Add workers.celery.securityContexts & workers.kubernetes.securityContexts

chart/files/pod-template-file.kubernetes-helm-yaml

@@ -21,10 +21,10 @@
 {{- $affinity := or .Values.workers.affinity .Values.affinity }}
 {{- $tolerations := or .Values.workers.tolerations .Values.tolerations }}
 {{- $topologySpreadConstraints := or .Values.workers.topologySpreadConstraints .Values.topologySpreadConstraints }}
-{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.workers) }}
-{{- $containerSecurityContextKerberosSidecar := include "containerSecurityContext" (list . .Values.workers.kerberosSidecar) }}
+{{- $securityContext := include "airflowPodSecurityContext" (list .Values.workers.kubernetes .Values.workers .Values) }}
+{{- $containerSecurityContextKerberosSidecar := include "containerSecurityContext" (list .Values.workers.kerberosSidecar .Values) }}
 {{- $containerLifecycleHooksKerberosSidecar := or .Values.workers.kerberosSidecar.containerLifecycleHooks .Values.containerLifecycleHooks }}
-{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.workers) }}
+{{- $containerSecurityContext := include "containerSecurityContext" (list .Values.workers.kubernetes .Values.workers .Values) }}
 {{- $containerLifecycleHooks := or .Values.workers.containerLifecycleHooks .Values.containerLifecycleHooks }}
 {{- $safeToEvict := dict "cluster-autoscaler.kubernetes.io/safe-to-evict" (.Values.workers.safeToEvict | toString) }}
 {{- $podAnnotations := mergeOverwrite (deepCopy .Values.airflowPodAnnotations) $safeToEvict .Values.workers.podAnnotations }}

chart/templates/_helpers.yaml

@@ -941,26 +941,30 @@ Values are not accumulated meaning that if runAsUser is set to 10 in <node>.secu
 any extra values set to securityContext or uid+gid will be ignored.
 
 The template can be called like so:
-   include "airflowPodSecurityContext" (list . .Values.webserver)
+   include "airflowPodSecurityContext" (list .Values.webserver .Values)
 
-Where `.` is the global variables scope and `.Values.webserver` the local variables scope for the webserver template.
+Where `.Values` is the global variables scope and `.Values.webserver` the local variables scope for the webserver template.
+Priority of values are from left to right, meaning if first value is not empty, the rest will not be evaluated.
 */}}
-{{- define "airflowPodSecurityContext" -}}
-  {{- $ := index . 0 -}}
-  {{- with index . 1 }}
-    {{- if .securityContexts.pod -}}
-      {{ toYaml .securityContexts.pod | print }}
-    {{- else if .securityContext -}}
-      {{ toYaml .securityContext | print }}
-    {{- else if $.Values.securityContexts.pod -}}
-      {{ toYaml $.Values.securityContexts.pod | print }}
-    {{- else if $.Values.securityContext -}}
-      {{ toYaml $.Values.securityContext | print }}
-    {{- else -}}
-runAsUser: {{ $.Values.uid }}
-fsGroup: {{ $.Values.gid }}
+{{- define "airflowPodSecurityContext" }}
+  {{- $ := last . }}
+  {{- $result := dict }}
+  {{- range . }}
+    {{- if and (hasKey . "securityContexts") (hasKey .securityContexts "pod") .securityContexts.pod }}
+      {{- $result = .securityContexts.pod }}
+      {{- break }}
+    {{- end }}
+    {{- if and (hasKey . "securityContext") .securityContext }}
+      {{- $result = .securityContext }}
+      {{- break }}
     {{- end }}
   {{- end }}
+  {{- if $result }}
+    {{- toYaml $result | print }}
+  {{- else }}
+runAsUser: {{ $.uid }}
+fsGroup: {{ $.gid }}
+  {{- end }}
 {{- end }}
 
 {{/*
@@ -1052,24 +1056,30 @@ If no value is passed for securityContexts.container or <node>.securityContexts.
     +-----------------------------------+      +----------------------------+      +-----------------------------------------------------------+
 
 The template can be called like so:
-   include "containerSecurityContext" (list . .Values.webserver)
+   include "containerSecurityContext" (list .Values.webserver .Values)
 
-Where `.` is the global variables scope and `.Values.webserver` the local variables scope for the webserver template.
+Where `.Values` is the global variables scope and `.Values.webserver` the local variables scope for the webserver template.
+Priority of values are from left to right, meaning if first value is not empty, the rest will not be evaluated.
 */}}
 {{- define "containerSecurityContext" -}}
-  {{- $ := index . 0 -}}
-  {{- with index . 1 }}
-    {{- if .securityContexts.container -}}
-      {{ toYaml .securityContexts.container | print }}
-    {{- else if $.Values.securityContexts.containers -}}
-      {{ toYaml $.Values.securityContexts.containers | print }}
-    {{- else -}}
+  {{- $ := last . }}
+  {{- $result := dict }}
+  {{- range . }}
+    {{- if and (hasKey . "securityContexts") (hasKey .securityContexts "container") .securityContexts.container }}
+      {{- $result = .securityContexts.container }}
+      {{- break }}
+    {{- end }}
+  {{- end }}
+  {{- if $result }}
+    {{- toYaml $result | print }}
+  {{- else if and (hasKey $ "securityContexts") (hasKey $.securityContexts "containers") $.securityContexts.containers }}
+    {{- toYaml $.securityContexts.containers | print }}
+  {{- else -}}
 allowPrivilegeEscalation: false
 capabilities:
   drop:
     - ALL
-    {{- end -}}
-  {{- end -}}
+  {{- end }}
 {{- end -}}
 
 {{/*

chart/templates/api-server/api-server-deployment.yaml

@@ -26,9 +26,9 @@
 {{- $tolerations := or .Values.apiServer.tolerations .Values.tolerations }}
 {{- $topologySpreadConstraints := or .Values.apiServer.topologySpreadConstraints .Values.topologySpreadConstraints }}
 {{- $revisionHistoryLimit := include "airflow.revisionHistoryLimit" (list .Values.apiServer.revisionHistoryLimit .Values.revisionHistoryLimit) }}
-{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.apiServer) }}
-{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.apiServer) }}
-{{- $containerSecurityContextWaitForMigrations := include "containerSecurityContext" (list . .Values.apiServer.waitForMigrations) }}
+{{- $securityContext := include "airflowPodSecurityContext" (list .Values.apiServer .Values) }}
+{{- $containerSecurityContext := include "containerSecurityContext" (list .Values.apiServer .Values) }}
+{{- $containerSecurityContextWaitForMigrations := include "containerSecurityContext" (list .Values.apiServer.waitForMigrations .Values) }}
 {{- $containerLifecycleHooks := or .Values.apiServer.containerLifecycleHooks .Values.containerLifecycleHooks }}
 apiVersion: apps/v1
 kind: Deployment

chart/templates/cleanup/cleanup-cronjob.yaml

@@ -25,8 +25,8 @@
 {{- $affinity := or .Values.cleanup.affinity .Values.affinity }}
 {{- $tolerations := or .Values.cleanup.tolerations .Values.tolerations }}
 {{- $topologySpreadConstraints := or .Values.cleanup.topologySpreadConstraints .Values.topologySpreadConstraints }}
-{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.cleanup) }}
-{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.cleanup) }}
+{{- $securityContext := include "airflowPodSecurityContext" (list .Values.cleanup .Values) }}
+{{- $containerSecurityContext := include "containerSecurityContext" (list .Values.cleanup .Values) }}
 apiVersion: batch/v1
 kind: CronJob
 metadata:

chart/templates/dag-processor/dag-processor-deployment.yaml

@@ -31,10 +31,10 @@
 {{- $tolerations := or .Values.dagProcessor.tolerations .Values.tolerations }}
 {{- $topologySpreadConstraints := or .Values.dagProcessor.topologySpreadConstraints .Values.topologySpreadConstraints }}
 {{- $revisionHistoryLimit := include "airflow.revisionHistoryLimit" (list .Values.dagProcessor.revisionHistoryLimit .Values.revisionHistoryLimit) }}
-{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.dagProcessor) }}
-{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.dagProcessor) }}
-{{- $containerSecurityContextLogGroomerSidecar := include "containerSecurityContext" (list . .Values.dagProcessor.logGroomerSidecar) }}
-{{- $containerSecurityContextWaitForMigrations := include "containerSecurityContext" (list . .Values.dagProcessor.waitForMigrations) }}
+{{- $securityContext := include "airflowPodSecurityContext" (list .Values.dagProcessor .Values) }}
+{{- $containerSecurityContext := include "containerSecurityContext" (list .Values.dagProcessor .Values) }}
+{{- $containerSecurityContextLogGroomerSidecar := include "containerSecurityContext" (list .Values.dagProcessor.logGroomerSidecar .Values) }}
+{{- $containerSecurityContextWaitForMigrations := include "containerSecurityContext" (list .Values.dagProcessor.waitForMigrations .Values) }}
 {{- $containerLifecycleHooks := or .Values.dagProcessor.containerLifecycleHooks .Values.containerLifecycleHooks }}
 apiVersion: apps/v1
 kind: Deployment

chart/templates/database-cleanup/database-cleanup-cronjob.yaml

@@ -25,8 +25,8 @@
 {{- $affinity := or .Values.databaseCleanup.affinity .Values.affinity }}
 {{- $tolerations := or .Values.databaseCleanup.tolerations .Values.tolerations }}
 {{- $topologySpreadConstraints := or .Values.databaseCleanup.topologySpreadConstraints .Values.topologySpreadConstraints }}
-{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.databaseCleanup) }}
-{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.databaseCleanup) }}
+{{- $securityContext := include "airflowPodSecurityContext" (list .Values.databaseCleanup .Values) }}
+{{- $containerSecurityContext := include "containerSecurityContext" (list .Values.databaseCleanup .Values) }}
 apiVersion: batch/v1
 kind: CronJob
 metadata:

chart/templates/flower/flower-deployment.yaml

@@ -27,8 +27,8 @@
 {{- $tolerations := or .Values.flower.tolerations .Values.tolerations }}
 {{- $topologySpreadConstraints := or .Values.flower.topologySpreadConstraints .Values.topologySpreadConstraints }}
 {{- $revisionHistoryLimit := include "airflow.revisionHistoryLimit" (list .Values.flower.revisionHistoryLimit .Values.revisionHistoryLimit) }}
-{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.flower) }}
-{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.flower) }}
+{{- $securityContext := include "airflowPodSecurityContext" (list .Values.flower .Values) }}
+{{- $containerSecurityContext := include "containerSecurityContext" (list .Values.flower .Values) }}
 {{- $containerLifecycleHooks := or .Values.flower.containerLifecycleHooks .Values.containerLifecycleHooks }}
 apiVersion: apps/v1
 kind: Deployment

chart/templates/jobs/create-user-job.yaml

@@ -25,8 +25,8 @@
 {{- $affinity := or .Values.createUserJob.affinity .Values.affinity }}
 {{- $tolerations := or .Values.createUserJob.tolerations .Values.tolerations }}
 {{- $topologySpreadConstraints := or .Values.createUserJob.topologySpreadConstraints .Values.topologySpreadConstraints }}
-{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.createUserJob) }}
-{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.createUserJob) }}
+{{- $securityContext := include "airflowPodSecurityContext" (list .Values.createUserJob .Values) }}
+{{- $containerSecurityContext := include "containerSecurityContext" (list .Values.createUserJob .Values) }}
 {{- $containerLifecycleHooks := or .Values.createUserJob.containerLifecycleHooks .Values.containerLifecycleHooks }}
 apiVersion: batch/v1
 kind: Job

chart/templates/jobs/migrate-database-job.yaml

@@ -25,8 +25,8 @@
 {{- $affinity := or .Values.migrateDatabaseJob.affinity .Values.affinity }}
 {{- $tolerations := or .Values.migrateDatabaseJob.tolerations .Values.tolerations }}
 {{- $topologySpreadConstraints := or .Values.migrateDatabaseJob.topologySpreadConstraints .Values.topologySpreadConstraints }}
-{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.migrateDatabaseJob) }}
-{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.migrateDatabaseJob) }}
+{{- $securityContext := include "airflowPodSecurityContext" (list .Values.migrateDatabaseJob .Values) }}
+{{- $containerSecurityContext := include "containerSecurityContext" (list .Values.migrateDatabaseJob .Values) }}
 {{- $containerLifecycleHooks := or .Values.migrateDatabaseJob.containerLifecycleHooks .Values.containerLifecycleHooks }}
 apiVersion: batch/v1
 kind: Job

chart/templates/scheduler/scheduler-deployment.yaml

@@ -41,10 +41,10 @@
 {{- $tolerations := or .Values.scheduler.tolerations .Values.tolerations }}
 {{- $topologySpreadConstraints := or .Values.scheduler.topologySpreadConstraints .Values.topologySpreadConstraints }}
 {{- $revisionHistoryLimit := include "airflow.revisionHistoryLimit" (list .Values.scheduler.revisionHistoryLimit .Values.revisionHistoryLimit) }}
-{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.scheduler) }}
-{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.scheduler) }}
-{{- $containerSecurityContextWaitForMigrations := include "containerSecurityContext" (list . .Values.scheduler.waitForMigrations) }}
-{{- $containerSecurityContextLogGroomerSidecar := include "containerSecurityContext" (list . .Values.scheduler.logGroomerSidecar) }}
+{{- $securityContext := include "airflowPodSecurityContext" (list .Values.scheduler .Values) }}
+{{- $containerSecurityContext := include "containerSecurityContext" (list .Values.scheduler .Values) }}
+{{- $containerSecurityContextWaitForMigrations := include "containerSecurityContext" (list .Values.scheduler.waitForMigrations .Values) }}
+{{- $containerSecurityContextLogGroomerSidecar := include "containerSecurityContext" (list .Values.scheduler.logGroomerSidecar .Values) }}
 {{- $containerLifecycleHooks := or .Values.scheduler.containerLifecycleHooks .Values.containerLifecycleHooks }}
 {{- $containerLifecycleHooksLogGroomerSidecar := or .Values.scheduler.logGroomerSidecar.containerLifecycleHooks .Values.containerLifecycleHooks }}
 apiVersion: apps/v1

chart/templates/triggerer/triggerer-deployment.yaml

@@ -30,10 +30,10 @@
 {{- $tolerations := or .Values.triggerer.tolerations .Values.tolerations }}
 {{- $topologySpreadConstraints := or .Values.triggerer.topologySpreadConstraints .Values.topologySpreadConstraints }}
 {{- $revisionHistoryLimit := include "airflow.revisionHistoryLimit" (list .Values.triggerer.revisionHistoryLimit .Values.revisionHistoryLimit) }}
-{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.triggerer) }}
-{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.triggerer) }}
-{{- $containerSecurityContextWaitForMigrations := include "containerSecurityContext" (list . .Values.triggerer.waitForMigrations) }}
-{{- $containerSecurityContextLogGroomer := include "containerSecurityContext" (list . .Values.triggerer.logGroomerSidecar) }}
+{{- $securityContext := include "airflowPodSecurityContext" (list .Values.triggerer .Values) }}
+{{- $containerSecurityContext := include "containerSecurityContext" (list .Values.triggerer .Values) }}
+{{- $containerSecurityContextWaitForMigrations := include "containerSecurityContext" (list .Values.triggerer.waitForMigrations .Values) }}
+{{- $containerSecurityContextLogGroomer := include "containerSecurityContext" (list .Values.triggerer.logGroomerSidecar .Values) }}
 {{- $containerLifecycleHooks := or .Values.triggerer.containerLifecycleHooks .Values.containerLifecycleHooks }}
 {{- $containerLifecycleHooksLogGroomerSidecar := or .Values.triggerer.logGroomerSidecar.containerLifecycleHooks .Values.containerLifecycleHooks }}
 apiVersion: apps/v1

chart/templates/webserver/webserver-deployment.yaml

@@ -26,9 +26,9 @@
 {{- $tolerations := or .Values.webserver.tolerations .Values.tolerations }}
 {{- $topologySpreadConstraints := or .Values.webserver.topologySpreadConstraints .Values.topologySpreadConstraints }}
 {{- $revisionHistoryLimit := include "airflow.revisionHistoryLimit" (list .Values.webserver.revisionHistoryLimit .Values.revisionHistoryLimit) }}
-{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.webserver) }}
-{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.webserver) }}
-{{- $containerSecurityContextWaitForMigrations := include "containerSecurityContext" (list . .Values.webserver.waitForMigrations) }}
+{{- $securityContext := include "airflowPodSecurityContext" (list .Values.webserver .Values) }}
+{{- $containerSecurityContext := include "containerSecurityContext" (list .Values.webserver .Values) }}
+{{- $containerSecurityContextWaitForMigrations := include "containerSecurityContext" (list .Values.webserver.waitForMigrations .Values) }}
 {{- $containerLifecycleHooks := or .Values.webserver.containerLifecycleHooks .Values.containerLifecycleHooks }}
 apiVersion: apps/v1
 kind: Deployment

chart/templates/workers/worker-deployment.yaml

@@ -52,13 +52,12 @@
 {{- $tolerations := or .Values.workers.tolerations .Values.tolerations }}
 {{- $topologySpreadConstraints := or .Values.workers.topologySpreadConstraints .Values.topologySpreadConstraints }}
 {{- $revisionHistoryLimit := include "airflow.revisionHistoryLimit" (list .Values.workers.celery.revisionHistoryLimit .Values.workers.revisionHistoryLimit .Values.revisionHistoryLimit) }}
-{{- $securityContext := include "airflowPodSecurityContext" (list . .Values.workers) }}
-{{- $containerSecurityContext := include "containerSecurityContext" (list . .Values.workers) }}
-{{- $containerSecurityContextPersistence := include "containerSecurityContext" (list . .Values.workers.persistence) }}
-{{- $containerSecurityContextCeleryPersistence := include "containerSecurityContext" (list . .Values.workers.celery.persistence) }}
-{{- $containerSecurityContextWaitForMigrations := include "containerSecurityContext" (list . .Values.workers.waitForMigrations) }}
-{{- $containerSecurityContextLogGroomerSidecar := include "containerSecurityContext" (list . .Values.workers.logGroomerSidecar) }}
-{{- $containerSecurityContextKerberosSidecar := include "containerSecurityContext" (list . .Values.workers.kerberosSidecar) }}
+{{- $securityContext := include "airflowPodSecurityContext" (list .Values.workers.celery .Values.workers .Values) }}
+{{- $containerSecurityContext := include "containerSecurityContext" (list .Values.workers.celery .Values.workers .Values) }}
+{{- $containerSecurityContextPersistence := include "containerSecurityContext" (list .Values.workers.celery.persistence .Values.workers.persistence .Values) }}
+{{- $containerSecurityContextWaitForMigrations := include "containerSecurityContext" (list .Values.workers.waitForMigrations .Values) }}
+{{- $containerSecurityContextLogGroomerSidecar := include "containerSecurityContext" (list .Values.workers.logGroomerSidecar .Values) }}
+{{- $containerSecurityContextKerberosSidecar := include "containerSecurityContext" (list .Values.workers.kerberosSidecar .Values) }}
 {{- $containerLifecycleHooks := or .Values.workers.containerLifecycleHooks .Values.containerLifecycleHooks }}
 {{- $containerLifecycleHooksLogGroomerSidecar := or .Values.workers.logGroomerSidecar.containerLifecycleHooks .Values.containerLifecycleHooks }}
 {{- $containerLifecycleHooksKerberosSidecar := or .Values.workers.kerberosSidecar.containerLifecycleHooks .Values.containerLifecycleHooks }}
@@ -184,11 +183,7 @@ spec:
             - -R
             - "{{ include "airflowPodSecurityContextsIds" (list . .Values.workers) }}"
             - {{ template "airflow_logs" . }}
-          {{- if .Values.workers.celery.persistence.securityContexts.container }}
-          securityContext: {{ $containerSecurityContextCeleryPersistence | nindent 12 }}
-          {{- else }}
           securityContext: {{ $containerSecurityContextPersistence | nindent 12 }}
-          {{- end }}
           volumeMounts:
             - name: logs
               mountPath: {{ template "airflow_logs" . }}
@@ -280,7 +275,7 @@ spec:
           image: {{ template "airflow_image" . }}
           imagePullPolicy: {{ .Values.images.airflow.pullPolicy }}
           securityContext: {{ $containerSecurityContext | nindent 12 }}
-          {{- if $containerLifecycleHooks  }}
+          {{- if $containerLifecycleHooks }}
           lifecycle: {{- tpl (toYaml $containerLifecycleHooks) . | nindent 12 }}
           {{- end }}
           {{- if or .Values.workers.celery.command .Values.workers.command }}