Skip to content

Conversation

@HsiuChuanHsu
Copy link
Contributor

Description

This PR fixes an issue where the Airflow webserver-secret-key secret is not automatically created when deploying worker-only setups using the Helm chart (Airflow < 3.0.0).

Problem:
The Helm chart only creates the webserver-secret-key secret when .Values.webserver.enabled is true, but this global secret is needed by multiple Airflow components, including workers and scheduler

This causes the following problems:

  • When only workers or scheduler are deployed (e.g., in a worker-only namespace), the required secret is missing.
  • Users must manually create the secret in each namespace.

Solution

Only modified Airflow < 3.0.0 behavior:

# Before
{{- if and (semverCompare "<3.0.0" .Values.airflowVersion) .Values.webserver.enabled (not .Values.webserverSecretKeySecretName) }}

# After  
{{- if and (semverCompare "<3.0.0" .Values.airflowVersion) (or .Values.webserver.enabled .Values.workers.enabled .Values.scheduler.enabled) (not .Values.webserverSecretKeySecretName) }}

Airflow ≥ 3.0.0 behavior:

  • jwt-secret.yaml - No change needed (already works)
  • api-secret-key-secret.yaml - No change needed (already works)

Closes: #53375


^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

…re component is enabled

- Update secret creation conditions to check for any enabled core component
  (webserver, workers, or scheduler) instead of only webserver
- Change component labels from specific service names to 'global-secret'
  to better reflect their shared nature
- Apply fix consistently across all Airflow versions:
  * < 3.0.0: webserver-secret-key-secret.yaml
  * >= 3.0.0: jwt-secret.yaml and api-secret-key-secret.yaml
@romsharon98
Copy link
Contributor

closes as #52953 fix it

@HsiuChuanHsu HsiuChuanHsu deleted the bug/missing-webserver-secret-key-secret-separate-deployment branch October 14, 2025 22:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:helm-chart Airflow Helm Chart

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Missing webserver-secret-key-secret

2 participants