Improve annotations customization in the chart #13643

FloChehab · 2021-01-12T19:42:53Z

Description

As discussed in #13616 (comment), we would need to improve the customization of annotations across all objects of the chart.

Use case / motivation

We often need to paremetrize the annotations and we would rather do it in one PR with all the objects rather than one small PR everytime.

Are you willing to submit a PR?

@mik-laj I am ready to be assigned.

Related Issues
Not to my knowledge.

What need to be tackled before starting dev:

On what objects do we want annotations?
What terminology do we choose in the values.yaml? (annotations or extraAnnotations or both or something else?)
Have a table with the mapping of each object and the value path for the annotation parametrization?
Should we drop the value airflowPodAnnotations ?

The text was updated successfully, but these errors were encountered:

FloChehab · 2021-01-12T19:52:46Z

First:

Objects that should have parametrizable annotations:

Pod (inside deployment and StatefulSet),
Service,
ServiceAccount,
Ingress.

Is this list too much ? Am I missing something?

FloChehab · 2021-01-12T19:55:48Z

(I have added more info in the issue description, feel free to edit)

mik-laj · 2021-01-12T20:16:15Z

@dimberman @XD-DENG @potiuk Do you have any thoughts on this? I saw that these changes often come back in different forms, and I think we can do it once, but good.

XD-DENG · 2021-01-12T20:19:48Z

Absolutely a good idea 👍

potiuk · 2021-01-12T20:37:50Z

Absolutely !

mik-laj · 2021-01-29T06:28:23Z

We have a ticket that improves the annotation handling for SA a bit. Anyone willing to do a review and say if this change is sufficient for this ticket as well?
#11769

FloChehab · 2021-02-07T19:50:24Z

Hello,

Regarding the terminology

What terminology do we choose in the values.yaml? (annotations or extraAnnotations or both or something else?)

I checked the chart and extraAnnotations is only used when there are other annotations related to prometheus that are already present (for the pgbouncer-service & the statsd-service). My position on this would be to remove such annotations related to prometheus and use the annotations terminology everywhere.

FloChehab · 2021-02-23T20:18:04Z

Hello, just wanted to let you now that I should have time to work on this issue in couple of weeks.

dimberman · 2021-03-29T22:55:14Z

@FloChehab awesome! Please let us know when it's ready to review :)

FloChehab · 2021-04-29T07:59:11Z

Hello, time flies!

I am going to have a quick lool at #15238 ; also, some related work seems to be going on in #14152 .

dimberman · 2021-04-30T01:40:22Z

@FloChehab sounds good let me know where I can help!

@jaydesl

This PR builds off of and supersedes @jaydesl's work on his [PR](#11769) to move forward with properly following [helm's rbac best practices](https://helm.sh/docs/chart_best_practices/rbac/). This PR updates every potential pod that can be deployed to include the option to either create or use an existing service account. This is the first step towards supporting environments where users have the [PodSecurityPolicy](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy) admission controller enabled without forcing such users to provide any additional permissions to the default service account in the namespace this is deployed to. closes: #11755 related: #13643 Co-authored-by: jaydesl <jay.deslauriers@gmail.com> Co-authored-by: Ian Stanton <ian@astronomer.io> Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com>

@jaydesl

This PR builds off of and supersedes @jaydesl's work on his [PR](apache/airflow#11769) to move forward with properly following [helm's rbac best practices](https://helm.sh/docs/chart_best_practices/rbac/). This PR updates every potential pod that can be deployed to include the option to either create or use an existing service account. This is the first step towards supporting environments where users have the [PodSecurityPolicy](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy) admission controller enabled without forcing such users to provide any additional permissions to the default service account in the namespace this is deployed to. closes: apache/airflow#11755 related: apache/airflow#13643 Co-authored-by: jaydesl <jay.deslauriers@gmail.com> Co-authored-by: Ian Stanton <ian@astronomer.io> Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com> GitOrigin-RevId: 8655d66cea977102862379d9894810b1e836f7a8

This PR adds a new field (`airflowConfigAnnotations`) that allows users to add `annotations` to the main `configmap.yaml` file. I ended up setting up a new testing file as I didn't find a file where this specifically fit, but if it should be moved elsewhere let me know. closes apache/airflow#13643 GitOrigin-RevId: 6d64cc54a6b7d1b22d0de89b5815035e21bfaf8c

@jaydesl

This PR builds off of and supersedes @jaydesl's work on his [PR](apache/airflow#11769) to move forward with properly following [helm's rbac best practices](https://helm.sh/docs/chart_best_practices/rbac/). This PR updates every potential pod that can be deployed to include the option to either create or use an existing service account. This is the first step towards supporting environments where users have the [PodSecurityPolicy](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy) admission controller enabled without forcing such users to provide any additional permissions to the default service account in the namespace this is deployed to. closes: apache/airflow#11755 related: apache/airflow#13643 Co-authored-by: jaydesl <jay.deslauriers@gmail.com> Co-authored-by: Ian Stanton <ian@astronomer.io> Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com> GitOrigin-RevId: 8655d66cea977102862379d9894810b1e836f7a8

This PR adds a new field (`airflowConfigAnnotations`) that allows users to add `annotations` to the main `configmap.yaml` file. I ended up setting up a new testing file as I didn't find a file where this specifically fit, but if it should be moved elsewhere let me know. closes apache/airflow#13643 GitOrigin-RevId: 6d64cc54a6b7d1b22d0de89b5815035e21bfaf8c

@jaydesl

This PR builds off of and supersedes @jaydesl's work on his [PR](apache/airflow#11769) to move forward with properly following [helm's rbac best practices](https://helm.sh/docs/chart_best_practices/rbac/). This PR updates every potential pod that can be deployed to include the option to either create or use an existing service account. This is the first step towards supporting environments where users have the [PodSecurityPolicy](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy) admission controller enabled without forcing such users to provide any additional permissions to the default service account in the namespace this is deployed to. closes: apache/airflow#11755 related: apache/airflow#13643 Co-authored-by: jaydesl <jay.deslauriers@gmail.com> Co-authored-by: Ian Stanton <ian@astronomer.io> Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com> GitOrigin-RevId: 8655d66cea977102862379d9894810b1e836f7a8

This PR adds a new field (`airflowConfigAnnotations`) that allows users to add `annotations` to the main `configmap.yaml` file. I ended up setting up a new testing file as I didn't find a file where this specifically fit, but if it should be moved elsewhere let me know. closes apache/airflow#13643 GitOrigin-RevId: 6d64cc54a6b7d1b22d0de89b5815035e21bfaf8c

@jaydesl

This PR builds off of and supersedes @jaydesl's work on his [PR](apache/airflow#11769) to move forward with properly following [helm's rbac best practices](https://helm.sh/docs/chart_best_practices/rbac/). This PR updates every potential pod that can be deployed to include the option to either create or use an existing service account. This is the first step towards supporting environments where users have the [PodSecurityPolicy](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy) admission controller enabled without forcing such users to provide any additional permissions to the default service account in the namespace this is deployed to. closes: apache/airflow#11755 related: apache/airflow#13643 Co-authored-by: jaydesl <jay.deslauriers@gmail.com> Co-authored-by: Ian Stanton <ian@astronomer.io> Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com> GitOrigin-RevId: 8655d66cea977102862379d9894810b1e836f7a8

This PR adds a new field (`airflowConfigAnnotations`) that allows users to add `annotations` to the main `configmap.yaml` file. I ended up setting up a new testing file as I didn't find a file where this specifically fit, but if it should be moved elsewhere let me know. closes apache/airflow#13643 GitOrigin-RevId: 6d64cc54a6b7d1b22d0de89b5815035e21bfaf8c

@jaydesl

This PR builds off of and supersedes @jaydesl's work on his [PR](apache/airflow#11769) to move forward with properly following [helm's rbac best practices](https://helm.sh/docs/chart_best_practices/rbac/). This PR updates every potential pod that can be deployed to include the option to either create or use an existing service account. This is the first step towards supporting environments where users have the [PodSecurityPolicy](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy) admission controller enabled without forcing such users to provide any additional permissions to the default service account in the namespace this is deployed to. closes: apache/airflow#11755 related: apache/airflow#13643 Co-authored-by: jaydesl <jay.deslauriers@gmail.com> Co-authored-by: Ian Stanton <ian@astronomer.io> Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com> GitOrigin-RevId: 8655d66cea977102862379d9894810b1e836f7a8

This PR adds a new field (`airflowConfigAnnotations`) that allows users to add `annotations` to the main `configmap.yaml` file. I ended up setting up a new testing file as I didn't find a file where this specifically fit, but if it should be moved elsewhere let me know. closes apache/airflow#13643 GitOrigin-RevId: 6d64cc54a6b7d1b22d0de89b5815035e21bfaf8c

@jaydesl

This PR builds off of and supersedes @jaydesl's work on his [PR](apache/airflow#11769) to move forward with properly following [helm's rbac best practices](https://helm.sh/docs/chart_best_practices/rbac/). This PR updates every potential pod that can be deployed to include the option to either create or use an existing service account. This is the first step towards supporting environments where users have the [PodSecurityPolicy](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy) admission controller enabled without forcing such users to provide any additional permissions to the default service account in the namespace this is deployed to. closes: apache/airflow#11755 related: apache/airflow#13643 Co-authored-by: jaydesl <jay.deslauriers@gmail.com> Co-authored-by: Ian Stanton <ian@astronomer.io> Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com> GitOrigin-RevId: 8655d66cea977102862379d9894810b1e836f7a8

This PR adds a new field (`airflowConfigAnnotations`) that allows users to add `annotations` to the main `configmap.yaml` file. I ended up setting up a new testing file as I didn't find a file where this specifically fit, but if it should be moved elsewhere let me know. closes apache/airflow#13643 GitOrigin-RevId: 6d64cc54a6b7d1b22d0de89b5815035e21bfaf8c

@jaydesl

This PR builds off of and supersedes @jaydesl's work on his [PR](apache/airflow#11769) to move forward with properly following [helm's rbac best practices](https://helm.sh/docs/chart_best_practices/rbac/). This PR updates every potential pod that can be deployed to include the option to either create or use an existing service account. This is the first step towards supporting environments where users have the [PodSecurityPolicy](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy) admission controller enabled without forcing such users to provide any additional permissions to the default service account in the namespace this is deployed to. closes: apache/airflow#11755 related: apache/airflow#13643 Co-authored-by: jaydesl <jay.deslauriers@gmail.com> Co-authored-by: Ian Stanton <ian@astronomer.io> Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com> GitOrigin-RevId: 8655d66cea977102862379d9894810b1e836f7a8

This PR adds a new field (`airflowConfigAnnotations`) that allows users to add `annotations` to the main `configmap.yaml` file. I ended up setting up a new testing file as I didn't find a file where this specifically fit, but if it should be moved elsewhere let me know. closes apache/airflow#13643 GitOrigin-RevId: 6d64cc54a6b7d1b22d0de89b5815035e21bfaf8c

@jaydesl

This PR builds off of and supersedes @jaydesl's work on his [PR](apache/airflow#11769) to move forward with properly following [helm's rbac best practices](https://helm.sh/docs/chart_best_practices/rbac/). This PR updates every potential pod that can be deployed to include the option to either create or use an existing service account. This is the first step towards supporting environments where users have the [PodSecurityPolicy](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy) admission controller enabled without forcing such users to provide any additional permissions to the default service account in the namespace this is deployed to. closes: apache/airflow#11755 related: apache/airflow#13643 Co-authored-by: jaydesl <jay.deslauriers@gmail.com> Co-authored-by: Ian Stanton <ian@astronomer.io> Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com> GitOrigin-RevId: 8655d66cea977102862379d9894810b1e836f7a8

This PR adds a new field (`airflowConfigAnnotations`) that allows users to add `annotations` to the main `configmap.yaml` file. I ended up setting up a new testing file as I didn't find a file where this specifically fit, but if it should be moved elsewhere let me know. closes apache/airflow#13643 GitOrigin-RevId: 6d64cc54a6b7d1b22d0de89b5815035e21bfaf8c

@jaydesl

This PR builds off of and supersedes @jaydesl's work on his [PR](apache/airflow#11769) to move forward with properly following [helm's rbac best practices](https://helm.sh/docs/chart_best_practices/rbac/). This PR updates every potential pod that can be deployed to include the option to either create or use an existing service account. This is the first step towards supporting environments where users have the [PodSecurityPolicy](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy) admission controller enabled without forcing such users to provide any additional permissions to the default service account in the namespace this is deployed to. closes: apache/airflow#11755 related: apache/airflow#13643 Co-authored-by: jaydesl <jay.deslauriers@gmail.com> Co-authored-by: Ian Stanton <ian@astronomer.io> Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com> GitOrigin-RevId: 8655d66cea977102862379d9894810b1e836f7a8

This PR adds a new field (`airflowConfigAnnotations`) that allows users to add `annotations` to the main `configmap.yaml` file. I ended up setting up a new testing file as I didn't find a file where this specifically fit, but if it should be moved elsewhere let me know. closes apache/airflow#13643 GitOrigin-RevId: 6d64cc54a6b7d1b22d0de89b5815035e21bfaf8c

@jaydesl

This PR builds off of and supersedes @jaydesl's work on his [PR](apache/airflow#11769) to move forward with properly following [helm's rbac best practices](https://helm.sh/docs/chart_best_practices/rbac/). This PR updates every potential pod that can be deployed to include the option to either create or use an existing service account. This is the first step towards supporting environments where users have the [PodSecurityPolicy](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy) admission controller enabled without forcing such users to provide any additional permissions to the default service account in the namespace this is deployed to. closes: apache/airflow#11755 related: apache/airflow#13643 Co-authored-by: jaydesl <jay.deslauriers@gmail.com> Co-authored-by: Ian Stanton <ian@astronomer.io> Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com> GitOrigin-RevId: 8655d66cea977102862379d9894810b1e836f7a8

This PR adds a new field (`airflowConfigAnnotations`) that allows users to add `annotations` to the main `configmap.yaml` file. I ended up setting up a new testing file as I didn't find a file where this specifically fit, but if it should be moved elsewhere let me know. closes apache/airflow#13643 GitOrigin-RevId: 6d64cc54a6b7d1b22d0de89b5815035e21bfaf8c

@jaydesl

This PR builds off of and supersedes @jaydesl's work on his [PR](apache/airflow#11769) to move forward with properly following [helm's rbac best practices](https://helm.sh/docs/chart_best_practices/rbac/). This PR updates every potential pod that can be deployed to include the option to either create or use an existing service account. This is the first step towards supporting environments where users have the [PodSecurityPolicy](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy) admission controller enabled without forcing such users to provide any additional permissions to the default service account in the namespace this is deployed to. closes: apache/airflow#11755 related: apache/airflow#13643 Co-authored-by: jaydesl <jay.deslauriers@gmail.com> Co-authored-by: Ian Stanton <ian@astronomer.io> Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com> GitOrigin-RevId: 8655d66cea977102862379d9894810b1e836f7a8

This PR adds a new field (`airflowConfigAnnotations`) that allows users to add `annotations` to the main `configmap.yaml` file. I ended up setting up a new testing file as I didn't find a file where this specifically fit, but if it should be moved elsewhere let me know. closes apache/airflow#13643 GitOrigin-RevId: 6d64cc54a6b7d1b22d0de89b5815035e21bfaf8c

@jaydesl

This PR builds off of and supersedes @jaydesl's work on his [PR](apache/airflow#11769) to move forward with properly following [helm's rbac best practices](https://helm.sh/docs/chart_best_practices/rbac/). This PR updates every potential pod that can be deployed to include the option to either create or use an existing service account. This is the first step towards supporting environments where users have the [PodSecurityPolicy](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy) admission controller enabled without forcing such users to provide any additional permissions to the default service account in the namespace this is deployed to. closes: apache/airflow#11755 related: apache/airflow#13643 Co-authored-by: jaydesl <jay.deslauriers@gmail.com> Co-authored-by: Ian Stanton <ian@astronomer.io> Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com> GitOrigin-RevId: 8655d66cea977102862379d9894810b1e836f7a8

This PR adds a new field (`airflowConfigAnnotations`) that allows users to add `annotations` to the main `configmap.yaml` file. I ended up setting up a new testing file as I didn't find a file where this specifically fit, but if it should be moved elsewhere let me know. closes apache/airflow#13643 GitOrigin-RevId: 6d64cc54a6b7d1b22d0de89b5815035e21bfaf8c

@jaydesl

This PR builds off of and supersedes @jaydesl's work on his [PR](apache/airflow#11769) to move forward with properly following [helm's rbac best practices](https://helm.sh/docs/chart_best_practices/rbac/). This PR updates every potential pod that can be deployed to include the option to either create or use an existing service account. This is the first step towards supporting environments where users have the [PodSecurityPolicy](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy) admission controller enabled without forcing such users to provide any additional permissions to the default service account in the namespace this is deployed to. closes: apache/airflow#11755 related: apache/airflow#13643 Co-authored-by: jaydesl <jay.deslauriers@gmail.com> Co-authored-by: Ian Stanton <ian@astronomer.io> Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com> GitOrigin-RevId: 8655d66cea977102862379d9894810b1e836f7a8

This PR adds a new field (`airflowConfigAnnotations`) that allows users to add `annotations` to the main `configmap.yaml` file. I ended up setting up a new testing file as I didn't find a file where this specifically fit, but if it should be moved elsewhere let me know. closes apache/airflow#13643 GitOrigin-RevId: 6d64cc54a6b7d1b22d0de89b5815035e21bfaf8c

@jaydesl

This PR builds off of and supersedes @jaydesl's work on his [PR](apache/airflow#11769) to move forward with properly following [helm's rbac best practices](https://helm.sh/docs/chart_best_practices/rbac/). This PR updates every potential pod that can be deployed to include the option to either create or use an existing service account. This is the first step towards supporting environments where users have the [PodSecurityPolicy](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy) admission controller enabled without forcing such users to provide any additional permissions to the default service account in the namespace this is deployed to. closes: apache/airflow#11755 related: apache/airflow#13643 Co-authored-by: jaydesl <jay.deslauriers@gmail.com> Co-authored-by: Ian Stanton <ian@astronomer.io> Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com> GitOrigin-RevId: 8655d66cea977102862379d9894810b1e836f7a8

This PR adds a new field (`airflowConfigAnnotations`) that allows users to add `annotations` to the main `configmap.yaml` file. I ended up setting up a new testing file as I didn't find a file where this specifically fit, but if it should be moved elsewhere let me know. closes apache/airflow#13643 GitOrigin-RevId: 6d64cc54a6b7d1b22d0de89b5815035e21bfaf8c

@jaydesl

This PR builds off of and supersedes @jaydesl's work on his [PR](apache/airflow#11769) to move forward with properly following [helm's rbac best practices](https://helm.sh/docs/chart_best_practices/rbac/). This PR updates every potential pod that can be deployed to include the option to either create or use an existing service account. This is the first step towards supporting environments where users have the [PodSecurityPolicy](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#podsecuritypolicy) admission controller enabled without forcing such users to provide any additional permissions to the default service account in the namespace this is deployed to. closes: apache/airflow#11755 related: apache/airflow#13643 Co-authored-by: jaydesl <jay.deslauriers@gmail.com> Co-authored-by: Ian Stanton <ian@astronomer.io> Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com> GitOrigin-RevId: 8655d66cea977102862379d9894810b1e836f7a8

This PR adds a new field (`airflowConfigAnnotations`) that allows users to add `annotations` to the main `configmap.yaml` file. I ended up setting up a new testing file as I didn't find a file where this specifically fit, but if it should be moved elsewhere let me know. closes apache/airflow#13643 GitOrigin-RevId: 6d64cc54a6b7d1b22d0de89b5815035e21bfaf8c

FloChehab added the kind:feature Feature Requests label Jan 12, 2021

FloChehab mentioned this issue Jan 12, 2021

Support annotations for the flower service in the chart #13616

Closed

mik-laj assigned FloChehab Jan 12, 2021

mik-laj mentioned this issue Jan 29, 2021

Update charts to follow Helm RBAC best practices #11769

Closed

DerekHeldtWerle mentioned this issue Feb 9, 2021

Helm RBAC Best Practices #14152

Merged

DerekHeldtWerle mentioned this issue Apr 6, 2021

adds airflowConfigAnnotations field to allow for the setting of the main configmaps annotations #15238

Merged

mik-laj added the area:helm-chart Airflow Helm Chart label Apr 6, 2021

kaxil closed this as completed in 6d64cc5 May 12, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Improve annotations customization in the chart #13643

Improve annotations customization in the chart #13643

FloChehab commented Jan 12, 2021 •

edited

Loading

FloChehab commented Jan 12, 2021

FloChehab commented Jan 12, 2021 •

edited

Loading

mik-laj commented Jan 12, 2021

XD-DENG commented Jan 12, 2021

potiuk commented Jan 12, 2021

mik-laj commented Jan 29, 2021

FloChehab commented Feb 7, 2021

FloChehab commented Feb 23, 2021

dimberman commented Mar 29, 2021

FloChehab commented Apr 29, 2021

dimberman commented Apr 30, 2021

Improve annotations customization in the chart #13643

Improve annotations customization in the chart #13643

Comments

FloChehab commented Jan 12, 2021 • edited Loading

FloChehab commented Jan 12, 2021

FloChehab commented Jan 12, 2021 • edited Loading

mik-laj commented Jan 12, 2021

XD-DENG commented Jan 12, 2021

potiuk commented Jan 12, 2021

mik-laj commented Jan 29, 2021

FloChehab commented Feb 7, 2021

FloChehab commented Feb 23, 2021

dimberman commented Mar 29, 2021

FloChehab commented Apr 29, 2021

dimberman commented Apr 30, 2021

FloChehab commented Jan 12, 2021 •

edited

Loading

FloChehab commented Jan 12, 2021 •

edited

Loading