DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
...
Parameter | Description | Default | Opinion Jens | Opinion Bugra | Opinion Przemek |
|---|---|---|---|---|---|
| Specify scheduling constraints for API server pods. |
|
|
| keep |
| Allow API server to read k8s pod logs. Useful when you don’t have an external log store. |
|
|
| Could Maybe it could be automatically set based on the executor value 🤔. Maybe, as I'm not sure about whether it is needed or not, with e.g. remote logging set |
| Annotations to add to the API server deployment |
|
|
| keep |
| Args to use when running the Airflow API server (templated). When running behind a reverse proxy, add –proxy-headers to enable Uvicorn to respect X-Forwarded-Proto, X-Forwarded-For, and X-Forwarded-Port headers. |
Examples: args: - bash - -c - exec airflow api-server --proxy-headers |
|
| keep |
| Command to use when running the Airflow API server (templated). |
|
|
| keep |
| Extra annotations to apply to the API server configmap. |
|
|
| keep |
| Enable Airflow API server deployment. |
|
|
| keep |
| Add additional env vars to API server. When running behind a reverse proxy, set FORWARDED_ALLOW_IPS to specify which IPs are trusted to send X-Forwarded-* headers. Use “*” for trusted environments, or specify proxy IP ranges for production. |
Examples: env: - - name: FORWARDED_ALLOW_IPS value: '*' |
|
| keep |
| Launch additional containers into API server. |
|
|
| keep |
| Add additional init containers into API server. |
|
|
| keep |
| Mount additional volumes into API server. |
|
|
| keep |
| Mount additional volumes into API server. |
|
|
| keep |
| HostAliases for the API server pod. |
Examples: hostAliases: - hostnames: - foo.local ip: 127.0.0.1 hostAliases: - hostnames: - foo.remote ip: 10.1.2.3 |
|
| keep |
| HorizontalPodAutoscalerBehavior configures the scaling behavior of the target. |
| Should we keep both KEDA and HPA? Or move both to a Kustomize?
| My vote would be moving Keda to Kustomize, as it is really custom if we think of core components
| Keep HPA, document Keda in Kustomize
|
| Enable HPA autoscaling for API server |
| |||
| Maximum number of API server replicas created by HPA if HPA is enabled. |
| |||
| Specifications for which to use to calculate the desired replica count. |
| |||
| Minimum number of API server replicas created by HPA if HPA is enabled. |
| |||
| Labels to add to the API server objects and pods. |
|
|
| keep |
| API server Liveness probe failure threshold. |
|
|
| keep |
| API server Liveness probe initial delay. |
|
|
| keep |
| API server Liveness probe period seconds. |
|
|
| keep |
| API server Liveness probe scheme. |
|
|
| keep |
| API server Liveness probe timeout seconds. |
|
|
| keep |
| Peers for API server NetworkPolicyingress. |
|
|
| keep |
| Ports for API server NetworkPolicyingress (if from is set). |
Examples: ports: - port: 8080 |
|
| keep |
| Select certain nodes for API server pods. |
|
|
| keep |
| Annotations to add to the API server pods. |
|
|
| keep |
| Max unavailable pods for API server. |
|
|
| Remove maxUnavailable and minAvailable and set config: {} |
| Min available pods for API server. |
|
|
| |
| Enable pod disruption budget. |
|
|
| keep |
| Specify priority for API server pods. |
|
|
| keep |
| API server Readiness probe failure threshold. |
|
|
| keep |
| API server Readiness probe initial delay. |
|
|
| keep |
| API server Readiness probe period seconds. |
|
|
| keep |
| API server Readiness probe scheme. |
|
|
| keep |
| API server Readiness probe timeout seconds. |
|
|
| keep |
| How many Airflow API server replicas should run. This setting is ignored when HPA (Horizontal Pod Autoscaler) is enabled |
|
|
| keep |
| Resources for API server pods. |
Examples: resources: limits: cpu: 100m memory: 128Mi requests: cpu: 100m memory: 128Mi |
|
| keep |
| Annotations for the API server Service. |
|
|
| keep |
| API server Service loadBalancerIP. |
|
|
| keep |
| API server Service |
Examples: loadBalancerSourceRanges: - 10.123.0.0/16 |
|
| keep |
| Ports for the API server Service. |
Examples: ports: - name: api-server port: 8080 targetPort: api-server ports: - name: only_sidecar port: 9080 targetPort: 8888 |
|
| keep |
| API server Service type. |
|
|
| keep |
| Annotations to add to the API server Kubernetes ServiceAccount. |
|
|
| keep |
| Specifies if ServiceAccount’s API credentials should be mounted onto Pods. |
|
|
| keep |
| Specifies whether a ServiceAccount should be created. |
|
|
| keep |
The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name. |
|
|
| keep | |
| API server Startup probe failure threshold. |
|
|
| keep |
| API server Startup probe initial delay seconds. |
|
|
| keep |
| API server Startup probe period seconds. |
|
|
| keep |
| API server Startup probe scheme. |
|
|
| keep |
| API server Startup probe timeout seconds. |
|
|
| keep |
| Specifies the strategy used to replace old Pods by new ones. |
|
|
| keep |
| Specify Tolerations for API server pods. |
|
|
| keep |
| Enable wait-for-airflow-migrations init container. |
|
|
| Not sure if this should be a container-level flag (I don't have a specific use case in mind when it would make sense to have it only in one component and not in another) |
| Add additional env vars to wait-for-airflow-migrations init container. |
|
|
|
...
Parameter | Description | Default | Opinion Jens | Opinion Bugra | Opinion Przemek |
|---|---|---|---|---|---|
| Specify scheduling constraints for StatsD pods. |
|
|
| Move to Kustomize & document OpenTelemetry setup too |
| Annotations to add to the StatsD deployment. |
|
|
| |
| Args to use when running statsd-exporter (templated). |
|
|
| |
| Maximum number of metric mappings to cache in memory. Higher values improve performance for frequently used metrics but consume more memory. |
|
|
| |
| Time-to-live for cached metric mappings. Determines how long mappings remain in cache before expiring. Set to ‘0s’ to disable expiration. |
|
|
| |
| Cache eviction strategy for metric mappings. lru (Least Recently Used) evicts oldest accessed items, ‘random’ evicts randomly selected items. |
|
|
| |
| Extra annotations to apply to the statsd configmap. |
|
|
| |
| Enable StatsD. |
|
|
| |
| Add additional env vars to statsd container. |
|
|
| |
| Additional mappings for StatsD exporter.If set, will merge default mapping and extra mappings, default mapping has higher priority. So, if you want to change some default mapping, please use overrideMappings |
|
|
| |
| Additional NetworkPolicies as needed. |
|
|
| |
| Labels specific to statsd objects and pods |
|
|
| |
| Select certain nodes for StatsD pods. |
|
|
| |
| Override mappings for StatsD exporter.If set, will ignore setting item in default and extraMappings. So, If you use it, ensure all mapping item contains in it. |
|
|
| |
| Annotations to add to the StatsD pods. |
|
|
| |
| Specify priority for StatsD pods. |
|
|
| |
| Resources for StatsD pods. |
Examples: resources: limits: cpu: 100m memory: 128Mi requests: cpu: 100m memory: 128Mi |
|
| |
| Security context for the StatsD pod (deprecated, use securityContexts instead). |
Examples: securityContext: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
|
| |
| Extra annotations for the StatsD Service. |
|
|
| |
| Annotations to add to the StatsD Kubernetes ServiceAccount. |
|
|
| |
| Specifies if ServiceAccount’s API credentials should be mounted onto Pods. |
|
|
| |
| Specifies whether a ServiceAccount should be created. |
|
|
| |
The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name. |
|
|
| ||
| Grace period for statsd to finish after SIGTERM is sent from Kubernetes. |
|
|
| |
| Specify Tolerations for StatsD pods. |
|
|
| |
| Specify topology spread constraints for StatsD pods. |
|
|
| |
| StatsD run as user parameter. |
|
|
|
Jobs
Parameter | Description | Default | Opinion Jens | Opinion Bugra | Opinion Przemek |
|---|---|---|---|---|---|
| Specify scheduling constraints for cleanup pods. |
|
|
| Move it under workers.kubernetes section as it is needed only for KubernetesExecutor |
| Args to use when running the cleanup cronjob (templated). |
|
|
| |
| Command to use when running the cleanup cronjob (templated). |
|
|
| |
| Enable cleanup. |
|
|
| |
| Add additional env vars to cleanup. |
|
|
| |
| Annotations to add to the cleanup cronjob. |
|
|
| |
| labels to add to cleanup pods. |
|
|
| |
| Select certain nodes for cleanup pods. |
|
|
| |
| Annotations to add to cleanup pods. |
|
|
| |
| Specify priority for cleanup pods. |
|
|
| |
| Resources for cleanup pods |
Examples: resources: limits: cpu: 100m memory: 128Mi requests: cpu: 100m memory: 128Mi |
|
| |
| Cleanup schedule (templated). |
|
|
| |
| Security context for the cleanup job pod (deprecated, use securityContexts instead). If not set, the values from securityContext will be used. |
Examples: securityContext: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
|
| |
| Annotations to add to the cleanup CronJob Kubernetes ServiceAccount. |
|
|
| |
| Specifies if ServiceAccount’s API credentials should be mounted onto Pods |
|
|
| |
| Specifies whether a ServiceAccount should be created. |
|
|
| |
The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name. |
|
|
| ||
| Specify Tolerations for cleanup pods. |
|
|
| |
| Specify topology spread constraints for cleanup pods. |
|
|
| |
| Specify scheduling constraints for the create user job pod. |
|
|
| Move under the new flask section Agreed on making createUserJob.enabled false by default |
| Annotations to add to the create user job pod. |
|
|
| |
| Specify if you want additional configured env vars applied to this job |
|
|
| |
| Args to use when running create user job (templated). |
|
|
| |
| Command to use when running create user job (templated). |
|
|
| |
| Default user email address. |
|
| ||
| Default user firstname. |
|
|
| |
| Default user lastname. |
|
|
| |
| Default user password. |
|
|
| |
| Default user role. |
|
|
| |
| Default user username. |
|
|
| |
| Whether the create user job should be created. |
| Should we make this Fals eas default not to be insecure by default? | Make sense. The only thing people can expect this is true by default. Maybe we can add docs there to route them to | |
| Add additional env vars to the create user job pod. |
|
|
| |
| Launch additional containers for the create user job pod |
|
|
| |
| Add additional init containers into create user job pod (templated). |
|
|
| |
| Mount additional volumes into create user job |
|
|
| |
| Mount additional volumes into create user job |
|
|
| |
| Annotations to add to the create user job job. |
|
|
| |
| Labels to add to the create user job objects and pods. |
|
|
| |
| Select certain nodes for the create user job pod. |
|
|
| |
| Specify priority for the create user job pod. |
|
|
| |
| Resources for the create user job pod |
Examples: resources: limits: cpu: 100m memory: 128Mi requests: cpu: 100m memory: 128Mi |
|
| |
| Security context for the create user job pod (deprecated, use securityContexts instead). If not set, the values from securityContext will be used. |
Examples: securityContext: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
|
| |
| Annotations to add to the create user job Kubernetes ServiceAccount. |
|
|
| |
| Specifies if ServiceAccount’s API credentials should be mounted onto Pods. |
|
|
| |
| Specifies whether a ServiceAccount should be created. |
|
|
| |
The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name. |
|
|
| ||
| Specify Tolerations for the create user job pod. |
|
|
| |
| Specify topology spread constraints for the create user job pod. |
|
|
| |
| Limit the lifetime of the job object after it finished execution |
|
|
| |
| Specify if you want to use the default Helm Hook annotations |
|
|
| |
| Specify scheduling constraints for database cleanup pods. |
|
|
| keep |
| Specify if you want additional configured env vars applied to database cleanup job |
|
|
| keep |
| Args to use when running the database cleanup cronjob (templated). |
|
|
| keep |
| Maximum number of rows to delete or archive in a single transaction. |
|
|
| keep |
| Command to use when running the database cleanup cronjob (templated). |
|
|
| keep |
| Enable database cleanup. |
|
|
| keep |
| Add additional env vars to database cleanup. |
|
|
| keep |
| Annotations to add to the database cleanup cronjob. |
|
|
| keep |
| labels to add to database cleanup pods. |
|
|
| keep |
| Select certain nodes for database cleanup pods. |
|
|
| keep |
| Annotations to add to database cleanup pods. |
|
|
| keep |
| Specify priority for database cleanup pods. |
|
|
| keep |
| Resources for database cleanup pods |
Examples: resources: limits: cpu: 100m memory: 128Mi requests: cpu: 100m memory: 128Mi |
|
| keep |
| Number of days to retain records in the metadata database. |
|
|
| keep |
| Database cleanup schedule (templated). |
|
|
| keep |
| Annotations to add to the database cleanup CronJob Kubernetes ServiceAccount. |
|
|
| keep |
| Specifies if ServiceAccount’s API credentials should be mounted onto Pods |
|
|
| keep |
| Specifies whether a ServiceAccount should be created. |
|
|
| keep |
The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name. |
|
|
| keep | |
| Don’t preserve purged records in an archive table. |
|
|
| keep |
| Table names to perform maintenance on. Supported values in: https://airflow.apache.org/docs/apache-airflow/stable/cli-and-env-variables-ref.html#clean |
|
|
| keep |
| Specify Tolerations for database cleanup pods. |
|
|
| keep |
| Specify topology spread constraints for database cleanup pods. |
|
|
| keep |
| Make logging output more verbose. |
|
|
| keep |
| Specify scheduling constraints for the migrate database job pod. |
|
|
| keep |
| Annotations to add to the migrate database job pod. |
|
|
| keep |
| Specify if you want additional configured env vars applied to this job |
|
|
| keep |
| Args to use when running migrate database job (templated). |
|
|
| keep |
| Command to use when running migrate database job (templated). |
|
|
| keep |
| Enable migrate database job. |
|
|
| keep |
| Add additional env vars to migrate database job. |
|
|
| keep |
| Launch additional containers for the migrate database job pod |
|
|
| keep |
| Add additional init containers into migrate database job (templated). |
|
|
| keep |
| Mount additional volumes into migrate database job |
|
|
| keep |
| Mount additional volumes into migrate database job |
|
|
| keep |
| Annotations to add to the migrate database job. |
|
|
| keep |
| Labels to add to the migrate database job objects and pods. |
|
|
| keep |
| Select certain nodes for the migrate database job pod. |
|
|
| keep |
| Specify priority for the migrate database job pod. |
|
|
| keep |
| Resources for the migrate database job pod |
Examples: resources: limits: cpu: 100m memory: 128Mi requests: cpu: 100m memory: 128Mi |
|
| keep |
| Security context for the migrate database job pod (deprecated, use securityContexts instead). If not set, the values from securityContext will be used. |
Examples: securityContext: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
|
| keep |
| Annotations to add to the migrate database job Kubernetes ServiceAccount. |
|
|
| keep |
| Specifies if ServiceAccount’s API credentials should be mounted onto Pods. |
|
|
| keep |
| Specifies whether a ServiceAccount should be created. |
|
|
| keep |
The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name. |
|
|
| keep | |
| Specify Tolerations for the migrate database job pod. |
|
|
| keep |
| Specify topology spread constraints for migrate database job pod. |
|
|
| keep |
| Limit the lifetime of the job object after it finished execution |
|
|
| keep |
| Specify if you want to use the default Helm Hook annotations |
|
|
|
Kubernetes
Modify the chart deployment logic in a way that this will not be needed in the sense that:
|
Kubernetes
Parameter
Parameter |
|---|
Description | Default | Opinion Jens | Opinion Bugra | Opinion Przemek | |
|---|---|---|---|---|---|
| Specify scheduling constraints for all pods. |
|
|
| keep |
| Extra annotations to apply to the main Airflow configmap. |
|
|
| keep |
| Extra annotations to apply to all Airflow pods. |
|
|
| keep |
| Container Lifecycle Hooks definition for the API server. If not set, the values from global containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
|
| keep |
| Container security context definition for the API server. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| keep |
| Pod security context definition for the API server. |
Examples: pod: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
|
| keep |
| Specify topology spread constraints for API server pods. |
|
|
| keep |
| Container security context definition for the wait for migrations. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| Related comment under dagProcessor section next to waitForMigration section |
| Container Lifecycle Hooks definition for the cleanup. If not set, the values from global containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
|
| keep |
| Container security context definition for the cleanup. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| keep |
| Pod security context definition for the cleanup. |
Examples: pod: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
|
| keep |
| Default Container Lifecycle Hooks definition. The values in this parameter will be used when containerLifecycleHooks is not defined for specific containers. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
|
| keep |
| Container Lifecycle Hooks definition for the create user job. If not set, the values from global containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
|
| Related comment under jobs section next to createUserJob section |
| Container security context definition for the create user job. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| |
| Pod security context definition for the create user job. |
Examples: pod: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
|
| |
| Container Lifecycle Hooks definition for the dag processor. If not set, the values from global containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
|
| keep |
| Container security context definition for the dag processor. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| keep |
| Pod security context definition for the dag processor. |
Examples: pod: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
|
| keep |
| Container security context definition for the wait for migrations. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| Related comment under dagProcessor section next to waitForMigration section |
| Container Lifecycle Hooks definition for the git sync sidecar. If not set, the values from global containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
| gitSync related, could be useful to tag if we do bundle or deprecate
| Related comment next to other dags.gitSync fields |
| Container security context definition for the git sync sidecar. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
| ||
| Container Lifecycle Hooks definition for the database cleanup. If not set, the values from global containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
|
| keep |
| Container security context definition for the database cleanup. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| keep |
| Pod security context definition for the database cleanup. |
Examples: pod: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
|
| keep |
| Extra ConfigMaps that will be managed by the chart. |
Examples: extraConfigMaps: '{{ .Release.Name }}-airflow-variables': data: |- AIRFLOW_VAR_HELLO_MESSAGE: 'Hi!' AIRFLOW_VAR_KUBERNETES_NAMESPACE: '{{ .Release.Namespace }}' |
|
| keep |
| Extra secrets that will be managed by the chart. |
Examples: extraSecrets: '{{ .Release.Name }}-airflow-connections': data: |- AIRFLOW_CONN_GCP: 'base64_encoded_gcp_conn_string' AIRFLOW_CONN_AWS: 'base64_encoded_aws_conn_string' stringData: 'AIRFLOW_CONN_OTHER: ''other_conn''' |
|
| keep |
| Container Lifecycle Hooks definition for the network policy. If not set, the values from global containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
|
Flower settings, above comment related | Related comment under flower section |
| Container security context definition for the network policy. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
| ||
| Pod security context definition for the network policy. |
Examples: pod: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
| ||
| List of existing Kubernetes secrets containing Base64 encoded credentials to connect to private registries (will get passed to imagePullSecrets). |
|
|
| keep |
| Add common labels to all objects and pods defined in this chart. |
|
|
| keep |
| Define default/max/min values for pods and containers in namespace. |
|
|
| keep |
| Container Lifecycle Hooks definition for the migrate database job. If not set, the values from global containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
|
| Related comment under jobs section next to migrateDatabaseJob other fields |
| Container security context definition for the migrate database job. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| |
| Pod security context definition for the migrate database job. |
Examples: pod: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
|
| |
| Enabled network policies. |
|
|
| keep |
| Select certain nodes for all pods. |
|
|
| keep |
| Container Lifecycle Hooks definition for the PgBouncer. If not set, the values from global containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
|
| Related comment under PgBouncer section |
| Container Lifecycle Hooks definition for the metrics exporter sidecar. If not set, the values from global containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
|
| |
| Container security context definition for the metrics exporter sidecar. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| |
| Container security context definition for the PgBouncer. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| |
| Pod security context definition for the PgBouncer. |
Examples: pod: fsGroup: 0 runAsGroup: 0 runAsUser: 65534 |
|
| |
| Priority Classes created by helm charts |
Examples: priorityClasses: - name: class1 preemptionPolicy: PreemptLowerPriority value: 10000 priorityClasses: - name: class2 preemptionPolicy: Never value: 100000 |
|
| keep |
| Define any ResourceQuotas for namespace. |
|
|
| keep |
| Specifies whether RBAC resources should be created. |
|
|
| keep |
| Specifies whether SCC RoleBinding resource should be created (refer to Production Guide). |
|
|
| keep |
| Container Lifecycle Hooks definition for the redis. If not set, the values from global containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
|
| Related comment under redis section |
| Container security context definition for the redis. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| |
| Pod security context definition for the redis. |
Examples: pod: fsGroup: 0 runAsGroup: 0 runAsUser: 999 |
|
| |
| Credentials to connect to a private registry, these will get Base64 encoded and stored in a secret (will get passed to imagePullSecrets) (create manually the credentials secret and add to imagePullSecrets instead). |
Examples: connection: email: '...' host: '...' pass: '...' user: '...' |
|
| keep |
| Email Address |
|
|
| keep |
| Registry Server URL (e.g. https://index.docker.io/v1/ for DockerHub) |
|
|
| keep |
| Password |
|
|
| keep |
| Username |
|
|
| keep |
| Name of the Kubernetes secret containing Base64 encoded credentials to connect to a private registry (will get passed to imagePullSecrets) (Deprecated - renamed to registry.secretNames). |
|
|
| registry.secretNames is not used in chart |
| Container Lifecycle Hooks definition for the scheduler. If not set, the values from global containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
|
| keep |
| Container security context definition for the scheduler. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| keep |
| Pod security context definition for the scheduler. |
Examples: pod: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
|
| keep |
| Container security context definition for the wait for migrations. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| Related comment under dagProcessor section next to waitForMigration section |
| Default pod security context definition (deprecated, use securityContexts instead). The values in this parameter will be used when securityContext is not defined for specific Pods |
Examples: securityContext: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
|
| Drop |
| Default container security context definition. The values in this parameter will be used when securityContexts is not defined for specific containers |
Examples: containers: allowPrivilegeEscalation: false |
|
| keep |
| Default pod security context definition. The values in this parameter will be used when securityContexts is not defined for specific Pods. |
Examples: pod: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
|
| keep |
| Container Lifecycle Hooks definition for the statsd. If not set, the values from global containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
|
| Related comment under statsd section |
| Container security context definition for the statsd. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| |
| Pod security context definition for the statsd. |
Examples: pod: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
|
| |
| Specify Tolerations for all pods. |
|
|
| keep |
| Specify topology spread constraints for all pods. |
|
|
| keep |
| Container Lifecycle Hooks definition for the triggerer. If not set, the values from global containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
|
| keep |
| Container security context definition for the triggerer. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| keep |
| Pod security context definition for the triggerer. |
Examples: pod: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
|
| keep |
| Container security context definition for the wait for migrations. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| Related comment under dagProcessor section next to waitForMigration section |
| Container Lifecycle Hooks definition for the webserver. If not set, the values from global containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
|
We should either remove these or convert to an API server but I assume just removing is the way to go
| Drop with Airflow 2 |
| Container security context definition for the webserver. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
| ||
| Pod security context definition for the webserver. |
Examples: pod: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
| ||
| Specify topology spread constraints for webserver pods. |
|
| ||
| Container security context definition for the wait for migrations. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
| ||
| Container Lifecycle Hooks definition for the kerberos init container. If not set, the values from workers.kerberosInitContainer.containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
| Kerberos, if we move to Kustomize
| Related comment under kerberos section |
| Container security context definition for the kerberos init container. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
| ||
| Container security context definition for the persistence. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| keep |
| Container security context definition. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| keep |
| Pod security context definition. |
Examples: pod: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
|
| keep |
| Container Lifecycle Hooks definition for Airflow Celery workers and pods created with pod-template-file. If not set, the values from global containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
|
| Move to proper workers.celery/workers.kubernetes sections |
| Container Lifecycle Hooks definition for the kerberos init container. If not set, the values from global containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
|
Kerberos, if we move Kustomize. | Related comment under kerberos section |
| Container security context definition for the kerberos init container. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
| ||
| Container Lifecycle Hooks definition for the kerberos sidecar. If not set, the values from global containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
| ||
| Container security context definition for the kerberos sidecar. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
| ||
| Container Lifecycle Hooks definition for the kerberos init container. If not set, the values from workers.kerberosInitContainer.containerLifecycleHooks will be used. |
Examples: containerLifecycleHooks: postStart: exec: command: - /bin/sh - -c - echo postStart handler > /usr/share/message preStop: exec: command: - /bin/sh - -c - echo preStop handler > /usr/share/message |
| ||
| Container security context definition for the kerberos init container. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
| ||
| Container security context definition. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| keep |
| Pod security context definition. |
Examples: pod: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
|
| keep |
| Container security context definition for the persistence. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| Move to proper workers.celery/workers.kubernetes sections |
| Container security context definition. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| |
| Pod security context definition. |
Examples: pod: fsGroup: 0 runAsGroup: 0 runAsUser: 50000 |
|
| |
| Container security context definition for the wait-for-airflow-migrations container. |
Examples: container: allowPrivilegeEscalation: false capabilities: drop: - ALL |
|
| Related comment under dagProcessor section next to waitForMigration section |
Ingress
Parameter | Description | Default | Opinion Jens | Opinion Jens | Opinion Przemek |
|---|---|---|---|---|---|
| Annotations for the API server Ingress. |
|
|
| keep |
| Enable API server ingress resource. |
|
|
| keep |
| The hostname for the API server Ingress. (Deprecated - renamed to ingress.apiServer.hosts) |
|
|
| drop |
| The hostnames or hosts configuration for the API server Ingress. |
|
|
| keep |
| The Ingress Class for the API server Ingress. |
|
|
| keep |
| The path for the API server Ingress. |
|
|
| keep |
| The pathType for the API server Ingress (required for Kubernetes 1.19 and above). |
|
|
| keep |
| HTTP paths to add to the API server Ingress before the default path. |
|
|
| keep |
| HTTP paths to add to the API server Ingress after the default path. |
|
|
| keep |
| Enable TLS termination for the API server Ingress. |
|
|
| drop - missing deprecation info |
| The name of a pre-created Secret containing a TLS private key and certificate. |
|
|
| drop - missing deprecation info |
| Enable all ingress resources (deprecated - use ingress.web.enabled and ingress.flower.enabled). |
|
|
| drop |
| Annotations for the flower Ingress. |
|
|
| Move to Kustomize |
| Enable flower ingress resource. |
|
|
| |
| The hostname for the flower Ingress. (Deprecated - renamed to ingress.flower.hosts) |
|
|
| |
| The hostnames or hosts configuration for the flower Ingress. |
|
|
| |
| The Ingress Class for the flower Ingress. |
|
|
| |
| The path for the flower Ingress. |
|
|
| |
| The pathType for the flower Ingress (required for Kubernetes 1.19 and above). |
|
|
| |
| Enable TLS termination for the flower Ingress. |
|
|
| |
| The name of a pre-created Secret containing a TLS private key and certificate. |
|
|
| |
| Annotations for the PgBouncer Ingress. |
| Why should pgbouncer have an ingress? | These are all deployed into the same cluster. So there is no reason to have. It is even a possible open door.
| Related comment under PgBouncer section. Ingress needed for setups where components are separated from each other, looking at different setups (basically, all enabled flags allow for that) |
| Enable PgBouncer ingress resource. |
|
| ||
| The hostname for the PgBouncer Ingress. (Deprecated - renamed to ingress.pgbouncer.hosts) |
|
| ||
| The hostnames or hosts configuration for the PgBouncer Ingress. |
|
| ||
| The Ingress Class for the PgBouncer Ingress. |
|
| ||
| The path for the PgBouncer Ingress. |
|
| ||
| The pathType for the PgBouncer Ingress (required for Kubernetes 1.19 and above). |
|
| ||
| Annotations for the statsd Ingress. |
| Why should statsd have an ingress? | This could make sense if the deployed logging tool is outside of the cluster, I would understand if they need to reach out to statsd
| Move to Kustomize. Ingress needs for setups where Observability tools gather metrics from the endpoint instead of having dedicated agents inside the Kubernetes cluster |
| Enable statsd ingress resource. |
|
| ||
| The hostname for the statsd Ingress. (Deprecated - renamed to ingress.statsd.hosts) |
|
| ||
| The hostnames or hosts configuration for the statsd Ingress. |
|
| ||
| The Ingress Class for the statsd Ingress. |
|
| ||
| The path for the statsd Ingress. |
|
| ||
| The pathType for the statsd Ingress (required for Kubernetes 1.19 and above). |
|
| ||
| Annotations for the web Ingress. |
| Will be removed with deprecation of Airflow 2 |
Yes, API server separatly defined. | Drop with Airflow 2 |
| Enable web ingress resource. |
|
| ||
| The hostname for the web Ingress. (Deprecated - renamed to ingress.web.hosts) |
|
| ||
| The hostnames or hosts configuration for the web Ingress. |
|
| ||
| The Ingress Class for the web Ingress. |
|
| ||
| The path for the web Ingress. |
|
| ||
| The pathType for the web Ingress (required for Kubernetes 1.19 and above). |
|
| ||
| HTTP paths to add to the web Ingress before the default path. |
|
| ||
| HTTP paths to add to the web Ingress after the default path. |
|
| ||
| Enable TLS termination for the web Ingress. |
|
| ||
| The name of a pre-created Secret containing a TLS private key and certificate. |
|
|
...