Apache Airflow version

main / chart 1.21.0+

Under which category would you file this issue?

Helm chart

What happened and how to reproduce it?

The api-server deployment template (chart/templates/api-server/api-server-deployment.yaml) carries checksum annotations for several config sources (airflow-config, extra-configmaps, extra-secrets, metadata-secret, pgbouncer-config-secret, and — since #60111 — jwt-secret), but it does not carry one for the api-server ConfigMap rendered from apiServer.apiServerConfig. As a result, changing apiServer.apiServerConfig updates airflow-api-server-config in the cluster but does not trigger a rollout of the api-server pods.

In our case (downstream user) we changed webserver_config.py to swap auth backends. ArgoCD applied the new ConfigMap, but the running api-server pods kept the old code because:

1. The file is mounted with subPath (no auto-refresh of the file content even though kubelet would normally sync ConfigMap-backed volumes).
2. The api-server (Python/Flask) loads webserver_config.py once at boot, so even an auto-refreshed file would not take effect without a process restart.
3. Nothing in the deployment template's pod-template hash depends on the ConfigMap content, so helm upgrade doesn't perform a rolling update.

The user-visible symptom is that auth/security changes silently don't take effect until someone runs kubectl rollout restart deploy/<release>-api-server manually.

Reproduction steps

1. Install the chart with apiServer.apiServerConfig set to anything that emits a custom webserver_config.py.
2. Change apiServer.apiServerConfig and run helm upgrade.
3. Observe: kubectl get cm <release>-api-server-config -o yaml shows the new content, but kubectl exec into an api-server pod and cat /opt/airflow/webserver_config.py shows the old content. No pod rollout occurred.

Expected behavior

Same behavior as checksum/airflow-config and checksum/jwt-secret: a change in the rendered ConfigMap content should bump the pod template hash and roll the api-server deployment.

Proposed fix

Add a checksum/api-server-config annotation to chart/templates/api-server/api-server-deployment.yaml, guarded by the same condition that controls whether chart/templates/configmaps/api-server-configmap.yaml renders:

{{- if and .Values.apiServer.apiServerConfig (not .Values.apiServer.apiServerConfigConfigMapName) }}
checksum/api-server-config: {{ include (print $.Template.BasePath "/configmaps/api-server-configmap.yaml") . | sha256sum }}
{{- end }}

This mirrors exactly the pattern used in #60111 for checksum/jwt-secret.

Anything else?

Happy to open a PR — see #60111 (merged Jan 2026) for the analogous fix. The change is +3/0 in a single template.

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct