diff --git a/chart/templates/workers/worker-deployment.yaml b/chart/templates/workers/worker-deployment.yaml index 95cc7f137b595..118e3e2fadb65 100644 --- a/chart/templates/workers/worker-deployment.yaml +++ b/chart/templates/workers/worker-deployment.yaml @@ -217,7 +217,11 @@ spec: - name: logs mountPath: {{ template "airflow_logs" . }} {{- include "airflow_config_mount" . | nindent 12 }} - {{- if .Values.workers.kerberosSidecar.enabled }} + {{- if .Values.kerberos.enabled }} + - name: kerberos-keytab + subPath: "kerberos.keytab" + mountPath: {{ .Values.kerberos.keytabPath | quote }} + readOnly: true - name: config mountPath: {{ .Values.kerberos.configPath | quote }} subPath: krb5.conf diff --git a/tests/charts/test_kerberos.py b/tests/charts/test_kerberos.py index ebccfa1000f52..27b9d02a883f0 100644 --- a/tests/charts/test_kerberos.py +++ b/tests/charts/test_kerberos.py @@ -97,6 +97,28 @@ def test_keberos_sidecar_resources_are_not_added_by_default(self): ) assert jmespath.search("spec.template.spec.containers[0].resources", docs[0]) == {} + def test_kerberos_keytab_exists_in_worker_when_enable(self): + docs = render_chart( + values={ + "executor": "CeleryExecutor", + "kerberos": { + "enabled": True, + "keytabBase64Content": "dGVzdGtleXRhYg==", + "configPath": "/etc/krb5.conf", + "ccacheMountPath": "/var/kerberos-ccache", + "ccacheFileName": "ccache", + }, + }, + show_only=["templates/workers/worker-deployment.yaml"], + ) + + assert { + "name": "kerberos-keytab", + "subPath": "kerberos.keytab", + "mountPath": "/etc/airflow.keytab", + "readOnly": True, + } in jmespath.search("spec.template.spec.containers[0].volumeMounts", docs[0]) + def test_kerberos_keytab_secret_available(self): docs = render_chart( values={