Added support for job launcher

chart/templates/rbac/job-launcher-role.yaml

@@ -0,0 +1,67 @@
+{{/*
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements.  See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership.  The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License.  You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied.  See the License for the
+ specific language governing permissions and limitations
+ under the License.
+*/}}
+
+################################
+## Airflow Job Launcher Role
+#################################
+{{- if and .Values.rbac.create .Values.allowJobLaunching }}
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if .Values.multiNamespaceMode }}
+kind: ClusterRole
+{{- else }}
+kind: Role
+{{- end }}
+metadata:
+  {{- if not .Values.multiNamespaceMode }}
+  name: {{ include "airflow.fullname" . }}-job-launcher-role
+  namespace: "{{ .Release.Namespace }}"
+  {{- else }}
+  name: {{ .Release.Namespace }}-{{ include "airflow.fullname" . }}-job-launcher-role
+  {{- end }}
+  labels:
+    tier: airflow
+    release: {{ .Release.Name }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    heritage: {{ .Release.Service }}
+    {{- if .Values.multiNamespaceMode }}
+    namespace: "{{ .Release.Namespace }}"
+    {{- end }}
+    {{- with .Values.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+rules:
+  - apiGroups:
+      - "batch"
+    resources:
+      - "jobs"
+    verbs:
+      - "create"
+      - "list"
+      - "get"
+      - "patch"
+      - "watch"
+      - "delete"
+  - apiGroups:
+      - "batch"
+    resources:
+      - "jobs/status"
+    verbs:
+      - "get"
+      - watch"
+{{- end }}

chart/templates/rbac/job-launcher-rolebinding.yaml

@@ -0,0 +1,79 @@
+{{/*
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements.  See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership.  The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License.  You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied.  See the License for the
+ specific language governing permissions and limitations
+ under the License.
+*/}}
+
+################################
+## Airflow Job Launcher Role Binding
+#################################
+{{- if and .Values.rbac.create .Values.allowJobLaunching }}
+{{- $schedulerLaunchExecutors := list "LocalExecutor" "LocalKubernetesExecutor" "KubernetesExecutor" "CeleryKubernetesExecutor" }}
+{{- $workerLaunchExecutors := list "CeleryExecutor" "LocalKubernetesExecutor" "KubernetesExecutor" "CeleryKubernetesExecutor" }}
+{{- $executors := split "," .Values.executor }}
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if .Values.multiNamespaceMode }}
+kind: ClusterRoleBinding
+{{- else }}
+kind: RoleBinding
+{{- end }}
+metadata:
+  {{- if not .Values.multiNamespaceMode }}
+  namespace: "{{ .Release.Namespace }}"
+  name: {{ include "airflow.fullname" . }}-job-launcher-rolebinding
+  {{- else }}
+  name: {{ .Release.Namespace }}-{{ include "airflow.fullname" . }}-job-launcher-rolebinding
+  {{- end }}
+  labels:
+    tier: airflow
+    release: {{ .Release.Name }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    heritage: {{ .Release.Service }}
+    {{- if .Values.multiNamespaceMode }}
+    namespace: "{{ .Release.Namespace }}"
+    {{- end }}
+    {{- with .Values.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  {{- if .Values.multiNamespaceMode }}
+  kind: ClusterRole
+  name: {{ .Release.Namespace }}-{{ include "airflow.fullname" . }}-job-launcher-role
+  {{- else }}
+  kind: Role
+  name: {{ include "airflow.fullname" . }}-job-launcher-role
+  {{- end }}
+subjects:
+  {{- $schedulerAdded := false }}
+  {{- range $executor := $executors }}
+  {{- if and (has $executor $schedulerLaunchExecutors) (not $schedulerAdded) }}
+  {{- $schedulerAdded = true }}
+  - kind: ServiceAccount
+    name: {{ include "scheduler.serviceAccountName" $ }}
+    namespace: "{{ $.Release.Namespace }}"
+  {{- end }}
+  {{- end }}
+  {{- $workerAdded := false }}
+  {{- range $executor := $executors }}
+  {{- if and (has $executor $workerLaunchExecutors) (not $workerAdded) }}
+  {{- $workerAdded = true }}
+  - kind: ServiceAccount
+    name: {{ include "worker.serviceAccountName" $ }}
+    namespace: "{{ $.Release.Namespace }}"
+  {{- end }}
+  {{- end }}
+{{- end }}

chart/values.schema.json

@@ -695,6 +695,12 @@
             "x-docsSection": "Airflow",
             "default": true
         },
+        "allowJobLaunching": {
+            "description": "Whether various Airflow components launch jobs.",
+            "type": "boolean",
+            "x-docsSection": "Airflow",
+            "default": false
+        },
         "images": {
             "description": "Images.",
             "type": "object",

chart/values.yaml

@@ -379,6 +379,7 @@ executor: "CeleryExecutor"
 # If this is true and using CeleryExecutor/KubernetesExecutor/CeleryKubernetesExecutor, the workers
 # will be able to launch pods.
 allowPodLaunching: true
+allowJobLaunching: false
 
 # Environment variables for all airflow containers
 env: []

helm-tests/tests/helm_tests/airflow_aux/test_job_launcher_role.py

@@ -0,0 +1,117 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+from __future__ import annotations
+
+import jmespath
+import pytest
+from chart_utils.helm_template_generator import render_chart
+
+
+class TestJobLauncher:
+    """Tests job launcher RBAC."""
+
+    @pytest.mark.parametrize(
+        "executor, rbac, allow, expected_accounts",
+        [
+            ("CeleryKubernetesExecutor", True, True, ["scheduler", "worker"]),
+            ("KubernetesExecutor", True, True, ["scheduler", "worker"]),
+            ("CeleryExecutor", True, True, ["worker"]),
+            ("LocalExecutor", True, True, ["scheduler"]),
+            ("LocalExecutor", False, False, []),
+            ("CeleryExecutor,KubernetesExecutor", True, True, ["scheduler", "worker"]),
+        ],
+    )
+    def test_job_launcher_rolebinding(self, executor, rbac, allow, expected_accounts):
+        docs = render_chart(
+            values={
+                "rbac": {"create": rbac},
+                "allowJobLaunching": allow,
+                "executor": executor,
+            },
+            show_only=["templates/rbac/job-launcher-rolebinding.yaml"],
+        )
+        if expected_accounts:
+            for idx, suffix in enumerate(expected_accounts):
+                assert f"release-name-airflow-{suffix}" == jmespath.search(f"subjects[{idx}].name", docs[0])
+        else:
+            assert docs == []
+
+    @pytest.mark.parametrize(
+        "multiNamespaceMode, namespace, expectedRole, expectedRoleBinding",
+        [
+            (
+                True,
+                "namespace",
+                "namespace-release-name-job-launcher-role",
+                "namespace-release-name-job-launcher-rolebinding",
+            ),
+            (
+                True,
+                "other-ns",
+                "other-ns-release-name-job-launcher-role",
+                "other-ns-release-name-job-launcher-rolebinding",
+            ),
+            (False, "namespace", "release-name-job-launcher-role", "release-name-job-launcher-rolebinding"),
+        ],
+    )
+    def test_job_launcher_rolebinding_multi_namespace(
+        self, multiNamespaceMode, namespace, expectedRole, expectedRoleBinding
+    ):
+        docs = render_chart(
+            namespace=namespace,
+            values={"allowJobLaunching": True, "multiNamespaceMode": multiNamespaceMode},
+            show_only=["templates/rbac/job-launcher-rolebinding.yaml"],
+        )
+
+        actualRoleBinding = jmespath.search("metadata.name", docs[0])
+        assert actualRoleBinding == expectedRoleBinding
+
+        actualRoleRef = jmespath.search("roleRef.name", docs[0])
+        assert actualRoleRef == expectedRole
+
+        actualKind = jmespath.search("kind", docs[0])
+        actualRoleRefKind = jmespath.search("roleRef.kind", docs[0])
+        if multiNamespaceMode:
+            assert actualKind == "ClusterRoleBinding"
+            assert actualRoleRefKind == "ClusterRole"
+        else:
+            assert actualKind == "RoleBinding"
+            assert actualRoleRefKind == "Role"
+
+    @pytest.mark.parametrize(
+        "multiNamespaceMode, namespace, expectedRole",
+        [
+            (True, "namespace", "namespace-release-name-job-launcher-role"),
+            (True, "other-ns", "other-ns-release-name-job-launcher-role"),
+            (False, "namespace", "release-name-job-launcher-role"),
+        ],
+    )
+    def test_job_launcher_role_multi_namespace(self, multiNamespaceMode, namespace, expectedRole):
+        docs = render_chart(
+            namespace=namespace,
+            values={"allowJobLaunching": True, "multiNamespaceMode": multiNamespaceMode},
+            show_only=["templates/rbac/job-launcher-role.yaml"],
+        )
+
+        actualRole = jmespath.search("metadata.name", docs[0])
+        assert actualRole == expectedRole
+
+        actualKind = jmespath.search("kind", docs[0])
+        if multiNamespaceMode:
+            assert actualKind == "ClusterRole"
+        else:
+            assert actualKind == "Role"