This is an automated email from the ASF dual-hosted git repository.
Miretpl pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 53f6786a9ec Add startup probe for Kerberos worker sidecars (#71221)
53f6786a9ec is described below
commit 53f6786a9eca4b7a516c33148fc43c765af58106
Author: Aaron Chen <[email protected]>
AuthorDate: Sun Aug 16 03:31:14 2026 +0900
Add startup probe for Kerberos worker sidecars (#71221)
* Add startup probe for Kerberos worker sidecars
* Reject invalid Kerberos startup probe settings
---
chart/files/pod-template-file.kubernetes-helm-yaml | 9 +++
chart/templates/workers/worker-deployment.yaml | 9 +++
.../airflow_aux/test_pod_template_file.py | 70 ++++++++++++++++++++-
chart/tests/helm_tests/security/test_kerberos.py | 71 ++++++++++++++++++++-
chart/values.schema.json | 72 ++++++++++++++++++++++
chart/values.yaml | 18 ++++++
6 files changed, 247 insertions(+), 2 deletions(-)
diff --git a/chart/files/pod-template-file.kubernetes-helm-yaml
b/chart/files/pod-template-file.kubernetes-helm-yaml
index 76d7316ac15..e9ffea6e0fb 100644
--- a/chart/files/pod-template-file.kubernetes-helm-yaml
+++ b/chart/files/pod-template-file.kubernetes-helm-yaml
@@ -175,6 +175,15 @@ spec:
{{- end }}
args: ["kerberos"]
resources: {{- toYaml
.Values.workers.kubernetes.kerberosSidecar.resources | nindent 8 }}
+ {{- if .Values.workers.kubernetes.kerberosSidecar.startupProbe.enabled }}
+ startupProbe:
+ exec:
+ command: ["klist", "-s"]
+ timeoutSeconds: {{
.Values.workers.kubernetes.kerberosSidecar.startupProbe.timeoutSeconds }}
+ initialDelaySeconds: {{
.Values.workers.kubernetes.kerberosSidecar.startupProbe.initialDelaySeconds }}
+ periodSeconds: {{
.Values.workers.kubernetes.kerberosSidecar.startupProbe.periodSeconds }}
+ failureThreshold: {{
.Values.workers.kubernetes.kerberosSidecar.startupProbe.failureThreshold }}
+ {{- end }}
volumeMounts:
- name: logs
mountPath: {{ template "airflow_logs" . }}
diff --git a/chart/templates/workers/worker-deployment.yaml
b/chart/templates/workers/worker-deployment.yaml
index 536e73a216a..ea893150c3d 100644
--- a/chart/templates/workers/worker-deployment.yaml
+++ b/chart/templates/workers/worker-deployment.yaml
@@ -403,6 +403,15 @@ spec:
{{- end }}
args: ["kerberos"]
resources: {{- toYaml
.Values.workers.celery.kerberosSidecar.resources | nindent 12 }}
+ {{- if .Values.workers.celery.kerberosSidecar.startupProbe.enabled }}
+ startupProbe:
+ exec:
+ command: ["klist", "-s"]
+ timeoutSeconds: {{
.Values.workers.celery.kerberosSidecar.startupProbe.timeoutSeconds }}
+ initialDelaySeconds: {{
.Values.workers.celery.kerberosSidecar.startupProbe.initialDelaySeconds }}
+ periodSeconds: {{
.Values.workers.celery.kerberosSidecar.startupProbe.periodSeconds }}
+ failureThreshold: {{
.Values.workers.celery.kerberosSidecar.startupProbe.failureThreshold }}
+ {{- end }}
volumeMounts:
- name: logs
mountPath: {{ template "airflow_logs" . }}
diff --git a/chart/tests/helm_tests/airflow_aux/test_pod_template_file.py
b/chart/tests/helm_tests/airflow_aux/test_pod_template_file.py
index 42a776b5fb6..8958fa1e17c 100644
--- a/chart/tests/helm_tests/airflow_aux/test_pod_template_file.py
+++ b/chart/tests/helm_tests/airflow_aux/test_pod_template_file.py
@@ -22,7 +22,7 @@ from shutil import copyfile, copytree
import jmespath
import pytest
-from chart_utils.helm_template_generator import render_chart
+from chart_utils.helm_template_generator import HelmFailedError, render_chart
@pytest.fixture(scope="class")
@@ -1343,6 +1343,74 @@ class TestPodTemplateFile:
"allowPrivilegeEscalation": False
}
+ @pytest.mark.parametrize(
+ ("override", "expected"),
+ [
+ (
+ {},
+ {
+ "exec": {"command": ["klist", "-s"]},
+ "timeoutSeconds": 5,
+ "initialDelaySeconds": 0,
+ "periodSeconds": 10,
+ "failureThreshold": 6,
+ },
+ ),
+ (
+ {
+ "timeoutSeconds": 11,
+ "initialDelaySeconds": 12,
+ "periodSeconds": 13,
+ "failureThreshold": 14,
+ },
+ {
+ "exec": {"command": ["klist", "-s"]},
+ "timeoutSeconds": 11,
+ "initialDelaySeconds": 12,
+ "periodSeconds": 13,
+ "failureThreshold": 14,
+ },
+ ),
+ ({"enabled": False}, None),
+ ],
+ ids=["default", "custom", "disabled"],
+ )
+ def test_kerberos_sidecar_startup_probe(self, override, expected):
+ docs = render_chart(
+ values={
+ "workers": {"kubernetes": {"kerberosSidecar": {"enabled":
True, "startupProbe": override}}}
+ },
+ show_only=["templates/pod-template-file.yaml"],
+ chart_dir=self.temp_chart_dir,
+ )
+
+ assert (
+ jmespath.search("spec.containers[?name=='worker-kerberos'] |
[0].startupProbe", docs[0])
+ == expected
+ )
+
+ @pytest.mark.parametrize(
+ "override",
+ [
+ {"timeoutSeconds": 0},
+ {"initialDelaySeconds": -1},
+ {"periodSeconds": 0},
+ {"failureThreshold": 0},
+ ],
+ ids=["timeout", "initial-delay", "period", "failure-threshold"],
+ )
+ def test_kerberos_sidecar_startup_probe_rejects_invalid_values(self,
override):
+ with pytest.raises(HelmFailedError):
+ render_chart(
+ values={
+ "workers": {
+ "kubernetes": {"kerberosSidecar": {"enabled": True,
"startupProbe": override}}
+ }
+ },
+ show_only=["templates/pod-template-file.yaml"],
+ chart_dir=self.temp_chart_dir,
+ )
+
def test_kerberos_init_container_default(self):
docs = render_chart(
show_only=["templates/pod-template-file.yaml"],
diff --git a/chart/tests/helm_tests/security/test_kerberos.py
b/chart/tests/helm_tests/security/test_kerberos.py
index ad8bca57193..f8c1a79fbb2 100644
--- a/chart/tests/helm_tests/security/test_kerberos.py
+++ b/chart/tests/helm_tests/security/test_kerberos.py
@@ -19,7 +19,8 @@ from __future__ import annotations
import json
import jmespath
-from chart_utils.helm_template_generator import render_chart
+import pytest
+from chart_utils.helm_template_generator import HelmFailedError, render_chart
class TestKerberos:
@@ -153,3 +154,71 @@ class TestKerberos:
)
assert len(docs) == 0
+
+ @pytest.mark.parametrize(
+ ("override", "expected"),
+ [
+ (
+ {},
+ {
+ "exec": {"command": ["klist", "-s"]},
+ "timeoutSeconds": 5,
+ "initialDelaySeconds": 0,
+ "periodSeconds": 10,
+ "failureThreshold": 6,
+ },
+ ),
+ (
+ {
+ "timeoutSeconds": 11,
+ "initialDelaySeconds": 12,
+ "periodSeconds": 13,
+ "failureThreshold": 14,
+ },
+ {
+ "exec": {"command": ["klist", "-s"]},
+ "timeoutSeconds": 11,
+ "initialDelaySeconds": 12,
+ "periodSeconds": 13,
+ "failureThreshold": 14,
+ },
+ ),
+ ({"enabled": False}, None),
+ ],
+ ids=["default", "custom", "disabled"],
+ )
+ def test_kerberos_sidecar_startup_probe(self, override, expected):
+ docs = render_chart(
+ values={
+ "executor": "CeleryExecutor",
+ "workers": {"celery": {"kerberosSidecar": {"enabled": True,
"startupProbe": override}}},
+ },
+ show_only=["templates/workers/worker-deployment.yaml"],
+ )
+
+ assert (
+ jmespath.search(
+ "spec.template.spec.containers[?name=='worker-kerberos'] |
[0].startupProbe", docs[0]
+ )
+ == expected
+ )
+
+ @pytest.mark.parametrize(
+ "override",
+ [
+ {"timeoutSeconds": 0},
+ {"initialDelaySeconds": -1},
+ {"periodSeconds": 0},
+ {"failureThreshold": 0},
+ ],
+ ids=["timeout", "initial-delay", "period", "failure-threshold"],
+ )
+ def test_kerberos_sidecar_startup_probe_rejects_invalid_values(self,
override):
+ with pytest.raises(HelmFailedError):
+ render_chart(
+ values={
+ "executor": "CeleryExecutor",
+ "workers": {"celery": {"kerberosSidecar": {"enabled":
True, "startupProbe": override}}},
+ },
+ show_only=["templates/workers/worker-deployment.yaml"],
+ )
diff --git a/chart/values.schema.json b/chart/values.schema.json
index 63d12f58b20..8ff8f46f264 100644
--- a/chart/values.schema.json
+++ b/chart/values.schema.json
@@ -2111,6 +2111,42 @@
"type": "boolean",
"default": false
},
+ "startupProbe": {
+ "description": "Startup probe for the
Kerberos worker sidecar (runs `klist -s`).",
+ "type": "object",
+ "additionalProperties": false,
+ "properties": {
+ "enabled": {
+ "description": "Enable the
Kerberos sidecar startup probe. Disable for custom images without `klist`.",
+ "type": "boolean",
+ "default": true
+ },
+ "timeoutSeconds": {
+ "description": "Number of seconds
after which the probe times out.",
+ "type": "integer",
+ "default": 5,
+ "minimum": 1
+ },
+ "initialDelaySeconds": {
+ "description": "Number of seconds
after the container has started before the startup probe is initiated.",
+ "type": "integer",
+ "default": 0,
+ "minimum": 0
+ },
+ "periodSeconds": {
+ "description": "How often (in
seconds) to perform the probe.",
+ "type": "integer",
+ "default": 10,
+ "minimum": 1
+ },
+ "failureThreshold": {
+ "description": "Number of
consecutive failures required for the startup probe to fail.",
+ "type": "integer",
+ "default": 6,
+ "minimum": 1
+ }
+ }
+ },
"resources": {
"description": "Resources on kerberos
sidecar.",
"type": "object",
@@ -2859,6 +2895,42 @@
"type": "boolean",
"default": false
},
+ "startupProbe": {
+ "description": "Startup probe for the
Kerberos worker sidecar (runs `klist -s`).",
+ "type": "object",
+ "additionalProperties": false,
+ "properties": {
+ "enabled": {
+ "description": "Enable the
Kerberos sidecar startup probe. Disable for custom images without `klist`.",
+ "type": "boolean",
+ "default": true
+ },
+ "timeoutSeconds": {
+ "description": "Number of seconds
after which the probe times out.",
+ "type": "integer",
+ "default": 5,
+ "minimum": 1
+ },
+ "initialDelaySeconds": {
+ "description": "Number of seconds
after the container has started before the startup probe is initiated.",
+ "type": "integer",
+ "default": 0,
+ "minimum": 0
+ },
+ "periodSeconds": {
+ "description": "How often (in
seconds) to perform the probe.",
+ "type": "integer",
+ "default": 10,
+ "minimum": 1
+ },
+ "failureThreshold": {
+ "description": "Number of
consecutive failures required for the startup probe to fail.",
+ "type": "integer",
+ "default": 6,
+ "minimum": 1
+ }
+ }
+ },
"resources": {
"description": "Resources on kerberos
sidecar.",
"type": "object",
diff --git a/chart/values.yaml b/chart/values.yaml
index 409dc691a70..c1ebe441a77 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -839,6 +839,15 @@ workers:
# Container level lifecycle hooks
containerLifecycleHooks: {}
+ # Startup probe for the kerberos sidecar: `klist -s` succeeds once the
credential
+ # cache holds a valid, unexpired ticket. Disable for custom images
without `klist`.
+ startupProbe:
+ enabled: true
+ timeoutSeconds: 5
+ initialDelaySeconds: 0
+ periodSeconds: 10
+ failureThreshold: 6
+
# Kerberos init container configuration for Airflow Celery workers
# If not set, the values from `workers.kerberosInitContainer` section will
be used.
kerberosInitContainer:
@@ -1086,6 +1095,15 @@ workers:
# Container level lifecycle hooks
containerLifecycleHooks: {}
+ # Startup probe for the kerberos sidecar: `klist -s` succeeds once the
credential
+ # cache holds a valid, unexpired ticket. Disable for custom images
without `klist`.
+ startupProbe:
+ enabled: true
+ timeoutSeconds: 5
+ initialDelaySeconds: 0
+ periodSeconds: 10
+ failureThreshold: 6
+
# Kerberos init container configuration for pods created with
pod-template-file
# If not set, the values from `workers.kerberosInitContainer` section will
be used.
kerberosInitContainer:
