Move triggerer from pod-log-reader-role to pod-launcher-role

[AutomationDev85]

Overview

We are preparing an update to the KubernetesPodTriggerer workflow to align its startup behavior with that of the synchronous workflow. As part of this effort, we are introducing this preparation PR.

This PR moves the triggerer to the pod-launcher-role, enabling it to read events from pods during the startup phase. Another reason for this change is to grant the triggerer the rights to clean up pods if it detects that the state of an Airflow task was set to failed by the user. This cleanup behavior will be introduced in a future PR.

We welcome your feedback on this change!

Details of change:

• Move KubernetesPodTriggerer to the pod-launcher-role.
• Remove KubernetesPodTriggerer from the pod-reader-role, as pod-launcher-role already provides the necessary rights.

[jscheffl]

Totally makes sense to me that the Triggerer receives more permissions... looking forward for the other PR making Triggerer better.

[jscheffl]

Oh helm tests fail... I assume you can fix this? Else let me/us know.

@jedcunningham how do we handle this (did we have such in the past?) if a feature in K8s provider package has a dependency to Helm deployment? Any special care in release notes needed?

@AutomationDev85 considering people might have not upgraded the Helm and would use the async mode in future, can an explicit error being generated pointing to the root cause other than a plain HTTP 403 from K8s API?

[AutomationDev85]

@jscheffl Thanks for the feedback! I fixed and extend the unit tests. Regarding the explicit error error. I will add during the rework of this PR #56875 more detailed error message about permission issues and the helm chart.

[AutomationDev85]

Overview

We are preparing an update to the KubernetesPodTriggerer workflow to align its startup behavior with that of the synchronous workflow. As part of this effort, we are introducing this preparation PR.

This PR moves the triggerer to the pod-launcher-role, enabling it to read events from pods during the startup phase. Another reason for this change is to grant the triggerer the rights to clean up pods if it detects that the state of an Airflow task was set to failed by the user. This cleanup behavior will be introduced in a future PR.

We welcome your feedback on this change!

Details of change:

• Move KubernetesPodTriggerer to the pod-launcher-role.
• Remove KubernetesPodTriggerer from the pod-reader-role, as pod-launcher-role already provides the necessary rights.

[jscheffl]

Totally makes sense to me that the Triggerer receives more permissions... looking forward for the other PR making Triggerer better.

[jscheffl]

Oh helm tests fail... I assume you can fix this? Else let me/us know.

@jedcunningham how do we handle this (did we have such in the past?) if a feature in K8s provider package has a dependency to Helm deployment? Any special care in release notes needed?

@AutomationDev85 considering people might have not upgraded the Helm and would use the async mode in future, can an explicit error being generated pointing to the root cause other than a plain HTTP 403 from K8s API?

[AutomationDev85]

@jscheffl Thanks for the feedback! I fixed and extend the unit tests. Regarding the explicit error error. I will add during the rework of this PR #56875 more detailed error message about permission issues and the helm chart.

[AutomationDev85]

Overview

We are preparing an update to the KubernetesPodTriggerer workflow to align its startup behavior with that of the synchronous workflow. As part of this effort, we are introducing this preparation PR.

This PR moves the triggerer to the pod-launcher-role, enabling it to read events from pods during the startup phase. Another reason for this change is to grant the triggerer the rights to clean up pods if it detects that the state of an Airflow task was set to failed by the user. This cleanup behavior will be introduced in a future PR.

We welcome your feedback on this change!

Details of change:

• Move KubernetesPodTriggerer to the pod-launcher-role.
• Remove KubernetesPodTriggerer from the pod-reader-role, as pod-launcher-role already provides the necessary rights.

[jscheffl]

Totally makes sense to me that the Triggerer receives more permissions... looking forward for the other PR making Triggerer better.

[jscheffl]

Oh helm tests fail... I assume you can fix this? Else let me/us know.

@jedcunningham how do we handle this (did we have such in the past?) if a feature in K8s provider package has a dependency to Helm deployment? Any special care in release notes needed?

@AutomationDev85 considering people might have not upgraded the Helm and would use the async mode in future, can an explicit error being generated pointing to the root cause other than a plain HTTP 403 from K8s API?

[AutomationDev85]

@jscheffl Thanks for the feedback! I fixed and extend the unit tests. Regarding the explicit error error. I will add during the rework of this PR #56875 more detailed error message about permission issues and the helm chart.

[AutomationDev85]

Overview

We are preparing an update to the KubernetesPodTriggerer workflow to align its startup behavior with that of the synchronous workflow. As part of this effort, we are introducing this preparation PR.

This PR moves the triggerer to the pod-launcher-role, enabling it to read events from pods during the startup phase. Another reason for this change is to grant the triggerer the rights to clean up pods if it detects that the state of an Airflow task was set to failed by the user. This cleanup behavior will be introduced in a future PR.

We welcome your feedback on this change!

Details of change:

• Move KubernetesPodTriggerer to the pod-launcher-role.
• Remove KubernetesPodTriggerer from the pod-reader-role, as pod-launcher-role already provides the necessary rights.

[jscheffl]

Totally makes sense to me that the Triggerer receives more permissions... looking forward for the other PR making Triggerer better.

[jscheffl]

Oh helm tests fail... I assume you can fix this? Else let me/us know.

@jedcunningham how do we handle this (did we have such in the past?) if a feature in K8s provider package has a dependency to Helm deployment? Any special care in release notes needed?

@AutomationDev85 considering people might have not upgraded the Helm and would use the async mode in future, can an explicit error being generated pointing to the root cause other than a plain HTTP 403 from K8s API?

[AutomationDev85]

@jscheffl Thanks for the feedback! I fixed and extend the unit tests. Regarding the explicit error error. I will add during the rework of this PR #56875 more detailed error message about permission issues and the helm chart.

[AutomationDev85]

Overview

We are preparing an update to the KubernetesPodTriggerer workflow to align its startup behavior with that of the synchronous workflow. As part of this effort, we are introducing this preparation PR.

This PR moves the triggerer to the pod-launcher-role, enabling it to read events from pods during the startup phase. Another reason for this change is to grant the triggerer the rights to clean up pods if it detects that the state of an Airflow task was set to failed by the user. This cleanup behavior will be introduced in a future PR.

We welcome your feedback on this change!

Details of change:

• Move KubernetesPodTriggerer to the pod-launcher-role.
• Remove KubernetesPodTriggerer from the pod-reader-role, as pod-launcher-role already provides the necessary rights.

[jscheffl]

Totally makes sense to me that the Triggerer receives more permissions... looking forward for the other PR making Triggerer better.

[jscheffl]

Oh helm tests fail... I assume you can fix this? Else let me/us know.

@jedcunningham how do we handle this (did we have such in the past?) if a feature in K8s provider package has a dependency to Helm deployment? Any special care in release notes needed?

@AutomationDev85 considering people might have not upgraded the Helm and would use the async mode in future, can an explicit error being generated pointing to the root cause other than a plain HTTP 403 from K8s API?

[AutomationDev85]

@jscheffl Thanks for the feedback! I fixed and extend the unit tests. Regarding the explicit error error. I will add during the rework of this PR #56875 more detailed error message about permission issues and the helm chart.

[AutomationDev85]

Overview

We are preparing an update to the KubernetesPodTriggerer workflow to align its startup behavior with that of the synchronous workflow. As part of this effort, we are introducing this preparation PR.

This PR moves the triggerer to the pod-launcher-role, enabling it to read events from pods during the startup phase. Another reason for this change is to grant the triggerer the rights to clean up pods if it detects that the state of an Airflow task was set to failed by the user. This cleanup behavior will be introduced in a future PR.

We welcome your feedback on this change!

Details of change:

• Move KubernetesPodTriggerer to the pod-launcher-role.
• Remove KubernetesPodTriggerer from the pod-reader-role, as pod-launcher-role already provides the necessary rights.

[jscheffl]

Totally makes sense to me that the Triggerer receives more permissions... looking forward for the other PR making Triggerer better.

[jscheffl]

Oh helm tests fail... I assume you can fix this? Else let me/us know.

@jedcunningham how do we handle this (did we have such in the past?) if a feature in K8s provider package has a dependency to Helm deployment? Any special care in release notes needed?

@AutomationDev85 considering people might have not upgraded the Helm and would use the async mode in future, can an explicit error being generated pointing to the root cause other than a plain HTTP 403 from K8s API?

[AutomationDev85]

@jscheffl Thanks for the feedback! I fixed and extend the unit tests. Regarding the explicit error error. I will add during the rework of this PR #56875 more detailed error message about permission issues and the helm chart.

[AutomationDev85]

Overview

We are preparing an update to the KubernetesPodTriggerer workflow to align its startup behavior with that of the synchronous workflow. As part of this effort, we are introducing this preparation PR.

This PR moves the triggerer to the pod-launcher-role, enabling it to read events from pods during the startup phase. Another reason for this change is to grant the triggerer the rights to clean up pods if it detects that the state of an Airflow task was set to failed by the user. This cleanup behavior will be introduced in a future PR.

We welcome your feedback on this change!

Details of change:

• Move KubernetesPodTriggerer to the pod-launcher-role.
• Remove KubernetesPodTriggerer from the pod-reader-role, as pod-launcher-role already provides the necessary rights.

[jscheffl]

Totally makes sense to me that the Triggerer receives more permissions... looking forward for the other PR making Triggerer better.

[jscheffl]

Oh helm tests fail... I assume you can fix this? Else let me/us know.

@jedcunningham how do we handle this (did we have such in the past?) if a feature in K8s provider package has a dependency to Helm deployment? Any special care in release notes needed?

@AutomationDev85 considering people might have not upgraded the Helm and would use the async mode in future, can an explicit error being generated pointing to the root cause other than a plain HTTP 403 from K8s API?

[AutomationDev85]

@jscheffl Thanks for the feedback! I fixed and extend the unit tests. Regarding the explicit error error. I will add during the rework of this PR #56875 more detailed error message about permission issues and the helm chart.

[AutomationDev85]

Overview

We are preparing an update to the KubernetesPodTriggerer workflow to align its startup behavior with that of the synchronous workflow. As part of this effort, we are introducing this preparation PR.

This PR moves the triggerer to the pod-launcher-role, enabling it to read events from pods during the startup phase. Another reason for this change is to grant the triggerer the rights to clean up pods if it detects that the state of an Airflow task was set to failed by the user. This cleanup behavior will be introduced in a future PR.

We welcome your feedback on this change!

Details of change:

• Move KubernetesPodTriggerer to the pod-launcher-role.
• Remove KubernetesPodTriggerer from the pod-reader-role, as pod-launcher-role already provides the necessary rights.

[jscheffl]

Totally makes sense to me that the Triggerer receives more permissions... looking forward for the other PR making Triggerer better.

[jscheffl]

Oh helm tests fail... I assume you can fix this? Else let me/us know.

@jedcunningham how do we handle this (did we have such in the past?) if a feature in K8s provider package has a dependency to Helm deployment? Any special care in release notes needed?

@AutomationDev85 considering people might have not upgraded the Helm and would use the async mode in future, can an explicit error being generated pointing to the root cause other than a plain HTTP 403 from K8s API?

[AutomationDev85]

@jscheffl Thanks for the feedback! I fixed and extend the unit tests. Regarding the explicit error error. I will add during the rework of this PR #56875 more detailed error message about permission issues and the helm chart.