Allow configuration of ContainerSecurityContext for XCom Sidecar (KubernetesPodOperator) #49276

Activity

1. DjVinnii

   added

   kind:featureFeature RequestsFeature Requests

   needs-triagelabel for new issues that we didn't triage yetlabel for new issues that we didn't triage yet

   on Apr 15, 2025
2. DjVinnii

   changed the title [-]Allow configuration of PodSecurityContext for XCom Sidecar (KubernetesPodOperator)[/-] [+]Allow configuration of ContainerSecurityContext for XCom Sidecar (KubernetesPodOperator)[/+] on Apr 15, 2025
3. dosubot

   added

   area:providers

   provider:cncf-kubernetesKubernetes (k8s) provider related issuesKubernetes (k8s) provider related issues

   on Apr 15, 2025
4. insomnes commented on Apr 15, 2025

   

   insomnes

   on Apr 15, 2025

   Contributor

   More actions

   Regardless of the triage, you may find the way to configure described in #10605 useful to work around your problem:

   #  You can redefine class vars of this class in your airflow_local_settings.py
   class PodDefaults:
       """Static defaults for Pods."""
   
       XCOM_MOUNT_PATH = "/airflow/xcom"
       SIDECAR_CONTAINER_NAME = "airflow-xcom-sidecar"
       XCOM_CMD = 'trap "exit 0" INT; while true; do sleep 1; done;'
       VOLUME_MOUNT = k8s.V1VolumeMount(name="xcom", mount_path=XCOM_MOUNT_PATH)
       VOLUME = k8s.V1Volume(name="xcom", empty_dir=k8s.V1EmptyDirVolumeSource())
       # Here, the full spec is configurable for the sidecar container used
       SIDECAR_CONTAINER = k8s.V1Container(
           name=SIDECAR_CONTAINER_NAME,
           command=["sh", "-c", XCOM_CMD],
           image="alpine",
           volume_mounts=[VOLUME_MOUNT],
           resources=k8s.V1ResourceRequirements(
               requests={
                   "cpu": "1m",
                   "memory": "10Mi",
               },
           ),
       )
5. DjVinnii commented on Apr 15, 2025

   

   DjVinnii

   on Apr 15, 2025

   ContributorAuthor

   More actions

   Regardless of the triage, you may find the way to configure described in #10605 useful to work around your problem:

   I tried the proposed solution/workaround by adding the code below. Unfortunately, the Security Context is not injected.

   SIDECAR_CONTAINER = k8s.V1Container(
   ...
     security_context=k8s.V1SecurityContext(
       allow_privilege_escalation=False,
       read_only_root_filesystem=True,
       seccomp_profile=k8s.V1SeccompProfile(
         type="RuntimeDefault"
       ),
    ),
   )

   The complete airflow_local_settings.py looks like this:

   from kubernetes.client import models as k8s
   
   class PodDefaults:
     """Static defaults for Pods."""
   
     XCOM_MOUNT_PATH = "/airflow/xcom"
     SIDECAR_CONTAINER_NAME = "airflow-xcom-sidecar"
     XCOM_CMD = 'trap "exit 0" INT; while true; do sleep 1; done;'
     VOLUME_MOUNT = k8s.V1VolumeMount(name="xcom", mount_path=XCOM_MOUNT_PATH)
     VOLUME = k8s.V1Volume(name="xcom", empty_dir=k8s.V1EmptyDirVolumeSource())
     SIDECAR_CONTAINER = k8s.V1Container(
       name=SIDECAR_CONTAINER_NAME,
       command=["sh", "-c", XCOM_CMD],
       image="alpine",
       volume_mounts=[VOLUME_MOUNT],
       resources=k8s.V1ResourceRequirements(
         requests={
             "cpu": "1m",
             "memory": "10Mi",
         },
       ),
       security_context = k8s.V1SecurityContext(
         allow_privilege_escalation=False,
         read_only_root_filesystem=True,
         seccomp_profile=k8s.V1SeccompProfile(
           type="RuntimeDefault"
         ),
        ),
     )
6. insomnes commented on Apr 15, 2025

   

   insomnes

   on Apr 15, 2025

   Contributor

   More actions

   I am sorry for not providing the proper example in my first comment. As mentioned in the issue redifinition requires you to change the class variables of the existing class via imports in your airflow_local_settings.py:

   from airflow.providers.cncf.kubernetes.utils.xcom_sidecar import PodDefaults
   
   PodDefaults.SIDECAR_CONTAINER.image = "docker.very.private.repo.net/alpine:3.10"

   So, your security context re-configuration should look like this, I suppose:

   from airflow.providers.cncf.kubernetes.utils.xcom_sidecar import PodDefaults
   from kubernetes.client import models as k8s
   
   PodDefaults.SIDECAR_CONTAINER.security_context=k8s.V1SecurityContext(
       allow_privilege_escalation=False,
       read_only_root_filesystem=True,
       seccomp_profile=k8s.V1SeccompProfile(
           type="RuntimeDefault"
       ),
   ) 

   🚀React with 🚀5Reacted by Vincent Kling, Erik Surface, Ben Tullis, David Shipman and Marco Rossi
7. DjVinnii commented on Apr 16, 2025

   

   DjVinnii

   on Apr 16, 2025

   ContributorAuthor

   More actions

   Thanks @insomnes! This indeed works like a charm. Is this something we could add in the provider docs? I'm willing to add this if needed.
8. insomnes commented on Apr 16, 2025

   

   insomnes

   on Apr 16, 2025

   Contributor

   More actions

   I don't know what the proper solution to this problem is.

   Even with the current intended resource and image configuration approach via the k8s connection (or hack I mentioned), it is not clear to me. I think that the default XCOM sidecar container spec should be fully configurable, and we should have an easier way to reconfigure it for specific KubernetesPodOperator too. But I can't imagine how common / uncommon this requirement to tune sidecar is.

   The current approach of digging through issues and finding this "arcane solution" is not sustainable for me either. Maybe you can try to make a PR with a paragraph in docs and see what committers would say on this, or wait for the issue triage.

   👍React with 👍1Reacted by Danni
9. aaron-y-chen commented on Jul 9, 2026

   

   aaron-y-chen

   on Jul 9, 2026

   Contributor

   More actions

   I opened PR #69613 to add support for configuring the XCom sidecar container security context. Feedback is welcome :)
10. Miretpl

    removed

    needs-triagelabel for new issues that we didn't triage yetlabel for new issues that we didn't triage yet

    on Jul 15, 2026
11. Miretpl

    closed this as completedin #69613on Jul 17, 2026