Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Parameter

Description

Default

Opinion Jens

Opinion Bugra

Opinion Przemek

apiServer.affinity

Specify scheduling constraints for API server pods.

See values.yaml

 

 

keep

apiServer.allowPodLogReading

Allow API server to read k8s pod logs. Useful when you don’t have an external log store.

True

 

 

Could Maybe it could be automatically set based on the executor value 🤔. Maybe, as I'm not sure about whether it is needed or not, with e.g. remote logging set

apiServer.annotations

Annotations to add to the API server deployment

{}

 

 

keep 

apiServer.args

Args to use when running the Airflow API server (templated). When running behind a reverse proxy, add –proxy-headers to enable Uvicorn to respect X-Forwarded-Proto, X-Forwarded-For, and X-Forwarded-Port headers.

['bash', '-c', 'exec airflow api-server']

Examples:

args:
- bash
- -c
- exec airflow api-server --proxy-headers

 

 

keep

apiServer.command

Command to use when running the Airflow API server (templated).

~

 

 

keep

apiServer.configMapAnnotations

Extra annotations to apply to the API server configmap.

{}

 

 

keep

apiServer.enabled

Enable Airflow API server deployment.

True

 

 

keep

apiServer.env

Add additional env vars to API server. When running behind a reverse proxy, set FORWARDED_ALLOW_IPS to specify which IPs are trusted to send X-Forwarded-* headers. Use “*” for trusted environments, or specify proxy IP ranges for production.

[]

Examples:

env:
- - name: FORWARDED_ALLOW_IPS
    value: '*'

 

 

keep

apiServer.extraContainers

Launch additional containers into API server.

[]

 

 

keep

apiServer.extraInitContainers

Add additional init containers into API server.

[]

 

 

keep

apiServer.extraVolumeMounts

Mount additional volumes into API server.

[]

 

 

keep

apiServer.extraVolumes

Mount additional volumes into API server.

[]

 

 

keep

apiServer.hostAliases

HostAliases for the API server pod.

[]

Examples:

hostAliases:
- hostnames:
  - foo.local
  ip: 127.0.0.1
hostAliases:
- hostnames:
  - foo.remote
  ip: 10.1.2.3

 

 

keep

apiServer.hpa.behavior

HorizontalPodAutoscalerBehavior configures the scaling behavior of the target.

{}

Should we keep both KEDA and HPA? Or move both to a Kustomize?


 


 


 


 

My vote would be moving Keda to Kustomize, as it is really custom if we think of core components


 


 


 


 

Keep HPA, document Keda in Kustomize


 


 


 


 

apiServer.hpa.enabled

Enable HPA autoscaling for API server

False

apiServer.hpa.maxReplicaCount

Maximum number of API server replicas created by HPA if HPA is enabled.

5

apiServer.hpa.metrics

Specifications for which to use to calculate the desired replica count.

[{'type': 'Resource', 'resource': {'name': 'cpu', 'target': {'type': 'Utilization', 'averageUtilization': 50}}}]

apiServer.hpa.minReplicaCount

Minimum number of API server replicas created by HPA if HPA is enabled.

1

apiServer.labels

Labels to add to the API server objects and pods.

{}

 

 

keep

apiServer.livenessProbe.failureThreshold

API server Liveness probe failure threshold.

5

 

 

keep 

apiServer.livenessProbe.initialDelaySeconds

API server Liveness probe initial delay.

15

 

 

keep

apiServer.livenessProbe.periodSeconds

API server Liveness probe period seconds.

10

 

 

keep

apiServer.livenessProbe.scheme

API server Liveness probe scheme.

HTTP

 

 

keep

apiServer.livenessProbe.timeoutSeconds

API server Liveness probe timeout seconds.

5

 

 

keep

apiServer.networkPolicy.ingress.from

Peers for API server NetworkPolicyingress.

[]

 

 

keep

apiServer.networkPolicy.ingress.ports

Ports for API server NetworkPolicyingress (if from is set).

[{'port': '{{ .Values.ports.apiServer }}'}]

Examples:

ports:
- port: 8080

 

 

keep

apiServer.nodeSelector

Select certain nodes for API server pods.

{}

 

 

keep

apiServer.podAnnotations

Annotations to add to the API server pods.

{}

 

 

keep

apiServer.podDisruptionBudget.config.maxUnavailable

Max unavailable pods for API server.

1

 

 

Remove maxUnavailable and minAvailable and set config: {}


apiServer.podDisruptionBudget.config.minAvailable

Min available pods for API server.

1

 

 

apiServer.podDisruptionBudget.enabled

Enable pod disruption budget.

False

 

 

keep

apiServer.priorityClassName

Specify priority for API server pods.

~

 

 

keep

apiServer.readinessProbe.failureThreshold

API server Readiness probe failure threshold.

5

 

 

keep

apiServer.readinessProbe.initialDelaySeconds

API server Readiness probe initial delay.

15

 

 

keep

apiServer.readinessProbe.periodSeconds

API server Readiness probe period seconds.

10

 

 

keep

apiServer.readinessProbe.scheme

API server Readiness probe scheme.

HTTP

 

 

keep

apiServer.readinessProbe.timeoutSeconds

API server Readiness probe timeout seconds.

5

 

 

keep

apiServer.replicas

How many Airflow API server replicas should run. This setting is ignored when HPA (Horizontal Pod Autoscaler) is enabled

1

 

 

keep

apiServer.resources

Resources for API server pods.

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

 

keep

apiServer.service.annotations

Annotations for the API server Service.

{}

 

 

keep

apiServer.service.loadBalancerIP

API server Service loadBalancerIP.

~

 

 

keep

apiServer.service.loadBalancerSourceRanges

API server Service loadBalancerSourceRanges.

[]

Examples:

loadBalancerSourceRanges:
- 10.123.0.0/16

 

 

keep

apiServer.service.ports

Ports for the API server Service.

[{'name': 'api-server', 'port': '{{ .Values.ports.apiServer }}'}]

Examples:

ports:
- name: api-server
  port: 8080
  targetPort: api-server
ports:
- name: only_sidecar
  port: 9080
  targetPort: 8888

 

 

keep

apiServer.service.type

API server Service type.

ClusterIP

 

 

keep

apiServer.serviceAccount.annotations

Annotations to add to the API server Kubernetes ServiceAccount.

{}

 

 

keep

apiServer.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods.

True

 

 

keep

apiServer.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

 

 

keep

apiServer.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

 

 

keep

apiServer.startupProbe.failureThreshold

API server Startup probe failure threshold.

6

 

 

keep

apiServer.startupProbe.initialDelaySeconds

API server Startup probe initial delay seconds.

0

 

 

keep

apiServer.startupProbe.periodSeconds

API server Startup probe period seconds.

10

 

 

keep

apiServer.startupProbe.scheme

API server Startup probe scheme.

HTTP

 

 

keep

apiServer.startupProbe.timeoutSeconds

API server Startup probe timeout seconds.

20

 

 

keep

apiServer.strategy

Specifies the strategy used to replace old Pods by new ones.

~

 

 

keep

apiServer.tolerations

Specify Tolerations for API server pods.

[]

 

 

keep

apiServer.waitForMigrations.enabled

Enable wait-for-airflow-migrations init container.

True

 

 

Not sure if this should be a container-level flag (I don't have a specific use case in mind when it would make sense to have it only in one component and not in another)


apiServer.waitForMigrations.env

Add additional env vars to wait-for-airflow-migrations init container.

[]

 

 

...

Parameter

Description

Default

Opinion Jens

Opinion Bugra

Opinion Przemek

statsd.affinity

Specify scheduling constraints for StatsD pods.

{}

 

 

Move to Kustomize & document OpenTelemetry setup too

statsd.annotations

Annotations to add to the StatsD deployment.

{}

 

 

statsd.args

Args to use when running statsd-exporter (templated).

['--statsd.mapping-config=/etc/statsd-exporter/mappings.yml']

 

 

statsd.cache.size

Maximum number of metric mappings to cache in memory. Higher values improve performance for frequently used metrics but consume more memory.

1000

 

 

statsd.cache.ttl

Time-to-live for cached metric mappings. Determines how long mappings remain in cache before expiring. Set to ‘0s’ to disable expiration.

0s

 

 

statsd.cache.type

Cache eviction strategy for metric mappings. lru (Least Recently Used) evicts oldest accessed items, ‘random’ evicts randomly selected items.

lru

 

 

statsd.configMapAnnotations

Extra annotations to apply to the statsd configmap.

{}

 

 

statsd.enabled

Enable StatsD.

True

 

 

statsd.env

Add additional env vars to statsd container.

[]

 

 

statsd.extraMappings

Additional mappings for StatsD exporter.If set, will merge default mapping and extra mappings, default mapping has higher priority. So, if you want to change some default mapping, please use overrideMappings

[]

 

 

statsd.extraNetworkPolicies

Additional NetworkPolicies as needed.

[]

 

 

statsd.labels

Labels specific to statsd objects and pods

{}

 

 

statsd.nodeSelector

Select certain nodes for StatsD pods.

{}

 

 

statsd.overrideMappings

Override mappings for StatsD exporter.If set, will ignore setting item in default and extraMappings. So, If you use it, ensure all mapping item contains in it.

[]

 

 

statsd.podAnnotations

Annotations to add to the StatsD pods.

{}

 

 

statsd.priorityClassName

Specify priority for StatsD pods.

~

 

 

statsd.resources

Resources for StatsD pods.

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

 

statsd.securityContext

Security context for the StatsD pod (deprecated, use securityContexts instead).

{}

Examples:

securityContext:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

 

statsd.service.extraAnnotations

Extra annotations for the StatsD Service.

{}

 

 

statsd.serviceAccount.annotations

Annotations to add to the StatsD Kubernetes ServiceAccount.

{}

 

 

statsd.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods.

True

 

 

statsd.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

 

 

statsd.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

 

 

statsd.terminationGracePeriodSeconds

Grace period for statsd to finish after SIGTERM is sent from Kubernetes.

30

 

 

statsd.tolerations

Specify Tolerations for StatsD pods.

[]

 

 

statsd.topologySpreadConstraints

Specify topology spread constraints for StatsD pods.

[]

 

 

statsd.uid

StatsD run as user parameter.

65534

 

 

Jobs

Parameter

Description

Default

Opinion Jens

Opinion Bugra

Opinion Przemek

cleanup.affinity

Specify scheduling constraints for cleanup pods.

{}

 

 

Move it under workers.kubernetes section as it is needed only for KubernetesExecutor

cleanup.args

Args to use when running the cleanup cronjob (templated).

['bash', '-c', 'exec airflow kubernetes cleanup-pods --namespace={{ .Release.Namespace }}']

 

 

cleanup.command

Command to use when running the cleanup cronjob (templated).

~

 

 

cleanup.enabled

Enable cleanup.

False

 

 

cleanup.env

Add additional env vars to cleanup.

[]

 

 

cleanup.jobAnnotations

Annotations to add to the cleanup cronjob.

{}

 

 

cleanup.labels

labels to add to cleanup pods.

{}

 

 

cleanup.nodeSelector

Select certain nodes for cleanup pods.

{}

 

 

cleanup.podAnnotations

Annotations to add to cleanup pods.

{}

 

 

cleanup.priorityClassName

Specify priority for cleanup pods.

~

 

 

cleanup.resources

Resources for cleanup pods

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

 

cleanup.schedule

Cleanup schedule (templated).

*/15 * * * *

 

 

cleanup.securityContext

Security context for the cleanup job pod (deprecated, use securityContexts instead). If not set, the values from securityContext will be used.

{}

Examples:

securityContext:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

 

cleanup.serviceAccount.annotations

Annotations to add to the cleanup CronJob Kubernetes ServiceAccount.

{}

 

 

cleanup.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods

True

 

 

cleanup.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

 

 

cleanup.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

 

 

cleanup.tolerations

Specify Tolerations for cleanup pods.

[]

 

 

cleanup.topologySpreadConstraints

Specify topology spread constraints for cleanup pods.

[]

 

 

createUserJob.affinity

Specify scheduling constraints for the create user job pod.

{}

 

 

Move under the new flask section


Agreed on making createUserJob.enabled false by default

createUserJob.annotations

Annotations to add to the create user job pod.

{}

 

 

createUserJob.applyCustomEnv

Specify if you want additional configured env vars applied to this job

True

 

 

createUserJob.args

Args to use when running create user job (templated).

['bash', '-c', 'exec \\\nairflow {{ semverCompare ">=2.0.0" .Values.airflowVersion | ternary "users create" "create_user" }} "$@"', '--', '-r', '{{ if .Values.webserver.defaultUser }}{{ .Values.webserver.defaultUser.role }}{{ else }}{{ .Values.createUserJob.defaultUser.role }}{{ end }}', '-u', '{{ if .Values.webserver.defaultUser }}{{ .Values.webserver.defaultUser.username }}{{ else }}{{ .Values.createUserJob.defaultUser.username }}{{ end }}', '-e', '{{ if .Values.webserver.defaultUser }}{{ .Values.webserver.defaultUser.email }}{{ else }}{{ .Values.createUserJob.defaultUser.email }}{{ end }}', '-f', '{{ if .Values.webserver.defaultUser }}{{ .Values.webserver.defaultUser.firstName }}{{ else }}{{ .Values.createUserJob.defaultUser.firstName }}{{ end }}', '-l', '{{ if .Values.webserver.defaultUser }}{{ .Values.webserver.defaultUser.lastName }}{{ else }}{{ .Values.createUserJob.defaultUser.lastName }}{{ end }}', '-p', '{{ if .Values.webserver.defaultUser }}{{ .Values.webserver.defaultUser.password }}{{ else }}{{ .Values.createUserJob.defaultUser.password }}{{ end }}']

 

 

createUserJob.command

Command to use when running create user job (templated).

~

 

 

createUserJob.defaultUser.email

Default user email address.

admin@example.com

 

 

createUserJob.defaultUser.firstName

Default user firstname.

admin

 

 

createUserJob.defaultUser.lastName

Default user lastname.

user

 

 

createUserJob.defaultUser.password

Default user password.

admin

 

 

createUserJob.defaultUser.role

Default user role.

Admin

 

 

createUserJob.defaultUser.username

Default user username.

admin

 

 

createUserJob.enabled

Whether the create user job should be created.

True

Should we make this Fals eas default not to be insecure by default?

Make sense. The only thing people can expect this is true by default. Maybe we can add docs there to route them to 

createUserJob.env

Add additional env vars to the create user job pod.

[]

 

 

createUserJob.extraContainers

Launch additional containers for the create user job pod

[]

 

 

createUserJob.extraInitContainers

Add additional init containers into create user job pod (templated).

[]

 

 

createUserJob.extraVolumeMounts

Mount additional volumes into create user job

[]

 

 

createUserJob.extraVolumes

Mount additional volumes into create user job

[]

 

 

createUserJob.jobAnnotations

Annotations to add to the create user job job.

{}

 

 

createUserJob.labels

Labels to add to the create user job objects and pods.

{}

 

 

createUserJob.nodeSelector

Select certain nodes for the create user job pod.

{}

 

 

createUserJob.priorityClassName

Specify priority for the create user job pod.

~

 

 

createUserJob.resources

Resources for the create user job pod

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

 

createUserJob.securityContext

Security context for the create user job pod (deprecated, use securityContexts instead). If not set, the values from securityContext will be used.

{}

Examples:

securityContext:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

 

createUserJob.serviceAccount.annotations

Annotations to add to the create user job Kubernetes ServiceAccount.

{}

 

 

createUserJob.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods.

True

 

 

createUserJob.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

 

 

createUserJob.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

 

 

createUserJob.tolerations

Specify Tolerations for the create user job pod.

[]

 

 

createUserJob.topologySpreadConstraints

Specify topology spread constraints for the create user job pod.

[]

 

 

createUserJob.ttlSecondsAfterFinished

Limit the lifetime of the job object after it finished execution

300

 

 

createUserJob.useHelmHooks

Specify if you want to use the default Helm Hook annotations

True

 

 

databaseCleanup.affinity

Specify scheduling constraints for database cleanup pods.

{}

 

 

keep

databaseCleanup.applyCustomEnv

Specify if you want additional configured env vars applied to database cleanup job

True

 

 

keep

databaseCleanup.args

Args to use when running the database cleanup cronjob (templated).

['-c', 'CLEAN_TS=$(date -d "-{{ .Values.databaseCleanup.retentionDays }} days" +"%Y-%m-%dT%H:%M:%S"); echo "Cleaning up metadata DB entries older than ${CLEAN_TS}"; exec airflow db clean --clean-before-timestamp "${CLEAN_TS}" --yes {{- if .Values.databaseCleanup.skipArchive }} --skip-archive{{ end }} {{- if .Values.databaseCleanup.verbose }} --verbose{{ end }} {{- with .Values.databaseCleanup.batchSize }} --batch-size {{ . }}{{ end }} {{- with .Values.databaseCleanup.tables }} --tables {{ . | join "," }}{{ end }}']

 

 

keep

databaseCleanup.batchSize

Maximum number of rows to delete or archive in a single transaction.

~

 

 

keep

databaseCleanup.command

Command to use when running the database cleanup cronjob (templated).

['bash']

 

 

keep

databaseCleanup.enabled

Enable database cleanup.

False

 

 

keep

databaseCleanup.env

Add additional env vars to database cleanup.

[]

 

 

keep

databaseCleanup.jobAnnotations

Annotations to add to the database cleanup cronjob.

{}

 

 

keep

databaseCleanup.labels

labels to add to database cleanup pods.

{}

 

 

keep

databaseCleanup.nodeSelector

Select certain nodes for database cleanup pods.

{}

 

 

keep

databaseCleanup.podAnnotations

Annotations to add to database cleanup pods.

{}

 

 

keep

databaseCleanup.priorityClassName

Specify priority for database cleanup pods.

~

 

 

keep

databaseCleanup.resources

Resources for database cleanup pods

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

 

keep

databaseCleanup.retentionDays

Number of days to retain records in the metadata database.

90

 

 

keep

databaseCleanup.schedule

Database cleanup schedule (templated).

0 0 * * 0

 

 

keep

databaseCleanup.serviceAccount.annotations

Annotations to add to the database cleanup CronJob Kubernetes ServiceAccount.

{}

 

 

keep

databaseCleanup.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods

True

 

 

keep

databaseCleanup.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

 

 

keep

databaseCleanup.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

 

 

keep

databaseCleanup.skipArchive

Don’t preserve purged records in an archive table.

False

 

 

keep

databaseCleanup.tables

Table names to perform maintenance on. Supported values in: https://airflow.apache.org/docs/apache-airflow/stable/cli-and-env-variables-ref.html#clean

[]

 

 

keep

databaseCleanup.tolerations

Specify Tolerations for database cleanup pods.

[]

 

 

keep

databaseCleanup.topologySpreadConstraints

Specify topology spread constraints for database cleanup pods.

[]

 

 

keep

databaseCleanup.verbose

Make logging output more verbose.

True

 

 

keep

migrateDatabaseJob.affinity

Specify scheduling constraints for the migrate database job pod.

{}

 

 

keep

migrateDatabaseJob.annotations

Annotations to add to the migrate database job pod.

{}

 

 

keep

migrateDatabaseJob.applyCustomEnv

Specify if you want additional configured env vars applied to this job

True

 

 

keep

migrateDatabaseJob.args

Args to use when running migrate database job (templated).

['bash', '-c', 'exec \\\nairflow {{ semverCompare ">=2.7.0" .Values.airflowVersion | ternary "db migrate" (semverCompare ">=2.0.0" .Values.airflowVersion | ternary "db upgrade" "upgradedb") }}']

 

 

keep

migrateDatabaseJob.command

Command to use when running migrate database job (templated).

~

 

 

keep

migrateDatabaseJob.enabled

Enable migrate database job.

True

 

 

keep

migrateDatabaseJob.env

Add additional env vars to migrate database job.

[]

 

 

keep

migrateDatabaseJob.extraContainers

Launch additional containers for the migrate database job pod

[]

 

 

keep

migrateDatabaseJob.extraInitContainers

Add additional init containers into migrate database job (templated).

[]

 

 

keep

migrateDatabaseJob.extraVolumeMounts

Mount additional volumes into migrate database job

[]

 

 

keep

migrateDatabaseJob.extraVolumes

Mount additional volumes into migrate database job

[]

 

 

keep

migrateDatabaseJob.jobAnnotations

Annotations to add to the migrate database job.

{}

 

 

keep

migrateDatabaseJob.labels

Labels to add to the migrate database job objects and pods.

{}

 

 

keep

migrateDatabaseJob.nodeSelector

Select certain nodes for the migrate database job pod.

{}

 

 

keep

migrateDatabaseJob.priorityClassName

Specify priority for the migrate database job pod.

~

 

 

keep

migrateDatabaseJob.resources

Resources for the migrate database job pod

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

 

keep

migrateDatabaseJob.securityContext

Security context for the migrate database job pod (deprecated, use securityContexts instead). If not set, the values from securityContext will be used.

{}

Examples:

securityContext:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

 

keep

migrateDatabaseJob.serviceAccount.annotations

Annotations to add to the migrate database job Kubernetes ServiceAccount.

{}

 

 

keep

migrateDatabaseJob.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods.

True

 

 

keep

migrateDatabaseJob.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

 

 

keep

migrateDatabaseJob.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

 

 

keep

migrateDatabaseJob.tolerations

Specify Tolerations for the migrate database job pod.

[]

 

 

keep

migrateDatabaseJob.topologySpreadConstraints

Specify topology spread constraints for migrate database job pod.

[]

 

 

keep

migrateDatabaseJob.ttlSecondsAfterFinished

Limit the lifetime of the job object after it finished execution

300

 

 

keep

migrateDatabaseJob.useHelmHooks

Specify if you want to use the default Helm Hook annotations

True

 

 

Kubernetes

Modify the chart deployment logic in a way that this will not be needed in the sense that:

  1. Deployment with helm --wait flag will work by default
  2. The order of components deployment will be proper, e.g. api server should be one of the first components to be deployed and e.g. workers after api server

Kubernetes

Parameter

Parameter

Description

Default

Opinion Jens

Opinion Bugra

Opinion Przemek

affinity

Specify scheduling constraints for all pods.

{}

 

 

keep

airflowConfigAnnotations

Extra annotations to apply to the main Airflow configmap.

{}

 

 

keep

airflowPodAnnotations

Extra annotations to apply to all Airflow pods.

{}

 

 

keep

apiServer.containerLifecycleHooks

Container Lifecycle Hooks definition for the API server. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

 

keep

apiServer.securityContexts.container

Container security context definition for the API server.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

keep

apiServer.securityContexts.pod

Pod security context definition for the API server.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

 

keep

apiServer.topologySpreadConstraints

Specify topology spread constraints for API server pods.

[]

 

 

keep

apiServer.waitForMigrations.securityContexts.container

Container security context definition for the wait for migrations.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

Related comment under dagProcessor section next to waitForMigration section

cleanup.containerLifecycleHooks

Container Lifecycle Hooks definition for the cleanup. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

 

keep

cleanup.securityContexts.container

Container security context definition for the cleanup.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

keep

cleanup.securityContexts.pod

Pod security context definition for the cleanup.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

 

keep

containerLifecycleHooks

Default Container Lifecycle Hooks definition. The values in this parameter will be used when containerLifecycleHooks is not defined for specific containers.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

 

keep

createUserJob.containerLifecycleHooks

Container Lifecycle Hooks definition for the create user job. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

 

Related comment under jobs section next to createUserJob section

createUserJob.securityContexts.container

Container security context definition for the create user job.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

createUserJob.securityContexts.pod

Pod security context definition for the create user job.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

 

dagProcessor.containerLifecycleHooks

Container Lifecycle Hooks definition for the dag processor. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

 

keep

dagProcessor.securityContexts.container

Container security context definition for the dag processor.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

keep

dagProcessor.securityContexts.pod

Pod security context definition for the dag processor.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

 

keep

dagProcessor.waitForMigrations.securityContexts.container

Container security context definition for the wait for migrations.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

Related comment under dagProcessor section next to waitForMigration section

dags.gitSync.containerLifecycleHooks

Container Lifecycle Hooks definition for the git sync sidecar. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

gitSync related, could be useful to tag if we do bundle or deprecate


 

Related comment next to other dags.gitSync fields

dags.gitSync.securityContexts.container

Container security context definition for the git sync sidecar.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

databaseCleanup.containerLifecycleHooks

Container Lifecycle Hooks definition for the database cleanup. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

 

keep

databaseCleanup.securityContexts.container

Container security context definition for the database cleanup.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

keep

databaseCleanup.securityContexts.pod

Pod security context definition for the database cleanup.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

 

keep

extraConfigMaps

Extra ConfigMaps that will be managed by the chart.

{}

Examples:

extraConfigMaps:
  '{{ .Release.Name }}-airflow-variables':
    data: |-
      AIRFLOW_VAR_HELLO_MESSAGE: 'Hi!'
      AIRFLOW_VAR_KUBERNETES_NAMESPACE: '{{ .Release.Namespace }}'

 

 

keep

extraSecrets

Extra secrets that will be managed by the chart.

{}

Examples:

extraSecrets:
  '{{ .Release.Name }}-airflow-connections':
    data: |-
      AIRFLOW_CONN_GCP: 'base64_encoded_gcp_conn_string'
      AIRFLOW_CONN_AWS: 'base64_encoded_aws_conn_string'
    stringData: 'AIRFLOW_CONN_OTHER: ''other_conn'''

 

 

keep

flower.containerLifecycleHooks

Container Lifecycle Hooks definition for the network policy. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

 

 

Flower settings, above comment related 

Related comment under flower section

flower.securityContexts.container

Container security context definition for the network policy.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

flower.securityContexts.pod

Pod security context definition for the network policy.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

imagePullSecrets

List of existing Kubernetes secrets containing Base64 encoded credentials to connect to private registries (will get passed to imagePullSecrets).

[]

 

 

keep

labels

Add common labels to all objects and pods defined in this chart.

{}

 

 

keep

limits

Define default/max/min values for pods and containers in namespace.

[]

 

 

keep

migrateDatabaseJob.containerLifecycleHooks

Container Lifecycle Hooks definition for the migrate database job. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

 

Related comment under jobs section next to migrateDatabaseJob other fields

migrateDatabaseJob.securityContexts.container

Container security context definition for the migrate database job.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

migrateDatabaseJob.securityContexts.pod

Pod security context definition for the migrate database job.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

 

networkPolicies.enabled

Enabled network policies.

False

 

 

keep

nodeSelector

Select certain nodes for all pods.

{}

 

 

keep

pgbouncer.containerLifecycleHooks

Container Lifecycle Hooks definition for the PgBouncer. If not set, the values from global containerLifecycleHooks will be used.

{'preStop': {'exec': {'command': ['/bin/sh', '-c', 'killall -INT pgbouncer && sleep 120']}}}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

 

Related comment under PgBouncer section

pgbouncer.metricsExporterSidecar.containerLifecycleHooks

Container Lifecycle Hooks definition for the metrics exporter sidecar. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

 

pgbouncer.metricsExporterSidecar.securityContexts.container

Container security context definition for the metrics exporter sidecar.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

pgbouncer.securityContexts.container

Container security context definition for the PgBouncer.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

pgbouncer.securityContexts.pod

Pod security context definition for the PgBouncer.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 65534

 

 

priorityClasses

Priority Classes created by helm charts

[]

Examples:

priorityClasses:
- name: class1
  preemptionPolicy: PreemptLowerPriority
  value: 10000
priorityClasses:
- name: class2
  preemptionPolicy: Never
  value: 100000

 

 

keep

quotas

Define any ResourceQuotas for namespace.

{}

 

 

keep

rbac.create

Specifies whether RBAC resources should be created.

True

 

 

keep

rbac.createSCCRoleBinding

Specifies whether SCC RoleBinding resource should be created (refer to Production Guide).

False

 

 

keep

redis.containerLifecycleHooks

Container Lifecycle Hooks definition for the redis. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

 

Related comment under redis section

redis.securityContexts.container

Container security context definition for the redis.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

redis.securityContexts.pod

Pod security context definition for the redis.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 999

 

 

registry.connection

Credentials to connect to a private registry, these will get Base64 encoded and stored in a secret (will get passed to imagePullSecrets) (create manually the credentials secret and add to imagePullSecrets instead).

{}

Examples:

connection:
  email: '...'
  host: '...'
  pass: '...'
  user: '...'

 

 

keep

registry.connection.email

Email Address

""

 

 

keep

registry.connection.host

Registry Server URL (e.g. https://index.docker.io/v1/ for DockerHub)

""

 

 

keep

registry.connection.pass

Password

""

 

 

keep

registry.connection.user

Username

""

 

 

keep

registry.secretName

Name of the Kubernetes secret containing Base64 encoded credentials to connect to a private registry (will get passed to imagePullSecrets) (Deprecated - renamed to registry.secretNames).

~

 

 

registry.secretNames is not used in chart

scheduler.containerLifecycleHooks

Container Lifecycle Hooks definition for the scheduler. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

 

keep

scheduler.securityContexts.container

Container security context definition for the scheduler.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

keep

scheduler.securityContexts.pod

Pod security context definition for the scheduler.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

 

keep

scheduler.waitForMigrations.securityContexts.container

Container security context definition for the wait for migrations.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

Related comment under dagProcessor section next to waitForMigration section

securityContext

Default pod security context definition (deprecated, use securityContexts instead). The values in this parameter will be used when securityContext is not defined for specific Pods

{}

Examples:

securityContext:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

 

Drop

securityContexts.containers

Default container security context definition. The values in this parameter will be used when securityContexts is not defined for specific containers

{}

Examples:

containers:
  allowPrivilegeEscalation: false

 

 

keep

securityContexts.pod

Default pod security context definition. The values in this parameter will be used when securityContexts is not defined for specific Pods.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

 

keep

statsd.containerLifecycleHooks

Container Lifecycle Hooks definition for the statsd. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

 

Related comment under statsd section

statsd.securityContexts.container

Container security context definition for the statsd.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

statsd.securityContexts.pod

Pod security context definition for the statsd.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

 

tolerations

Specify Tolerations for all pods.

[]

 

 

keep

topologySpreadConstraints

Specify topology spread constraints for all pods.

[]

 

 

keep

triggerer.containerLifecycleHooks

Container Lifecycle Hooks definition for the triggerer. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

 

keep

triggerer.securityContexts.container

Container security context definition for the triggerer.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

keep

triggerer.securityContexts.pod

Pod security context definition for the triggerer.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

 

keep

triggerer.waitForMigrations.securityContexts.container

Container security context definition for the wait for migrations.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

Related comment under dagProcessor section next to waitForMigration section

webserver.containerLifecycleHooks

Container Lifecycle Hooks definition for the webserver. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

 

 

 

 

 

We should either remove these or convert to an API server but I assume just removing is the way to go


 

 

 

 

Drop with Airflow 2

webserver.securityContexts.container

Container security context definition for the webserver.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

webserver.securityContexts.pod

Pod security context definition for the webserver.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

webserver.topologySpreadConstraints

Specify topology spread constraints for webserver pods.

[]

 

webserver.waitForMigrations.securityContexts.container

Container security context definition for the wait for migrations.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

workers.celery.kerberosInitContainer.containerLifecycleHooks

Container Lifecycle Hooks definition for the kerberos init container. If not set, the values from workers.kerberosInitContainer.containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

Kerberos, if we move to Kustomize


 

Related comment under kerberos section

workers.celery.kerberosInitContainer.securityContexts.container

Container security context definition for the kerberos init container.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

workers.celery.persistence.securityContexts.container

Container security context definition for the persistence.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

keep

workers.celery.securityContexts.container

Container security context definition.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

keep

workers.celery.securityContexts.pod

Pod security context definition.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

 

keep

workers.containerLifecycleHooks

Container Lifecycle Hooks definition for Airflow Celery workers and pods created with pod-template-file. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

 

Move to proper workers.celery/workers.kubernetes sections

workers.kerberosInitContainer.containerLifecycleHooks

Container Lifecycle Hooks definition for the kerberos init container. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

 

 

 

 

 

Kerberos, if we move Kustomize. 

Related comment under kerberos section

workers.kerberosInitContainer.securityContexts.container

Container security context definition for the kerberos init container.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

workers.kerberosSidecar.containerLifecycleHooks

Container Lifecycle Hooks definition for the kerberos sidecar. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

workers.kerberosSidecar.securityContexts.container

Container security context definition for the kerberos sidecar.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

workers.kubernetes.kerberosInitContainer.containerLifecycleHooks

Container Lifecycle Hooks definition for the kerberos init container. If not set, the values from workers.kerberosInitContainer.containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

workers.kubernetes.kerberosInitContainer.securityContexts.container

Container security context definition for the kerberos init container.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

workers.kubernetes.securityContexts.container

Container security context definition.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

keep

workers.kubernetes.securityContexts.pod

Pod security context definition.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

 

keep

workers.persistence.securityContexts.container

Container security context definition for the persistence.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

Move to proper workers.celery/workers.kubernetes sections

workers.securityContexts.container

Container security context definition.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

workers.securityContexts.pod

Pod security context definition.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

 

workers.waitForMigrations.securityContexts.container

Container security context definition for the wait-for-airflow-migrations container.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

 

Related comment under dagProcessor section next to waitForMigration section

Ingress

Parameter

Description

Default

Opinion Jens

Opinion Jens

Opinion Przemek

ingress.apiServer.annotations

Annotations for the API server Ingress.

{}

 

 

keep

ingress.apiServer.enabled

Enable API server ingress resource.

False

 

 

keep

ingress.apiServer.host

The hostname for the API server Ingress. (Deprecated - renamed to ingress.apiServer.hosts)

""

 

 

drop

ingress.apiServer.hosts

The hostnames or hosts configuration for the API server Ingress.

[]

 

 

keep

ingress.apiServer.ingressClassName

The Ingress Class for the API server Ingress.

""

 

 

keep

ingress.apiServer.path

The path for the API server Ingress.

/

 

 

keep

ingress.apiServer.pathType

The pathType for the API server Ingress (required for Kubernetes 1.19 and above).

ImplementationSpecific

 

 

keep

ingress.apiServer.precedingPaths

HTTP paths to add to the API server Ingress before the default path.

[]

 

 

keep

ingress.apiServer.succeedingPaths

HTTP paths to add to the API server Ingress after the default path.

[]

 

 

keep

ingress.apiServer.tls.enabled

Enable TLS termination for the API server Ingress.

False

 

 

drop - missing deprecation info

ingress.apiServer.tls.secretName

The name of a pre-created Secret containing a TLS private key and certificate.

""

 

 

drop - missing deprecation info

ingress.enabled

Enable all ingress resources (deprecated - use ingress.web.enabled and ingress.flower.enabled).

~

 

 

drop

ingress.flower.annotations

Annotations for the flower Ingress.

{}

 

 

Move to Kustomize

ingress.flower.enabled

Enable flower ingress resource.

False

 

 

ingress.flower.host

The hostname for the flower Ingress. (Deprecated - renamed to ingress.flower.hosts)

""

 

 

ingress.flower.hosts

The hostnames or hosts configuration for the flower Ingress.

[]

 

 

ingress.flower.ingressClassName

The Ingress Class for the flower Ingress.

""

 

 

ingress.flower.path

The path for the flower Ingress.

/

 

 

ingress.flower.pathType

The pathType for the flower Ingress (required for Kubernetes 1.19 and above).

ImplementationSpecific

 

 

ingress.flower.tls.enabled

Enable TLS termination for the flower Ingress.

False

 

 

ingress.flower.tls.secretName

The name of a pre-created Secret containing a TLS private key and certificate.

""

 

 

ingress.pgbouncer.annotations

Annotations for the PgBouncer Ingress.

{}

Why should pgbouncer have an ingress?

These are all deployed into the same cluster.

So there is no reason to have.

It is even a possible open door.


 

 

 

 

 

 

Related comment under PgBouncer section.

Ingress needed for setups where components are separated from each other, looking at different setups (basically, all enabled flags allow for that)

ingress.pgbouncer.enabled

Enable PgBouncer ingress resource.

False

 

ingress.pgbouncer.host

The hostname for the PgBouncer Ingress. (Deprecated - renamed to ingress.pgbouncer.hosts)

""

 

ingress.pgbouncer.hosts

The hostnames or hosts configuration for the PgBouncer Ingress.

[]

 

ingress.pgbouncer.ingressClassName

The Ingress Class for the PgBouncer Ingress.

""

 

ingress.pgbouncer.path

The path for the PgBouncer Ingress.

/metrics

 

ingress.pgbouncer.pathType

The pathType for the PgBouncer Ingress (required for Kubernetes 1.19 and above).

ImplementationSpecific

 

ingress.statsd.annotations

Annotations for the statsd Ingress.

{}

Why should statsd have an ingress?

This could make sense if the deployed logging tool is outside of the cluster,

I would understand if they need to reach out to statsd


 

 

 

 

 

 

Move to Kustomize.

Ingress needs for setups where Observability tools gather metrics from the endpoint instead of having dedicated agents inside the Kubernetes cluster

ingress.statsd.enabled

Enable statsd ingress resource.

False

 

ingress.statsd.host

The hostname for the statsd Ingress. (Deprecated - renamed to ingress.statsd.hosts)

""

 

ingress.statsd.hosts

The hostnames or hosts configuration for the statsd Ingress.

[]

 

ingress.statsd.ingressClassName

The Ingress Class for the statsd Ingress.

""

 

ingress.statsd.path

The path for the statsd Ingress.

/metrics

 

ingress.statsd.pathType

The pathType for the statsd Ingress (required for Kubernetes 1.19 and above).

ImplementationSpecific

 

ingress.web.annotations

Annotations for the web Ingress.

{}

Will be removed with deprecation of Airflow 2

 

 

 

 

 

 

 

 

 

 

Yes, API server separatly defined.

Drop with Airflow 2

ingress.web.enabled

Enable web ingress resource.

False

 

ingress.web.host

The hostname for the web Ingress. (Deprecated - renamed to ingress.web.hosts)

""

 

ingress.web.hosts

The hostnames or hosts configuration for the web Ingress.

[]

 

ingress.web.ingressClassName

The Ingress Class for the web Ingress.

""

 

ingress.web.path

The path for the web Ingress.

/

 

ingress.web.pathType

The pathType for the web Ingress (required for Kubernetes 1.19 and above).

ImplementationSpecific

 

ingress.web.precedingPaths

HTTP paths to add to the web Ingress before the default path.

[]

 

ingress.web.succeedingPaths

HTTP paths to add to the web Ingress after the default path.

[]

 

ingress.web.tls.enabled

Enable TLS termination for the web Ingress.

False

 

ingress.web.tls.secretName

The name of a pre-created Secret containing a TLS private key and certificate.

""

 

...