Skip to main content
If your organization enforces Pod labeling for security, workload identity, multi-tenancy, or policy enforcement, you can configure Astro Private Cloud (APC) to automatically add labels to the Pods it creates. You can apply labels to:
  • All platform Pods created by the APC Helm chart, by setting global.podLabels in the platform chart values during installation or upgrade.
  • Airflow Pods created by the airflow-chart for Deployments in a data plane cluster, by setting helm.airflow.labels as a cluster configuration override. This doesn’t label Pods from the chart’s sub-charts (for example, Postgres, PgBouncer, and StatsD).

​
Prerequisites

​
Add labels to platform Pods

In your Helm chart, add the podLabels configuration to the values.yaml file during your update or installation process.
For example, you can use the label security.level: "high" as a way to identify Pods created by Astro Private Cloud using the following code:

​
Add labels to Airflow Pods

To apply labels to Airflow Pods in a data plane cluster, set helm.airflow.labels as a cluster configuration override. The override is merged into the airflow-chart values used for each Deployment in that cluster, and the labels are attached to Pods that the airflow-chart creates directly. Pods created by the chart’s sub-charts (for example, Postgres, PgBouncer, and StatsD) aren’t labeled by this field. You can supply the override when you register a cluster, or you can update an existing cluster’s Configuration Override in the Astro Private Cloud UI or with the APC API updateCluster mutation. For the full procedure, see Override data plane cluster configurations. The following example sets the label security.level: "high" on Airflow Pods created by the airflow-chart in the cluster:
After you save the override, individually redeploy each affected Deployment for the labels to take effect on existing Pods.

​
Find labeled Pods

You can search for Pods using the kubectl command get pods with the label flag. For example, to retrieve a list of all Pods labeled with the key-value pair security.level=high in the astronomer namespace, you can use the following command:
To search across all Airflow Deployment namespaces, omit the -n flag or specify the Deployment namespace: