Helm: add custom annotations to jwt secret

chart/templates/secrets/jwt-secret.yaml

@@ -36,6 +36,10 @@ metadata:
     {{- with .Values.labels }}
       {{- toYaml . | nindent 4 }}
     {{- end }}
+  {{- with .Values.jwtSecretAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 type: Opaque
 data:
   jwt-secret: {{ (default $generated_secret_key .Values.jwtSecret) | b64enc | quote }}

chart/values.schema.json

@@ -1482,6 +1482,15 @@
             "x-docsSection": "Airflow",
             "default": null
         },
+        "jwtSecretAnnotations": {
+            "description": "Annotations to add to the JWT secret.",
+            "type": "object",
+            "x-docsSection": "Common",
+            "default": {},
+            "additionalProperties": {
+                "type": "string"
+            }
+        },
         "webserverSecretKey": {
             "description": "The Flask secret key for Airflow Webserver to encrypt browser session.",
             "type": [

chart/values.yaml

@@ -559,6 +559,8 @@ webserverSecretKeySecretName: ~
 
 # Secret key used to encode and decode JWTs: `[api_auth] jwt_secret` in airflow.cfg
 jwtSecret: ~
+# Add custom annotations to the JWT secret
+jwtSecretAnnotations: {}
 jwtSecretName: ~
 
 # In order to use kerberos you need to create secret containing the keytab file

helm-tests/tests/helm_tests/apiserver/test_apiserver.py

@@ -75,3 +75,18 @@ def test_should_add_volume_and_volume_mount_when_exist_api_server_config(self):
             "subPath": "webserver_config.py",
             "readOnly": True,
         } in jmespath.search("spec.template.spec.containers[0].volumeMounts", docs[0])
+
+
+class TestAPIServerJWTSecret:
+    """Tests API Server JWT secret."""
+
+    def test_should_add_annotations_to_jwt_secret(self):
+        docs = render_chart(
+            values={
+                "jwtSecretAnnotations": {"test_annotation": "test_annotation_value"},
+            },
+            show_only=["templates/secrets/jwt-secret.yaml"],
+        )[0]
+
+        assert "annotations" in jmespath.search("metadata", docs)
+        assert jmespath.search("metadata.annotations", docs)["test_annotation"] == "test_annotation_value"