[chart/v1-2x-test] Separate JWT secret env var from the standard Airflow environment helper (#70896) - #71129
Open
rohan9446 wants to merge 1 commit into
Open
Conversation
…low environment helper (apache#70896) `AIRFLOW__API_AUTH__JWT_SECRET` was rendered from inside `standard_airflow_environment` behind an `IncludeJwtSecret` flag, so every component had to opt out of it explicitly with `(merge (dict "IncludeJwtSecret" false) .)`. Move the variable into its own `jwt_secret_environment` helper, following the shape of the existing `keda_airflow_environment` helper, and include it only in the API server and scheduler containers that need it. Every other caller of `standard_airflow_environment` passes a plain context again, and the `IncludeJwtSecret` context mutation is gone. No behavioural change: the same containers receive the same variable, still gated on `enableBuiltInSecretEnvVars.AIRFLOW__API_AUTH__JWT_SECRET`, preserving the least-privilege exposure introduced in apache#63204. Only the position of the variable within the rendered env list changes, so the ordered assertion in `test_have_all_variables` is updated to match. Closes: apache#70843 (cherry picked from commit 562cc3e) Co-authored-by: rohan9446 <99634410+rohan9446@users.noreply.github.com> Co-authored-by: rohan9446 <bandaru04052004@gmail.com>
rohan9446
requested review from
Miretpl,
bugraoz93,
hussein-awala,
jedcunningham and
jscheffl
as code owners
August 4, 2026 23:00
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Manual backport of #70896 to
chart/v1-2x-test, as requested by @Miretpl.The automated backport conflicted because this branch still supports Airflow 2 alongside 3:
AIRFLOW__API_AUTH__JWT_SECRETblock is additionally gated onsemverCompare ">=3.0.0" .Values.airflowVersion— that gate now lives inside the newjwt_secret_environmenthelper, so Airflow 2 rendering is unchangedkeda_airflow_environmenthelper on this branch, so the new define sits beforecustom_airflow_environmentinstead (the cherry-picked commit message references it — that's carried over from main)helm-tests/tests/rather thanchart/tests/Otherwise identical to main:
IncludeJwtSecretis gone fromstandard_airflow_environmentand all ten call sites, and the secret is included explicitly in the API server and scheduler containers only.Tested locally with helm v3.21.3:
pytest helm-tests/tests/helm_tests/→ 3454 passed.Was generative AI tooling used to co-author this PR?
Generated-by: Claude (Cowork) following the guidelines