Skip to content

refactor(helm): extract JWT secret env to dedicated helper - #70864

Closed
AaryanCdry wants to merge 1187 commits into
apache:mainfrom
AaryanCdry:refactor/jwt-env-helper
Closed

refactor(helm): extract JWT secret env to dedicated helper#70864
AaryanCdry wants to merge 1187 commits into
apache:mainfrom
AaryanCdry:refactor/jwt-env-helper

Conversation

@AaryanCdry

Copy link
Copy Markdown

Summary

This PR extracts the AIRFLOW__API_AUTH__JWT_SECRET environment variable block from the inline definition in standard_airflow_environment to a standalone jwt_secret_environment helper template in chart/templates/_helpers.yaml.

Motivation

PR #63204 added the JWT secret env var directly inside standard_airflow_environment. While this works, it means the JWT env var is inherited by every deployment template that includes the standard helper, making it impossible to include or exclude it per component.

Extracting it to a dedicated helper:

  • Improves template readability by separating the JWT concern
  • Enables future per-component opt-in/opt-out of the JWT env var
  • Follows the existing pattern where each secret has its own named helper

Changes

-  {{- if and (semverCompare ">=3.0.0" .Values.airflowVersion) .Values.enableBuiltInSecretEnvVars.AIRFLOW__API_AUTH__JWT_SECRET }}
-  - name: AIRFLOW__API_AUTH__JWT_SECRET
-    valueFrom:
-      secretKeyRef:
-        name: {{ template "jwt_secret" . }}
-        key: jwt-secret
-  {{- end }}
+  {{- include "jwt_secret_environment" . }}

New helper added after standard_airflow_environment:

{{- define "jwt_secret_environment" }}
  {{- if and (semverCompare ">=3.0.0" .Values.airflowVersion) .Values.enableBuiltInSecretEnvVars.AIRFLOW__API_AUTH__JWT_SECRET }}
  - name: AIRFLOW__API_AUTH__JWT_SECRET
    valueFrom:
      secretKeyRef:
        name: {{ template "jwt_secret" . }}
        key: jwt-secret
  {{- end }}
{{- end }}

Behavior

No behavior change. All components that previously received the JWT env var continue to receive it through the new helper via standard_airflow_environment.

Closes #70843

pierrejeambrun and others added 30 commits January 21, 2026 16:25
* Fix slow log scrolling for large task logs

* Trim to focus on scroll top/bottom

(cherry picked from commit 4766f9c)

Co-authored-by: Guan-Ming (Wesley) Chiu <105915352+guan404ming@users.noreply.github.com>
)

* Convert Tasks Table from card to table mode

* Fix e2e tests

(cherry picked from commit 8bbe0fc)
…g connections (apache#59643) (apache#60873)

* Fix connection test API to restore masked password/extra from existing connections

* Use get_connection_from_secrets in test endpoint

* Remove unused session parameter

* Add use_existing_credentials flag to test connections

* fix api-gen description

* Standardize docstring format

* Add use_existing_credentials flag to test connections

* Refactor connection test logic using update_orm_from_pydantic

* Remove useExistingCredentials flag from TestConnectionButton mutation

* Add proper assertions for test connection merge tests

* Small test adjustment

---------


(cherry picked from commit efb27dc)

Co-authored-by: Yeonguk Choo <choo121600@gmail.com>
…or Airflow (apache#60809) (apache#60813)

(cherry picked from commit ad8ce12)

Co-authored-by: Srabasti Banerjee <srabasti_b@ymail.com>
Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>
…) (apache#60906)

Mypy Checks in CI have not been run on "scripts" folder - only on
dev folder and if a mypy error creeped-in, it remained undetected
unless someone run `pre-push` mypy check that instead of folders
run it on individual files.

This PR fixes the errors that creeped in and fixes the CI so that
mypy-dev also checks scripts.
(cherry picked from commit 7214ff8)
…le (apache#60152)

* refactor: If asend in TriggerRunner comms decoder crashes due to NotImplementedError as a trigger event is not serializable, then retry without that event and cancel associated trigger

* refactor: Applied some reformatting

* refactor: Fixed some mypy issues

* refactor: Fixed return type of send_changes method

* refactor: Changed imports of trigger events

* refactor: Reformatted trigger job runner

* refactor: Fixed mocking of comms decoder

* refactor: Forgot to add the patched supervisor_builder

* refactor: Changed asserts in test_sync_state_to_supervisor

* refactor: Refactored how state changes are validated

* refactor: Validate events while creating the TriggerStateChanges message

* refactor: Refactored try/except in validate_state_changes to keep mypy happy

* Update airflow-core/src/airflow/jobs/triggerer_job_runner.py

Co-authored-by: Ash Berlin-Taylor <ash_github@firemirror.com>

* refactor: Renamed validate_state_changes method to process_trigger_events

* refactor: Only sanitize invalid trigger events if first attempt fails

* refactor: Should check if msg.events is not None

* refactor: Adapted test_sync_state_to_supervisor so both initial and retry call are correctly asserted and bad events are being sanitized

---------

Co-authored-by: Ash Berlin-Taylor <ash_github@firemirror.com>

(cherry picked from commit 0238244)
…evel (apache#60784) (apache#60970)

* Use log_level for root logger instead of hardcoded INFO level

* Added test for debug level
(cherry picked from commit f08d414)

Co-authored-by: Justin Pakzad <114518232+justinpakzad@users.noreply.github.com>
…60935) (apache#60959)

* Fix dag access control for dag_id in query param

* Fix CI
(cherry picked from commit 1163e92)

Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
…apache#60958)

* Fix permissions on get_event_logs endpoint

* Fix CI
(cherry picked from commit c064739)

Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
… (apache#61000)

MySQL Connector/Python package from Oracle version 9.6.0 has been badly
published to PyPI and it misses both sdist and wheel distributions for
Python 3.12, 3.13, 3.14 making it impossible to install on these Python
versions. We need to exclude this version until Oracle fixes the issue.
Issue raised: https://bugs.mysql.com/bug.php?id=119736
(cherry picked from commit 573cb47)

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
…le (apache#60152) (apache#60981)

* refactor: If asend in TriggerRunner comms decoder crashes due to NotImplementedError as a trigger event is not serializable, then retry without that event and cancel associated trigger

* refactor: Applied some reformatting

* refactor: Fixed some mypy issues

* refactor: Fixed return type of send_changes method

* refactor: Changed imports of trigger events

* refactor: Reformatted trigger job runner

* refactor: Fixed mocking of comms decoder

* refactor: Forgot to add the patched supervisor_builder

* refactor: Changed asserts in test_sync_state_to_supervisor

* refactor: Refactored how state changes are validated

* refactor: Validate events while creating the TriggerStateChanges message

* refactor: Refactored try/except in validate_state_changes to keep mypy happy

* Update airflow-core/src/airflow/jobs/triggerer_job_runner.py

Co-authored-by: Ash Berlin-Taylor <ash_github@firemirror.com>

* refactor: Renamed validate_state_changes method to process_trigger_events

* refactor: Only sanitize invalid trigger events if first attempt fails

* refactor: Should check if msg.events is not None

* refactor: Adapted test_sync_state_to_supervisor so both initial and retry call are correctly asserted and bad events are being sanitized

---------

Co-authored-by: Ash Berlin-Taylor <ash_github@firemirror.com>

(cherry picked from commit 0238244)
…apache#61016) (apache#61020)

(cherry picked from commit e916980)

Co-authored-by: Dheeraj Turaga <dheerajturaga@gmail.com>
…he#61031)

(cherry picked from commit ee4bf89)

Co-authored-by: Henry Chen <henryhenry0512@gmail.com>
…run permissions (apache#60979) (apache#60988)

(cherry picked from commit cb8debb)

Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
…57779) (apache#57719)

Co-authored-by: Wei Lee <weilee.rx@gmail.com>
Co-authored-by: Tzu-ping Chung <uranusjr@gmail.com>
) (apache#61064)

Finally the Lucas-C pre-commit hook and octopin repo got released with changes
we need so we can get rid of bleeding-edge.
(cherry picked from commit f94039b)
…61073)

* Respect maximum page limit in API

* Fix CI
(cherry picked from commit 2ed3969)

Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
…sing. (apache#55894) (apache#61053)

Co-authored-by: Josef Šimánek <josef.simanek@gmail.com>
fixup! [v3-1-test] Add bundle_path temporarily to sys.path during DagBag parsing. (apache#55894)
fixup! fixup! [v3-1-test] Add bundle_path temporarily to sys.path during DagBag parsing. (apache#55894)
fixup! fixup! fixup! [v3-1-test] Add bundle_path temporarily to sys.path during DagBag parsing. (apache#55894)
* Close German Translation Gaps 2026-01-26 v3.1

* Review by @TJaniF

Co-authored-by: Tamara Janina Fingerlin <90063506+TJaniF@users.noreply.github.com>

---------

Co-authored-by: Tamara Janina Fingerlin <90063506+TJaniF@users.noreply.github.com>
…61114)

(cherry picked from commit 4a0364a)

Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>

@SameerMesiah97 SameerMesiah97 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like you might need a rebase. And why have you opened 2 PRs? Please close one.

@AaryanCdry

Copy link
Copy Markdown
Author

Closing in favor of #70913, which contains the same refactor rebased cleanly on current main (this branch had merge conflicts). Same change, same author — keeping the mergeable version.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Separate JWT Secret Env from Standard Airflow Environment Variables