From 668d3ae5bcc59335beea6a57742dd22d16254cd8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Octave=20Pr=C3=A9v=C3=B4t?= Date: Fri, 14 Aug 2026 18:17:06 +0200 Subject: [PATCH 1/3] feat(airflow): enable dcr --- packages/services/airflow/airflow.yaml | 68 +++++++++++++++++++++++++- 1 file changed, 67 insertions(+), 1 deletion(-) diff --git a/packages/services/airflow/airflow.yaml b/packages/services/airflow/airflow.yaml index 8fa9e1c..1c06001 100644 --- a/packages/services/airflow/airflow.yaml +++ b/packages/services/airflow/airflow.yaml @@ -1,6 +1,6 @@ apiVersion: v1alpha1 name: airflow -tag: 3.2.1-p2 +tag: 3.2.1-p3 protected: false description: | Apache Airflow 2.9.3 - Workflow orchestration platform with Spark Operator integration @@ -15,6 +15,9 @@ usage: Authenticate via the configured OIDC provider. schema: + parameters: + properties: + enableDCR: { type: boolean, default: false, description: "Whether to enable Dynamic Client Registration" } context: properties: platform: @@ -32,6 +35,59 @@ schema: suffix: { type: string, required: true } modules: + - name: oidc-dcr + enabled: "{{ .Parameters.enableDCR }}" + timeout: 10m + source: + oci: + repository: quay.io/adaltas/oidc-dcr + tag: 0.3.2 + values: | + {{- $namespace := printf "%v" .Release.spec.targetNamespace -}} + {{- $release := printf "%v" .Release.metadata.name -}} + {{- $domain := printf "%v" .Context.platform.ingress.suffix -}} + + {{- $oidcId := .Context.airflow.oidc.provider -}} + {{- $oidcProvider := (index .Context $oidcId).provider -}} + + {{- $oidcIssuerUri := $oidcProvider.issuerUri + | replace "{{ .Release.namespace }}" $namespace + | replace "{{ .Release.metadata.name }}" $release + | replace "{{ .Context.ingress.suffix }}" $domain -}} + + {{- $oidcRegistrationUrl := $oidcProvider.endpoints.clientRegistrationUrl + | replace "{{ .Context.ingress.suffix }}" $domain -}} + + {{- $airflowScopes := "" -}} + {{- range .Context.defaultIdp.settings.clients -}} + {{- if eq .clientId "airflow" -}} + {{- $airflowScopes = concat .defaultClientScopes .optionalClientScopes | join " " -}} + {{- end -}} + {{- end -}} + + ttl_seconds: 30 + registration_url: "{{ $oidcRegistrationUrl }}" + request: + application_type: web + client_name: "{{ $release }}-{{ $namespace }}" + redirect_uris: + - "https://airflow-{{ $namespace }}.{{ $domain }}/auth/oauth-authorized/oidc" + logo_uri: "https://raw.githubusercontent.com/apache/airflow/c3f9da4846c8bde6b70aff771615d39e010decb0/airflow-core/docs/img/logos/wordmark_1.svg" + grant_types: + - "authorization_code" + - "client_credentials" + scope: "{{ $airflowScopes }}" + tls: + insecure: false + certificate: "certs-bundle" + secret: "{{ $release }}-{{ $namespace }}-dcr" + mapping: + use_default: false + key_mapping: + OIDC_CLIENT_ID: ".client_id" + OIDC_CLIENT_SECRET: ".client_secret" + OIDC_ISSUER_URL: "{{ $oidcIssuerUri }}" + OIDC_SCOPES: "{{ $airflowScopes }}" - name: main timeout: 15m source: @@ -88,13 +144,23 @@ modules: - name: AIRFLOW_OIDC_CLIENT_ID valueFrom: secretKeyRef: + {{- if .Parameters.enableDCR }} + name: {{ $release }}-{{ $namespace }}-dcr + key: OIDC_CLIENT_ID + {{- else }} name: {{ $airflowOidc.credentialsSecret.name }} key: {{ $airflowOidc.credentialsSecret.clientIdKey }} + {{- end }} - name: AIRFLOW_OIDC_CLIENT_SECRET valueFrom: secretKeyRef: + {{- if .Parameters.enableDCR }} + name: {{ $release }}-{{ $namespace }}-dcr + key: OIDC_CLIENT_SECRET + {{- else }} name: {{ $airflowOidc.credentialsSecret.name }} key: {{ $airflowOidc.credentialsSecret.clientSecretKey }} + {{- end }} - name: AIRFLOW_OIDC_API_BASE_URL value: {{ $airflowOidcBaseUrl | quote }} - name: AIRFLOW_OIDC_ACCESS_TOKEN_URL From 032553d87cc1c3b09a62c3b9d76d7ba9975e4f28 Mon Sep 17 00:00:00 2001 From: SteBaum <94869007+SteBaum@users.noreply.github.com> Date: Fri, 21 Aug 2026 14:39:35 +0200 Subject: [PATCH 2/3] Update packages/services/airflow/airflow.yaml Co-authored-by: Moncef LAHOUAR --- packages/services/airflow/airflow.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/packages/services/airflow/airflow.yaml b/packages/services/airflow/airflow.yaml index 1c06001..f2253c6 100644 --- a/packages/services/airflow/airflow.yaml +++ b/packages/services/airflow/airflow.yaml @@ -58,6 +58,11 @@ modules: {{- $oidcRegistrationUrl := $oidcProvider.endpoints.clientRegistrationUrl | replace "{{ .Context.ingress.suffix }}" $domain -}} + {{- $airflowUrl := .Context.airflow.endpoint.url + | replace "{{ .Release.namespace }}" $namespace + | replace "{{ .Release.metadata.name }}" $release + | replace "{{ .Context.ingress.suffix }}" $domain -}} + {{- $airflowScopes := "" -}} {{- range .Context.defaultIdp.settings.clients -}} {{- if eq .clientId "airflow" -}} From 59bb2e762607a3273c5f79bdcc3d4047646709ba Mon Sep 17 00:00:00 2001 From: SteBaum <94869007+SteBaum@users.noreply.github.com> Date: Fri, 21 Aug 2026 14:39:45 +0200 Subject: [PATCH 3/3] Update packages/services/airflow/airflow.yaml Co-authored-by: Moncef LAHOUAR --- packages/services/airflow/airflow.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/services/airflow/airflow.yaml b/packages/services/airflow/airflow.yaml index f2253c6..d35fe55 100644 --- a/packages/services/airflow/airflow.yaml +++ b/packages/services/airflow/airflow.yaml @@ -76,7 +76,7 @@ modules: application_type: web client_name: "{{ $release }}-{{ $namespace }}" redirect_uris: - - "https://airflow-{{ $namespace }}.{{ $domain }}/auth/oauth-authorized/oidc" + - "{{ $airflowUrl }}/auth/oauth-authorized/oidc" logo_uri: "https://raw.githubusercontent.com/apache/airflow/c3f9da4846c8bde6b70aff771615d39e010decb0/airflow-core/docs/img/logos/wordmark_1.svg" grant_types: - "authorization_code"