[chart/v1-2x-test] Add securityContexts.disableDefaults flag for OpenShift SCC compatibility (#70238) - #72108
Open
Aaryan123456679 wants to merge 1 commit into
Conversation
…Shift SCC compatibility (apache#70238) * Allow runAsUser and fsGroup to be explicitly null in pod securityContexts OpenShift assigns runAsUser/fsGroup automatically via SCC and rejects pods that hard-code them, so users need to null these out in the rendered pod securityContext. The vendored PodSecurityContext schema required these fields to be integers, so setting them to null failed Helm's values.schema.json validation before the templates ever rendered (the templates already pass through explicit nulls correctly). Introduces a new AirflowPodSecurityContext schema definition (not io.k8s.*-prefixed, so it survives vendor_k8s_json_schema.py regeneration) that allows null for runAsUser/runAsGroup/fsGroup, and points all 16 securityContexts.pod $refs at it instead of the vendored definition. closes: apache#41630 * Add newsfragment for Helm chart securityContexts fix * Rename newsfragment to match this PR's number Named after the GitHub issue instead of the actual PR number, which the check-newsfragment-pr-number CI check expects. * Replace null-based OpenShift SCC workaround with a securityContexts.disableDefaults flag Explicit null in securityContexts.pod/containers was fragile and made every call site guess whether to render a key at all. A dedicated flag is more explicit about intent and lets the chart omit the default runAsUser/fsGroup (and related) values entirely on platforms like OpenShift where the cluster's SCC assigns them automatically and rejects hard-coded values. * Update production guide for the disableDefaults securityContexts flag The OpenShift SCC guidance still described the earlier null-based workaround, which no longer omits the rendered securityContext keys. * Fix docs spellcheck failure from unescaped securityContexts.* in schema description securityContexts.pod / securityContexts.containers appeared as plain text in the disableDefaults description, which the docs build renders as prose rather than code, tripping the spellchecker on the camelCase identifier. * Deprecate implicit securityContexts.disableDefaults default and unify helper argument order Address review feedback: mark the disableDefaults false default as deprecated (surfaced via NOTES.txt, values.yaml, values.schema.json and the newsfragment) since it will flip to true in a future release, and align airflowPodSecurityContextsIds's argument order with the rest of the security-context helpers in the chart. Also adds coverage for component-level securityContexts overrides taking priority over disableDefaults, both for Deployments and for the pod-template-file path used by KubernetesExecutor/KubernetesPodOperator. * Extend disableDefaults component-override test coverage to all chart components The disableDefaults escape hatch touches every component's security context, but the regression test only exercised scheduler and workers.celery. Parametrize it across all 13 affected components so a future template change can't silently break the override behavior for components that were previously untested, and add databaseCleanup coverage that no other test in this file provided either. * Tidy disableDefaults wording in values.yaml and values.schema.json The parenthetical note doesn't need a trailing period, and the values.yaml comment was missing backticks around the referenced keys that every other comment in the file uses. * Address review feedback on disableDefaults test coverage Split the mixed CronJob/Deployment assertions in test_disable_defaults_pod_and_container into separate tests instead of branching on list position, replace per-doc Python loops and init-container name comprehensions with jmespath expressions to match the rest of the file, and drop docstrings that only restated what the test name already says. * Update chart/values.schema.json Co-authored-by: Przemysław Mirowski <17602603+Miretpl@users.noreply.github.com> * Update chart/values.yaml Co-authored-by: Przemysław Mirowski <17602603+Miretpl@users.noreply.github.com> * Fixing PR comments --------- (cherry picked from commit 3ac3851) Co-authored-by: Aaryan Mahajan <aaryanmhjn@gmail.com> Co-authored-by: Przemysław Mirowski <17602603+Miretpl@users.noreply.github.com>
Aaryan123456679
requested review from
Miretpl,
bugraoz93,
hussein-awala,
jedcunningham and
jscheffl
as code owners
August 26, 2026 15:51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Manual backport of #70238 to
chart/v1-2x-test(automated backport failed with cherry-pick conflicts).securityContexts.disableDefaultslets the chart skip its defaultrunAsUser/fsGroup(pod) andrunAsUser(container) values whensecurityContexts.pod/securityContexts.containers(or per-component overrides) are left empty, so platforms like OpenShift can assign these via SCC instead of the chart hard-coding them.Conflict resolution notes
chart/v1-2x-testhas diverged frommainin ways unrelated to this PR, so the automatic cherry-pick (cherry_picker 3ac3851 chart/v1-2x-test) failed and this was resolved manually:_helpers.yaml:localPodSecurityContext/localContainerSecurityContextneeded the dual-arg (list <node> .) form frommainto see the globaldisableDefaultsflag, while keeping this branch's legacy<node>.securityContext(singular) fallback thatmainhad already dropped — losing it brokeTestSecurityContext::test_check_local_uidand three other pre-existing tests until it was restored.worker-deployment.yamland friends: adaptedmain's.Values.workers.celery.*values to this branch's flat.Values.workers.*(the Celery/Kubernetes worker-set split underworkers.celeryhasn't been backported here).chart/tests/helm_tests/security/test_security_context.pyno longer exists on this branch (its content lives athelm-tests/tests/helm_tests/security/test_security_context.pyinstead); the newtest_disable_defaults_*coverage was added there, with the sameworkers.celery→workersadaptation.Test plan
helm lint chart/passesbreeze testing helm-tests --test-type security— 431 passedbreeze testing helm-tests --test-type airflow_aux— 1143 passedbreeze testing helm-tests --test-type other— 433 passedprek run --stage pre-commitandprek run --stage manualagainstchart/v1-2x-test— all passed (includingkubeconform,Lint chart/values.schema.json)Was generative AI tooling used to co-author this PR?
Generated-by: Claude Code (Sonnet 5) following the guidelines