How to change default password in Airflow Helm chart?

[kbm-bax]

I am using Airflow helm chart (version: airflow-1.15.0). I am using custom-values.yaml file to override the defaults. I am not able to change the defaultUser Password. When I add the, it is accepted my the chart. However, when the chart is installed it is still allowing logging in with default username and password (and not with the new_password as seen below).

webserver:
  defaultUser:
    password: new_password

When I search for my helm values I can see that new_password has been acccepted (as seen in the output below):

$ helm get values airflow
USER-SUPPLIED VALUES:
config:
  webserver:
    base_url: http://localhost/airflow
    enable_proxy_fix: "True"
images:
  airflow:
    repository:xyz/airflow
    tag: 8a032a78
ingress:
  enabled: null
  flower:
    annotations: {}
    enabled: false
    host: ""
    hosts: []
    ingressClassName: ""
    path: /
    pathType: ImplementationSpecific
    tls:
      enabled: false
      secretName: ""
  web:
    annotations: {}
    enabled: true
    host: ""
    hosts:
    - name: myhost.com
      tls:
        enabled: true
        secretName: ing-server-tls-secret
    ingressClassName: public
    path: /airflow/*
    pathType: ImplementationSpecific
    precedingPaths: []
    succeedingPaths: []
    tls:
      enabled: true
      secretName: ingclientsecret
webserver:
  defaultUser:
    password: new_password

[jimmyhedstr0m]

The user is created only first time and the password value does not get updated since the value is stored in the postgres database. I had the same issue and ended up in overriding the create user arguments with password coming from secrets ref

createUserJob:
  useHelmHooks: false
  applyCustomEnv: true
  env:
    - name: ADMIN_PASSWORD
      valueFrom:
        secretKeyRef:
          name: airflow-env-vars
          key: ADMIN_PASSWORD
  args:
    - "bash"
    - "-c"
    # The format below is necessary to get `helm lint` happy
    - |-
      exec \
      airflow {{ semverCompare ">=2.0.0" .Values.airflowVersion | ternary "users create" "create_user" }} "$@"
    - --
    - "-r"
    - "{{ .Values.webserver.defaultUser.role }}"
    - "-u"
    - "{{ .Values.webserver.defaultUser.username }}"
    - "-e"
    - "{{ .Values.webserver.defaultUser.email }}"
    - "-f"
    - "{{ .Values.webserver.defaultUser.firstName }}"
    - "-l"
    - "{{ .Values.webserver.defaultUser.lastName }}"
    - "-p"
    - "$(ADMIN_PASSWORD)"
migrateDatabaseJob:
  useHelmHooks: false
  applyCustomEnv: false
webserver:
  defaultUser:
    enabled: true
    username: admin
    password: dummy
    role: Admin

[arm-moodys]

The user is created only first time and the password value does not get updated since the value is stored in the postgres database. I had the same issue and ended up in overriding the create user arguments with password coming from secrets ref

createUserJob:
  useHelmHooks: false
  applyCustomEnv: true
  env:
    - name: ADMIN_PASSWORD
      valueFrom:
        secretKeyRef:
          name: airflow-env-vars
          key: ADMIN_PASSWORD
  args:
    - "bash"
    - "-c"
    # The format below is necessary to get `helm lint` happy
    - |-
      exec \
      airflow {{ semverCompare ">=2.0.0" .Values.airflowVersion | ternary "users create" "create_user" }} "$@"
    - --
    - "-r"
    - "{{ .Values.webserver.defaultUser.role }}"
    - "-u"
    - "{{ .Values.webserver.defaultUser.username }}"
    - "-e"
    - "{{ .Values.webserver.defaultUser.email }}"
    - "-f"
    - "{{ .Values.webserver.defaultUser.firstName }}"
    - "-l"
    - "{{ .Values.webserver.defaultUser.lastName }}"
    - "-p"
    - "$(ADMIN_PASSWORD)"
migrateDatabaseJob:
  useHelmHooks: false
  applyCustomEnv: false
webserver:
  defaultUser:
    enabled: true
    username: admin
    password: dummy
    role: Admin

Thanks, this did it!