Document how to rotate the Fernet key with the Helm chart#70242
Open
Aaryan123456679 wants to merge 3 commits into
Open
Document how to rotate the Fernet key with the Helm chart#70242Aaryan123456679 wants to merge 3 commits into
Aaryan123456679 wants to merge 3 commits into
Conversation
Aaryan123456679
requested review from
Miretpl,
bugraoz93,
hussein-awala,
jedcunningham and
jscheffl
as code owners
July 22, 2026 14:45
bugraoz93
reviewed
Jul 22, 2026
bugraoz93
left a comment
bugraoz93
left a comment
Contributor
There was a problem hiding this comment.
Thanks for the PR! Some nits
Aaryan123456679
force-pushed
the
docs/fernet-key-rotation-helm-18509
branch
from
July 22, 2026 17:45
ebac38f to
a1dbb7b
Compare
Miretpl
requested changes
Jul 23, 2026
Aaryan123456679
force-pushed
the
docs/fernet-key-rotation-helm-18509
branch
from
July 24, 2026 10:37
a1dbb7b to
ab32998
Compare
Miretpl
approved these changes
Jul 24, 2026
Miretpl
left a comment
Miretpl
left a comment
Contributor
There was a problem hiding this comment.
Good for me, @bugraoz93 good for you too?
Miretpl
added
the
backport-to-chart/v1-2x-test
The Helm chart docs explained how to point at a custom Fernet key Secret but never how to safely rotate one. The chart also generates the Fernet key Secret via a pre-install hook, which means it cannot be updated through helm upgrade, so a self-managed Secret plus the standard prepend/rotate/trim procedure is required. Document that gap so operators aren't left guessing or reverse-engineering the chart templates. closes: apache#18509
Reviewers pointed out three gaps: the plaintext-key warning didn't explicitly say not to commit values.yaml to version control, the kubectl-created Secret example didn't mention that it needs to be managed as infrastructure so it survives a cluster migration or redeploy, and the rotation steps described updating the Secret's value without ever showing the command to do it. Rename the newsfragment to the PR number (70242) instead of the issue number (18509) per towncrier convention.
Tighten the wording per reviewer suggestions and drop the newsfragment, since a docs-only addition does not need one.
Aaryan123456679
force-pushed
the
docs/fernet-key-rotation-helm-18509
branch
from
July 24, 2026 18:17
29ed5ff to
f3a3cf5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Helm chart docs describe pointing at a custom Fernet key Secret via
fernetKeySecretName, but never explain how to actually rotate the key once Airflow is deployed via the chart. This adds a "Fernet Key" section to the production guide covering the standard prepend/rotate/trim procedure, and notes that the chart-generated Secret is only created onhelm install(via a pre-install hook) so a self-managed Secret is required to rotate at all.closes: #18509
Test plan
breeze build-docs --package-filter helm-chartsucceeded with no warnings/errorsprek run --from-ref upstream/main --stage pre-commitpassed (including the RST double-backtick check)prek run --from-ref upstream/main --stage manualpassedgit diff upstream/main...HEAD --statconfirms only the doc file and newsfragment changedWas generative AI tooling used to co-author this PR?
Generated-by: Claude Code (Sonnet 5) following the guidelines