Added support for using SHA digest of Docker images.

chart/templates/_helpers.yaml

@@ -248,16 +248,30 @@ If release name contains chart name it will be used as a full name.
 
 {{/* This helper will change when customers deploy a new image */}}
 {{- define "airflow_image" -}}
-  {{- printf "%s:%s" (.Values.images.airflow.repository | default .Values.defaultAirflowRepository) (.Values.images.airflow.tag | default .Values.defaultAirflowTag) }}
+{{- $repository := .Values.images.airflow.repository | default .Values.defaultAirflowRepository -}}
+{{- $tag := .Values.images.airflow.tag | default .Values.defaultAirflowTag -}}
+{{- $digest := .Values.images.airflow.digest | default .Values.defaultAirflowDigest -}}
+{{- if $digest }}
+{{- printf "%s@%s" $repository $digest -}}
+{{- else }}
+{{- printf "%s:%s" $repository $tag -}}
+{{- end }}
 {{- end }}
 
 {{- define "pod_template_image" -}}
   {{- printf "%s:%s" (.Values.images.pod_template.repository | default .Values.defaultAirflowRepository) (.Values.images.pod_template.tag | default .Values.defaultAirflowTag) }}
 {{- end }}
 
 {{/* This helper is used for airflow containers that do not need the users code */}}
-{{- define "default_airflow_image" -}}
-  {{- printf "%s:%s" .Values.defaultAirflowRepository .Values.defaultAirflowTag }}
+{{ define "default_airflow_image" -}}
+{{- $repository := .Values.defaultAirflowRepository -}}
+{{- $tag := .Values.defaultAirflowTag -}}
+{{- $digest := .Values.defaultAirflowDigest -}}
+{{- if $digest }}
+{{- printf "%s@%s" $repository $digest -}}
+{{- else }}
+{{- printf "%s:%s" $repository $tag -}}
+{{- end }}
 {{- end }}
 
 {{ define "airflow_image_for_migrations" -}}

chart/values.schema.json

@@ -80,6 +80,15 @@
             "default": "2.5.3",
             "x-docsSection": "Common"
         },
+        "defaultAirflowDigest": {
+            "description": "Default airflow digest to deploy. Overrides tag.",
+            "type": [
+                "string",
+                "null"
+            ],
+            "default": null,
+            "x-docsSection": "Common"
+        },
         "airflowVersion": {
             "description": "Airflow version (Used to make some decisions based on Airflow Version being deployed).",
             "type": "string",
@@ -477,6 +486,14 @@
                             ],
                             "default": null
                         },
+                        "digest": {
+                            "description": "The airflow image digest. If set, it will override the tag.",
+                            "type": [
+                                "string",
+                                "null"
+                            ],
+                            "default": null
+                        },
                         "pullPolicy": {
                             "description": "The airflow image pull policy.",
                             "type": "string",

chart/values.yaml

@@ -51,6 +51,9 @@ defaultAirflowRepository: apache/airflow
 # Default airflow tag to deploy
 defaultAirflowTag: "2.5.3"
 
+# Default airflow digest. If specified, it takes precedence over tag
+defaultAirflowDigest: ~
+
 # Airflow version (Used to make some decisions based on Airflow Version being deployed)
 airflowVersion: "2.5.3"
 
@@ -59,6 +62,8 @@ images:
   airflow:
     repository: ~
     tag: ~
+    # Specifying digest takes precedence over tag.
+    digest: ~
     pullPolicy: IfNotPresent
   # To avoid images with user code, you can turn this to 'true' and
   # all the 'run-airflow-migrations' and 'wait-for-airflow-migrations' containers/jobs

tests/charts/test_airflow_common.py

@@ -234,23 +234,22 @@ def test_global_affinity_tolerations_topology_spread_constraints_and_node_select
             assert "foo" == jmespath.search("topologySpreadConstraints[0].topologyKey", podSpec)
 
     @pytest.mark.parametrize(
-        "use_default_image,expected_image",
+        "expected_image,tag,digest",
         [
-            (True, "apache/airflow:2.1.0"),
-            (False, "apache/airflow:user-image"),
+            ("apache/airflow:user-tag", "user-tag", None),
+            ("apache/airflow@user-digest", None, "user-digest"),
+            ("apache/airflow@user-digest", "user-tag", "user-digest"),
         ],
     )
-    def test_should_use_correct_image(self, use_default_image, expected_image):
+    def test_should_use_correct_image(self, expected_image, tag, digest):
         docs = render_chart(
             values={
-                "defaultAirflowRepository": "apache/airflow",
-                "defaultAirflowTag": "2.1.0",
                 "images": {
                     "airflow": {
                         "repository": "apache/airflow",
-                        "tag": "user-image",
+                        "tag": tag,
+                        "digest": digest,
                     },
-                    "useDefaultImageForMigration": use_default_image,
                 },
             },
             show_only=[
@@ -265,6 +264,34 @@ def test_should_use_correct_image(self, use_default_image, expected_image):
         for doc in docs:
             assert expected_image == jmespath.search("spec.template.spec.initContainers[0].image", doc)
 
+    @pytest.mark.parametrize(
+        "expected_image,tag,digest",
+        [
+            ("apache/airflow:user-tag", "user-tag", None),
+            ("apache/airflow@user-digest", None, "user-digest"),
+            ("apache/airflow@user-digest", "user-tag", "user-digest"),
+        ],
+    )
+    def test_should_use_correct_default_image(self, expected_image, tag, digest):
+        docs = render_chart(
+            values={
+                "defaultAirflowRepository": "apache/airflow",
+                "defaultAirflowTag": tag,
+                "defaultAirflowDigest": digest,
+                "images": {"useDefaultImageForMigration": True},
+            },
+            show_only=[
+                "templates/scheduler/scheduler-deployment.yaml",
+                "templates/workers/worker-deployment.yaml",
+                "templates/webserver/webserver-deployment.yaml",
+                "templates/triggerer/triggerer-deployment.yaml",
+                "templates/dag-processor/dag-processor-deployment.yaml",
+            ],
+        )
+
+        for doc in docs:
+            assert expected_image == jmespath.search("spec.template.spec.initContainers[0].image", doc)
+
     def test_should_set_correct_helm_hooks_weight(self):
         docs = render_chart(
             show_only=["templates/secrets/fernetkey-secret.yaml"],