rohan9446 opened a new pull request, #70896:
URL: https://github.com/apache/airflow/pull/70896
`AIRFLOW__API_AUTH__JWT_SECRET` was rendered from inside the
`standard_airflow_environment` helper behind an `IncludeJwtSecret` flag,
which
meant every component had to opt out of it explicitly with
`(merge (dict "IncludeJwtSecret" false) .)`.
This moves the variable into its own `jwt_secret_environment` helper,
following
the shape of the existing `keda_airflow_environment` helper, and includes it
only in the two containers that actually need it — the API server and the
scheduler. Every other caller of `standard_airflow_environment` passes a
plain
context again, and the `IncludeJwtSecret` context mutation is gone entirely.
What this changes:
- Removes the `IncludeJwtSecret` plumbing from `standard_airflow_environment`
and from all ten call sites.
- Makes secret exposure explicit at the API server and scheduler call sites
rather than implicit in a shared helper.
- Preserves the least-privilege behaviour introduced in #63204:
migration/init
containers, workers, the triggerer and the DAG processor still do not
receive
the raw signing secret.
- Adds regression coverage asserting the secret appears in the API server and
scheduler containers exactly once, and never in sidecars or init
containers.
No behavioural change: the same containers receive the same variable, still
gated on `enableBuiltInSecretEnvVars.AIRFLOW__API_AUTH__JWT_SECRET`. The only
difference in rendered output is the position of the variable within the env
list, so the ordered assertion in `test_have_all_variables` is updated to
match.
Tested locally with helm v3.21.3: `pytest chart/tests/helm_tests/` → 2108
passed.
closes: #70843
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (please specify the tool below)
Generated-by: Claude (Cowork) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
