[Helm]Support tpl rendering in ServiceAccount annotations, metadataConnection, and config ConfigMap names

[shlomitubul]

The scheduler ServiceAccount already tpl-renders annotations via range/tpl, but all other ServiceAccounts (pgbouncer, webserver, workers, triggerer, dag-processor, api-server) use raw toYaml. This makes it impossible to use template expressions like
{{ .Values.global.appName }}-sa@project.iam.gserviceaccount.com in annotation values for those components.

Apply the same range/tpl pattern from the scheduler to all ServiceAccount templates for consistency.

Also tpl-render data.metadataConnection.user and
data.metadataConnection.db so wrapper charts can derive database credentials from template expressions instead of requiring static values. This affects the metadata connection secret and pgbouncer config.

Also tpl-render webserverConfigConfigMapName and
apiServerConfigConfigMapName so wrapper charts can use {{ .Release.Name }}-custom-config instead of hardcoding the release name.

All changes are backward compatible: tpl on a plain string without template expressions returns the string unchanged.

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)
  Generated-by: Claude Code (Anthropic Claude Opus 4.6) following the guidelines

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

[boring-cyborg]

Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide (https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
Here are some useful points:

• Pay attention to the quality of your code (ruff, mypy and type annotations). Our prek-hooks will help you with that.
• In case of a new feature add useful documentation (in docstrings or in docs/ directory). Adding a new operator? Check this short guide Consider adding an example DAG that shows how users should use it.
• Consider using Breeze environment for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
• Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
• Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
• Be sure to read the Airflow Coding style.
• Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
  Apache Airflow is a community-driven project and together we are making it better 🚀.
  In case of doubts contact the developers at:
  Mailing List: dev@airflow.apache.org
  Slack: https://s.apache.org/airflow-slack

[jscheffl]

Good for me, leavinf review to another pair of eyes prior merge.

[Miretpl]

Also, looking at the tests, I would recommend configuring prek for running hooks before commit and push - you can find a guide here -> https://github.com/apache/airflow/blob/main/contributing-docs/03_contributors_quick_start.rst#id9

[shlomitubul]

@Miretpl Thanks for the thorough review! All feedback addressed in the latest commit:

• tplDict helper: Removed nindent — now generic, indent controlled at call sites
• Tests restructured: Deleted test_tpl_rendering.py, moved annotation tests to test_annotations.py and metadata connection tests to test_metadata_connection_secret.py
• No conditional test logic: Split Airflow 2.x/3.x into separate parametrized test methods
• result-backend nit: Fixed

Will also set up pre-commit hooks as suggested. Thanks!

[Miretpl]

Looks much better! Just small nits

[eladkal]

Overall LGTM
probably need also @jedcunningham eye on this one

[shlomitubul]

@Miretpl All feedback addressed and tests verified locally (82/82 pass):

• Separated pgbouncer into dedicated test — no conditional logic
• Used workers.celery.serviceAccount for Celery worker test
• Changed airflowVersion to 2.11.0 and removed explicit version from Airflow 3 tests
• Removed the kubernetes worker SA test — workers.kubernetes.serviceAccount doesn't propagate to the worker SA template (it only affects the pod-template-file); the worker SA reads from workers.serviceAccount merged via workers.celery
• Pre-commit hooks (prek) passing

[Miretpl]

Removed the kubernetes worker SA test — workers.kubernetes.serviceAccount doesn't propagate to the worker SA template (it only affects the pod-template-file); the worker SA reads from workers.serviceAccount merged via workers.celery

@shlomitubul it works in a little different way. The workers.celery configuration only affects the rendering for celery workers deployments with the whole overwrite logic of workers.celery to workers. The pod-template-file is not affected by it in any form, and it uses the workers service account or dedicated workers kubernetes service account (if workers.kubernetes.serviceAccount.create=true) with respective fields and fallbacks, so basically in current form we are missing the testing of workers.serviceAccount.annotations which is deprecated already and workers.kubernetes.serviceAccount (which is kinda ok as this PR does not modify the content of workers-kubernetes-serviceaccount.yaml file -> "kinda ok" as it will be not strightforward from user perspective why we support template annotations in most of the places, but not in this one).

[Miretpl]

@shlomitubul I see that the commits were co-authored by Claude. I would really encourage you to make sure that everything that Claude did is fully understandable to be compliant with our AI-usage policy - https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

[shlomitubul]

@shlomitubul I see that the commits were co-authored by Claude. I would really encourage you to make sure that everything that Claude did is fully understandable to be compliant with our AI-usage policy - https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

@Miretpl i appreciate your excellent review !, yes im aware of the project AI policy and fully understand the changeset

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR enables broader Helm tpl rendering support across the chart so wrapper charts can derive values (ServiceAccount annotations, metadata DB credentials, and config ConfigMap names) from template expressions.

Changes:

• Standardize ServiceAccount annotation rendering to use a shared tpl-rendering helper across components.
• tpl-render data.metadataConnection.user and .db for the metadata connection secret and PgBouncer config.
• tpl-render webserverConfigConfigMapName and apiServerConfigConfigMapName overrides.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
helm-tests/tests/helm_tests/security/test_metadata_connection_secret.py	Adds tests for tpl rendering of metadata connection user and db.
helm-tests/tests/helm_tests/airflow_aux/test_annotations.py	Adds tests ensuring ServiceAccount annotations support tpl rendering across components.
chart/templates/workers/worker-serviceaccount.yaml	Switches worker SA annotations rendering to shared tpl dict helper.
chart/templates/webserver/webserver-serviceaccount.yaml	Switches webserver SA annotations rendering to shared tpl dict helper.
chart/templates/triggerer/triggerer-serviceaccount.yaml	Switches triggerer SA annotations rendering to shared tpl dict helper.
chart/templates/secrets/metadata-connection-secret.yaml	Applies tpl rendering to metadata connection user and db in generated connection URIs.
chart/templates/scheduler/scheduler-serviceaccount.yaml	Refactors scheduler SA annotations to use shared tpl dict helper.
chart/templates/pgbouncer/pgbouncer-serviceaccount.yaml	Switches PgBouncer SA annotations rendering to shared tpl dict helper.
chart/templates/dag-processor/dag-processor-serviceaccount.yaml	Switches dag-processor SA annotations rendering to shared tpl dict helper.
chart/templates/api-server/api-server-serviceaccount.yaml	Switches api-server SA annotations rendering to shared tpl dict helper.
chart/templates/_helpers.yaml	Introduces airflow.tplDict helper; tpl-renders PgBouncer db/user fields and config ConfigMap name overrides.

[jscheffl]

@Miretpl can you re-review if OK now?

[Miretpl]

LGTM

[boring-cyborg]

Awesome work, congrats on your first merged pull request! You are invited to check our Issue Tracker for additional contributions.

[github-actions]

Backport successfully created: chart/v1-2x-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	chart/v1-2x-test