Item	Command or source	Example value	Verification step
Airflow version	airflow version	3.3.0	Confirm major.minor and note 2.x vs 3.x features.
Deployment method	docs/runbook	Kubernetes Helm release <release-name>	Match to CI/CD manifest and image digests.
Executor	airflow config get-value core executor	KubernetesExecutor	Ensure executor aligns with worker topology.
Metadata database	airflow config get-value database sql_alchemy_conn	postgresql+psycopg2://...@<database-host>:5432/airflow	Confirm external Postgres or MySQL, not SQLite.
DAG distribution	docs/runbook	Git-sync sidecar to /opt/airflow/dags	Verify DAGs update path and revision.
Remote logging	airflow config get-value logging remote_logging	True	Confirm remote_base_log_folder is reachable.
Secrets backend	airflow config get-value secrets backend	airflow.providers.hashicorp.vault.secrets.vault.VaultBackend	Validate read access with a test connection.
Providers	python -m pip list	apache-airflow-providers-amazon 9.x	Check provider versions against constraints.
Authentication manager	airflow config get-value webserver auth_backend	airflow.api.auth.backend.session	Verify login flow and roles.
Architecture (2 vs 3)	docs/runbook	Airflow 3 with API server and external DAG processor	Ensure components are deployed accordingly.

Item

Command or source

Example value

Verification step

Airflow version

airflow version

3.3.0

Confirm major.minor and note 2.x vs 3.x features.

Deployment method

docs/runbook

Kubernetes Helm release <release-name>

Match to CI/CD manifest and image digests.

Executor

airflow config get-value core executor

KubernetesExecutor

Ensure executor aligns with worker topology.

Metadata database

airflow config get-value database sql_alchemy_conn

postgresql+psycopg2://...@<database-host>:5432/airflow

Confirm external Postgres or MySQL, not SQLite.

DAG distribution

docs/runbook

Git-sync sidecar to /opt/airflow/dags

Verify DAGs update path and revision.

Remote logging

airflow config get-value logging remote_logging

True

Confirm remote_base_log_folder is reachable.

Secrets backend

airflow config get-value secrets backend

airflow.providers.hashicorp.vault.secrets.vault.VaultBackend

Validate read access with a test connection.

Providers

python -m pip list

apache-airflow-providers-amazon 9.x

Check provider versions against constraints.

Authentication manager

airflow config get-value webserver auth_backend

airflow.api.auth.backend.session

Verify login flow and roles.

Architecture (2 vs 3)

docs/runbook

Airflow 3 with API server and external DAG processor

Ensure components are deployed accordingly.

Component or symptom	Likely causes	First safe check	Example command	Expected result
API server or web UI slow	DB saturation, auth backend latency, host CPU	Check DB connections and CPU	psql ... -c "select count(*) from pg_stat_activity;"	Connections within configured limits.
Scheduler heartbeat stalled	DB outage, deadlock, memory pressure, crash loop	Use jobs check and inspect scheduler logs	airflow jobs check --job-type SchedulerJob	Exit 0 when healthy; logs show steady heartbeats.
DAG processing backlog	Expensive imports, too few parsing processes	Inspect dag-processor logs and metrics	grep -i "processing" $AIRFLOW_HOME/logs/dag_processor/*	Parse duration stable and below target.
Growing queued-task age	Executor capacity, pool saturation, worker crash	Check pools and worker concurrency	airflow pools list	Pool used below limit or adjust as needed.
Worker saturation	Too many parallel tasks, host limits	Compare worker slots vs pod or VM limits	kubectl get pods -l component=worker	Desired count running and ready.
Triggerer lag	Many deferrable tasks, triggerer down	Check triggerer job and logs	airflow jobs check --job-type TriggererJob	Exit 0 and low backlog.
DB errors in UI	Network ACL change, TLS cert issue	Test direct DB connectivity	psql ... -c "select 1;"	Query succeeds with low latency.
Remote log failures	Bad IAM, bucket policy, temp creds expired	Tail task logs for upload errors	grep -i "failed to upload" <task-log>	Errors absent after credential refresh.

Asset	What to back up	Restore approach	Validation step	Notes
Metadata database	Daily full and frequent incrementals	Provision new DB, restore snapshot, point Airflow to it	Airflow starts, DAGs and connections visible	Do not treat running pods or containers as a backup.
DAG source or DAG bundles	Git repository and built artifacts	Re-deploy from tagged commit or artifact	DAG parse succeeds and schedules match	Keep reproducible builds.
Configuration-as-code	airflow.cfg, environment, Helm values	Reapply config to new environment	health checks succeed	Exclude secrets from repos; reference backends.
Secrets references	Secret paths and access policies	Recreate roles or service accounts	Connection test DAG succeeds	Never export raw secrets in backups.
Plugins, providers, custom images	Image registry and provider pin set	Re-tag and redeploy image versions	Import tests pass	Verify image digests match.
Remote logs	Object storage path and lifecycle rules	Point new Airflow to same bucket	Historical task logs retrievable	Retention duration driven by requirements.
Infrastructure definitions	Terraform or cloud templates	Recreate base infra and networking	New environment passes smoke tests	Document per-region differences.

Stage	Operator actions	Gate to proceed	Fallback if gate fails	Version notes
Plan and constraints	Read release notes and constraints, pin provider versions	Compatibility matrix reviewed	Defer upgrade and open issues	For 3.x, confirm auth and plugin compatibility.
Staging build	Rebuild image, update providers, apply config changes	DAGs import and basic runs succeed	Revert image tag and provider pins	Use the same executor and DB engine as prod.
DB migrate dry run	Stop schedulers, run airflow db migrate in staging	Migrations complete without errors	Restore DB from snapshot and retry	Do not use airflow db upgrade.
Roll or stop-the-world	Choose strategy based on executor and orchestration	Runbook approved	Abort and hold current prod	Rolling is limited for some executors.
Production migrate	Backup, stop schedulers, run airflow db migrate	Airflow starts and health checks pass	Restore DB and previous images	Verify jobs check and API health immediately.
Post-upgrade verification	Run representative DAG tests and review metrics	No regressions over agreed window	Roll back image and DB snapshot	Keep fallback plan valid for the window.

Cadence	Actions	Verification	Notes
Daily	Review scheduler delay, queued age, top failing DAGs	Dashboards show stable or improving trends	Adjust pools or concurrency based on evidence.
Weekly	Prune old XComs and failed task logs per policy	Storage growth within budget	Use a maintenance DAG for predictable cleanup.
Monthly	Rotate keys, audit roles, vacuum or analyze DB	Access and performance checks pass	Coordinate with security and DB teams.
Release time	Stage, migrate with airflow db migrate, verify DAGs	Health checks and smoke tests pass	Keep rollback plan and snapshot at hand.

Cadence

Actions

Verification

Notes

Daily

Review scheduler delay, queued age, top failing DAGs

Dashboards show stable or improving trends

Adjust pools or concurrency based on evidence.

Weekly

Prune old XComs and failed task logs per policy

Storage growth within budget

Use a maintenance DAG for predictable cleanup.

Monthly

Rotate keys, audit roles, vacuum or analyze DB

Access and performance checks pass

Coordinate with security and DB teams.

Release time

Stage, migrate with airflow db migrate, verify DAGs

Health checks and smoke tests pass

Keep rollback plan and snapshot at hand.