Complexity Analysis and Rating - Chart Parameters

Parameters from Docs

Common

Parameter

Description

Default

Opinion Jens

Opinion Bugra

airflowLocalSettings

airflow_local_settings file as a string (templated). You can bake an airflow_local_settings.py into your image instead. In that case, set this value to null.

See values.yaml

keep

keep

airflowVersion

Airflow version (Used to make some decisions based on Airflow Version being deployed).

3.1.7

keep

keep

apiSecretAnnotations

Annotations to add to the Api secret.

{}

Why is this for flask in AF3?

Description remains from v2 terms. 

apiSecretKey

The Flask secret key for Airflow Api to encrypt browser session.

~

Why is this for flask in AF3?

Description remains from v2 terms. 

apiServer.apiServerConfig

This string (templated) will be mounted into the Airflow API Server as a custom webserver_config.py. You can bake a webserver_config.py in to your image instead or specify a configmap containing the webserver_config.py.

~

Examples:

apiServerConfig: |-
  from airflow import configuration as conf

  # The SQLAlchemy connection string.
  SQLALCHEMY_DATABASE_URI = conf.get('database', 'SQL_ALCHEMY_CONN')

  # Flask-WTF flag for CSRF
  CSRF_ENABLED = True

keep

Is example still relevant?

This is still relevant if the user is using providers-fab and adding more fine-grained authentication integration through fab. That also generalised to BaseAuthManager and to providers that implement 3rd-party libraries and tools. I think the description should be updated.

webserver_config.py migration check mentioned above.

apiServer.apiServerConfigConfigMapName

The configmap name containing the webserver_config.py.

~

Examples:

apiServerConfigConfigMapName: my-api-server-configmap

keep

keep

config

Settings to go into the mounted airflow.cfg

See values.yaml

keep

keep

createUserJob.defaultUser.enabled

Enable default user creation.

True

keep

keep

defaultAirflowDigest

Default airflow digest to deploy. Overrides tag.

~

keepkeep

defaultAirflowRepository

Default airflow repository. Overrides all the specific images below.

apache/airflow

keep

keep

defaultAirflowTag

Default airflow tag to deploy.

3.1.7

keep

keep

executor

Airflow executor.

CeleryExecutor

 

 

fernetKey

The Fernet key used to encrypt passwords (can only be set during install, not upgrade).

~

keep

keep

fernetKeySecretAnnotations

Annotations to add to the Fernet Key secret.

{}

keep

keep

jwtSecret

Secret key used to encode and decode JWTs to authenticate to public and private APIs (can only be set during install, not upgrade).

~

keep

keep

jwtSecretAnnotations

Annotations to add to the JWT secret.

{}

keep

keep

pgbouncer.enabled

Enable PgBouncer.

False

keep

keep

pgbouncer.mountConfigSecret

Whether to mount the config secret files under /etc/pgbouncer/ by default.

True

keep

keep

schedulerName

Specify kube scheduler name for Pods.

~

Put this to Kustomize?

No disagreement with Jens.

webserver.webserverConfig

This string (templated) will be mounted into the Airflow webserver as a custom webserver_config.py. You can bake a webserver_config.py in to your image instead or specify a configmap containing the webserver_config.py.

~

Examples:

webserverConfig: |-
  from airflow import configuration as conf

  # The SQLAlchemy connection string.
  SQLALCHEMY_DATABASE_URI = conf.get('database', 'SQL_ALCHEMY_CONN')

  # Flask-WTF flag for CSRF
  CSRF_ENABLED = True

removed with dropping AF2 support


webserver.webserverConfigConfigMapName

The configmap name containing the webserver_config.py.

~

Examples:

webserverConfigConfigMapName: my-webserver-configmap

removed with dropping AF2 support

 

webserverSecretAnnotations

Annotations to add to the webserver secret.

{}

removed with dropping AF2 support

 

webserverSecretKey

The Flask secret key for Airflow Webserver to encrypt browser session.

~

removed with dropping AF2 support

 

workers.schedulerName

Specify kube scheduler name for Airflow Celery workers objects and pods created with pod-template-file.

~

Put this to Kustomize?

No disagreement with Jens.


Airflow

Parameter

Description

Default

Opinion Jens

Opinion Bugra

airflowHome

Airflow home directory. Used for mount paths.

/opt/airflow

keep

keep

allowJobLaunching

Whether various Airflow components launch jobs.

False

Can this not implicitly be discovered if K8s executor?

It can be automated indeed. We can map to both a feature and a deprecation along with it.

allowPodLaunching

Whether various Airflow components launch pods.

True

Can this not implicitly be discovered if K8s executor?

It can be automated indeed. We can map to both a feature and a deprecation along with it.

apiSecretKeySecretName

The Secret name containing Flask secret_key for the Api.

~

Why is this for flask in AF3?

Description remains from v2 terms. 

dags.gitSync.branch

Git branch

v2-2-stable

Should we transform the gitSync into a bundle definition?

It makes sense. There are multiple ways in various systems of mounting the dags into the components. Making it bundled can help with easier additions on top of it for mounting operations.

dags.gitSync.containerName

Git sync container name.

git-sync

 

 

dags.gitSync.credentialsSecret

Name of a Secret containing the repo GIT_SYNC_USERNAME and GIT_SYNC_PASSWORD.

~

 

 

dags.gitSync.depth

Repository depth.

1

 

 

dags.gitSync.emptyDirConfig

Configuration for dags empty dir volume.

~

 

 

dags.gitSync.enabled

Enable Git sync.

False

 

 

dags.gitSync.env

Environment variables for git sync container.

[]

Examples:

env:
- name: GIT_SYNC_TIMEOUT
  value: '60'
env:
- name: GIT_SYNC_USERNAME
  valueFrom:
    secretKeyRef:
      key: username
      name: git-secret

 

 

dags.gitSync.envFrom

Extra envFrom ‘items’ that will be added to the definition of Airflow gitSync containers; a string or array are expected (templated).

~

Examples:

envFrom: |-
  - secretRef:
      name: 'proxy-config
envFrom: |-
  - configMapRef:
      name: 'proxy-config

 

 

dags.gitSync.extraVolumeMounts

Mount additional volumes into git sync container.

[]

 

 

dags.gitSync.knownHosts

When using a ssh private key, the contents of your known_hosts file.

~

Examples:

knownHosts: |-
  <host1>,<ip1> <key1>
  <host2>,<ip2> <key2>
knownHosts: <host1>,<ip1> <key1>

 

 

dags.gitSync.maxFailures

The number of consecutive failures allowed before aborting.

0

 

 

dags.gitSync.period

Interval between git sync attempts in Go-style duration string. High values are more likely to cause DAGs to become out of sync between different components. Low values cause more traffic to the remote git repository.

5s

 

 

dags.gitSync.ref

Git revision branch, tag, or hash.

v2-2-stable

 

 

dags.gitSync.repo

Git repository.

https://github.com/apache/airflow.git

 

 

dags.gitSync.resources

Resources on workers git-sync sidecar

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

 

dags.gitSync.rev

Git revision.

HEAD

 

 

dags.gitSync.securityContext

Security context for the gitSync container (deprecated, use securityContexts instead). If not set, the values from securityContext will be used.

{}

Examples:

securityContext:
  runAsGroup: 0
  runAsUser: 50000

 

 

dags.gitSync.sshKey

SSH private key

~

 

 

dags.gitSync.sshKeySecret

Name of a Secret containing the repo sshKeySecret.

~

 

 

dags.gitSync.subPath

Subpath within the repo where dags are located.

tests/dags

 

 

dags.gitSync.uid

Git sync container run as user parameter.

65533

 

 

dags.gitSync.wait

Interval between git sync attempts in seconds. High values are more likely to cause DAGs to become out of sync between different components. Low values cause more traffic to the remote git repository.

~

 

 

dags.mountPath

Where dags volume will be mounted. Works for both persistence and gitSync. If not specified, dags mount path will be set to $AIRFLOW_HOME/dags

~

 

 

dags.persistence.accessMode

Access mode of the persistent volume.

ReadWriteOnce

 

 

dags.persistence.annotations

Annotations for the dag PVC

{}

 

 

dags.persistence.enabled

Enable persistent volume for storing dags.

False

 

 

dags.persistence.existingClaim

The name of an existing PVC to use.

~

 

 

dags.persistence.size

Volume size for dags.

1Gi

 

 

dags.persistence.storageClassName

If using a custom StorageClass, pass name here (templated).

~

 

 

dags.persistence.subPath

Subpath within the PVC where dags are located.

~

 

 

elasticsearch.connection

Elasticsearch connection configuration.

{}

Examples:

connection:
  host: '...'
  pass: '...'
  port: '...'
  scheme: https
  user: '...'

 

 

elasticsearch.connection.host

Host

""

 

 

elasticsearch.connection.pass

Password

""

 

 

elasticsearch.connection.port

Port

80

 

 

elasticsearch.connection.scheme

Scheme

http

 

 

elasticsearch.connection.user

Username

""

 

 

elasticsearch.enabled

Enable Elasticsearch task logging.

False

 

 

elasticsearch.secretAnnotations

Extra annotations to apply to the elasticsearch secret.

{}

 

 

elasticsearch.secretName

A secret containing the connection string.

~

 

 

enableBuiltInSecretEnvVars.AIRFLOW_CONN_AIRFLOW_DB

Enable AIRFLOW_CONN_AIRFLOW_DB variable to be read from the Metadata Secret

True

What is this for?

SQLAlchemy connection string from K8s secret. Keeping with a better description and maybe renaming to reflect better.

enableBuiltInSecretEnvVars.AIRFLOW__API_AUTH__JWT_SECRET

Enable AIRFLOW__API_AUTH__JWT_SECRET variable to be read from the JWT Secret

True

What is this for?

Enable using K8S secret in env var to pass jwt_secret config

enableBuiltInSecretEnvVars.AIRFLOW__API__SECRET_KEY

Enable AIRFLOW__API__SECRET_KEY variable to be read from the Api Secret Key Secret

True

What is this for?

Similar to above

secret_key

enableBuiltInSecretEnvVars.AIRFLOW__CELERY__BROKER_URL

Enable AIRFLOW__CELERY__BROKER_URL variable to be read from the Celery Broker URL Secret

True

What is this for?

 

 

 

 

 

 

 

 

All these are the same as above, as setting some config that enables to read secret to pass to the env var. Maybe move them to Kustomize?

enableBuiltInSecretEnvVars.AIRFLOW__CELERY__CELERY_RESULT_BACKEND

Enable AIRFLOW__CELERY__CELERY_RESULT_BACKEND variable to be read from the Celery Result Backend Secret - Airflow 1.10.* variant

True

What is this for?

enableBuiltInSecretEnvVars.AIRFLOW__CELERY__RESULT_BACKEND

Enable AIRFLOW__CELERY__RESULT_BACKEND variable to be read from the Celery Result Backend Secret

True

What is this for?

enableBuiltInSecretEnvVars.AIRFLOW__CORE__FERNET_KEY

Enable AIRFLOW__CORE__FERNET_KEY variable to be read from the Fernet key Secret

True

What is this for?

enableBuiltInSecretEnvVars.AIRFLOW__CORE__SQL_ALCHEMY_CONN

Enable AIRFLOW__CORE__SQL_ALCHEMY_CONN variable to be read from the Metadata Secret

True

What is this for?

enableBuiltInSecretEnvVars.AIRFLOW__DATABASE__SQL_ALCHEMY_CONN

Enable AIRFLOW__DATABASE__SQL_ALCHEMY_CONN variable to be read from the Metadata Secret

True

What is this for?

enableBuiltInSecretEnvVars.AIRFLOW__ELASTICSEARCH__ELASTICSEARCH_HOST

Enable AIRFLOW__ELASTICSEARCH__ELASTICSEARCH_HOST variable to be read from the Elasticsearch Host Secret - Airflow <1.10.4 variant

True

What is this for?

enableBuiltInSecretEnvVars.AIRFLOW__ELASTICSEARCH__HOST

Enable AIRFLOW__ELASTICSEARCH__HOST variable to be read from the Elasticsearch Host Secret

True

What is this for?

enableBuiltInSecretEnvVars.AIRFLOW__OPENSEARCH__HOST

Enable AIRFLOW__OPENSEARCH__HOST variable to be read from the OpenSearch Host Secret

True

What is this for?

enableBuiltInSecretEnvVars.AIRFLOW__WEBSERVER__SECRET_KEY

Enable AIRFLOW__WEBSERVER__SECRET_KEY variable to be read from the Webserver Secret Key Secret

True

removed with dropping AF2 support

 

env

Environment variables for all Airflow containers.

[]

Examples:

env:
- name: MYENVVAR
  value: something_fun

 

 

extraEnv

Extra env ‘items’ that will be added to the definition of Airflow containers; a string is expected (templated).

~

Examples:

extraEnv: |-
  - name: AIRFLOW__CORE__LOAD_EXAMPLES
     value: True

 

 

extraEnvFrom

Extra envFrom ‘items’ that will be added to the definition of Airflow containers; a string is expected (templated).

~

Examples:

extraEnvFrom: |-
  - secretRef:
      name: '{{ .Release.Name }}-airflow-connections'
extraEnvFrom: |-
  - configMapRef:
      name: '{{ .Release.Name }}-airflow-variables'

 

 

fernetKeySecretName

The Fernet key secret name.

~

 

 

gid

Group of airflow user.

0

 

 

jwtSecretName

The JWT secret name.

~

 

 

logs.emptyDirConfig

Configuration for logs empty dir volume.

~

 

 

logs.persistence.annotations

Annotations to add to logs PVC

{}

 

 

logs.persistence.enabled

Enable persistent volume for storing logs.

False

 

 

logs.persistence.existingClaim

The name of an existing PVC to use.

~

 

 

logs.persistence.size

Volume size for logs.

100Gi

 

 

logs.persistence.storageClassName

If using a custom StorageClass, pass name here (templated).

~

 

 

logs.persistence.subPath

The subpath of the existing PVC to use.

~

 

 

multiNamespaceMode

Whether Airflow can launch workers and/or pods in multiple namespaces. If true, it creates ClusterRole/ClusterRolebinding (with access to entire cluster)

False

 

 

opensearch.connection

OpenSearch connection configuration.

{}

Examples:

connection:
  host: '...'
  pass: '...'
  port: '...'
  scheme: https
  user: '...'

 

 

opensearch.connection.host

Host

""

 

 

opensearch.connection.pass

Password

""

 

 

opensearch.connection.port

Port

80

 

 

opensearch.connection.scheme

Scheme

http

 

 

opensearch.connection.user

Username

""

 

 

opensearch.enabled

Enable OpenSearch task logging.

False

 

 

opensearch.secretName

A secret containing the connection string.

~

 

 

podTemplate

The content of pod_template_file.yaml used for KubernetesExecutor workers (templated). The default (see files/pod-template-file.kubernetes-helm-yaml) already takes into account normal workers configuration parameters (e.g. workers.resources), so you normally won’t need to override this directly.

~

Examples:

podTemplate: |-
  apiVersion: v1
  kind: Pod
  metadata:
    name: placeholder-name
    labels:
      tier: airflow
      component: worker
      release: {{ .Release.Name }}
  spec:
    priorityClassName: high-priority
    containers:
      - name: base
      ...

 

 

secret

Secrets for all Airflow containers.

[]

Examples:

secret:
- envName: SecretEnvVar
  secretKey: somekey
  secretName: somesecret

 

 

uid

User of airflow user.

50000

 

 

volumeMounts

VolumeMounts for all Airflow containers.

[]

 

 

volumes

Volumes for all Airflow containers.

[]

 

 

webserverSecretKeySecretName

The Secret name containing Flask secret_key for the Webserver.

~

removed with dropping AF2 support

 

Images

Parameter

Description

Default

Opinion Jens

images.airflow.digest

The airflow image digest. If set, it will override the tag.

~

 

images.airflow.pullPolicy

The airflow image pull policy.

IfNotPresent

 

images.airflow.repository

The airflow image repository.

~

 

images.airflow.tag

The airflow image tag.

~

 

images.flower.pullPolicy

The flower image pull policy.

IfNotPresent

 

images.flower.repository

The flower image repository.

~

 

images.flower.tag

The flower image tag.

~

 

images.gitSync.pullPolicy

The gitSync image pull policy.

IfNotPresent

 

images.gitSync.repository

The gitSync image repository.

registry.k8s.io/git-sync/git-sync

 

images.gitSync.tag

The gitSync image tag.

v4.4.2

Note: Drop support for old versions!

images.migrationsWaitTimeout

The time (in seconds) to wait for the DB migrations to complete.

60

 

images.pgbouncer.pullPolicy

The PgBouncer image pull policy.

IfNotPresent

 

images.pgbouncer.repository

The PgBouncer image repository.

apache/airflow

 

images.pgbouncer.tag

The PgBouncer image tag.

airflow-pgbouncer-2025.03.05-1.23.1

 

images.pgbouncerExporter.pullPolicy

The PgBouncer exporter image pull policy.

IfNotPresent

 

images.pgbouncerExporter.repository

The PgBouncer exporter image repository.

apache/airflow

 

images.pgbouncerExporter.tag

The PgBouncer exporter image tag.

airflow-pgbouncer-exporter-2025.03.05-0.18.0

 

images.pod_template.pullPolicy

The pod_template image pull policy.

IfNotPresent

 

images.pod_template.repository

The pod_template image repository. If config.kubernetes.worker_container_repository is set, k8s executor will use config value instead.

~

 

images.pod_template.tag

The pod_template image tag. If config.kubernetes.worker_container_tag is set, k8s executor will use config value instead.

~

 

images.redis.pullPolicy

The redis image pull policy.

IfNotPresent

 

images.redis.repository

The redis image repository.

redis

 

images.redis.tag

The redis image tag.

7.2-bookworm

 

images.statsd.pullPolicy

The StatsD image pull policy.

IfNotPresent

 

images.statsd.repository

The StatsD image repository.

quay.io/prometheus/statsd-exporter

 

images.statsd.tag

The StatsD image tag.

v0.28.0

 

images.useDefaultImageForMigration

To avoid images with user code for running and waiting for DB migrations set this to true.

False

 

Ports

Parameter

Description

Default

Opinion Jens

ports.airflowUI

Airflow UI port.

8080

keep all

ports.apiServer

API server port.

8080

 

ports.flowerUI

Flower UI port.

5555

 

ports.pgbouncer

PgBouncer port.

6543

 

ports.pgbouncerScrape

PgBouncer scrape port.

9127

 

ports.redisDB

Redis port.

6379

 

ports.statsdIngest

StatsD ingest port.

9125

 

ports.statsdScrape

StatsD scrape port.

9102

 

ports.triggererLogs

Triggerer logs port.

8794

 

ports.workerLogs

Worker logs port.

8793

 

Database

Parameter

Description

Default

Opinion Jens

data.brokerUrlSecretAnnotations

Annotations to add to the broker url secret.

{}

 

data.metadataConnection.db

The name of the database.

postgres

 

data.metadataConnection.host

The database host.

~

 

data.metadataConnection.pass

The user’s password.

postgres

 

data.metadataConnection.port

The database port.

5432

 

data.metadataConnection.protocol

The database protocol.

postgresql

 

data.metadataConnection.secretAnnotations

Annotations to add to the metadata connection secret.

{}

 

data.metadataConnection.sslmode

The database SSL parameter.

disable

 

data.metadataConnection.user

The database user.

postgres

 

data.metadataSecretName

Metadata connection string secret.

~

 

data.resultBackendConnection

Result backend connection configuration.

~

 

data.resultBackendConnection.db

The name of the database.

~

 

data.resultBackendConnection.host

The database host.

~

 

data.resultBackendConnection.pass

The database password.

~

 

data.resultBackendConnection.port

The database port.

~

 

data.resultBackendConnection.protocol

The database protocol.

~

 

data.resultBackendConnection.sslmode

The database SSL parameter.

~

 

data.resultBackendConnection.user

The database user.

~

 

data.resultBackendConnectionSecretAnnotations

Annotations to add to the result backend connection secret.

{}

 

data.resultBackendSecretName

Result backend connection string secret.

~

 

postgresql.auth.enablePostgresUser

Assign a password to the ‘postgres’ admin user. Otherwise, remote access will be blocked for this user

True

Drop postgres inline support

postgresql.auth.password

Password for the custom user to create.

""

 

postgresql.auth.postgresPassword

Password for the ‘postgres’ admin user.

postgres

 

postgresql.auth.username

Name for a custom user to create

""

 

postgresql.enabled

Enable PostgreSQL subchart.

True

 

postgresql.image.repository

The PostgreSQL image repository.

bitnamilegacy/postgresql

 

postgresql.image.tag

The PostgreSQL image tag.

16.1.0-debian-11-r15

 

PgBouncer

Parameter

Description

Default

Opinion Jens

pgbouncer.affinity

Specify scheduling constraints for PgBouncer pods.

{}

 

pgbouncer.annotations

Annotations to add to the PgBouncer deployment

{}

 

pgbouncer.args

Args to use for PgBouncer (templated).

~

 

pgbouncer.auth_file

The name of the file to load user names and passwords from

/etc/pgbouncer/users.txt

 

pgbouncer.auth_type

Method of authenticating users

scram-sha-256

 

pgbouncer.certificatesSecretAnnotations

Annotations to add to the PgBouncer certificates secret.

{}

 

pgbouncer.ciphers

The allowed ciphers, might be ‘fast’, ‘normal’ or list ciphers separated with ‘:’.

normal

 

pgbouncer.command

Command to use for PgBouncer (templated).

['pgbouncer', '-u', 'nobody', '/etc/pgbouncer/pgbouncer.ini']

 

pgbouncer.configSecretAnnotations

Annotations to add to the PgBouncer config secret.

{}

 

pgbouncer.configSecretName

The PgBouncer config Secret name.

~

 

pgbouncer.env

Add additional env vars to pgbouncer container.

[]

 

pgbouncer.extraContainers

Launch additional containers into pgbouncer.

[]

 

pgbouncer.extraIni

Add extra general PgBouncer ini configuration: https://www.pgbouncer.org/config.html

~

 

pgbouncer.extraIniMetadata

Add extra metadata database specific PgBouncer ini configuration: https://www.pgbouncer.org/config.html#section-databases

~

 

pgbouncer.extraIniResultBackend

Add extra result backend database specific PgBouncer ini configuration: https://www.pgbouncer.org/config.html#section-databases

~

 

pgbouncer.extraNetworkPolicies

Additional NetworkPolicies as needed.

[]

 

pgbouncer.extraVolumeMounts

Mount additional volumes into PgBouncer.

[]

 

pgbouncer.extraVolumes

Mount additional volumes into PgBouncer.

[]

 

pgbouncer.labels

Labels to add to the PgBouncer objects and pods.

{}

 

pgbouncer.logConnections

Log successful logins.

0

 

pgbouncer.logDisconnections

Log disconnections with reasons.

0

 

pgbouncer.maxClientConn

Maximum clients that can connect to PgBouncer (higher = more file descriptors).

100

 

pgbouncer.metadataPoolSize

Metadata pool size.

10

 

pgbouncer.metricsExporterSidecar.extraVolumeMounts

Mount additional volumes into PgBouncer Metrics Exporter.

[]

 

pgbouncer.metricsExporterSidecar.livenessProbe.initialDelaySeconds

Metrics Exporter liveness probe initial delay

10

 

pgbouncer.metricsExporterSidecar.livenessProbe.periodSeconds

Metrics Exporter liveness probe frequency

10

 

pgbouncer.metricsExporterSidecar.livenessProbe.timeoutSeconds

Metrics Exporter liveness probe command timeout

1

 

pgbouncer.metricsExporterSidecar.readinessProbe.initialDelaySeconds

Metrics Exporter readiness probe initial delay

10

 

pgbouncer.metricsExporterSidecar.readinessProbe.periodSeconds

Metrics Exporter readiness probe frequency

10

 

pgbouncer.metricsExporterSidecar.readinessProbe.timeoutSeconds

Metrics Exporter readiness probe command timeout

1

 

pgbouncer.metricsExporterSidecar.resources

Resources for the PgBouncer metric exporter.

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

pgbouncer.metricsExporterSidecar.sslmode

SSL mode for metricsExporterSidecar

disable

 

pgbouncer.metricsExporterSidecar.statsSecretAnnotations

Annotations to add to the PgBouncer stats secret.

{}

 

pgbouncer.metricsExporterSidecar.statsSecretKey

Key referencing the PGBouncer Metrics connection URI within an existing Secrets object. Defaults to connection if left null.

~

 

pgbouncer.metricsExporterSidecar.statsSecretName

Name of an existing Secrets object containing PgBouncer Metrics secrets.

~

 

pgbouncer.nodeSelector

Select certain nodes for PgBouncer pods.

{}

 

pgbouncer.podAnnotations

Add annotations for the PgBouncer Pod.

{}

 

pgbouncer.podDisruptionBudget.config.maxUnavailable

Max unavailable pods for PgBouncer.

1

 

pgbouncer.podDisruptionBudget.config.minAvailable

Min available pods for PgBouncer.

1

 

pgbouncer.podDisruptionBudget.enabled

Enabled PodDistributionBudget.

False

 

pgbouncer.priorityClassName

Specify priority for PgBouncer pods.

~

 

pgbouncer.replicas

Number of PgBouncer replicas to run in Deployment.

1

 

pgbouncer.resources

Resources for the PgBouncer pods.

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

pgbouncer.resultBackendPoolSize

Result backend pool size.

5

 

pgbouncer.service.clusterIp

Specific ClusterIP for the PgBouncer Service.

~

 

pgbouncer.service.extraAnnotations

Extra annotations for the PgBouncer Service.

{}

 

pgbouncer.serviceAccount.annotations

Annotations to add to the worker Kubernetes ServiceAccount.

{}

 

pgbouncer.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods.

True

 

pgbouncer.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

 

pgbouncer.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

 

pgbouncer.ssl.ca

Certificate Authority for server side

~

 

pgbouncer.ssl.cert

Server Certificate for server side

~

 

pgbouncer.ssl.key

Private key used to authenticate with the server

~

 

pgbouncer.sslmode

SSL mode for PgBouncer.

prefer

 

pgbouncer.tolerations

Specify Tolerations for PgBouncer pods.

[]

 

pgbouncer.topologySpreadConstraints

Specify topology spread constraints for PgBouncer pods.

[]

 

pgbouncer.uid

PgBouncer run as user parameter.

65534

 

pgbouncer.verbose

Increase PgBouncer verbosity.

0

 

API Server

Parameter

Description

Default

Opinion Jens

apiServer.affinity

Specify scheduling constraints for API server pods.

See values.yaml

 

apiServer.allowPodLogReading

Allow API server to read k8s pod logs. Useful when you don’t have an external log store.

True

 

apiServer.annotations

Annotations to add to the API server deployment

{}

 

apiServer.args

Args to use when running the Airflow API server (templated). When running behind a reverse proxy, add –proxy-headers to enable Uvicorn to respect X-Forwarded-Proto, X-Forwarded-For, and X-Forwarded-Port headers.

['bash', '-c', 'exec airflow api-server']

Examples:

args:
- bash
- -c
- exec airflow api-server --proxy-headers

 

apiServer.command

Command to use when running the Airflow API server (templated).

~

 

apiServer.configMapAnnotations

Extra annotations to apply to the API server configmap.

{}

 

apiServer.enabled

Enable Airflow API server deployment.

True

 

apiServer.env

Add additional env vars to API server. When running behind a reverse proxy, set FORWARDED_ALLOW_IPS to specify which IPs are trusted to send X-Forwarded-* headers. Use “*” for trusted environments, or specify proxy IP ranges for production.

[]

Examples:

env:
- - name: FORWARDED_ALLOW_IPS
    value: '*'

 

apiServer.extraContainers

Launch additional containers into API server.

[]

 

apiServer.extraInitContainers

Add additional init containers into API server.

[]

 

apiServer.extraVolumeMounts

Mount additional volumes into API server.

[]

 

apiServer.extraVolumes

Mount additional volumes into API server.

[]

 

apiServer.hostAliases

HostAliases for the API server pod.

[]

Examples:

hostAliases:
- hostnames:
  - foo.local
  ip: 127.0.0.1
hostAliases:
- hostnames:
  - foo.remote
  ip: 10.1.2.3

 

apiServer.hpa.behavior

HorizontalPodAutoscalerBehavior configures the scaling behavior of the target.

{}

Should we keep both KEDA and HPA? Or move both to a Kustomize?

apiServer.hpa.enabled

Enable HPA autoscaling for API server

False

 

apiServer.hpa.maxReplicaCount

Maximum number of API server replicas created by HPA if HPA is enabled.

5

 

apiServer.hpa.metrics

Specifications for which to use to calculate the desired replica count.

[{'type': 'Resource', 'resource': {'name': 'cpu', 'target': {'type': 'Utilization', 'averageUtilization': 50}}}]

 

apiServer.hpa.minReplicaCount

Minimum number of API server replicas created by HPA if HPA is enabled.

1

 

apiServer.labels

Labels to add to the API server objects and pods.

{}

 

apiServer.livenessProbe.failureThreshold

API server Liveness probe failure threshold.

5

 

apiServer.livenessProbe.initialDelaySeconds

API server Liveness probe initial delay.

15

 

apiServer.livenessProbe.periodSeconds

API server Liveness probe period seconds.

10

 

apiServer.livenessProbe.scheme

API server Liveness probe scheme.

HTTP

 

apiServer.livenessProbe.timeoutSeconds

API server Liveness probe timeout seconds.

5

 

apiServer.networkPolicy.ingress.from

Peers for API server NetworkPolicyingress.

[]

 

apiServer.networkPolicy.ingress.ports

Ports for API server NetworkPolicyingress (if from is set).

[{'port': '{{ .Values.ports.apiServer }}'}]

Examples:

ports:
- port: 8080

 

apiServer.nodeSelector

Select certain nodes for API server pods.

{}

 

apiServer.podAnnotations

Annotations to add to the API server pods.

{}

 

apiServer.podDisruptionBudget.config.maxUnavailable

Max unavailable pods for API server.

1

 

apiServer.podDisruptionBudget.config.minAvailable

Min available pods for API server.

1

 

apiServer.podDisruptionBudget.enabled

Enable pod disruption budget.

False

 

apiServer.priorityClassName

Specify priority for API server pods.

~

 

apiServer.readinessProbe.failureThreshold

API server Readiness probe failure threshold.

5

 

apiServer.readinessProbe.initialDelaySeconds

API server Readiness probe initial delay.

15

 

apiServer.readinessProbe.periodSeconds

API server Readiness probe period seconds.

10

 

apiServer.readinessProbe.scheme

API server Readiness probe scheme.

HTTP

 

apiServer.readinessProbe.timeoutSeconds

API server Readiness probe timeout seconds.

5

 

apiServer.replicas

How many Airflow API server replicas should run. This setting is ignored when HPA (Horizontal Pod Autoscaler) is enabled

1

 

apiServer.resources

Resources for API server pods.

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

apiServer.service.annotations

Annotations for the API server Service.

{}

 

apiServer.service.loadBalancerIP

API server Service loadBalancerIP.

~

 

apiServer.service.loadBalancerSourceRanges

API server Service loadBalancerSourceRanges.

[]

Examples:

loadBalancerSourceRanges:
- 10.123.0.0/16

 

apiServer.service.ports

Ports for the API server Service.

[{'name': 'api-server', 'port': '{{ .Values.ports.apiServer }}'}]

Examples:

ports:
- name: api-server
  port: 8080
  targetPort: api-server
ports:
- name: only_sidecar
  port: 9080
  targetPort: 8888

 

apiServer.service.type

API server Service type.

ClusterIP

 

apiServer.serviceAccount.annotations

Annotations to add to the API server Kubernetes ServiceAccount.

{}

 

apiServer.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods.

True

 

apiServer.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

 

apiServer.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

 

apiServer.startupProbe.failureThreshold

API server Startup probe failure threshold.

6

 

apiServer.startupProbe.initialDelaySeconds

API server Startup probe initial delay seconds.

0

 

apiServer.startupProbe.periodSeconds

API server Startup probe period seconds.

10

 

apiServer.startupProbe.scheme

API server Startup probe scheme.

HTTP

 

apiServer.startupProbe.timeoutSeconds

API server Startup probe timeout seconds.

20

 

apiServer.strategy

Specifies the strategy used to replace old Pods by new ones.

~

 

apiServer.tolerations

Specify Tolerations for API server pods.

[]

 

apiServer.waitForMigrations.enabled

Enable wait-for-airflow-migrations init container.

True

 

apiServer.waitForMigrations.env

Add additional env vars to wait-for-airflow-migrations init container.

[]

 

Scheduler

Parameter

Description

Default

Opinion Jens

scheduler.affinity

Specify scheduling constraints for scheduler pods.

See values.yaml

 

scheduler.annotations

Annotations to add to the scheduler deployment

{}

 

scheduler.args

Args to use when running the Airflow scheduler (templated).

['bash', '-c', 'exec airflow scheduler']

 

scheduler.command

Command to use when running the Airflow scheduler (templated).

~

 

scheduler.enabled

Enable scheduler

True

 

scheduler.env

Add additional env vars to scheduler.

[]

 

scheduler.extraContainers

Launch additional containers into scheduler (templated).

[]

 

scheduler.extraInitContainers

Add additional init containers into scheduler (templated).

[]

 

scheduler.extraVolumeMounts

Mount additional volumes into scheduler.

[]

 

scheduler.extraVolumes

Mount additional volumes into scheduler.

[]

 

scheduler.hostAliases

HostAliases for the scheduler pod.

[]

Examples:

hostAliases:
- hostnames:
  - foo.local
  ip: 127.0.0.1
hostAliases:
- hostnames:
  - foo.remote
  ip: 10.1.2.3

 

scheduler.labels

Labels to add to the scheduler objects and pods.

{}

 

scheduler.livenessProbe.failureThreshold

Minimum consecutive failures for the probe to be considered failed after having succeeded. Minimum value is 1.

5

 

scheduler.livenessProbe.initialDelaySeconds

Number of seconds after the container has started before liveness probes are initiated.

10

 

scheduler.livenessProbe.periodSeconds

How often (in seconds) to perform the probe. Minimum value is 1.

60

 

scheduler.livenessProbe.timeoutSeconds

Number of seconds after which the probe times out. Minimum value is 1 seconds.

20

 

scheduler.nodeSelector

Select certain nodes for scheduler pods.

{}

 

scheduler.podAnnotations

Annotations to add to the scheduler pods.

{}

 

scheduler.podDisruptionBudget.config.maxUnavailable

Max unavailable pods for scheduler.

1

 

scheduler.podDisruptionBudget.config.minAvailable

Min available pods for scheduler.

1

 

scheduler.podDisruptionBudget.enabled

Enable pod disruption budget.

False

 

scheduler.priorityClassName

Specify priority for scheduler pods.

~

 

scheduler.replicas

Airflow 2.0 allows users to run multiple schedulers. This feature is only recommended for MySQL 8+ and PostgreSQL

1

 

scheduler.resources

Resources for scheduler pods.

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

scheduler.safeToEvict

This setting tells Kubernetes that its ok to evict when it wants to scale a node down.

True

 

scheduler.securityContext

Security context for the scheduler pod (deprecated, use securityContexts instead). If not set, the values from securityContext will be used.

{}

Examples:

securityContext:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

scheduler.serviceAccount.annotations

Annotations to add to the scheduler Kubernetes ServiceAccount.

{}

 

scheduler.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods. When false, you can use serviceAccountTokenVolume to manually configure service account token volume for pod-launching executors.

True

 

scheduler.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

 

scheduler.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

 

scheduler.serviceAccount.serviceAccountTokenVolume.audience

Intended audience of the token. Optional - defaults to the identifier of the Kubernetes API server.

~

 

scheduler.serviceAccount.serviceAccountTokenVolume.enabled

Enable manual service account token volume configuration.

False

 

scheduler.serviceAccount.serviceAccountTokenVolume.expirationSeconds

Token expiration time in seconds.

3600

 

scheduler.serviceAccount.serviceAccountTokenVolume.mountPath

Path where the service account token volume will be mounted.

/var/run/secrets/kubernetes.io/serviceaccount

 

scheduler.serviceAccount.serviceAccountTokenVolume.volumeName

Name of the service account token volume.

kube-api-access

 

scheduler.startupProbe.failureThreshold

Minimum consecutive failures for the probe to be considered failed after having succeeded. Minimum value is 1.

6

 

scheduler.startupProbe.initialDelaySeconds

Number of seconds after the container has started before startup probes are initiated.

0

 

scheduler.startupProbe.periodSeconds

How often (in seconds) to perform the probe. Minimum value is 1.

10

 

scheduler.startupProbe.timeoutSeconds

Number of seconds after which the probe times out. Minimum value is 1 seconds.

20

 

scheduler.strategy

Specifies the strategy used to replace old Pods by new ones when deployed as a Deployment (when not using LocalExecutor and workers.persistence).

~

 

scheduler.terminationGracePeriodSeconds

Grace period for scheduler to finish after SIGTERM is sent from Kubernetes.

10

 

scheduler.tolerations

Specify Tolerations for scheduler pods.

[]

 

scheduler.topologySpreadConstraints

Specify topology spread constraints for scheduler pods.

[]

 

scheduler.updateStrategy

Specifies the strategy used to replace old Pods by new ones when deployed as a StatefulSet (when using LocalExecutor and workers.persistence).

~

 

scheduler.waitForMigrations.enabled

Enable wait-for-airflow-migrations init container.

True

 

scheduler.waitForMigrations.env

Add additional env vars to wait-for-airflow-migrations init container.

[]

 

Webserver

Opinion Jens: Full section will be dropped in 1.21 with removal of Airflow 2 support. Big complexity reduction!

Workers

Parameter

Description

Default

Opinion Jens

workers.affinity

Specify scheduling constraints for Airflow Celery worker pods and pods created with pod-template-file.

See values.yaml

All "workers" options should go to "workers.celery", Deprecations /fallback removed

workers.annotations

Annotations to add to the Airflow Celery worker deployment.

{}

ditto

workers.args

Args to use when running Airflow Celery workers (templated) (deprecated, use workers.celery.args instead).

['bash', '-c', 'exec \\\nairflow {{ semverCompare ">=2.0.0" .Values.airflowVersion | ternary "celery worker" "worker" }}\n{{- if and .Values.workers.queue (ne .Values.workers.queue "default") }}\n{{- " -q " }}{{ .Values.workers.queue }}\n{{- end }}']

ditto 

workers.celery.args

Args to use when running Airflow Celery workers (templated).

~

 

workers.celery.command

Command to use when running Airflow Celery workers (templated).

~

 

workers.celery.enableDefault

Enable the default worker defined by the workers and workers.celery configurations.

True

Should we have a "default" worker and sets in parallel? Can we not make the set havinf one default to reduce complexity?

workers.celery.kerberosInitContainer.enabled

Enable Kerberos init container.

~

 

workers.celery.kerberosInitContainer.resources

Resources on kerberos init container.

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

workers.celery.livenessProbe.enabled

Enable liveness probe for Airflow Celery workers.

~

 

workers.celery.livenessProbe.failureThreshold

Minimum consecutive failures for the probe to be considered failed after having succeeded. Minimum value is 1.

~

 

workers.celery.livenessProbe.initialDelaySeconds

Number of seconds after the container has started before liveness probes are initiated.

~

 

workers.celery.livenessProbe.periodSeconds

How often (in seconds) to perform the probe. Minimum value is 1.

~

 

workers.celery.livenessProbe.timeoutSeconds

Number of seconds after which the probe times out. Minimum value is 1 seconds.

~

 

workers.celery.persistence.annotations

Annotations to add to Airflow Celery worker volumes.

{}

 

workers.celery.persistence.enabled

Enable persistent volumes.

~

 

workers.celery.persistence.fixPermissions

Execute init container to chown log directory. This is currently only needed in kind, due to usage of local-path provisioner.

~

 

workers.celery.persistence.size

Volume size for Airflow Celery worker StatefulSet.

~

 

workers.celery.persistence.storageClassName

If using a custom StorageClass, pass name ref to all StatefulSets here (templated).

~

 

workers.celery.podManagementPolicy

Specifies the policy for managing pods within the Airflow Celery worker. Only applicable to StatefulSet.

~

 

workers.celery.queue

Queue name for the worker.

default

 

workers.celery.replicas

Number of Airflow Celery workers.

~

 

workers.celery.sets

List of worker sets. Each item can overwrite values from the parent workers and workers.celery sections.

[]

Here all properties from above and below should go in, with one "default"?

workers.celery.strategy

Specifies the strategy used to replace old Airflow Celery worker pods by new ones when deployed as a Deployment.

~

 

workers.celery.updateStrategy

Specifies the strategy used to replace old Airflow Celery worker pods by new ones when deployed as a StatefulSet.

~

 

workers.command

Command to use when running Airflow Celery workers and using pod-template-file (templated). Use workers.celery.command and/or workers.kubernetes.command to separate value between Celery workers and pod-template-file.

~

^^^ ditto

workers.env

Add additional env vars to the Airflow Celery workers and pods created with pod-template-file.

[]

ditto

workers.extraContainers

Launch additional containers into Airflow Celery workers and pods created with pod-template-file (templated). Note, if used with KubernetesExecutor, you are responsible for signaling sidecars to exit when the main container finishes so Airflow can continue the worker shutdown process!

[]

ditto

workers.extraInitContainers

Add additional init containers into Airflow Celery workers and pods created with pod-template-file (templated).

[]

ditto

workers.extraPorts

Expose additional ports of Airflow Celery worker container.

[]

ditto

workers.extraVolumeMounts

Additional volume mounts attached to the Airflow Celery workers and pods created with pod-template-file.

[]

ditto

workers.extraVolumes

Additional volumes attached to the Airflow Celery workers and pods created with pod-template-file.

[]

ditto

workers.hostAliases

Specify HostAliases for Airflow Celery worker pods and pods created with pod-template-file.

[]

Examples:

hostAliases:
- hostnames:
  - test.hostname.one
  ip: 127.0.0.2
hostAliases:
- hostnames:
  - test.hostname.two
  ip: 127.0.0.3

ditto

workers.hpa.behavior

HorizontalPodAutoscalerBehavior configures the scaling behavior of the target.

{}

Should we have HPA and KEDA? How about moving this to Kustomize?

workers.hpa.enabled

Allow HPA autoscaling (KEDA must be disabled).

False

 

workers.hpa.maxReplicaCount

Maximum number of Airflow Celery workers created by HPA.

5

 

workers.hpa.metrics

Specifications for which to use to calculate the desired replica count.

[{'type': 'Resource', 'resource': {'name': 'cpu', 'target': {'type': 'Utilization', 'averageUtilization': 80}}}]

 

workers.hpa.minReplicaCount

Minimum number of Airflow Celery workers created by HPA.

0

 

workers.keda.advanced

Advanced KEDA configuration.

{}

 

workers.keda.advanced.horizontalPodAutoscalerConfig

HorizontalPodAutoscalerConfig specifies horizontal scale config.

{}

 

workers.keda.advanced.horizontalPodAutoscalerConfig.behavior

HorizontalPodAutoscalerBehavior configures the scaling behavior of the target.

{}

 

workers.keda.cooldownPeriod

How many seconds KEDA will wait before scaling to zero.

30

 

workers.keda.enabled

Allow KEDA autoscaling.

False

 

workers.keda.maxReplicaCount

Maximum number of Airflow Celery workers created by KEDA.

10

 

workers.keda.minReplicaCount

Minimum number of Airflow Celery workers created by KEDA.

0

 

workers.keda.namespaceLabels

Labels used in matchLabels for namespace in the PgBouncer NetworkPolicy.

{}

 

workers.keda.pollingInterval

How often KEDA polls the airflow DB to report new scale requests to the HPA.

5

 

workers.keda.query

Query to use for KEDA autoscaling. Must return a single integer.

SELECT ceil(COUNT(*)::decimal / {{ .Values.config.celery.worker_concurrency }}) FROM task_instance WHERE (state='running' OR state='queued') AND queue IN ( {{- range $i, $q := splitList "," .Values.workers.queue -}} {{- if $i }},{{ end }}'{{ $q | trim }}' {{- end -}} ) {{- if contains "CeleryKubernetesExecutor" .Values.executor }} AND queue != '{{ .Values.config.celery_kubernetes_executor.kubernetes_queue }}' {{- else if contains "KubernetesExecutor" .Values.executor }} AND executor IS DISTINCT FROM 'KubernetesExecutor' {{- else if contains "airflow.providers.edge3.executors.EdgeExecutor" .Values.executor }} AND executor IS DISTINCT FROM 'EdgeExecutor' {{- end }}

 

workers.keda.usePgbouncer

Weather to use PGBouncer to connect to the database or not when it is enabled. This configuration will be ignored if PGBouncer is not enabled.

True

 

workers.kerberosInitContainer.enabled

Enable Kerberos init container.

False

^^^ ditto

workers.kerberosInitContainer.resources

Resources on kerberos init container.

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

ditto

workers.kerberosSidecar.enabled

Enable Kerberos sidecar.

False

ditto 

workers.kerberosSidecar.resources

Resources on kerberos sidecar.

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

ditto

workers.kubernetes.command

Command to use in pod-template-file (templated).

~

 

workers.kubernetes.kerberosInitContainer.enabled

Enable kerberos init container.

~

 

workers.kubernetes.kerberosInitContainer.resources

Resources on kerberos init container.

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

workers.labels

Labels to add to the Airflow Celery workers objects and pods created with pod-template-file.

{}

^^^ ditto

workers.livenessProbe.enabled

Enable liveness probe for Airflow Celery workers (deprecated, use workers.celery.livenessProbe.enabled instead).

True

ditto

workers.livenessProbe.failureThreshold

Minimum consecutive failures for the probe to be considered failed after having succeeded. Minimum value is 1 (deprecated, use workers.celery.livenessProbe.failureThreshold instead).

5

ditto

workers.livenessProbe.initialDelaySeconds

Number of seconds after the container has started before liveness probes are initiated (deprecated, use workers.celery.livenessProbe.initialDelaySeconds instead).

10

ditto

workers.livenessProbe.periodSeconds

How often (in seconds) to perform the probe. Minimum value is 1 (deprecated, use workers.celery.livenessProbe.periodSeconds instead).

60

ditto

workers.livenessProbe.timeoutSeconds

Number of seconds after which the probe times out. Minimum value is 1 seconds (deprecated, use workers.celery.livenessProbe.timeoutSeconds instead).

20

ditto

workers.nodeSelector

Select certain nodes for Airflow Celery worker pods and pods created with pod-template-file.

{}

ditto

workers.persistence.annotations

Annotations to add to Airflow Celery worker volumes (deprecated, use workers.celery.persistence.annotations instead).

{}

ditto

workers.persistence.enabled

Enable persistent volumes (deprecated, use workers.celery.persistence.enabled instead).

True

ditto

workers.persistence.fixPermissions

Execute init container to chown log directory. This is currently only needed in kind, due to usage of local-path provisioner (deprecated, use workers.celery.persistence.fixPermissions instead).

False

ditto

workers.persistence.size

Volume size for Airflow Celery worker StatefulSet (deprecated, use workers.celery.persistence.size instead).

100Gi

ditto

workers.persistence.storageClassName

If using a custom StorageClass, pass name ref to all StatefulSets here (templated) (deprecated, use workers.celery.persistence.storageClassName instead).

~

ditto

workers.podAnnotations

Annotations to add to the Airflow Celery workers and pods created with pod-template-file.

{}

ditto

workers.podDisruptionBudget.config.maxUnavailable

Max unavailable pods for worker.

1

ditto

workers.podDisruptionBudget.config.minAvailable

Min available pods for worker.

1

ditto

workers.podDisruptionBudget.enabled

Enable pod disruption budget.

False

ditto

workers.podManagementPolicy

Specifies the policy for managing pods within the Airflow Celery worker (deprecated, use workers.celery.podManagementPolicy instead). Only applicable to StatefulSet.

~

ditto

workers.priorityClassName

Specify priority for Airflow Celery worker pods and pods created with pod-template-file.

~

ditto

workers.replicas

Number of Airflow Celery workers (deprecated, use workers.celery.replicas instead).

1

ditto

workers.resources

Resource configuration for Airflow Celery workers and pods created with pod-template-file.

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

ditto

workers.runtimeClassName

Specify runtime for Airflow Celery worker pods and pods created with pod-template-file.

~

ditto

workers.safeToEvict

This setting tells Kubernetes that it’s ok to evict when it wants to scale a node down. It is used by Airflow Celery workers and pod-template-file.

False

ditto

workers.securityContext

Security context for the Airflow Celery worker pods and pods created with pod-template-file (deprecated, use securityContexts instead). If not set, the values from securityContext will be used.

{}

Examples:

securityContext:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

ditto

workers.serviceAccount.annotations

Annotations to add to the worker Kubernetes ServiceAccount.

{}

ditto

workers.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods

True

ditto

workers.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

ditto

workers.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

ditto

workers.strategy

Specifies the strategy used to replace old Airflow Celery worker pods by new ones when deployed as a Deployment (deprecated, use workers.celery.strategy instead).

{'rollingUpdate': {'maxSurge': '100%', 'maxUnavailable': '50%'}}

ditto

workers.terminationGracePeriodSeconds

Grace period for tasks to finish after SIGTERM is sent from Kubernetes. It is used by Airflow Celery workers and pod-template-file.

600

ditto

workers.tolerations

Specify Tolerations for Airflow Celery worker pods and pods created with pod-template-file.

[]

ditto

workers.topologySpreadConstraints

Specify topology spread constraints for Airflow Celery worker pods and pods created with pod-template-file.

[]

ditto

workers.updateStrategy

Specifies the strategy used to replace old Airflow Celery worker pods by new ones when deployed as a StatefulSet (deprecated, use workers.celery.updateStrategy instead).

~

ditto

workers.volumeClaimTemplates

Specify additional volume claim template for Airflow Celery workers.

[]

Examples:

volumeClaimTemplates:
- accessModes:
  - ReadWriteOnce
  name: data-volume-1
  resources:
    requests:
      storage: 10Gi
  storageClassName: storage-class-1
volumeClaimTemplates:
- accessModes:
  - ReadWriteOnce
  name: data-volume-2
  resources:
    requests:
      storage: 20Gi
  storageClassName: storage-class-2

ditto

workers.waitForMigrations.enabled

Enable wait-for-airflow-migrations init container.

True

ditto

workers.waitForMigrations.env

Add additional env vars to wait-for-airflow-migrations init container.

[]

ditto

Triggerer

Parameter

Description

Default

Opinion Jens

triggerer.affinity

Specify scheduling constraints for triggerer pods.

See values.yaml

 

triggerer.annotations

Annotations to add to the triggerer deployment

{}

 

triggerer.args

Args to use when running the Airflow triggerer (templated).

['bash', '-c', 'exec airflow triggerer']

 

triggerer.command

Command to use when running the Airflow triggerer (templated).

~

 

triggerer.enabled

Enable triggerer

True

 

triggerer.env

Add additional env vars to triggerer.

[]

 

triggerer.extraContainers

Launch additional containers into triggerer (templated).

[]

 

triggerer.extraInitContainers

Add additional init containers into triggerer (templated).

[]

 

triggerer.extraVolumeMounts

Mount additional volumes into triggerer.

[]

 

triggerer.extraVolumes

Mount additional volumes into triggerer.

[]

 

triggerer.hostAliases

HostAliases for the triggerer pod.

[]

Examples:

hostAliases:
- hostnames:
  - foo.local
  ip: 127.0.0.1
hostAliases:
- hostnames:
  - foo.remote
  ip: 10.1.2.3

 

triggerer.keda.advanced

Advanced KEDA configuration.

{}

Same like above: Should we have KEDA/HPA as Kustomize only?

triggerer.keda.advanced.horizontalPodAutoscalerConfig

HorizontalPodAutoscalerConfig specifies horizontal scale config.

{}

 

triggerer.keda.advanced.horizontalPodAutoscalerConfig.behavior

HorizontalPodAutoscalerBehavior configures the scaling behavior of the target.

{}

 

triggerer.keda.cooldownPeriod

How many seconds KEDA will wait before scaling to zero.

30

 

triggerer.keda.enabled

Allow KEDA autoscaling.

False

 

triggerer.keda.maxReplicaCount

Maximum number of triggerers created by KEDA.

10

 

triggerer.keda.minReplicaCount

Minimum number of triggerers created by KEDA.

0

 

triggerer.keda.namespaceLabels

Labels used in matchLabels for namespace in the PgBouncer NetworkPolicy.

{}

 

triggerer.keda.pollingInterval

How often KEDA polls the airflow DB to report new scale requests to the HPA.

5

 

triggerer.keda.query

Query to use for KEDA autoscaling. Must return a single integer.

SELECT ceil(COUNT(*)::decimal / {{ include "triggerer.capacity" . }}) FROM trigger

 

triggerer.keda.usePgbouncer

Whether to use PGBouncer to connect to the database or not when it is enabled. This configuration will be ignored if PGBouncer is not enabled.

False

 

triggerer.labels

Labels to add to the triggerer objects and pods.

{}

 

triggerer.livenessProbe.failureThreshold

Minimum consecutive failures for the probe to be considered failed after having succeeded. Minimum value is 1.

5

 

triggerer.livenessProbe.initialDelaySeconds

Number of seconds after the container has started before liveness probes are initiated.

10

 

triggerer.livenessProbe.periodSeconds

How often (in seconds) to perform the probe. Minimum value is 1.

60

 

triggerer.livenessProbe.timeoutSeconds

Number of seconds after which the probe times out. Minimum value is 1 seconds.

20

 

triggerer.nodeSelector

Select certain nodes for triggerer pods.

{}

 

triggerer.persistence.annotations

Annotations to add to triggerer volumes.

{}

 

triggerer.persistence.enabled

Enable persistent volumes.

True

 

triggerer.persistence.fixPermissions

Execute init container to chown log directory. This is currently only needed in kind, due to usage of local-path provisioner.

False

 

triggerer.persistence.size

Volume size for triggerer StatefulSet.

100Gi

 

triggerer.persistence.storageClassName

If using a custom StorageClass, pass name ref to all StatefulSets here (templated).

~

 

triggerer.podAnnotations

Annotations to add to the triggerer pods.

{}

 

triggerer.podDisruptionBudget.config.maxUnavailable

Max unavailable pods for triggerer.

1

 

triggerer.podDisruptionBudget.config.minAvailable

Min available pods for triggerer.

1

 

triggerer.podDisruptionBudget.enabled

Enable pod disruption budget.

False

 

triggerer.priorityClassName

Specify priority for triggerer pods.

~

 

triggerer.replicas

Number of triggerers to run.

1

 

triggerer.resources

Resources for triggerer pods.

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

triggerer.safeToEvict

This setting tells Kubernetes that its ok to evict when it wants to scale a node down.

True

 

triggerer.securityContext

Security context for the triggerer pod (deprecated, use securityContexts instead). If not set, the values from securityContext will be used.

{}

Examples:

securityContext:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

triggerer.serviceAccount.annotations

Annotations to add to the triggerer Kubernetes ServiceAccount.

{}

 

triggerer.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods.

True

 

triggerer.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

 

triggerer.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

 

triggerer.strategy

Specifies the strategy used to replace old Pods by new ones when deployed as a Deployment.

{'rollingUpdate': {'maxSurge': '100%', 'maxUnavailable': '50%'}}

 

triggerer.terminationGracePeriodSeconds

Grace period for tasks to finish after SIGTERM is sent from Kubernetes.

60

 

triggerer.tolerations

Specify Tolerations for triggerer pods.

[]

 

triggerer.topologySpreadConstraints

Specify topology spread constraints for triggerer pods.

[]

 

triggerer.updateStrategy

Specifies the strategy used to replace old Pods by new ones when deployed as a StatefulSet.

~

 

triggerer.waitForMigrations.enabled

Enable wait-for-airflow-migrations init container.

True

 

triggerer.waitForMigrations.env

Add additional env vars to wait-for-airflow-migrations init container.

[]

 

DagProcessor

Parameter

Description

Default

Opinion Jens

dagProcessor.affinity

Specify scheduling constraints for dag processor pods.

See values.yaml

 

dagProcessor.annotations

Annotations to add to the dag processor deployment

{}

 

dagProcessor.args

Args to use when running the Airflow dag processor (templated).

['bash', '-c', 'exec airflow dag-processor']

Same like with workers: There is this PR to start a deployment per bundle. Should structure be here made similar like with workers? (one default can add more?)

dagProcessor.command

Command to use when running the Airflow dag processor (templated).

~

 

dagProcessor.dagBundleConfigList

Define Dag bundles in a structured YAML format. This will be automatically converted to JSON string format for config.dag_processor.dag_bundle_config_list.

[{'name': 'dags-folder', 'classpath': 'airflow.dag_processing.bundles.local.LocalDagBundle', 'kwargs': {}}]

 

dagProcessor.dagBundleConfigList[].kwargs

Keyword arguments for the Dag bundle.

{}

 

dagProcessor.enabled

Enable standalone dag processor (requires Airflow 2.3.0+).

~

 

dagProcessor.env

Add additional env vars to dag processor.

[]

 

dagProcessor.extraContainers

Launch additional containers into dag processor (templated).

[]

 

dagProcessor.extraInitContainers

Add additional init containers into dag processor (templated).

[]

 

dagProcessor.extraVolumeMounts

Mount additional volumes into dag processor.

[]

 

dagProcessor.extraVolumes

Mount additional volumes into dag processor.

[]

 

dagProcessor.labels

Labels specific to dag processor objects and pods

{}

 

dagProcessor.livenessProbe.failureThreshold

Minimum consecutive failures for the probe to be considered failed after having succeeded. Minimum value is 1.

5

 

dagProcessor.livenessProbe.initialDelaySeconds

Number of seconds after the container has started before liveness probes are initiated.

10

 

dagProcessor.livenessProbe.periodSeconds

How often (in seconds) to perform the probe. Minimum value is 1.

60

 

dagProcessor.livenessProbe.timeoutSeconds

Number of seconds after which the probe times out. Minimum value is 1 seconds.

20

 

dagProcessor.nodeSelector

Select certain nodes for dag processor pods.

{}

 

dagProcessor.podAnnotations

Annotations to add to the dag processor pods.

{}

 

dagProcessor.podDisruptionBudget.config.maxUnavailable

Max unavailable pods for dag processor.

1

 

dagProcessor.podDisruptionBudget.config.minAvailable

Min available pods for dag processor.

1

 

dagProcessor.podDisruptionBudget.enabled

Enable pod disruption budget.

False

 

dagProcessor.priorityClassName

Specify priority for dag processor pods.

~

 

dagProcessor.replicas

Number of dag processors to run.

1

 

dagProcessor.resources

Resources for dag processor pods.

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

dagProcessor.safeToEvict

This setting tells Kubernetes that its ok to evict when it wants to scale a node down.

True

 

dagProcessor.securityContext

Security context for the dag processor pod (deprecated, use securityContexts instead). If not set, the values from securityContext will be used.

{}

Examples:

securityContext:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

dagProcessor.serviceAccount.annotations

Annotations to add to the dag processor Kubernetes ServiceAccount.

{}

 

dagProcessor.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods.

True

 

dagProcessor.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

 

dagProcessor.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

 

dagProcessor.strategy

Specifies the strategy used to replace old Pods by new ones when deployed as a Deployment.

{'rollingUpdate': {'maxSurge': '100%', 'maxUnavailable': '50%'}}

 

dagProcessor.terminationGracePeriodSeconds

Grace period for tasks to finish after SIGTERM is sent from Kubernetes.

60

 

dagProcessor.tolerations

Specify Tolerations for dag processor pods.

[]

 

dagProcessor.topologySpreadConstraints

Specify topology spread constraints for dag processor pods.

[]

 

dagProcessor.waitForMigrations.enabled

Enable wait-for-airflow-migrations init container.

True

 

dagProcessor.waitForMigrations.env

Add additional env vars to wait-for-airflow-migrations init container.

[]

 

Flower

Parameter

Description

Default

Opinion Jens

flower.affinity

Specify scheduling constraints for Flower pods.

{}

 

flower.annotations

Annotations to add to the flower deployment

{}

 

flower.args

Args to use when running flower (templated).

['bash', '-c', 'exec \\\nairflow {{ semverCompare ">=2.0.0" .Values.airflowVersion | ternary "celery flower" "flower" }}']

 

flower.command

Command to use when running flower (templated).

~

 

flower.enabled

Enable Flower.

False

Is flower a component that should be supported by helm chart? Not complex but could be carved-out into a separate deployment add-on in Kustomize...

flower.env

Add additional env vars to flower.

[]

 

flower.extraContainers

Launch additional containers into the flower pods.

[]

 

flower.extraNetworkPolicies

Additional NetworkPolicies as needed (Deprecated - renamed to flower.networkPolicy.ingress.from).

[]

 

flower.extraVolumeMounts

Mount additional volumes into the flower pods.

[]

 

flower.extraVolumes

Mount additional volumes into the flower pods.

[]

 

flower.labels

Labels to add to the flower objects and pods.

{}

 

flower.livenessProbe.failureThreshold

Flower Liveness probe failure threshold.

10

 

flower.livenessProbe.initialDelaySeconds

Flower Liveness probe initial delay.

10

 

flower.livenessProbe.periodSeconds

Flower Liveness probe period seconds.

5

 

flower.livenessProbe.timeoutSeconds

Flower Liveness probe timeout seconds.

5

 

flower.networkPolicy.ingress.from

Peers for flower NetworkPolicyingress.

[]

 

flower.networkPolicy.ingress.ports

Ports for flower NetworkPolicyingress (if from is set).

[{'port': '{{ .Values.ports.flowerUI }}'}]

Examples:

ports:
- port: 5565

 

flower.nodeSelector

Select certain nodes for Flower pods.

{}

 

flower.password

Password use to access Flower.

~

 

flower.podAnnotations

Annotations to add to the Flower pods.

{}

 

flower.priorityClassName

Specify priority for Flower pods.

~

 

flower.readinessProbe.failureThreshold

Flower Readiness probe failure threshold.

10

 

flower.readinessProbe.initialDelaySeconds

Flower Readiness probe initial delay.

10

 

flower.readinessProbe.periodSeconds

Flower Readiness probe period seconds.

5

 

flower.readinessProbe.timeoutSeconds

Flower Readiness probe timeout seconds.

5

 

flower.resources

Resources for Flower pods.

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

flower.secretAnnotations

Annotations to add to the flower secret.

{}

 

flower.secretName

A secret containing the user and password pair.

~

 

flower.securityContext

Security context for the flower pod (deprecated, use securityContexts instead). If not set, the values from securityContext will be used.

{}

Examples:

securityContext:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

flower.service.annotations

Annotations for the flower Service.

{}

 

flower.service.loadBalancerIP

Flower Service loadBalancerIP.

~

 

flower.service.loadBalancerSourceRanges

Flower Service loadBalancerSourceRanges.

[]

Examples:

loadBalancerSourceRanges:
- 10.123.0.0/16

 

flower.service.ports

Ports for the flower Service.

[{'name': 'flower-ui', 'port': '{{ .Values.ports.flowerUI }}'}]

Examples:

ports:
- name: flower-ui
  port: 8080
  targetPort: flower-ui

 

flower.service.type

Flower Service type.

ClusterIP

 

flower.serviceAccount.annotations

Annotations to add to the worker Kubernetes ServiceAccount.

{}

 

flower.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods.

True

 

flower.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

 

flower.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

 

flower.startupProbe.failureThreshold

Flower Startup probe failure threshold.

6

 

flower.startupProbe.initialDelaySeconds

Flower Startup probe initial delay seconds.

0

 

flower.startupProbe.periodSeconds

Flower Startup probe period seconds.

10

 

flower.startupProbe.timeoutSeconds

Flower Startup probe timeout seconds.

20

 

flower.tolerations

Specify Tolerations for Flower pods.

[]

 

flower.topologySpreadConstraints

Specify topology spread constraints for Flower pods.

[]

 

flower.username

Username use to access Flower.

~

 

Redis

Parameter

Description

Default

Opinion Jens

data.brokerUrl

Direct url to the redis broker (when using an external redis instance) (can only be set during install, not upgrade).

~

 

data.brokerUrlSecretName

Redis broker URL secret.

~

 

redis.affinity

Specify scheduling constraints for Redis pods.

{}

 

redis.annotations

Annotations for the redis.

{}

 

redis.emptyDirConfig

Configuration for redis empty dir volume.

~

 

redis.enabled

Enable the Redis provisioned by the chart (you can also use an external Redis instance with data.brokerUrl or data.brokerUrlSecretName).

True

 

redis.labels

Labels to add to the redis objects and pods.

{}

 

redis.nodeSelector

Select certain nodes for Redis pods.

{}

 

redis.password

If password is set, create secret with it, else generate a new one on install (can only be set during install, not upgrade).

~

 

redis.passwordSecretAnnotations

Annotations to add to the redis password secret.

{}

 

redis.passwordSecretName

Redis password secret.

~

 

redis.persistence.annotations

Annotations to add to redis volumes.

{}

 

redis.persistence.enabled

Enable persistent volumes.

True

 

redis.persistence.existingClaim

The name of an existing PVC to use.

~

 

redis.persistence.size

Volume size for Redis StatefulSet.

1Gi

 

redis.persistence.storageClassName

If using a custom StorageClass, pass name ref to all StatefulSets here (templated).

~

 

redis.podAnnotations

Annotations to add to the redis pods.

{}

 

redis.priorityClassName

Specify priority for redis pods.

~

 

redis.resources

Resources for the Redis pods

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

redis.safeToEvict

This setting tells Kubernetes that its ok to evict when it wants to scale a node down.

True

 

redis.securityContext

Security context for the cleanup job pod (deprecated, use securityContexts instead). If not set, the values from securityContext will be used.

{}

Examples:

securityContext:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

redis.service.clusterIP

If using ClusterIP service type, custom IP address can be specified.

~

 

redis.service.nodePort

If using NodePort service type, custom node port can be specified.

~

 

redis.service.type

Service type.

ClusterIP

 

redis.serviceAccount.annotations

Annotations to add to the worker Kubernetes ServiceAccount.

{}

 

redis.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods

True

 

redis.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

 

redis.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

 

redis.terminationGracePeriodSeconds

Grace period for Redis to exit after SIGTERM is sent from Kubernetes.

600

 

redis.tolerations

Specify Tolerations for Redis pods.

[]

 

redis.topologySpreadConstraints

Specify topology spread constraints for Redis pods.

[]

 

redis.uid

Redis run as user parameter.

0

 

StatsD

Parameter

Description

Default

Opinion Jens

statsd.affinity

Specify scheduling constraints for StatsD pods.

{}

 

statsd.annotations

Annotations to add to the StatsD deployment.

{}

 

statsd.args

Args to use when running statsd-exporter (templated).

['--statsd.mapping-config=/etc/statsd-exporter/mappings.yml']

 

statsd.cache.size

Maximum number of metric mappings to cache in memory. Higher values improve performance for frequently used metrics but consume more memory.

1000

 

statsd.cache.ttl

Time-to-live for cached metric mappings. Determines how long mappings remain in cache before expiring. Set to ‘0s’ to disable expiration.

0s

 

statsd.cache.type

Cache eviction strategy for metric mappings. lru (Least Recently Used) evicts oldest accessed items, ‘random’ evicts randomly selected items.

lru

 

statsd.configMapAnnotations

Extra annotations to apply to the statsd configmap.

{}

 

statsd.enabled

Enable StatsD.

True

 

statsd.env

Add additional env vars to statsd container.

[]

 

statsd.extraMappings

Additional mappings for StatsD exporter.If set, will merge default mapping and extra mappings, default mapping has higher priority. So, if you want to change some default mapping, please use overrideMappings

[]

 

statsd.extraNetworkPolicies

Additional NetworkPolicies as needed.

[]

 

statsd.labels

Labels specific to statsd objects and pods

{}

 

statsd.nodeSelector

Select certain nodes for StatsD pods.

{}

 

statsd.overrideMappings

Override mappings for StatsD exporter.If set, will ignore setting item in default and extraMappings. So, If you use it, ensure all mapping item contains in it.

[]

 

statsd.podAnnotations

Annotations to add to the StatsD pods.

{}

 

statsd.priorityClassName

Specify priority for StatsD pods.

~

 

statsd.resources

Resources for StatsD pods.

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

statsd.securityContext

Security context for the StatsD pod (deprecated, use securityContexts instead).

{}

Examples:

securityContext:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

statsd.service.extraAnnotations

Extra annotations for the StatsD Service.

{}

 

statsd.serviceAccount.annotations

Annotations to add to the StatsD Kubernetes ServiceAccount.

{}

 

statsd.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods.

True

 

statsd.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

 

statsd.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

 

statsd.terminationGracePeriodSeconds

Grace period for statsd to finish after SIGTERM is sent from Kubernetes.

30

 

statsd.tolerations

Specify Tolerations for StatsD pods.

[]

 

statsd.topologySpreadConstraints

Specify topology spread constraints for StatsD pods.

[]

 

statsd.uid

StatsD run as user parameter.

65534

 

Jobs

Parameter

Description

Default

Opinion Jens

cleanup.affinity

Specify scheduling constraints for cleanup pods.

{}

 

cleanup.args

Args to use when running the cleanup cronjob (templated).

['bash', '-c', 'exec airflow kubernetes cleanup-pods --namespace={{ .Release.Namespace }}']

 

cleanup.command

Command to use when running the cleanup cronjob (templated).

~

 

cleanup.enabled

Enable cleanup.

False

 

cleanup.env

Add additional env vars to cleanup.

[]

 

cleanup.jobAnnotations

Annotations to add to the cleanup cronjob.

{}

 

cleanup.labels

labels to add to cleanup pods.

{}

 

cleanup.nodeSelector

Select certain nodes for cleanup pods.

{}

 

cleanup.podAnnotations

Annotations to add to cleanup pods.

{}

 

cleanup.priorityClassName

Specify priority for cleanup pods.

~

 

cleanup.resources

Resources for cleanup pods

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

cleanup.schedule

Cleanup schedule (templated).

*/15 * * * *

 

cleanup.securityContext

Security context for the cleanup job pod (deprecated, use securityContexts instead). If not set, the values from securityContext will be used.

{}

Examples:

securityContext:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

cleanup.serviceAccount.annotations

Annotations to add to the cleanup CronJob Kubernetes ServiceAccount.

{}

 

cleanup.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods

True

 

cleanup.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

 

cleanup.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

 

cleanup.tolerations

Specify Tolerations for cleanup pods.

[]

 

cleanup.topologySpreadConstraints

Specify topology spread constraints for cleanup pods.

[]

 

createUserJob.affinity

Specify scheduling constraints for the create user job pod.

{}

 

createUserJob.annotations

Annotations to add to the create user job pod.

{}

 

createUserJob.applyCustomEnv

Specify if you want additional configured env vars applied to this job

True

 

createUserJob.args

Args to use when running create user job (templated).

['bash', '-c', 'exec \\\nairflow {{ semverCompare ">=2.0.0" .Values.airflowVersion | ternary "users create" "create_user" }} "$@"', '--', '-r', '{{ if .Values.webserver.defaultUser }}{{ .Values.webserver.defaultUser.role }}{{ else }}{{ .Values.createUserJob.defaultUser.role }}{{ end }}', '-u', '{{ if .Values.webserver.defaultUser }}{{ .Values.webserver.defaultUser.username }}{{ else }}{{ .Values.createUserJob.defaultUser.username }}{{ end }}', '-e', '{{ if .Values.webserver.defaultUser }}{{ .Values.webserver.defaultUser.email }}{{ else }}{{ .Values.createUserJob.defaultUser.email }}{{ end }}', '-f', '{{ if .Values.webserver.defaultUser }}{{ .Values.webserver.defaultUser.firstName }}{{ else }}{{ .Values.createUserJob.defaultUser.firstName }}{{ end }}', '-l', '{{ if .Values.webserver.defaultUser }}{{ .Values.webserver.defaultUser.lastName }}{{ else }}{{ .Values.createUserJob.defaultUser.lastName }}{{ end }}', '-p', '{{ if .Values.webserver.defaultUser }}{{ .Values.webserver.defaultUser.password }}{{ else }}{{ .Values.createUserJob.defaultUser.password }}{{ end }}']

 

createUserJob.command

Command to use when running create user job (templated).

~

 

createUserJob.defaultUser.email

Default user email address.

admin@example.com

 

createUserJob.defaultUser.firstName

Default user firstname.

admin

 

createUserJob.defaultUser.lastName

Default user lastname.

user

 

createUserJob.defaultUser.password

Default user password.

admin

 

createUserJob.defaultUser.role

Default user role.

Admin

 

createUserJob.defaultUser.username

Default user username.

admin

 

createUserJob.enabled

Whether the create user job should be created.

True

Should we make this Fals eas default not to be insecure by default?

createUserJob.env

Add additional env vars to the create user job pod.

[]

 

createUserJob.extraContainers

Launch additional containers for the create user job pod

[]

 

createUserJob.extraInitContainers

Add additional init containers into create user job pod (templated).

[]

 

createUserJob.extraVolumeMounts

Mount additional volumes into create user job

[]

 

createUserJob.extraVolumes

Mount additional volumes into create user job

[]

 

createUserJob.jobAnnotations

Annotations to add to the create user job job.

{}

 

createUserJob.labels

Labels to add to the create user job objects and pods.

{}

 

createUserJob.nodeSelector

Select certain nodes for the create user job pod.

{}

 

createUserJob.priorityClassName

Specify priority for the create user job pod.

~

 

createUserJob.resources

Resources for the create user job pod

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

createUserJob.securityContext

Security context for the create user job pod (deprecated, use securityContexts instead). If not set, the values from securityContext will be used.

{}

Examples:

securityContext:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

createUserJob.serviceAccount.annotations

Annotations to add to the create user job Kubernetes ServiceAccount.

{}

 

createUserJob.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods.

True

 

createUserJob.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

 

createUserJob.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

 

createUserJob.tolerations

Specify Tolerations for the create user job pod.

[]

 

createUserJob.topologySpreadConstraints

Specify topology spread constraints for the create user job pod.

[]

 

createUserJob.ttlSecondsAfterFinished

Limit the lifetime of the job object after it finished execution

300

 

createUserJob.useHelmHooks

Specify if you want to use the default Helm Hook annotations

True

 

databaseCleanup.affinity

Specify scheduling constraints for database cleanup pods.

{}

 

databaseCleanup.applyCustomEnv

Specify if you want additional configured env vars applied to database cleanup job

True

 

databaseCleanup.args

Args to use when running the database cleanup cronjob (templated).

['-c', 'CLEAN_TS=$(date -d "-{{ .Values.databaseCleanup.retentionDays }} days" +"%Y-%m-%dT%H:%M:%S"); echo "Cleaning up metadata DB entries older than ${CLEAN_TS}"; exec airflow db clean --clean-before-timestamp "${CLEAN_TS}" --yes {{- if .Values.databaseCleanup.skipArchive }} --skip-archive{{ end }} {{- if .Values.databaseCleanup.verbose }} --verbose{{ end }} {{- with .Values.databaseCleanup.batchSize }} --batch-size {{ . }}{{ end }} {{- with .Values.databaseCleanup.tables }} --tables {{ . | join "," }}{{ end }}']

 

databaseCleanup.batchSize

Maximum number of rows to delete or archive in a single transaction.

~

 

databaseCleanup.command

Command to use when running the database cleanup cronjob (templated).

['bash']

 

databaseCleanup.enabled

Enable database cleanup.

False

 

databaseCleanup.env

Add additional env vars to database cleanup.

[]

 

databaseCleanup.jobAnnotations

Annotations to add to the database cleanup cronjob.

{}

 

databaseCleanup.labels

labels to add to database cleanup pods.

{}

 

databaseCleanup.nodeSelector

Select certain nodes for database cleanup pods.

{}

 

databaseCleanup.podAnnotations

Annotations to add to database cleanup pods.

{}

 

databaseCleanup.priorityClassName

Specify priority for database cleanup pods.

~

 

databaseCleanup.resources

Resources for database cleanup pods

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

databaseCleanup.retentionDays

Number of days to retain records in the metadata database.

90

 

databaseCleanup.schedule

Database cleanup schedule (templated).

0 0 * * 0

 

databaseCleanup.serviceAccount.annotations

Annotations to add to the database cleanup CronJob Kubernetes ServiceAccount.

{}

 

databaseCleanup.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods

True

 

databaseCleanup.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

 

databaseCleanup.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

 

databaseCleanup.skipArchive

Don’t preserve purged records in an archive table.

False

 

databaseCleanup.tables

Table names to perform maintenance on. Supported values in: https://airflow.apache.org/docs/apache-airflow/stable/cli-and-env-variables-ref.html#clean

[]

 

databaseCleanup.tolerations

Specify Tolerations for database cleanup pods.

[]

 

databaseCleanup.topologySpreadConstraints

Specify topology spread constraints for database cleanup pods.

[]

 

databaseCleanup.verbose

Make logging output more verbose.

True

 

migrateDatabaseJob.affinity

Specify scheduling constraints for the migrate database job pod.

{}

 

migrateDatabaseJob.annotations

Annotations to add to the migrate database job pod.

{}

 

migrateDatabaseJob.applyCustomEnv

Specify if you want additional configured env vars applied to this job

True

 

migrateDatabaseJob.args

Args to use when running migrate database job (templated).

['bash', '-c', 'exec \\\nairflow {{ semverCompare ">=2.7.0" .Values.airflowVersion | ternary "db migrate" (semverCompare ">=2.0.0" .Values.airflowVersion | ternary "db upgrade" "upgradedb") }}']

 

migrateDatabaseJob.command

Command to use when running migrate database job (templated).

~

 

migrateDatabaseJob.enabled

Enable migrate database job.

True

 

migrateDatabaseJob.env

Add additional env vars to migrate database job.

[]

 

migrateDatabaseJob.extraContainers

Launch additional containers for the migrate database job pod

[]

 

migrateDatabaseJob.extraInitContainers

Add additional init containers into migrate database job (templated).

[]

 

migrateDatabaseJob.extraVolumeMounts

Mount additional volumes into migrate database job

[]

 

migrateDatabaseJob.extraVolumes

Mount additional volumes into migrate database job

[]

 

migrateDatabaseJob.jobAnnotations

Annotations to add to the migrate database job.

{}

 

migrateDatabaseJob.labels

Labels to add to the migrate database job objects and pods.

{}

 

migrateDatabaseJob.nodeSelector

Select certain nodes for the migrate database job pod.

{}

 

migrateDatabaseJob.priorityClassName

Specify priority for the migrate database job pod.

~

 

migrateDatabaseJob.resources

Resources for the migrate database job pod

{}

Examples:

resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

 

migrateDatabaseJob.securityContext

Security context for the migrate database job pod (deprecated, use securityContexts instead). If not set, the values from securityContext will be used.

{}

Examples:

securityContext:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

migrateDatabaseJob.serviceAccount.annotations

Annotations to add to the migrate database job Kubernetes ServiceAccount.

{}

 

migrateDatabaseJob.serviceAccount.automountServiceAccountToken

Specifies if ServiceAccount’s API credentials should be mounted onto Pods.

True

 

migrateDatabaseJob.serviceAccount.create

Specifies whether a ServiceAccount should be created.

True

 

migrateDatabaseJob.serviceAccount.name

The name of the ServiceAccount to use. If not set and create is true, a name is generated using the release name.

~

 

migrateDatabaseJob.tolerations

Specify Tolerations for the migrate database job pod.

[]

 

migrateDatabaseJob.topologySpreadConstraints

Specify topology spread constraints for migrate database job pod.

[]

 

migrateDatabaseJob.ttlSecondsAfterFinished

Limit the lifetime of the job object after it finished execution

300

 

migrateDatabaseJob.useHelmHooks

Specify if you want to use the default Helm Hook annotations

True

 

Kubernetes

Parameter

Description

Default

Opinion Jens

affinity

Specify scheduling constraints for all pods.

{}

 

airflowConfigAnnotations

Extra annotations to apply to the main Airflow configmap.

{}

 

airflowPodAnnotations

Extra annotations to apply to all Airflow pods.

{}

 

apiServer.containerLifecycleHooks

Container Lifecycle Hooks definition for the API server. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

apiServer.securityContexts.container

Container security context definition for the API server.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

apiServer.securityContexts.pod

Pod security context definition for the API server.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

apiServer.topologySpreadConstraints

Specify topology spread constraints for API server pods.

[]

 

apiServer.waitForMigrations.securityContexts.container

Container security context definition for the wait for migrations.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

cleanup.containerLifecycleHooks

Container Lifecycle Hooks definition for the cleanup. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

cleanup.securityContexts.container

Container security context definition for the cleanup.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

cleanup.securityContexts.pod

Pod security context definition for the cleanup.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

containerLifecycleHooks

Default Container Lifecycle Hooks definition. The values in this parameter will be used when containerLifecycleHooks is not defined for specific containers.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

createUserJob.containerLifecycleHooks

Container Lifecycle Hooks definition for the create user job. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

createUserJob.securityContexts.container

Container security context definition for the create user job.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

createUserJob.securityContexts.pod

Pod security context definition for the create user job.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

dagProcessor.containerLifecycleHooks

Container Lifecycle Hooks definition for the dag processor. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

dagProcessor.securityContexts.container

Container security context definition for the dag processor.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

dagProcessor.securityContexts.pod

Pod security context definition for the dag processor.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

dagProcessor.waitForMigrations.securityContexts.container

Container security context definition for the wait for migrations.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

dags.gitSync.containerLifecycleHooks

Container Lifecycle Hooks definition for the git sync sidecar. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

dags.gitSync.securityContexts.container

Container security context definition for the git sync sidecar.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

databaseCleanup.containerLifecycleHooks

Container Lifecycle Hooks definition for the database cleanup. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

databaseCleanup.securityContexts.container

Container security context definition for the database cleanup.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

databaseCleanup.securityContexts.pod

Pod security context definition for the database cleanup.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

extraConfigMaps

Extra ConfigMaps that will be managed by the chart.

{}

Examples:

extraConfigMaps:
  '{{ .Release.Name }}-airflow-variables':
    data: |-
      AIRFLOW_VAR_HELLO_MESSAGE: 'Hi!'
      AIRFLOW_VAR_KUBERNETES_NAMESPACE: '{{ .Release.Namespace }}'

 

extraSecrets

Extra secrets that will be managed by the chart.

{}

Examples:

extraSecrets:
  '{{ .Release.Name }}-airflow-connections':
    data: |-
      AIRFLOW_CONN_GCP: 'base64_encoded_gcp_conn_string'
      AIRFLOW_CONN_AWS: 'base64_encoded_aws_conn_string'
    stringData: 'AIRFLOW_CONN_OTHER: ''other_conn'''

 

flower.containerLifecycleHooks

Container Lifecycle Hooks definition for the network policy. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

flower.securityContexts.container

Container security context definition for the network policy.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

flower.securityContexts.pod

Pod security context definition for the network policy.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

imagePullSecrets

List of existing Kubernetes secrets containing Base64 encoded credentials to connect to private registries (will get passed to imagePullSecrets).

[]

 

labels

Add common labels to all objects and pods defined in this chart.

{}

 

limits

Define default/max/min values for pods and containers in namespace.

[]

 

migrateDatabaseJob.containerLifecycleHooks

Container Lifecycle Hooks definition for the migrate database job. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

migrateDatabaseJob.securityContexts.container

Container security context definition for the migrate database job.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

migrateDatabaseJob.securityContexts.pod

Pod security context definition for the migrate database job.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

networkPolicies.enabled

Enabled network policies.

False

 

nodeSelector

Select certain nodes for all pods.

{}

 

pgbouncer.containerLifecycleHooks

Container Lifecycle Hooks definition for the PgBouncer. If not set, the values from global containerLifecycleHooks will be used.

{'preStop': {'exec': {'command': ['/bin/sh', '-c', 'killall -INT pgbouncer && sleep 120']}}}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

pgbouncer.metricsExporterSidecar.containerLifecycleHooks

Container Lifecycle Hooks definition for the metrics exporter sidecar. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

pgbouncer.metricsExporterSidecar.securityContexts.container

Container security context definition for the metrics exporter sidecar.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

pgbouncer.securityContexts.container

Container security context definition for the PgBouncer.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

pgbouncer.securityContexts.pod

Pod security context definition for the PgBouncer.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 65534

 

priorityClasses

Priority Classes created by helm charts

[]

Examples:

priorityClasses:
- name: class1
  preemptionPolicy: PreemptLowerPriority
  value: 10000
priorityClasses:
- name: class2
  preemptionPolicy: Never
  value: 100000

 

quotas

Define any ResourceQuotas for namespace.

{}

 

rbac.create

Specifies whether RBAC resources should be created.

True

 

rbac.createSCCRoleBinding

Specifies whether SCC RoleBinding resource should be created (refer to Production Guide).

False

 

redis.containerLifecycleHooks

Container Lifecycle Hooks definition for the redis. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

redis.securityContexts.container

Container security context definition for the redis.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

redis.securityContexts.pod

Pod security context definition for the redis.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 999

 

registry.connection

Credentials to connect to a private registry, these will get Base64 encoded and stored in a secret (will get passed to imagePullSecrets) (create manually the credentials secret and add to imagePullSecrets instead).

{}

Examples:

connection:
  email: '...'
  host: '...'
  pass: '...'
  user: '...'

 

registry.connection.email

Email Address

""

 

registry.connection.host

Registry Server URL (e.g. https://index.docker.io/v1/ for DockerHub)

""

 

registry.connection.pass

Password

""

 

registry.connection.user

Username

""

 

registry.secretName

Name of the Kubernetes secret containing Base64 encoded credentials to connect to a private registry (will get passed to imagePullSecrets) (Deprecated - renamed to registry.secretNames).

~

 

scheduler.containerLifecycleHooks

Container Lifecycle Hooks definition for the scheduler. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

scheduler.securityContexts.container

Container security context definition for the scheduler.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

scheduler.securityContexts.pod

Pod security context definition for the scheduler.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

scheduler.waitForMigrations.securityContexts.container

Container security context definition for the wait for migrations.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

securityContext

Default pod security context definition (deprecated, use securityContexts instead). The values in this parameter will be used when securityContext is not defined for specific Pods

{}

Examples:

securityContext:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

securityContexts.containers

Default container security context definition. The values in this parameter will be used when securityContexts is not defined for specific containers

{}

Examples:

containers:
  allowPrivilegeEscalation: false

 

securityContexts.pod

Default pod security context definition. The values in this parameter will be used when securityContexts is not defined for specific Pods.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

statsd.containerLifecycleHooks

Container Lifecycle Hooks definition for the statsd. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

statsd.securityContexts.container

Container security context definition for the statsd.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

statsd.securityContexts.pod

Pod security context definition for the statsd.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

tolerations

Specify Tolerations for all pods.

[]

 

topologySpreadConstraints

Specify topology spread constraints for all pods.

[]

 

triggerer.containerLifecycleHooks

Container Lifecycle Hooks definition for the triggerer. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

triggerer.securityContexts.container

Container security context definition for the triggerer.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

triggerer.securityContexts.pod

Pod security context definition for the triggerer.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

triggerer.waitForMigrations.securityContexts.container

Container security context definition for the wait for migrations.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

webserver.containerLifecycleHooks

Container Lifecycle Hooks definition for the webserver. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

webserver.securityContexts.container

Container security context definition for the webserver.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

webserver.securityContexts.pod

Pod security context definition for the webserver.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

webserver.topologySpreadConstraints

Specify topology spread constraints for webserver pods.

[]

 

webserver.waitForMigrations.securityContexts.container

Container security context definition for the wait for migrations.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

workers.celery.kerberosInitContainer.containerLifecycleHooks

Container Lifecycle Hooks definition for the kerberos init container. If not set, the values from workers.kerberosInitContainer.containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

workers.celery.kerberosInitContainer.securityContexts.container

Container security context definition for the kerberos init container.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

workers.celery.persistence.securityContexts.container

Container security context definition for the persistence.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

workers.celery.securityContexts.container

Container security context definition.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

workers.celery.securityContexts.pod

Pod security context definition.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

workers.containerLifecycleHooks

Container Lifecycle Hooks definition for Airflow Celery workers and pods created with pod-template-file. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

workers.kerberosInitContainer.containerLifecycleHooks

Container Lifecycle Hooks definition for the kerberos init container. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

workers.kerberosInitContainer.securityContexts.container

Container security context definition for the kerberos init container.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

workers.kerberosSidecar.containerLifecycleHooks

Container Lifecycle Hooks definition for the kerberos sidecar. If not set, the values from global containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

workers.kerberosSidecar.securityContexts.container

Container security context definition for the kerberos sidecar.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

workers.kubernetes.kerberosInitContainer.containerLifecycleHooks

Container Lifecycle Hooks definition for the kerberos init container. If not set, the values from workers.kerberosInitContainer.containerLifecycleHooks will be used.

{}

Examples:

containerLifecycleHooks:
  postStart:
    exec:
      command:
      - /bin/sh
      - -c
      - echo postStart handler > /usr/share/message
  preStop:
    exec:
      command:
      - /bin/sh
      - -c
      - echo preStop handler > /usr/share/message

 

workers.kubernetes.kerberosInitContainer.securityContexts.container

Container security context definition for the kerberos init container.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

workers.kubernetes.securityContexts.container

Container security context definition.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

workers.kubernetes.securityContexts.pod

Pod security context definition.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

workers.persistence.securityContexts.container

Container security context definition for the persistence.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

workers.securityContexts.container

Container security context definition.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

workers.securityContexts.pod

Pod security context definition.

{}

Examples:

pod:
  fsGroup: 0
  runAsGroup: 0
  runAsUser: 50000

 

workers.waitForMigrations.securityContexts.container

Container security context definition for the wait-for-airflow-migrations container.

{}

Examples:

container:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL

 

Ingress

Parameter

Description

Default

Opinion Jens

ingress.apiServer.annotations

Annotations for the API server Ingress.

{}

 

ingress.apiServer.enabled

Enable API server ingress resource.

False

 

ingress.apiServer.host

The hostname for the API server Ingress. (Deprecated - renamed to ingress.apiServer.hosts)

""

 

ingress.apiServer.hosts

The hostnames or hosts configuration for the API server Ingress.

[]

 

ingress.apiServer.ingressClassName

The Ingress Class for the API server Ingress.

""

 

ingress.apiServer.path

The path for the API server Ingress.

/

 

ingress.apiServer.pathType

The pathType for the API server Ingress (required for Kubernetes 1.19 and above).

ImplementationSpecific

 

ingress.apiServer.precedingPaths

HTTP paths to add to the API server Ingress before the default path.

[]

 

ingress.apiServer.succeedingPaths

HTTP paths to add to the API server Ingress after the default path.

[]

 

ingress.apiServer.tls.enabled

Enable TLS termination for the API server Ingress.

False

 

ingress.apiServer.tls.secretName

The name of a pre-created Secret containing a TLS private key and certificate.

""

 

ingress.enabled

Enable all ingress resources (deprecated - use ingress.web.enabled and ingress.flower.enabled).

~

 

ingress.flower.annotations

Annotations for the flower Ingress.

{}

 

ingress.flower.enabled

Enable flower ingress resource.

False

 

ingress.flower.host

The hostname for the flower Ingress. (Deprecated - renamed to ingress.flower.hosts)

""

 

ingress.flower.hosts

The hostnames or hosts configuration for the flower Ingress.

[]

 

ingress.flower.ingressClassName

The Ingress Class for the flower Ingress.

""

 

ingress.flower.path

The path for the flower Ingress.

/

 

ingress.flower.pathType

The pathType for the flower Ingress (required for Kubernetes 1.19 and above).

ImplementationSpecific

 

ingress.flower.tls.enabled

Enable TLS termination for the flower Ingress.

False

 

ingress.flower.tls.secretName

The name of a pre-created Secret containing a TLS private key and certificate.

""

 

ingress.pgbouncer.annotations

Annotations for the PgBouncer Ingress.

{}

Why should pgbouncer have an ingress?

ingress.pgbouncer.enabled

Enable PgBouncer ingress resource.

False

 

ingress.pgbouncer.host

The hostname for the PgBouncer Ingress. (Deprecated - renamed to ingress.pgbouncer.hosts)

""

 

ingress.pgbouncer.hosts

The hostnames or hosts configuration for the PgBouncer Ingress.

[]

 

ingress.pgbouncer.ingressClassName

The Ingress Class for the PgBouncer Ingress.

""

 

ingress.pgbouncer.path

The path for the PgBouncer Ingress.

/metrics

 

ingress.pgbouncer.pathType

The pathType for the PgBouncer Ingress (required for Kubernetes 1.19 and above).

ImplementationSpecific

 

ingress.statsd.annotations

Annotations for the statsd Ingress.

{}

Why should statsd have an ingress?

ingress.statsd.enabled

Enable statsd ingress resource.

False

 

ingress.statsd.host

The hostname for the statsd Ingress. (Deprecated - renamed to ingress.statsd.hosts)

""

 

ingress.statsd.hosts

The hostnames or hosts configuration for the statsd Ingress.

[]

 

ingress.statsd.ingressClassName

The Ingress Class for the statsd Ingress.

""

 

ingress.statsd.path

The path for the statsd Ingress.

/metrics

 

ingress.statsd.pathType

The pathType for the statsd Ingress (required for Kubernetes 1.19 and above).

ImplementationSpecific

 

ingress.web.annotations

Annotations for the web Ingress.

{}

Will be removed with deprecation of Airflow 2

ingress.web.enabled

Enable web ingress resource.

False

 

ingress.web.host

The hostname for the web Ingress. (Deprecated - renamed to ingress.web.hosts)

""

 

ingress.web.hosts

The hostnames or hosts configuration for the web Ingress.

[]

 

ingress.web.ingressClassName

The Ingress Class for the web Ingress.

""

 

ingress.web.path

The path for the web Ingress.

/

 

ingress.web.pathType

The pathType for the web Ingress (required for Kubernetes 1.19 and above).

ImplementationSpecific

 

ingress.web.precedingPaths

HTTP paths to add to the web Ingress before the default path.

[]

 

ingress.web.succeedingPaths

HTTP paths to add to the web Ingress after the default path.

[]

 

ingress.web.tls.enabled

Enable TLS termination for the web Ingress.

False

 

ingress.web.tls.secretName

The name of a pre-created Secret containing a TLS private key and certificate.

""

 

Kerberos

Parameter

Description

Default

Opinion Jens

kerberos.ccacheFileName

Name for kerberos credentials cache file.

cache

 

kerberos.ccacheMountPath

Path to mount shared volume for kerberos credentials cache.

/var/kerberos-ccache

 

kerberos.config

Contents of krb5.conf.

See values.yaml

 

kerberos.configPath

Path to mount krb5.conf kerberos configuration file.

/etc/krb5.conf

 

kerberos.enabled

Enable kerberos.

False

 

kerberos.keytabBase64Content

Kerberos keytab base64 encoded content.

~

 

kerberos.keytabPath

Path to mount the keytab for refreshing credentials in the kerberos sidecar.

/etc/airflow.keytab

 

kerberos.principal

Principal to use when refreshing kerberos credentials.

airflow@FOO.COM

 

kerberos.reinitFrequency

How often (in minutes) airflow kerberos will reinitialize the credentials cache.

3600