Chart: Select NetworkPolicy log-access component by Airflow version

chart/templates/scheduler/scheduler-networkpolicy.yaml

@@ -48,7 +48,7 @@ spec:
     - podSelector:
         matchLabels:
           tier: airflow
-          component: api-server
+          component: {{ if semverCompare ">=3.0.0" .Values.airflowVersion }}api-server{{ else }}webserver{{ end }}
           release: {{ .Release.Name }}
     ports:
     - protocol: TCP

chart/templates/triggerer/triggerer-networkpolicy.yaml

@@ -48,7 +48,7 @@ spec:
         matchLabels:
           tier: airflow
           release: {{ .Release.Name }}
-          component: api-server
+          component: {{ if semverCompare ">=3.0.0" .Values.airflowVersion }}api-server{{ else }}webserver{{ end }}
     ports:
     - protocol: TCP
       port: {{ .Values.ports.triggererLogs }}

chart/templates/workers/worker-networkpolicy.yaml

@@ -64,7 +64,7 @@ spec:
         matchLabels:
           tier: airflow
           release: {{ .Release.Name }}
-          component: api-server
+          component: {{ if semverCompare ">=3.0.0" .Values.airflowVersion }}api-server{{ else }}webserver{{ end }}
     ports:
     - protocol: TCP
       port: {{ .Values.ports.workerLogs }}

helm-tests/tests/helm_tests/airflow_core/test_scheduler.py

@@ -1065,9 +1065,14 @@ def test_should_add_component_specific_labels(self):
         assert "test_label" in jmespath.search("metadata.labels", docs[0])
         assert jmespath.search("metadata.labels", docs[0])["test_label"] == "test_label_value"
 
-    def test_should_allow_api_server_to_read_scheduler_logs(self):
+    @pytest.mark.parametrize(
+        ("airflow_version", "expected_component"),
+        [("3.0.0", "api-server"), ("2.11.0", "webserver")],
+    )
+    def test_should_allow_log_server_to_read_scheduler_logs(self, airflow_version, expected_component):
         docs = render_chart(
             values={
+                "airflowVersion": airflow_version,
                 "executor": "LocalExecutor",
                 "networkPolicies": {"enabled": True},
             },
@@ -1076,7 +1081,7 @@ def test_should_allow_api_server_to_read_scheduler_logs(self):
 
         assert (
             jmespath.search("spec.ingress[0].from[0].podSelector.matchLabels.component", docs[0])
-            == "api-server"
+            == expected_component
         )
 
 

helm-tests/tests/helm_tests/airflow_core/test_triggerer.py

@@ -791,17 +791,22 @@ def test_overridden_automount_service_account_token(self):
 class TestTriggererNetworkPolicy:
     """Tests triggerer network policy."""
 
-    def test_should_allow_api_server_to_read_triggerer_logs(self):
+    @pytest.mark.parametrize(
+        ("airflow_version", "expected_component"),
+        [("3.0.0", "api-server"), ("2.11.0", "webserver")],
+    )
+    def test_should_allow_log_server_to_read_triggerer_logs(self, airflow_version, expected_component):
         docs = render_chart(
             values={
+                "airflowVersion": airflow_version,
                 "networkPolicies": {"enabled": True},
             },
             show_only=["templates/triggerer/triggerer-networkpolicy.yaml"],
         )
 
         assert (
             jmespath.search("spec.ingress[0].from[0].podSelector.matchLabels.component", docs[0])
-            == "api-server"
+            == expected_component
         )
 
 

helm-tests/tests/helm_tests/airflow_core/test_worker.py

@@ -2803,9 +2803,14 @@ def test_should_add_component_specific_labels(self, workers_values):
         assert "key" not in labels
 
     @pytest.mark.parametrize("executor", ["CeleryExecutor", "CeleryExecutor,KubernetesExecutor"])
-    def test_should_allow_api_server_to_read_worker_logs(self, executor):
+    @pytest.mark.parametrize(
+        ("airflow_version", "expected_component"),
+        [("3.0.0", "api-server"), ("2.11.0", "webserver")],
+    )
+    def test_should_allow_log_server_to_read_worker_logs(self, executor, airflow_version, expected_component):
         docs = render_chart(
             values={
+                "airflowVersion": airflow_version,
                 "networkPolicies": {"enabled": True},
                 "executor": executor,
             },
@@ -2814,7 +2819,7 @@ def test_should_allow_api_server_to_read_worker_logs(self, executor):
 
         assert (
             jmespath.search("spec.ingress[0].from[0].podSelector.matchLabels.component", docs[0])
-            == "api-server"
+            == expected_component
         )