Fix passing dags.gitSync.sshKeySecret with dags.persistence.enabled=true

chart/templates/dag-processor/dag-processor-deployment.yaml

@@ -243,10 +243,10 @@ spec:
         {{- else if .Values.dags.gitSync.enabled }}
         - name: dags
           emptyDir: {{- toYaml (default (dict) .Values.dags.gitSync.emptyDirConfig) | nindent 12 }}
-        {{- end }}
-        {{- if and .Values.dags.gitSync.enabled .Values.dags.gitSync.sshKeySecret }}
+        {{- if .Values.dags.gitSync.sshKeySecret }}
           {{- include "git_sync_ssh_key_volume" . | indent 8 }}
         {{- end }}
+        {{- end }}
         {{- if .Values.volumes }}
           {{- toYaml .Values.volumes | nindent 8 }}
         {{- end }}

chart/templates/scheduler/scheduler-deployment.yaml

@@ -166,6 +166,7 @@ spec:
             {{- end }}
         {{- end }}
         {{- if and $localOrDagProcessorDisabled .Values.dags.gitSync.enabled }}
+        # unlike other pods, git-sync in scheduler is enabled even if dag.persistence is enabled
           {{- include "git_sync_container" (dict "Values" .Values "is_init" "true" "Template" .Template) | nindent 8 }}
         {{- end }}
         {{- if .Values.scheduler.extraInitContainers }}
@@ -244,6 +245,7 @@ spec:
               {{- tpl (toYaml .Values.scheduler.extraVolumeMounts) . | nindent 12 }}
             {{- end }}
         {{- if and $localOrDagProcessorDisabled .Values.dags.gitSync.enabled }}
+        # unlike other pods, git-sync in scheduler is enabled even if dag.persistence is enabled
           {{- include "git_sync_container" . | indent 8 }}
         {{- end }}
         {{- if .Values.scheduler.logGroomerSidecar.enabled }}
@@ -299,11 +301,12 @@ spec:
         {{- else if .Values.dags.gitSync.enabled }}
         - name: dags
           emptyDir: {{- toYaml (default (dict) .Values.dags.gitSync.emptyDirConfig) | nindent 12 }}
+        {{- end }}
         {{- if .Values.dags.gitSync.sshKeySecret }}
+        # unlike other pods, git-sync in scheduler is enabled even if dag.persistence is enabled
           {{- include "git_sync_ssh_key_volume" . | indent 8 }}
         {{- end }}
         {{- end }}
-        {{- end }}
         {{- if .Values.volumes }}
           {{- toYaml .Values.volumes | nindent 8 }}
         {{- end }}

helm_tests/other/test_git_sync_dag_processor.py

@@ -0,0 +1,52 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+from __future__ import annotations
+
+import jmespath
+
+from tests.charts.helm_template_generator import render_chart
+
+
+class TestGitSyncDagProcessor:
+    """Test git sync dag processor."""
+
+    def test_validate_sshkeysecret_not_added_when_persistence_is_enabled(self):
+        docs = render_chart(
+            values={
+                "dagProcessor": {"enabled": True},
+                "dags": {
+                    "gitSync": {
+                        "enabled": True,
+                        "containerName": "git-sync-test",
+                        "sshKeySecret": "ssh-secret",
+                        "knownHosts": None,
+                        "branch": "test-branch",
+                    },
+                    "persistence": {"enabled": True},
+                },
+            },
+            show_only=["templates/dag-processor/dag-processor-deployment.yaml"],
+        )
+        assert "git-sync-ssh-key" not in jmespath.search("spec.template.spec.volumes[].name", docs[0])
+        assert "git-sync-ssh-key" not in jmespath.search(
+            "spec.template.spec.containers[].volumeMounts[].name",
+            docs[0],
+        )
+        assert "git-sync-ssh-key" not in jmespath.search(
+            "spec.template.spec.initContainers[].volumeMounts[].name",
+            docs[0],
+        )

helm_tests/other/test_git_sync_scheduler.py

@@ -17,6 +17,7 @@
 from __future__ import annotations
 
 import jmespath
+import pytest
 
 from tests.charts.helm_template_generator import render_chart
 
@@ -211,7 +212,9 @@ def test_validate_if_ssh_params_are_added(self):
             "secret": {"secretName": "ssh-secret", "defaultMode": 288},
         } in jmespath.search("spec.template.spec.volumes", docs[0])
 
-    def test_validate_sshkeysecret_not_added_when_persistence_is_enabled(self):
+    @pytest.mark.parametrize("persistence", [True, False])
+    def test_validate_sshkeysecret_added_regardless_of_persistence_value(self, persistence):
+        # Unlike
         docs = render_chart(
             values={
                 "dags": {
@@ -222,12 +225,20 @@ def test_validate_sshkeysecret_not_added_when_persistence_is_enabled(self):
                         "knownHosts": None,
                         "branch": "test-branch",
                     },
-                    "persistence": {"enabled": True},
+                    "persistence": {"enabled": persistence},
                 }
             },
             show_only=["templates/scheduler/scheduler-deployment.yaml"],
         )
-        assert "git-sync-ssh-key" not in jmespath.search("spec.template.spec.volumes[].name", docs[0])
+        assert "git-sync-ssh-key" in jmespath.search("spec.template.spec.volumes[].name", docs[0])
+        assert "git-sync-ssh-key" in jmespath.search(
+            "spec.template.spec.containers[].volumeMounts[].name",
+            docs[0],
+        )
+        assert "git-sync-ssh-key" in jmespath.search(
+            "spec.template.spec.initContainers[].volumeMounts[].name",
+            docs[0],
+        )
 
     def test_should_set_username_and_pass_env_variables(self):
         docs = render_chart(

helm_tests/other/test_git_sync_triggerer.py

@@ -41,3 +41,11 @@ def test_validate_sshkeysecret_not_added_when_persistence_is_enabled(self):
             show_only=["templates/triggerer/triggerer-deployment.yaml"],
         )
         assert "git-sync-ssh-key" not in jmespath.search("spec.template.spec.volumes[].name", docs[0])
+        assert "git-sync-ssh-key" not in jmespath.search(
+            "spec.template.spec.containers[].volumeMounts[].name",
+            docs[0],
+        )
+        assert "git-sync-ssh-key" not in jmespath.search(
+            "spec.template.spec.initContainers[].volumeMounts[].name",
+            docs[0],
+        )

helm_tests/other/test_git_sync_webserver.py

@@ -172,3 +172,11 @@ def test_validate_sshkeysecret_not_added_when_persistence_is_enabled(self):
             show_only=["templates/webserver/webserver-deployment.yaml"],
         )
         assert "git-sync-ssh-key" not in jmespath.search("spec.template.spec.volumes[].name", docs[0])
+        assert "git-sync-ssh-key" not in jmespath.search(
+            "spec.template.spec.containers[].volumeMounts[].name",
+            docs[0],
+        )
+        assert "git-sync-ssh-key" not in jmespath.search(
+            "spec.template.spec.initContainers[].volumeMounts[].name",
+            docs[0],
+        )

helm_tests/other/test_git_sync_worker.py

@@ -132,3 +132,11 @@ def test_validate_sshkeysecret_not_added_when_persistence_is_enabled(self):
         )
 
         assert "git-sync-ssh-key" not in jmespath.search("spec.template.spec.volumes[].name", docs[0])
+        assert "git-sync-ssh-key" not in jmespath.search(
+            "spec.template.spec.containers[].volumeMounts[].name",
+            docs[0],
+        )
+        assert "git-sync-ssh-key" not in jmespath.search(
+            "spec.template.spec.initContainers[].volumeMounts[].name",
+            docs[0],
+        )