From 7755369412711794fe777d0aa13f0f708120f2d8 Mon Sep 17 00:00:00 2001 From: Dheeren Mohta Date: Wed, 19 Aug 2026 12:02:22 +0530 Subject: [PATCH] Helm: Fix PgBouncer host for result backend when using standard naming The result backend connection secret built the PgBouncer hostname from `.Release.Name` directly and omitted the namespace, unlike the metadata connection secret's equivalent logic. Once `useStandardNaming` is enabled (the chart's own recommended setting for new installs) or a `fullnameOverride` is set, the computed hostname no longer matches the actual PgBouncer Service name, so Celery result-backend traffic silently fails to route through PgBouncer. Derive the host the same way the metadata secret already does, via the `airflow.fullname` template plus namespace, so both secrets stay consistent and resolve correctly regardless of naming configuration. --- .../PR_NUMBER_PLACEHOLDER.bugfix.rst | 1 + .../result-backend-connection-secret.yaml | 2 +- .../test_result_backend_connection_secret.py | 18 +++++++++++++++++- 3 files changed, 19 insertions(+), 2 deletions(-) create mode 100644 chart/newsfragments/PR_NUMBER_PLACEHOLDER.bugfix.rst diff --git a/chart/newsfragments/PR_NUMBER_PLACEHOLDER.bugfix.rst b/chart/newsfragments/PR_NUMBER_PLACEHOLDER.bugfix.rst new file mode 100644 index 0000000000000..a394801209d19 --- /dev/null +++ b/chart/newsfragments/PR_NUMBER_PLACEHOLDER.bugfix.rst @@ -0,0 +1 @@ +Fix PgBouncer connection routing in the auto-generated result backend secret to use the ``airflow.fullname`` naming convention, matching the metadata connection secret. Previously it pointed at a non-existent PgBouncer host whenever ``useStandardNaming`` or ``fullnameOverride`` changed the release naming. diff --git a/chart/templates/secrets/result-backend-connection-secret.yaml b/chart/templates/secrets/result-backend-connection-secret.yaml index 2b3218f02de17..558813629dda5 100644 --- a/chart/templates/secrets/result-backend-connection-secret.yaml +++ b/chart/templates/secrets/result-backend-connection-secret.yaml @@ -23,7 +23,7 @@ {{- if and .Values.data.resultBackendConnection (not .Values.data.resultBackendSecretName) (contains "CeleryExecutor" .Values.executor) }} {{- $connection := .Values.data.resultBackendConnection | default .Values.data.metadataConnection }} {{- $resultBackendHost := $connection.host | default (printf "%s-%s" .Release.Name "postgresql") }} -{{- $pgbouncerHost := printf "%s-%s" .Release.Name "pgbouncer" }} +{{- $pgbouncerHost := (printf "%s-%s.%s" ( include "airflow.fullname" . ) "pgbouncer" .Release.Namespace) }} {{- $host := ternary $pgbouncerHost $resultBackendHost .Values.pgbouncer.enabled }} {{- $port := (ternary .Values.ports.pgbouncer $connection.port .Values.pgbouncer.enabled) | toString }} {{- $database := ternary (printf "%s-%s" .Release.Name "result-backend") $connection.db .Values.pgbouncer.enabled }} diff --git a/chart/tests/helm_tests/security/test_result_backend_connection_secret.py b/chart/tests/helm_tests/security/test_result_backend_connection_secret.py index 94e166e28d5c8..f543ad3b788e1 100644 --- a/chart/tests/helm_tests/security/test_result_backend_connection_secret.py +++ b/chart/tests/helm_tests/security/test_result_backend_connection_secret.py @@ -127,7 +127,23 @@ def test_should_set_pgbouncer_overrides_with_non_chart_database_when_enabled(sel # host, port, dbname still get overridden even with an non-chart db assert ( - connection == "db+postgresql://someuser:somepass@release-name-pgbouncer:6543" + connection == "db+postgresql://someuser:somepass@release-name-pgbouncer.default:6543" + "/release-name-result-backend?sslmode=allow" + ) + + def test_should_set_pgbouncer_overrides_with_use_standard_naming(self): + # The pgbouncer host must be derived from the "airflow.fullname" template (like the metadata + # connection secret does), not from `.Release.Name` directly, so that it still resolves once + # `useStandardNaming`/`fullnameOverride` change the pgbouncer Service name. + values = { + "useStandardNaming": True, + "pgbouncer": {"enabled": True}, + "data": {"resultBackendConnection": {**self.non_chart_database_values}}, + } + connection = self._get_connection(values) + + assert ( + connection == "db+postgresql://someuser:somepass@release-name-airflow-pgbouncer.default:6543" "/release-name-result-backend?sslmode=allow" )