Update KubeExecutor pod templates to allow access to IAM token files #15669
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
boring-cyborg
bot
added
the
provider:cncf-kubernetes
kaxil
approved these changes
May 5, 2021
|
The PR most likely needs to run full matrix of tests because it modifies parts of the core of Airflow. However, committers might decide to merge it quickly and take the risk. If they don't merge it quickly - please rebase it to the latest master at your convenience, or amend the last commit of the PR, and push it with --force-with-lease. |
github-actions
bot
added
the
full tests needed
jedcunningham
approved these changes
May 5, 2021
If AWS's Identity-based IAM policies are in use on the cluster they token file will be mounted in to the pod (via the service account) and, prior to this change, will be owned by root. Specifying `fsGroup` makes the file group-readable by the `airflow` user. We already specify this in our helm chart, so this change is just for anyone looking at the docs.
ashb
force-pushed
the
iam-access-kube-exec-templates
branch
from
2d49561
to
a58ad55
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If AWS's Identity-based IAM policies are in use on the cluster they
token file will be mounted in to the pod (via the service account) and,
prior to this change, will be owned by root.
Specifying
fsGroupmakes the file group-readable by theairflowuser.
We already specify this in our helm chart, so this change is just for
anyone looking at the docs.
^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code change, Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in UPDATING.md.