PreethamSanji opened a new pull request, #69954:
URL: https://github.com/apache/airflow/pull/69954
## Why
The chart hardcodes `key: connection` in the `secretKeyRef` for
`AIRFLOW__DATABASE__SQL_ALCHEMY_CONN`, `AIRFLOW_CONN_AIRFLOW_DB`,
`AIRFLOW__CELERY__RESULT_BACKEND`, and `AIRFLOW__CELERY__BROKER_URL`.
Externally managed secrets that store the connection string under a different
key cannot be used with `data.metadataSecretName` / `resultBackendSecretName` /
`brokerUrlSecretName` — the concrete case from the issue is CloudNativePG,
whose `Cluster` app secrets expose the connection URI under the `uri` key.
Builds on the approach from #54037, which was closed by the stale bot
without receiving review.
## What
- New values `data.metadataSecretKey`, `data.resultBackendSecretKey`,
`data.brokerUrlSecretKey`, all defaulting to `connection` — fully backward
compatible.
- One deliberate difference from #54037: the custom key **only applies when
the corresponding `*SecretName` is user-provided**. Applying it unconditionally
would break deployments, because the chart-created secrets
(`metadata-connection-secret.yaml`, `result-backend-connection-secret.yaml`,
`redis-secrets.yaml`) always write their data under the `connection` key — the
env refs would point at a key that doesn't exist. Implemented as three
`airflow_*_secret_key` named templates alongside the existing
`airflow_*_secret` name helpers.
- KEDA's `kedaConnection` key and the elasticsearch/opensearch host secrets
are intentionally out of scope: `kedaConnection` is a chart-managed key with
its own format contract, and the es/os secrets can be a follow-up if there's
interest (the issue is scoped to database credentials).
- Docs: note + CloudNativePG example in the production guide's Kubernetes
Secret section; schema and `values.yaml` comments updated.
## Tests
There was previously no test coverage asserting the `secretKeyRef` keys of
the built-in secret env vars, so this adds a regression guard for the default
`connection` behavior as well:
- default key remains `connection` when only `*SecretName` is set
- custom key is rendered for all consuming env vars when set together with
`*SecretName`
- custom key is ignored when the secret is chart-created (no `*SecretName`),
for all three secrets
closes: #57860
<!-- SPDX-License-Identifier: Apache-2.0
https://www.apache.org/licenses/LICENSE-2.0 -->
<!--
Thank you for contributing!
Please provide above a brief description of the changes made in this pull
request.
Write a good git commit message following this guide:
http://chris.beams.io/posts/git-commit/
Please make sure that your code changes are covered with tests.
And in case of new features or big changes remember to adjust the
documentation.
For user-facing UI changes, please attach before/after screenshots (or a
short
screen recording) so reviewers can assess the visual impact.
Feel free to ping (in general) for the review if you do not see reaction for
a few days
(72 Hours is the minimum reaction time you can expect from volunteers) - we
sometimes miss notifications.
In case of an existing issue, reference it using one of the following:
* closes: #ISSUE
* related: #ISSUE
-->
---
##### Was generative AI tooling used to co-author this PR?
<!--
If generative AI tooling has been used in the process of authoring this PR,
please
change below checkbox to `[X]` followed by the name of the tool, uncomment
the "Generated-by".
-->
- [x] Yes (please specify the tool below)
Claude Fable 5
Generated-by: [Claude Fable 5] following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
---
* Read the **[Pull Request
Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)**
for more information. Note: commit author/co-author name and email in commits
become permanently public when merged.
* For fundamental code changes, an Airflow Improvement Proposal
([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals))
is needed.
* When adding dependency, check compliance with the [ASF 3rd Party License
Policy](https://www.apache.org/legal/resolved.html#category-x).
* For significant user-facing changes create newsfragment:
`{pr_number}.significant.rst`, in
[airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments).
You can add this file in a follow-up commit after the PR is created so you
know the PR number.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
