Repository: apache/airflow
Pull request: [Helm Chart] Grant Airflow API Server Permission to Read Pod Logs
During KE testing with helm we noticed API Server was unable to fetch logs from Kubernetes pods due to missing RBAC permissions. 

**Now:**
![image](https://github.com/user-attachments/assets/05b84dec-6f3a-425a-aaa7-1d3425fbb550)

**Before**
![image](https://github.com/user-attachments/assets/af86c8e9-6938-493b-bd92-73e3ed8ad0cf)


closes: https://github.com/apache/airflow/issues/47200

---
**^ Add meaningful description above**
Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information.
In case of fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
In case of a new dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
In case of backwards incompatible changes please leave a note in a newsfragment file, named `{pr_number}.significant.rst` or `{issue_number}.significant.rst`, in [newsfragments](https://github.com/apache/airflow/tree/main/newsfragments).


Problem statement:
Not able to view task logs with KE when deployed using helm chart
**Apache Airflow version**
3.0.0b1

**If "Other Airflow 2 version" selected, which one?**
No response

**What happened?**


**How to reproduce**

1. Create a deployment using breeze k8s 
2. Try running dags
3. Check tasks logs


**Logs** 
```

*** Attempting to fetch logs from pod tutorial-taskflow-api-load-zd9hqrqu through kube API

*** Reading from k8s pod logs failed: (403)

Reason: Forbidden

HTTP response headers: HTTPHeaderDict({\'Audit-Id\': \'b8854b7c-cdfe-4d63-a005-a2f6c8047638\', \'Cache-Control\': \'no-cache, private\', \'Content-Type\': \'application/json\', \'X-Content-Type-Options\': \'nosniff\', \'X-Kubernetes-Pf-Flowschema-Uid\': \'7e8ec8dc-5873-428f-b0fd-062a93610373\', \'X-Kubernetes-Pf-Prioritylevel-Uid\': \'0fe43c60-9772-43d6-b7bc-80458457cc5c\', \'Date\': \'Thu, 27 Feb 2025 06:45:51 GMT\', \'Content-Length\': \'293\'})

HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"pods is forbidden: User \\"system:serviceaccount:airflow:airflow-api-server\\" cannot list resource \\"pods\\" in API group \\"\\" in the namespace \\"airflow\\"","reason":"Forbidden","details":{"kind":"pods"},"code":403}

INFO - ::endgroup::

```

Hints from issue discussion:

Commit message: ensure apiserver have access to read pods logs

Patch to review:
diff --git a/chart/templates/rbac/pod-log-reader-rolebinding.yaml b/chart/templates/rbac/pod-log-reader-rolebinding.yaml
index 33b030789c92a..9f715c1c2af71 100644
--- a/chart/templates/rbac/pod-log-reader-rolebinding.yaml
+++ b/chart/templates/rbac/pod-log-reader-rolebinding.yaml
@@ -20,7 +20,7 @@
 ################################
 ## Airflow Pod Reader Role Binding
 #################################
-{{- if and .Values.rbac.create (or .Values.webserver.allowPodLogReading .Values.triggerer.enabled) }}
+{{- if and .Values.rbac.create (or .Values.webserver.allowPodLogReading .Values.triggerer.enabled .Values.apiServer.allowPodLogReading) }}
 apiVersion: rbac.authorization.k8s.io/v1
 {{- if .Values.multiNamespaceMode }}
 kind: ClusterRoleBinding
@@ -60,6 +60,11 @@ subjects:
     name: {{ include "webserver.serviceAccountName" . }}
     namespace: "{{ .Release.Namespace }}"
   {{- end }}
+  {{- if .Values.apiServer.allowPodLogReading }}
+  - kind: ServiceAccount
+    name: {{ include "apiServer.serviceAccountName" . }}
+    namespace: "{{ .Release.Namespace }}"
+  {{- end }}
   {{- if .Values.triggerer.enabled }}
   - kind: ServiceAccount
     name: {{ include "triggerer.serviceAccountName" . }}
diff --git a/chart/values.yaml b/chart/values.yaml
index 7651d9be2461b..13ac9891c6f3f 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -1262,6 +1262,7 @@ apiServer:
   command: ~
   # Args to use when running the Airflow API server (templated).
   args: ["bash", "-c", "exec airflow api-server"]
+  allowPodLogReading: true
   env: []
   serviceAccount:
     # default value is true


Code review comments:
diff_hunk: @@ -60,6 +60,11 @@ subjects:
     name: {{ include "webserver.serviceAccountName" . }}
     namespace: "{{ .Release.Namespace }}"
   {{- end }}
+  {{- if .Values.apiServer.allowPodLogReading }}
path: chart/templates/rbac/pod-log-reader-rolebinding.yaml
text: @user1:
We should probably pick the right SA based on the airflow version.

@author:
Done