Repository: apache/airflow
File: helm-tests/tests/helm_tests/airflow_core/test_worker.py (Python)

Code before:
                        "kerberosInitContainer": {
                            "enabled": True,
                            "securityContexts": {"container": {"runAsUser": 2000}},
                        }
                    }
                },
                {"runAsUser": 2000},
            ),
            (
                {
                    "kerberosInitContainer": {
                        "enabled": True,
                        "securityContexts": {"container": {"runAsUser": 1000}},
                    },
                    "celery": {
                        "kerberosInitContainer": {
                            "enabled": True,
                            "securityContexts": {"container": {"runAsUser": 2000}},
                        }
                    },
                },
                {"runAsUser": 2000},
            ),
        ],
    )
    def test_kerberos_init_container_security_context(self, workers_values, expected):
        docs = render_chart(
            values={
                "workers": workers_values,
            },
            show_only=["templates/workers/worker-deployment.yaml"],
        )

        assert (
            jmespath.search(
                "spec.template.spec.initContainers[?name=='kerberos-init'] | [0].securityContext", docs[0]
            )
            == expected
        )

    @pytest.mark.parametrize(
        ("workers_values", "expected"),
        [
            (
                {
                    "kerberosInitContainer": {
                        "enabled": True,
                        "containerLifecycleHooks": {"postStart": {"exec": {"command": ["echo", "base"]}}},
                    }
                },
                {"postStart": {"exec": {"command": ["echo", "base"]}}},

Review comment (security):
It is not intuitive, but all securityContext-related test cases are in `security/test_security_context.py` file (despite pod-template tests). Could we move this test case there?

Code after:
                        "kerberosInitContainer": {
                            "enabled": True,
                            "containerLifecycleHooks": {
                                "postStart": {"exec": {"command": ["echo", "celery"]}}
                            },
                        }
                    }
                },
                {"postStart": {"exec": {"command": ["echo", "celery"]}}},
            ),
            (
                {
                    "kerberosInitContainer": {
                        "enabled": True,
                        "containerLifecycleHooks": {"postStart": {"exec": {"command": ["echo", "base"]}}},
                    },
                    "celery": {
                        "kerberosInitContainer": {
                            "enabled": True,
                            "containerLifecycleHooks": {
                                "postStart": {"exec": {"command": ["echo", "celery"]}}
                            },
                        }
                    },
                },
                {"postStart": {"exec": {"command": ["echo", "celery"]}}},
            ),
        ],
    )
    def test_kerberos_init_container_lifecycle_hooks(self, workers_values, expected):
        docs = render_chart(
            values={
                "workers": workers_values,
            },
            show_only=["templates/workers/worker-deployment.yaml"],
        )

        assert (
            jmespath.search(
                "spec.template.spec.initContainers[?name=='kerberos-init'] | [0].lifecycle", docs[0]
            )
            == expected
        )

    @pytest.mark.parametrize(
        ("airflow_version", "expected_arg"),
        [
            ("1.10.14", "airflow worker"),
            ("2.0.2", "airflow celery worker"),
            ("2.1.0", "airflow celery worker"),
        ],