Back to Repositories

Testing Git Sync SSH Configuration for Airflow Triggerer in Apache Airflow

This test suite validates the Git sync functionality for Apache Airflow’s triggerer component in Helm deployments. It focuses on testing SSH key configuration and persistence settings when using git-sync containers with the Airflow triggerer.

Test Coverage Overview

The test suite provides comprehensive coverage of Git sync configuration scenarios in Airflow’s triggerer deployments.

Validates SSH key secret handling when persistence is enabled
Tests Git sync SSH parameter configuration
Verifies environment variable settings for git-sync containers
Covers volume mount configurations for SSH keys

Implementation Analysis

The tests utilize a Helm template generator approach to validate Kubernetes manifest generation. The implementation uses jmespath queries to inspect generated YAML structures, allowing precise validation of container configurations, environment variables, and volume mounts.

Testing patterns focus on configuration validation through manifest inspection rather than runtime behavior.

Technical Details

Uses render_chart utility for Helm template testing
Leverages jmespath for YAML structure traversal
Tests both positive and negative configuration scenarios
Validates volume configurations and environment variable sets
Focuses on Kubernetes manifest correctness

Best Practices Demonstrated

The test suite demonstrates several testing best practices for Kubernetes deployments.

Isolated test cases for specific configuration scenarios
Clear separation of test inputs and assertions
Structured validation of generated Kubernetes resources
Comprehensive coverage of configuration permutations

apache/airflow

helm_tests/other/test_git_sync_triggerer.py

            
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
from __future__ import annotations

import jmespath

from tests.charts.helm_template_generator import render_chart


class TestGitSyncTriggerer:
    """Test git sync triggerer."""

    def test_validate_sshkeysecret_not_added_when_persistence_is_enabled(self):
        docs = render_chart(
            values={
                "dags": {
                    "gitSync": {
                        "enabled": True,
                        "containerName": "git-sync-test",
                        "sshKeySecret": "ssh-secret",
                        "knownHosts": None,
                        "branch": "test-branch",
                    },
                    "persistence": {"enabled": True},
                }
            },
            show_only=["templates/triggerer/triggerer-deployment.yaml"],
        )
        assert "git-sync-ssh-key" not in jmespath.search("spec.template.spec.volumes[].name", docs[0])

    def test_validate_if_ssh_params_are_added_with_git_ssh_key(self):
        docs = render_chart(
            values={
                "dags": {
                    "gitSync": {
                        "enabled": True,
                        "sshKey": "dummy-ssh-key",
                    }
                }
            },
            show_only=["templates/triggerer/triggerer-deployment.yaml"],
        )

        assert {"name": "GIT_SSH_KEY_FILE", "value": "/etc/git-secret/ssh"} in jmespath.search(
            "spec.template.spec.containers[1].env", docs[0]
        )
        assert {"name": "GITSYNC_SSH_KEY_FILE", "value": "/etc/git-secret/ssh"} in jmespath.search(
            "spec.template.spec.containers[1].env", docs[0]
        )
        assert {"name": "GIT_SYNC_SSH", "value": "true"} in jmespath.search(
            "spec.template.spec.containers[1].env", docs[0]
        )
        assert {"name": "GITSYNC_SSH", "value": "true"} in jmespath.search(
            "spec.template.spec.containers[1].env", docs[0]
        )
        assert {"name": "GIT_KNOWN_HOSTS", "value": "false"} in jmespath.search(
            "spec.template.spec.containers[1].env", docs[0]
        )
        assert {"name": "GITSYNC_SSH_KNOWN_HOSTS", "value": "false"} in jmespath.search(
            "spec.template.spec.containers[1].env", docs[0]
        )
        assert {
            "name": "git-sync-ssh-key",
            "secret": {"secretName": "release-name-ssh-secret", "defaultMode": 288},
        } in jmespath.search("spec.template.spec.volumes", docs[0])