Skip to content

Add startup probe for Kerberos worker sidecars #71221

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aaron-y-chen wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add startup probe for Kerberos worker sidecars #71221

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions chart/files/pod-template-file.kubernetes-helm-yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,6 +175,15 @@ spec:
{{- end }}
args: ["kerberos"]
resources: {{- toYaml .Values.workers.kubernetes.kerberosSidecar.resources | nindent 8 }}
{{- if .Values.workers.kubernetes.kerberosSidecar.startupProbe.enabled }}
startupProbe:
exec:
command: ["klist", "-s"]
timeoutSeconds: {{ .Values.workers.kubernetes.kerberosSidecar.startupProbe.timeoutSeconds }}
initialDelaySeconds: {{ .Values.workers.kubernetes.kerberosSidecar.startupProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.workers.kubernetes.kerberosSidecar.startupProbe.periodSeconds }}
failureThreshold: {{ .Values.workers.kubernetes.kerberosSidecar.startupProbe.failureThreshold }}
{{- end }}
volumeMounts:
- name: logs
mountPath: {{ template "airflow_logs" . }}
Expand Down
9 changes: 9 additions & 0 deletions chart/templates/workers/worker-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -403,6 +403,15 @@ spec:
{{- end }}
args: ["kerberos"]
resources: {{- toYaml .Values.workers.celery.kerberosSidecar.resources | nindent 12 }}
{{- if .Values.workers.celery.kerberosSidecar.startupProbe.enabled }}
startupProbe:
exec:
command: ["klist", "-s"]
timeoutSeconds: {{ .Values.workers.celery.kerberosSidecar.startupProbe.timeoutSeconds }}
initialDelaySeconds: {{ .Values.workers.celery.kerberosSidecar.startupProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.workers.celery.kerberosSidecar.startupProbe.periodSeconds }}
failureThreshold: {{ .Values.workers.celery.kerberosSidecar.startupProbe.failureThreshold }}
{{- end }}
volumeMounts:
- name: logs
mountPath: {{ template "airflow_logs" . }}
Expand Down
46 changes: 46 additions & 0 deletions chart/tests/helm_tests/airflow_aux/test_pod_template_file.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1343,6 +1343,52 @@ def test_kerberos_sidecar_security_context(self):
"allowPrivilegeEscalation": False
}

@pytest.mark.parametrize(
("override", "expected"),
[
(
{},
{
"exec": {"command": ["klist", "-s"]},
"timeoutSeconds": 5,
"initialDelaySeconds": 0,
"periodSeconds": 10,
"failureThreshold": 6,
},
),
(
{
"timeoutSeconds": 11,
"initialDelaySeconds": 12,
"periodSeconds": 13,
"failureThreshold": 14,
},
{
"exec": {"command": ["klist", "-s"]},
"timeoutSeconds": 11,
"initialDelaySeconds": 12,
"periodSeconds": 13,
"failureThreshold": 14,
},
),
({"enabled": False}, None),
],
ids=["default", "custom", "disabled"],
)
def test_kerberos_sidecar_startup_probe(self, override, expected):
docs = render_chart(
values={
"workers": {"kubernetes": {"kerberosSidecar": {"enabled": True, "startupProbe": override}}}
},
show_only=["templates/pod-template-file.yaml"],
chart_dir=self.temp_chart_dir,
)

assert (
jmespath.search("spec.containers[?name=='worker-kerberos'] | [0].startupProbe", docs[0])
== expected
)

def test_kerberos_init_container_default(self):
docs = render_chart(
show_only=["templates/pod-template-file.yaml"],
Expand Down
49 changes: 49 additions & 0 deletions chart/tests/helm_tests/security/test_kerberos.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
import json

import jmespath
import pytest
from chart_utils.helm_template_generator import render_chart


Expand Down Expand Up @@ -153,3 +154,51 @@ def test_kerberos_keytab_secret_unavailable_when_not_specified(self):
)

assert len(docs) == 0

@pytest.mark.parametrize(
("override", "expected"),
[
(
{},
{
"exec": {"command": ["klist", "-s"]},
"timeoutSeconds": 5,
"initialDelaySeconds": 0,
"periodSeconds": 10,
"failureThreshold": 6,
},
),
(
{
"timeoutSeconds": 11,
"initialDelaySeconds": 12,
"periodSeconds": 13,
"failureThreshold": 14,
},
{
"exec": {"command": ["klist", "-s"]},
"timeoutSeconds": 11,
"initialDelaySeconds": 12,
"periodSeconds": 13,
"failureThreshold": 14,
},
),
({"enabled": False}, None),
],
ids=["default", "custom", "disabled"],
)
def test_kerberos_sidecar_startup_probe(self, override, expected):
docs = render_chart(
values={
"executor": "CeleryExecutor",
"workers": {"celery": {"kerberosSidecar": {"enabled": True, "startupProbe": override}}},
},
show_only=["templates/workers/worker-deployment.yaml"],
)

assert (
jmespath.search(
"spec.template.spec.containers[?name=='worker-kerberos'] | [0].startupProbe", docs[0]
)
== expected
)
64 changes: 64 additions & 0 deletions chart/values.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2111,6 +2111,38 @@
"type": "boolean",
"default": false
},
"startupProbe": {
"description": "Startup probe for the Kerberos worker sidecar (runs `klist -s`).",
"type": "object",
"additionalProperties": false,
"properties": {
"enabled": {
"description": "Enable the Kerberos sidecar startup probe. Disable for custom images without `klist`.",
"type": "boolean",
"default": true
},
"timeoutSeconds": {
"description": "Number of seconds after which the probe times out.",
"type": "integer",
"default": 5
},
"initialDelaySeconds": {
"description": "Number of seconds after the container has started before the startup probe is initiated.",
"type": "integer",
"default": 0
},
"periodSeconds": {
"description": "How often (in seconds) to perform the probe.",
"type": "integer",
"default": 10
},
"failureThreshold": {
"description": "Number of consecutive failures required for the startup probe to fail.",
"type": "integer",
"default": 6
}
}
},
"resources": {
"description": "Resources on kerberos sidecar.",
"type": "object",
Expand Down Expand Up @@ -2859,6 +2891,38 @@
"type": "boolean",
"default": false
},
"startupProbe": {
"description": "Startup probe for the Kerberos worker sidecar (runs `klist -s`).",
"type": "object",
"additionalProperties": false,
"properties": {
"enabled": {
"description": "Enable the Kerberos sidecar startup probe. Disable for custom images without `klist`.",
"type": "boolean",
"default": true
},
"timeoutSeconds": {
"description": "Number of seconds after which the probe times out.",
"type": "integer",
"default": 5
},
"initialDelaySeconds": {
"description": "Number of seconds after the container has started before the startup probe is initiated.",
"type": "integer",
"default": 0
},
"periodSeconds": {
"description": "How often (in seconds) to perform the probe.",
"type": "integer",
"default": 10
},
"failureThreshold": {
"description": "Number of consecutive failures required for the startup probe to fail.",
"type": "integer",
"default": 6
}
}
},
"resources": {
"description": "Resources on kerberos sidecar.",
"type": "object",
Expand Down
18 changes: 18 additions & 0 deletions chart/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -839,6 +839,15 @@ workers:
# Container level lifecycle hooks
containerLifecycleHooks: {}

# Startup probe for the kerberos sidecar: `klist -s` succeeds once the credential
# cache holds a valid, unexpired ticket. Disable for custom images without `klist`.
startupProbe:
enabled: true
timeoutSeconds: 5
initialDelaySeconds: 0
periodSeconds: 10
failureThreshold: 6

# Kerberos init container configuration for Airflow Celery workers
# If not set, the values from `workers.kerberosInitContainer` section will be used.
kerberosInitContainer:
Expand Down Expand Up @@ -1086,6 +1095,15 @@ workers:
# Container level lifecycle hooks
containerLifecycleHooks: {}

# Startup probe for the kerberos sidecar: `klist -s` succeeds once the credential
# cache holds a valid, unexpired ticket. Disable for custom images without `klist`.
startupProbe:
enabled: true
timeoutSeconds: 5
initialDelaySeconds: 0
periodSeconds: 10
failureThreshold: 6

# Kerberos init container configuration for pods created with pod-template-file
# If not set, the values from `workers.kerberosInitContainer` section will be used.
kerberosInitContainer:
Expand Down