ -82,14 +84,17 @@ class TestRedis:
assert REDIS_OBJECTS["SECRET_BROKER_URL"] not in
k8s_obj_by_key.keys()
def assert_broker_url_env(
- self, k8s_obj_by_key,
expected_broker_url_secret_name=REDIS_OBJECTS["SECRET_BROKER_URL"][1]
+ self,
+ k8s_obj_by_key,
+ expected_broker_url_secret_name=REDIS_OBJECTS["SECRET_BROKER_URL"][1],
+ airflow_fullname: str = RELEASE_NAME_REDIS,
):
broker_url_secret_in_scheduler =
self.get_broker_url_secret_in_deployment(
- k8s_obj_by_key, "StatefulSet", "worker"
+ k8s_obj_by_key, "Deployment", "scheduler", airflow_fullname
)
assert broker_url_secret_in_scheduler ==
expected_broker_url_secret_name
broker_url_secret_in_worker = self.get_broker_url_secret_in_deployment(
- k8s_obj_by_key, "Deployment", "scheduler"
+ k8s_obj_by_key, "StatefulSet", "worker", airflow_fullname
)
assert broker_url_secret_in_worker == expected_broker_url_secret_name
@@ -276,6 +281,36 @@ class TestRedis:
self.assert_broker_url_env(k8s_obj_by_key,
expected_broker_url_secret_name)
+ @pytest.mark.parametrize("executor", CELERY_EXECUTORS_PARAMS)
+ def test_redis_secrets_support_fullname_override(self, executor):
+ fullname_override = "redis-fullname-override"
+ fullname_override_objects = {
+ "NETWORK_POLICY": ("NetworkPolicy",
f"{fullname_override}-redis-policy"),
+ "SERVICE": ("Service", f"{fullname_override}-redis"),
+ "STATEFUL_SET": ("StatefulSet", f"{fullname_override}-redis"),
+ "SECRET_PASSWORD": ("Secret",
f"{fullname_override}-redis-password"),
+ "SECRET_BROKER_URL": ("Secret", f"{fullname_override}-broker-url"),
+ }
+
+ k8s_objects = render_chart(
+ RELEASE_NAME_REDIS,
+ {
+ "fullnameOverride": fullname_override,
+ "useStandardNaming": True,
+ "networkPolicies": {"enabled": True},
+ "executor": executor,
+ "redis": {"enabled": True},
+ },
+ )
+ k8s_obj_by_key = prepare_k8s_lookup_dict(k8s_objects)
+ created_redis_objects = set(fullname_override_objects.values()) &
set(k8s_obj_by_key.keys())
+ assert created_redis_objects == set(fullname_override_objects.values())
+ self.assert_broker_url_env(
+ k8s_obj_by_key,
+
expected_broker_url_secret_name=fullname_override_objects["SECRET_BROKER_URL"][1],
+ airflow_fullname=fullname_override,
+ )
+
def test_default_redis_secrets_created_with_non_celery_executor(self):
# We want to make sure default redis secrets (if needed) are still
# created during install, as they are marked "pre-install".
