diff --git a/demos/argo-cd-git-ops/README.md b/demos/argo-cd-git-ops/README.md index 00d62892..49a6c7ba 100644 --- a/demos/argo-cd-git-ops/README.md +++ b/demos/argo-cd-git-ops/README.md @@ -10,14 +10,63 @@ The easiest way to seal secrets via `kubeseal` is to have the `argo-cd-git-ops` It provides the Sealed Secrets controller and a generated certificate that is automatically used for signing via `kubeseal`. ```sh -kubeseal -n stackable-airflow --format=yaml < airflow-credentials.yaml > sealed-airflow-credentials.yaml +kubeseal -n stackable-airflow --format=yaml < airflow-admin-credentials.yaml > sealed-airflow-admin-credentials.yaml +kubeseal -n stackable-airflow --format=yaml < airflow-postgresql-credentials.yaml > sealed-airflow-postgresql-credentials.yaml ``` For "offline" usage you can first fetch the CA from the `sealed-secrets-controller` and use that for encryption when the demo / stack is not available. ```sh kubeseal --fetch-cert --controller-name sealed-secrets-controller --controller-namespace sealed-secrets > sealed-secrets.crt -kubeseal --cert sealed-secrets.crt -n stackable-airflow --format=yaml < airflow-credentials.yaml > sealed-airflow-credentials.yaml +kubeseal --cert sealed-secrets.crt -n stackable-airflow --format=yaml < airflow-admin-credentials.yaml > sealed-airflow-admin-credentials.yaml +``` + +After sealing, re-add the Stackable labels to `spec.template.metadata` of the generated SealedSecret manually (they are not part of the encrypted payload): + +```yaml + labels: + stackable.tech/vendor: Stackable + stackable.tech/demo: argo-cd-git-ops +``` + +IMPORTANT: These manifests are synced by Argo CD directly from Git, so Jinja2 template expressions like `"{{ DEMO }}"` are never rendered here. +Kubernetes rejects them as invalid label values, which breaks unsealing — label values must be hardcoded in everything under `manifests/`. + +## Plaintext secrets used in this demo + +The sealed secrets under `manifests/airflow/` were created from the following plaintext manifests. +These are demo-only credentials: the Sealed Secrets controller key for this stack is committed to this repository (`stacks/argo-cd-git-ops/secrets/sealed-secrets-key.yaml`), so the sealed secrets provide no confidentiality here — sealing only demonstrates the GitOps workflow. +Never use this pattern for real credentials. + +`airflow-admin-credentials.yaml`: + +```yaml +--- +apiVersion: v1 +kind: Secret +metadata: + name: airflow-admin-credentials +type: Opaque +stringData: + adminUser.username: admin + adminUser.firstname: Airflow + adminUser.lastname: Admin + adminUser.email: airflow@airflow.com + adminUser.password: adminadmin +``` + +`airflow-postgresql-credentials.yaml` (must match the credentials the PostgreSQL chart is provisioned with, see `manifests/airflow-postgres/`): + +```yaml +--- +apiVersion: v1 +kind: Secret +metadata: + name: airflow-postgresql-credentials +type: Opaque +stringData: + username: airflow + password: airflow ``` TODO: We should probably create a script that seals all secrets and puts them in the respective stack / demo folders diff --git a/demos/argo-cd-git-ops/manifests/airflow-postgres/sealed-airflow-postgres-credentials.yaml b/demos/argo-cd-git-ops/manifests/airflow-postgres/sealed-airflow-postgres-credentials.yaml index 21f3cdd9..7b01f330 100644 --- a/demos/argo-cd-git-ops/manifests/airflow-postgres/sealed-airflow-postgres-credentials.yaml +++ b/demos/argo-cd-git-ops/manifests/airflow-postgres/sealed-airflow-postgres-credentials.yaml @@ -18,5 +18,5 @@ spec: namespace: stackable-airflow labels: stackable.tech/vendor: Stackable - stackable.tech/demo: "{{ DEMO }}" + stackable.tech/demo: argo-cd-git-ops type: Opaque diff --git a/demos/argo-cd-git-ops/manifests/airflow/airflow.yaml b/demos/argo-cd-git-ops/manifests/airflow/airflow.yaml index 4df65e9a..3da53989 100644 --- a/demos/argo-cd-git-ops/manifests/airflow/airflow.yaml +++ b/demos/argo-cd-git-ops/manifests/airflow/airflow.yaml @@ -5,7 +5,7 @@ metadata: name: airflow labels: stackable.tech/vendor: Stackable - stackable.tech/demo: "{{ DEMO }}" + stackable.tech/demo: argo-cd-git-ops spec: image: productVersion: 3.2.2 @@ -13,7 +13,12 @@ spec: clusterConfig: loadExamples: false exposeConfig: false - credentialsSecret: airflow-credentials + metadataDatabase: + postgresql: + host: postgresql-airflow + database: airflow + credentialsSecretName: airflow-postgresql-credentials + credentialsSecretName: airflow-admin-credentials # NOTE: This cannot be parameterized via stackablectl since it is synced via ArgoCD. # # In terms of forking the repository, this should not be a problem since the DAGs are the same. diff --git a/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-admin-credentials.yaml b/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-admin-credentials.yaml new file mode 100644 index 00000000..c386395d --- /dev/null +++ b/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-admin-credentials.yaml @@ -0,0 +1,23 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: airflow-admin-credentials + namespace: stackable-airflow +spec: + encryptedData: + adminUser.email: AgDCOe0HVbkLNfxo6bCXr0zBhQzo5XKv0i+CtPAOdsVnaIp0YT8mcbIh24Sof//YDYtX9/8tTgFwnKfBpwTC+5aUiUabAkJifGMzEON40+nNnfMpTXRjCk3boLvucDtd2YE6+dlKvpksiIrn3Xf8ktn2B13ildfnEXQHwm7ddMxxScxlsUOP4axdQLAEuiRZoq7TWUkDXCQK6piSDfSadjcWSSxbsVdEGk//GLA4Mz2rodauHp5oVWp7sKamnyDZeNvyLkVbnZ+nqBljSdYReqsG/pg+S0pTR2bc+R11bVWnbw7Iw4YeReRsQbPD2rQmnIxWWwCjwzXgKtm211gFB4WyCBmnx1S8z4J3EWBhkQVb0pUVV0NWwa5X8FukzDBA0W/ZsxNmxlXeYrj8dFPBXmGxon4rbawITCmm7PvzLV3MG6vYpbWqO8UfP5bGVXJKNr2Aiz9piiPzWGiuHcxBB6xxrRjh0Y42HNq/IltI67Z7VFAf/aL4PSLR/oBGol7li/qSObdYny2waJH7W+wAE1x5AkbHU44lR9AX5eYKvtO3n9vS3GGY2b244qnDjqseVM23p/oiFyUFzLUHWa6z8vHzZqGiVvt1vHm2oYVYjq83641vdYArYTCfKq4KP+ZuGZ9XnX1cR4MTPisENZez2iYeFuAT0tQPJXs0V43igqJsWXTC1NW1qpknF6PRDLZ0zLaz7secGUObQ44o+qvxa8N7a1ba + adminUser.firstname: AgB9RjO3GWAevCNiew6vsD2RvnYjvYl6VW6pPrevoPpmxkczaXQMHY9iR88254fUFyOATLHrHfSxMmucvIgc4WuMR6xR4MhGNczDWOZ37khN8XvvbxW/7BlPWuhRheQUXuXJRhYEgeZywCUBMuJ+enJbjJg5z/5NoEb+NGmrl4lGcJrVbOPV4Bgw+oSdqdvT+yNTWjUaVie7shb8mwXr2AbcMAyIqsmmg6cnl4ehj3t5pk+666RLchIn0J8HN0EmDPp1mNFRVu0o7whSzF2FcZpcvkMGHD4K7lgoy6AwgMmCdJLiRQZSq7FVG2fdtRH0JqPCJOHBhfPYhWpDuyDXRxT/xQCmLQbAKgZeXoukyc6Knd74UJ0hfb7nfyFJftxdJbczKwPHkk+SpL/MUCmiYyYVsuvyx9De1CjBEcjGBBfh38NAg4l2ZpNYQpj4i4I9rQ2OEW/dykEikVFyvKFJWrrNV8EoJmG8IjW8Zmvtbf1Fw3Giq8Um+dgilQdrkEc0tWn+cANLYIS7avsQmukrrBpkLDH3i/OMr+VrieNOYtET8CuQS/NBvQeiiG0AL7BN4YNDW3oLenZz0CeO/iYZGAwMvWUpKeDKfXAI2jd8vrQl0lAIrSklY3MvGhc6eAHS8qYOk+owVdQ1wpmivhLcdT+/93+5IrZIjfd6hEoRb9mvYI/GJGJXLpnLCKvAU8xIuNUbCTcF0DdP + adminUser.lastname: AgCuOHWFCt6zSOtjh30bcdr+ykfal4Xn/MVy67kCh0I4bjdwMDbk1gjVtDZJ/J4LKVcJMMhs56zckgAqTR6L+Ly8ip4yLAnrBmH6hJMiQ0Isp/w0wAuZIo+GmiszX/g2YGKr73DMiPaijECpPn1G8E2yD5n8aksvxUtOsVLKPV/14f3TTl84m/SMFkuJu9E3tPQdz9QaNaBfG5dXMCldZZ9gn7vJ06SxnRC8y84gbLpYRTRE6MxpImC/R9gmrjefLV3+7RNgNjfBuzpTiA4PeK8nPaZ1b13aN3w3a4wwfruhquPyZiWjtN6QB7XebD9Iiw8PutMEUm3H1ftBnDVGVw2yTDCgXRteJMaZD2ENHC1zkiU0MtjCaiWLCBnrubYXNZ1PdV5z1YE+sWB3imeHLMBQeQCVbanIkAi43JpisJUAL+SeejkgoWKHtTzkq3DJb1h94yu2+6KVw0/eIqke5dOU7tLcGUNt4neeVlDHk0zh+caZUCERoQy0yCVVewKfvOo79g+SF+ln6AB4XxHkOfHK7PMJlaqdiDFIbjANeGFf8b/gmtPZ4UNeAKlu1iLyro8xpQ+43yF2VFtJLODUM+/H54ySKDEs5lPAtRhtkscL6r3E4HbkyDwXug+Bt8/4zn1UILtPluJt9pFMmuAo4If+lCSHfgnJsbgV3TSaTnkHPJdtMyapZamZRly0PzD13qtwoJJUcw== + adminUser.password: AgCPK0OegmhKpz+4NP2iu0n8uFp3ug68bcxE5EiTgVIqrMQo7R4Q38fQjzraCEHaSb34XpRPs2OgWQIkXybeDTFveeJooIe5UgqoLQlpHhJEFNxcQlYvrn5MNRERADqeEJP9VvcETIFWPZww3hq8JnFXn6IuGjhywWpILJGvjg4v1cwGFtAgvfEvis5Q5ciYuveFfCkcgsHfIfGvFElM1yY730aGe/RQQI5PextMfAnfA2PUF4IrrGtBBj+1EfYG3wL6Xcm9j+jb77hPkfpE0hxFzh/QnJOmkr2RGfMke+y/Z85PK5CVP6+OzYfl0BKDzLHvvqrpw+m53CrGNXajbKmeFNFCKQNuRXCU1INDr1BMZIaywWSvcKu7HSDD1cx0kDyFFMRozGADhydG8b7dqJjWRn8qLPWd54vqnzBx2JSE63RP4vF4aH93IwEDwqqaZ0IxDcS3IXeEfwYm1GuhVHrhLlrBS2ORZHzqBkJ+qpzaC2F1WgIqaHQzzH+Skuu9JXuOuyXZkSuxBVjTTOuVkVMvTh5iyzAKb5MuTFCpFzqg4dDsBEAzch/BDVsyinIaoveUj1fuDejRkG9H1S5gDeYdKISwbCq+7AzzM0s+GmcnrT1ELvvErQfYxZZuzbZYYnm/TYZPIehiqNnTZ5m0jB2wD1sLIW+wQk2tiRWlm9Vg4C619m7xGW5h+HEYYOymLVvYYYBBQmkSHuHf + adminUser.username: AgAGZ926kV4RdzOqW4IbWgPPzt/YU3WFaupIIYxaVmCtELTuKzZ8AVRWFDa3y9I4pU0MntkfORPJsZLxbUUmCEqogicTtUQMA0yQMLp/Wwfe736mUx0oBXP24juQQroeKg4sMUk0DRt9UF6Y/EiBv3iBIBC80tGNmbIq2MECUVkyx6sp2DmcIkLwuGJdMaKc0Jdju66mddmIx2eqKJ/VW1tBCkcYAa0ulcWHMNI4Q6uU/fhsqVLeQ6W5Mef7RyOw0bHLhb8a8puRiIik8GNYHklY3bbZlwBJZvwkcYKP2tiqVO+AbUh5q38PNIYsHcfumEVp1U3Gag58ck4XZ279m/8J3hz665jEszPxpeh0AwGbGBPVhu9EgPWP0jQoreCZhZ5UwRlHYIEs8ftrwHxl5z+RoR4rg1e8/4Bpe6tC6y+MZBW92iK5DCBFNcy15ik0cWBhe7XISWiCN6UTY92yg51RFHIgwv4XuwVj/71Y3Rr51yOp3oQ5cwIMB+bLieO0hrUGEDpG466qNkcN21SgQDZzh0KJ6W05VmPJB85NTDQ0O19yZ35N2XeUKI3ffm7MpQTm/JcKPqlllaQRBNIsjvR7Dj+evLD80txMHZGm5tboG9MfBZIncIAHqvmw5Za6BCzDUgOc2FhSE1cIuGb485EEnLqy0EUj7s5LjloMTp/bnk/YU7w4FSwd9fZkFnnqO3OGRukKVA== + template: + metadata: + creationTimestamp: null + name: airflow-admin-credentials + namespace: stackable-airflow + labels: + stackable.tech/vendor: Stackable + stackable.tech/demo: argo-cd-git-ops + type: Opaque diff --git a/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-credentials.yaml b/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-credentials.yaml deleted file mode 100644 index 520e5eff..00000000 --- a/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-credentials.yaml +++ /dev/null @@ -1,27 +0,0 @@ ---- -apiVersion: bitnami.com/v1alpha1 -kind: SealedSecret -metadata: - creationTimestamp: null - name: airflow-credentials - namespace: stackable-airflow -spec: - encryptedData: - adminUser.email: AgBJq/dTwq0biM8b8bl2/daQSbWPRXSnOHOMnrJRjxM7A5KX68HI0Ifp4r47gSTZDQuKxNx5PaFuyU6W0tT9CvbFSPdhTXb6G5xLXITafrpd2he9LiTRzI0wzh/xa8sOChTNHK3rXBpU8n0Y7aYVDp7mibFk6CQKhMMq8s/OL5Scp2R4mbiajAtXMwQ2wt1fF3CAqR4QgxqGGr0cEugGf8zl/Z3GryUjJsqjNyhkjDxBN2E6oiP8Q1NCMV7AGGxdqHyi3PJH6hFddk07fTKu24oV1/IkdPZ7QgTXzhV2dk57KcSX8wB9gksWsCiFGlL4RnKwkmMbNzXq5m9zAk9YkN0QyMu0pRBI/NqhFTfhXIBcVsIbEa/37rGxV6oIaLqndneSG4fDTu0HP6ga98pM/nD2Nrzlj1gS+KwaBSGWq+CWs3HSah35treHxne3U2nuG98+nnIvUQUYI36b7MAP9xQ5Koykk4iU6LrVoxyck42k3VxeWNLc4W1axOBLGyjSxxUmZMWF4lmlz4Z045/SuBF8O4mmIHj/3cK5EEcAlme3lebNKht9/w3iaxDd+dG04CP8RMQGE7i3OdHpteilZMszXyjYz8m08u/wgiKG8aEkh8ad9fNeR4RnGP5CMpifrLZeCsismj4R9JN6B3lr3q2s1Ot/aedPsk4JMj0RgJAnLkSQHbYI3twJAOq4C/6HH+fSsripLIL4CjC39Hevp6Nku6ef - adminUser.firstname: AgC+TLraEdynGLvTTBkzXgBEvnK0c+97PsdcVTK3BIFD0L4APn3HM6V2WiUcyBH//YJqUiNvg5mnJZx3EA1EakPdzkXlitYNFy6XoMDTkrMZTgiD/VAiABBmPyVJesGz5xxlovqFGpbGWQbXjr+fGOINqSciQi1JMzN/jQ9EJQRnyxr7Xq3rmF4/NsWo8s+fEbQHx8SmNrS8mu9BFd+QSL5pTskZJkcaUuzduCXIheacJcRE+YwiufQVOFSo2AkgGcbwzLBRJuL6+u6MST3qr/xapsBuGSwHtEoVcI/NApTYsGZCeNN6H8e083BnRGCunfnw/R9/5Xg4uxdUEbGT16gP4H5/o8V22AmH2opSgPgxVSntAn6h5cxva2YUc5Bezn+pKFZmK0KCmC8tUSDusje3X0emMIs9+fC+ksj81UwSikC+hKbuZz+HuzS23UCy+w5R9X2SDGk802zxdLVhsXn/46dgaEqzOEa1pYJEyCRZUUv4KTdM0/XXfkid4r1uP0d6bZ7jlS9tSDQ/ajm5dAhl5W7nIYdRVAqM5KhvvY3mWpqIdscdr+bhpE46mJPstP6O4FM3/0OYPntmjxSVTFf0Uc8mHY4RRAM2sN/ViqcDGumn3Q8xlQtG4vMO2Tx+GAStzIu9AGsTFYcak3fI8kpZhs7mhYCXeigSusaIcsH5bfC7uekMrqhrKraY5hOU/xaxjydPIzN6 - adminUser.lastname: AgBzqzvmZLHUVDcG6f5cyBxUef4Ov0PNBGaqrYLKPMk4a681XpPlfJnNvMk87aV8Ts1xunoozWs4uM2Z6pQa6ZIYoR5oRkO4bLqK16frBaVypKVsKRPkol+bSyWPLGuI0izIKdAcHrtuaEffb6Sr98i6ColIqGLEYlzUalnPIuK/W7QqKXO91jHYnTv4m6LUMere1N/x1cmeZ3+W+BukWLkfiLko4wgCSauUCene9azY5ehtmlIAUo9xNC3oDA+rTGTI1SkG2Xe/ytI92sedCEMmVX7oU9PI0KGfckchc6azmOTsWN0hSnUdIHPPDn+9L0x77HwHeMfiVgO2Bai76lC5fO2b9Pw0OxID5EKY4jvIrtQ2uQANCtYupge6Z37njpzI070U/H65NDtCKAGmcuy4pFgdF60VrEPrfAN+uaVJXmJGu75QmaKqGWE0RAW9UcjiKD9YaQf7pN2tx6v2oga/OR/cDTR+LJYIcwAC2HI+v9t2cb3LqznnoixVwU83qOOqDelq/Pd1vV3Sf1R2Kj5E4UlYm/lEtSczKJyxX4Rim34kzMqZnmYP/56bs4NwXjJ8vmMHEeFkO5tL3NaVgeJ3yKvLG4yUtasXxlrSUgLdXXTu6wN7PuBUkzCN4maYHrDjJYApo1iIXhObtgRbDatosCUCJOSvE0BEEf9CKP++SkUdipWVk84QK3ryNYQOZ12Lc4rnkw== - adminUser.password: AgAXw2meNuLCnWIDeBdrUI1osShroov1kjvRJ5+mLtGHD9cOTfQlAJpGXN+QwVWXz/hsRl0zhMxI1EomJhXOOyNI67ptlaMnSV/Wtt5X92ISmHReR/1R2cXv0e/NQLbD4M3AmCpvSz0agYMBxtIFh6mVeMah2RRjVD74Xc3P3SrHjnY7CiLYe58JWVkxGAp6WO2JTpopUJI1Iagr9MHfkGzPp3ygFVxwiMjPIVCM+IeAbtHLNi2w6slrcKa3IJduLSaGOQEr/p8YcPm2Qx2TGHOpiM6Lw9api8JtN28mS5hArc7qj5kkwkfEiHW2exYMXVSdWy7glgEGFuTr7MRi0LpLqS72DT55E9uxAObnlWuiKVmk6UfExX2mMfze+Iz4sKXrqOFoLAIXx8+yjO3t5oDvJf9pxLNihl4rYyLg9v8+UkkGJLQZPOqjQoeuH9ighDkHdfkiUDdprnG9iZAQBFzKN7On+tMA09McwHkC6jV+RIv47zty1CMoEPQ2wEM+zDHU6DG2HvtHQYov1pCpXzyvMz48hcKiAwIjZQM1RZBL0tN5qd8Tp38MqtAvVt7PvllwAN2LKt9HdV5j82kyWseE6MPYkB1l8Q6ctUn5YY0kw+tWwgtmYbeRY9+kSIUphxntX+unzhCKCAY1oBOc/cdim3YQInGGe6lx3JGUQvz5LpP6+aVBPyy8HOPnUSyxdu2ZaBkG5SKhKvfH - adminUser.username: AgCVVTX2c+4moS0v6mXuNQ5v6EtxZ43hN0QYg8wgYG+GPR3qZ2Ep+FkUJq86q9dFcuX6EXXtS2h8BJr2sUrRW6QySFnhtmg7A1d4anslN3yAjLipwrreNT9cn1t4PsdIhU0q5Z2uPmMsnLF28D73AxWA59iiveIId2KSuB2lsaC8S8CeW3Df48LW3cnukHtOvc+j84YQgFdagujBtwAMCiym2pdBJG5GojTHQ/5P3AnV+iM5wzXaYIeF5UZ0wLs5WU3CqHLxsY3q7NrLKGzS0xTqqdc6H++tJQFZY5G3q4NcCx+jq9oRErE0ARz3ok2pOHPArUEbyas9+iibA9HJcCmrKguQ8QBvaIQh9L0YtHCtwvaMbR12ZmMfRtMW6pZnM/d2K648JFekuezGTOVEjLk+ZvVm45L4USZpB0MD5LXEy3m8cDdkn2wqTWvblfjgfi7opoLgpwLyf/BZuunrFWT08x9K1WmNQ7OkM4WxscLRyccFOtZQfoUtT8hW+K5/mxLjOQDpryWPCUeBDAMnBvbGG/0AABp7a+vWG9KVus2ZyfUHVFIHgJBsHXXDtONIkmRvTal5bjlRsVk4Y0O3DoJa+UjXYoIBSm1JwdUJMOnL1MoS7Ijk+iXKPMc/3fcbrnfqYxw3ymr485bL8fKh2n99MsCdR1yX/mTxw3f6bRZdN5O7IUTkkKVxx1b08FD1svSwNKHBZQ== - connections.celeryBrokerUrl: AgAD1Iu/Oggx5NbNY29aJweDDVHlnL2KnsSJwBufPSxsaQouGdIIMIsWr/y2z+qCtd+TBG7f/ZK6vvTlT8kGeq9PGguGTOs+jQObFsqOWoWMn+zbZl+H3SsXHE9ohlrq36n6b68vRrpR/zIvI/QcFg7FC8qhH7GhxzYoUfXbIVEg9ZUyg8W9GgznIM8pJD7v1blz16fXerC3D3wcY449wvQuygZucGyGNfCK9+y75/HQldYVg5lG0Gb914uT5hQ4lATlH7xnHQcxwXhT+30qphNcIJSNZW2D6S0kovtoZ8xk6P/xoO5uZNzNyFnRxIu/AhVi3T2L/dzlO9ztbxwjCu19xxDo16/vhXQ5awGcyJjHqZc8Pu4v5e7sJTElguAHooQraL/dcx9fJvVOxk+3GUMwixfzSR3R/BD2Na4l9mT3fwiW53UTYIcDm/jRwZ8EPZz6GtWVPtwoOkpe6y/OLoRtGNlJEW2fR2d4VwsrqnPV57716FuI5ETwvCSJcqaoMk1kPZBzWGjgf02owizSD7gKONBLX8G34981JsTu/vloPD9uPYQoQ9oFlKVtdmYKhL6u08ekiwLoojp51T/JB5I0RYLKSu4nR8O8SK49RH2CF/4viBs5cCezP8Cfq4qxSBHsd12PXHocUWK3v5e7xgQXi4wJzoLifNcS2FXwV+97DvHaYCM9KUogdL3K/MnPSfb6SGI5WHJkExK5Hr2WqKG+3zFIr+TfIf8V5QcrXaFEz6m0iK49x5hIvjgmnQ== - connections.celeryResultBackend: AgAEg3o3zzMI1fqVt119TiNZ2U9Uvg5ua1gSW1klHtI8P49n/ZTmYftFJcPkJfw8mjawxuSzwTvPWNirkcTyF0jpauyn2W3L7q2SwuMMmS96z4R0FBwa4a1AjP7Rovq9r4lPjtjn45IPX5VPDG2gBiscVhBFLzozFucgXVk6bLo3bu8/lXuf+5PXaTH7TtRfYuTipiY4jbvlCx5jR3omzgnLThOWaoplnfIQPQbhnLF4t9ydipLxV+Dr2ccGnT+yehHxbmROK5kRD8DgPe0oe1+qFS5zIRyG6KZBgI3+ru3wAkbREeuE/Bq9nDWmRS5JVDlOKaFqFtYU2h12LB/f+MKPhwPdvzCiWLmT+XU8WW25pjUXHDakXRm4RJI2J+24cTjue2jv9GbNF4+n+ywunUpNqEagJ3q0VFZ8o5evZWjw55qMnsE6eMpSoPygssD1sfQ5jf4W00onxjSEijR7STqi/6zBEZzKzPSij3fH5HeWmsd9MwnQ+1/J8VIighxKm2RSRn6ClRsXggMvzCCf/wg5zwYClMWage65fytKYH12lR4Dl2fNHFYexTIWvrL/36xuuKhP/Glpz6dJHKm5bHOjeNo+RMtKLTWvr3NVqMQMzK9yl0JdPJKByoqLy+xR5pKy9TacihXJXZhpEPd2IDK2/zxCI+71OIN0iNqL1KnfI5VMtFJu/jEmkgzD+Hqg4UlI3a2frgxtv5chMvIusHIxf/2fv3OoWVhfIjObD9nlnbwFQHhAfnMemeMhaxlnxQ34aI4gFZJ1m3hg - connections.secretKey: AgB9N48o16//pMoE7YPHGHQUDd6n5gQGJcsDK2kmsxM1fj4POpG8eRwxXpRlNwBcH8VhgJAWJKLWUrIy5cQ4DM77gDGcG1YOpHIXDMDzTtocLmLJmpxoFGrswv0lEB0dCZwSpOph3btBzCDuKNA/nzHD/iwoVkZiDao/CyC+wjRrudamIfC0aJJsnSo1NAzcmsP1IEaURF0LoWdAPXWCqzEHbJ6FjCdQe/5F2md30PHGt1p0x3/ro4i4gv54ZePWBAStZml/a5i219UBvGROJgBCAJYEb0wlQ5Aut+7PVzjgUfLgWpvGEl1XBXGjuR5NUOiEwcYok+QsonQcUGaNScMzzqrfWRIagAlcGnSzs4TsLUgA2opBlKClVdEqnyS1QEH062ZTrxoFJ0mGg6T1oh6rElGfzmOTMhU95nRIF3wtYh4Si20IDAbWkIJgk1j5+Vvg31KHOTQXR6WdXc1CqYuo3LVzjP4JeIvrsdyqIJC4dg2WAKDTrQ3qixDv9Yq+bT9jMHrdQPQBz1clb8g6OEqtuDeobkTJFU/vdlZRSz86/mtsujpBNHr2SPa5IwIr2ALBx61NXfalc+gp2lUDTQSZPRf/oHIyD/SbARFDCNGmf0rPO1yQ2dg85+kLLSE2+K6uPYPwqippSIyiazIzCi5FLa6B6IEqAxjdrPyBdrMu3Qgkzdhp23UaL7yRnXJkHnPtb+URhrbnqPVIDiNeF0Nt - connections.sqlalchemyDatabaseUri: AgBGW3Nva7kn/GxNKinig8hj/b0KSa6nESiU2zKPwW6ZDhwTA3Kf3jcJCfKE2ISSLY3L7qNeihVnYP3f6S00y+b7oixLxvYxUxCGaVvNON/xtK+dFYoYQfh3hXevLWYuf7Bg5et6Rr2hoDJbkq6Nix2uIEMDiRjWyll3ma3ajlVSxbt4xdboXb/OqRzlCLS433nAruu2woSvw2d4ypoDHYd0uGw/W4ushxOEIDVC61kJU3T9K7UqzUK4bTMljiYxrwMAb3cZ0dnPw2FU/fpT9SDomCWtjnktMkfbzgVWgD/oIh+2IZH0p3Y9GoIDJUhHlBFudDu/t+tQ91F2Xpy3gqmWFSHkfnCex699hx4dBqAeSlf2Frwfz0ZR0CM4aSIKlPH1eyumz8VA5z8AmK8fDcWCvwYeRdS67qPcu0SDKodAlhA0XR3CSj+357TmId8KHS+DZCisrxAuMJGMt6FbCbTRxY6lM4yJHrkP+L9Hv3474deDApZix4h64pqiH5P1hYIsiDM02EkdI5JwrRuZewcfVMDzGhve/u9nSa5dMADrDdjKZAys8hCUgi//ynfJzpOKi/WbfvNeGcYbQdvDX9dyXTbvsSYQ/+jq8DnU69RwQWF3lYIwZAWeoGAThX4jvSppuDY+FtS/1TsrymLQSpPH4lXjgSw7yomRvNx2x2n4Pa3mPpgQ2SR4qKQX4lLeE2t+R39xKQreA4FO3XItLFnZ8ddLj1mcmatGhSMmD6AWI2hmxxxJJ3Of4AnBDrCoV68fYdPk/HeY3C8JfHQnSKcG - template: - metadata: - creationTimestamp: null - name: airflow-credentials - namespace: stackable-airflow - labels: - stackable.tech/vendor: Stackable - stackable.tech/demo: "{{ DEMO }}" - type: Opaque diff --git a/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-minio-connection.yaml b/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-minio-connection.yaml index 3e5d3ed1..40bc62b2 100644 --- a/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-minio-connection.yaml +++ b/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-minio-connection.yaml @@ -15,5 +15,5 @@ spec: namespace: stackable-airflow labels: stackable.tech/vendor: Stackable - stackable.tech/demo: "{{ DEMO }}" + stackable.tech/demo: argo-cd-git-ops type: Opaque diff --git a/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-postgresql-credentials.yaml b/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-postgresql-credentials.yaml new file mode 100644 index 00000000..8684ec66 --- /dev/null +++ b/demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-postgresql-credentials.yaml @@ -0,0 +1,20 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: airflow-postgresql-credentials + namespace: stackable-airflow +spec: + encryptedData: + password: AgBc32xJVX5MxFZIBfJ7KsgGxLTJHCxPIVhXT3rYbLaPPojIDfu+8ygtdc3UqzFc//nuxbg8WkCUI6UclxGkL9ODUknvQTYCd8ZtmbGfI7BaSbZLhQe5qzd1LLnKtVil2xvYKidtPiob2nn76I8BfiAoenWl9cEqJT3aAYdbau5rMO+WTmc6Sl2+Dl2tBGQBajZRPOB2474NFpEVHf+wOZrIRZhslYBL4i905wkUrpp3G6EPWJRVbeqNFRBYpAxJhMJgny84wLN9xt25L+B6XMagNuo6jXfHBpYkEuyb07k1vJd+4ij1w9w31Lf7HEmsFuLeQnYszyohecCBosORsNI0jwcs4QPbaCerBBZiLftIjAZEOrlU1EoF3I/K3SKJXtxN8ofq0IvNksJ5O+Ofgudi+eOdrdiVHQcDfh6afn0o0bFyQ5CB+/BbeA+nmOlcj0A1xNf8OmBEu6ARA7YQs8vwUMqvfh5BTxv0nmH/OMQkpIVqx8Ik0n7bUoJZNh21uYFATnfONx6R0kvz/WcLSW6qVt8xlr08sKjJh8BQi8WTnXISzZDbTG/j2O2vCD5TGgQ/JFGKzii32KCXw5d4Uk02nAvJhkbM8Xm+A5kC5d1g/w1W0/lnU4nVlkyJPq81A5R3+Pk/8jh96/u0oKjiBaqrQA3Qmam0mMt1k0ITmtMZy583y+BTqtrcU1H9HRV87n05DIZ4Z1ug + username: AgBmgNVPYGAsq2spiGiEqAHFqlww9hy8hFX9xhkJW3UWE+/DYzOCqfCIt+e5SMOD1sV+iTsbY/M7pRtGCafyq/pZPraQjs3tSYVC9ggUe/ApsQgWvVGnJJyENnBJAsyN/hH5PzQrgONFOS/B8Sdd4fYlngIEGkvZW/r5oXPmhiXfnUOKgT9f4E2GBVJPrmwZ4c2y34AxCv6Xf+qR7szNPOPYC4ELNPIGWUffOU0AYZHKXczz01fLbif5q/d8f7S6EbeU206xinGheEtsY6G2gDkP9cjgASJUqOq1Uq9tVvIlC1vU4fxo3v+D1pSDPbdHJj+shOtW26nUlNtmVbMCfMALnMbJ0Fowso6sCQY0Us+8FjuLoNHNUO+UFDMQgEVZuxCZGAVUoABAg05xdJCimmMgpvz632EslLcDtUJWpkpXcOzXFOgnrlr9vYHhm1catLUwrthOvV9xT+t6z1j00ztyxCYt9CEob5jNmtt/XEOWUl3iW0a6+Z/BHhwRN5/TjVi48n9WOWDGU66u7ZksDDv1eSgLumPFQUKjQVNUh9YgQdtUabATG6t2O5ttko6XGCTyZTBuCSoi/ZmVWrenF1gg8WoLCOFPk7UQvD8QlQsr/KEut2iZZUe4q3Hqp+KOwEnlXXZ10P+Da1Lr1StlA6FBdTy5YzTOmezkBI7nNwyM7udqB+/hmKDvpV9vA14JkZtjRGUUWn/I + template: + metadata: + creationTimestamp: null + name: airflow-postgresql-credentials + namespace: stackable-airflow + labels: + stackable.tech/vendor: Stackable + stackable.tech/demo: argo-cd-git-ops + type: Opaque diff --git a/demos/argo-cd-git-ops/manifests/minio/minio.yaml b/demos/argo-cd-git-ops/manifests/minio/minio.yaml index 7f2c5217..731d1109 100644 --- a/demos/argo-cd-git-ops/manifests/minio/minio.yaml +++ b/demos/argo-cd-git-ops/manifests/minio/minio.yaml @@ -6,7 +6,7 @@ metadata: name: "minio-sa" labels: stackable.tech/vendor: Stackable - stackable.tech/demo: {{ DEMO }} + stackable.tech/demo: argo-cd-git-ops --- # Source: minio/templates/configmap.yaml apiVersion: v1 @@ -19,7 +19,7 @@ metadata: release: minio heritage: Helm stackable.tech/vendor: Stackable - stackable.tech/demo: {{ DEMO }} + stackable.tech/demo: argo-cd-git-ops data: initialize: |- #!/bin/sh @@ -414,7 +414,7 @@ metadata: release: minio heritage: Helm stackable.tech/vendor: Stackable - stackable.tech/demo: {{ DEMO }} + stackable.tech/demo: argo-cd-git-ops spec: accessModes: - "ReadWriteOnce" @@ -433,7 +433,7 @@ metadata: release: minio heritage: Helm stackable.tech/vendor: Stackable - stackable.tech/demo: {{ DEMO }} + stackable.tech/demo: argo-cd-git-ops spec: type: NodePort externalTrafficPolicy: "Cluster" @@ -458,7 +458,7 @@ metadata: heritage: Helm monitoring: "true" stackable.tech/vendor: Stackable - stackable.tech/demo: {{ DEMO }} + stackable.tech/demo: argo-cd-git-ops spec: type: NodePort externalTrafficPolicy: "Cluster" @@ -482,7 +482,7 @@ metadata: release: minio heritage: Helm stackable.tech/vendor: Stackable - stackable.tech/demo: {{ DEMO }} + stackable.tech/demo: argo-cd-git-ops spec: strategy: type: RollingUpdate @@ -501,7 +501,7 @@ spec: app: minio release: minio stackable.tech/vendor: Stackable - stackable.tech/demo: {{ DEMO }} + stackable.tech/demo: argo-cd-git-ops annotations: checksum/secrets: fa63e34a92c817c84057e2d452fa683e66462a57b0529388fb96a57e05f38e57 checksum/config: ebea49cc4c1bfbd1b156a58bf770a776ff87fe199f642d31c2816b5515112e72 @@ -597,7 +597,7 @@ metadata: release: minio heritage: Helm stackable.tech/vendor: Stackable - stackable.tech/demo: {{ DEMO }} + stackable.tech/demo: argo-cd-git-ops annotations: "helm.sh/hook": post-install,post-upgrade "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation diff --git a/demos/argo-cd-git-ops/manifests/minio/sealed-minio-credentials.yaml b/demos/argo-cd-git-ops/manifests/minio/sealed-minio-credentials.yaml index d33f7d83..02fd6ae0 100644 --- a/demos/argo-cd-git-ops/manifests/minio/sealed-minio-credentials.yaml +++ b/demos/argo-cd-git-ops/manifests/minio/sealed-minio-credentials.yaml @@ -16,5 +16,5 @@ spec: namespace: minio labels: stackable.tech/vendor: Stackable - stackable.tech/demo: "{{ DEMO }}" + stackable.tech/demo: argo-cd-git-ops type: Opaque diff --git a/docs/modules/demos/images/argo-cd-git-ops/airflow-dag-overview.png b/docs/modules/demos/images/argo-cd-git-ops/airflow-dag-overview.png index 0f0dd57d..efefd76e 100644 Binary files a/docs/modules/demos/images/argo-cd-git-ops/airflow-dag-overview.png and b/docs/modules/demos/images/argo-cd-git-ops/airflow-dag-overview.png differ diff --git a/docs/modules/demos/images/argo-cd-git-ops/airflow-dag-run-logs.png b/docs/modules/demos/images/argo-cd-git-ops/airflow-dag-run-logs.png index 99e5ee60..8cefc6a8 100644 Binary files a/docs/modules/demos/images/argo-cd-git-ops/airflow-dag-run-logs.png and b/docs/modules/demos/images/argo-cd-git-ops/airflow-dag-run-logs.png differ diff --git a/docs/modules/demos/images/argo-cd-git-ops/airflow-welcome-page.png b/docs/modules/demos/images/argo-cd-git-ops/airflow-welcome-page.png index 7a069ef5..5319af97 100644 Binary files a/docs/modules/demos/images/argo-cd-git-ops/airflow-welcome-page.png and b/docs/modules/demos/images/argo-cd-git-ops/airflow-welcome-page.png differ diff --git a/stacks/argo-cd-git-ops/secrets/sealed-secrets-key.yaml b/stacks/argo-cd-git-ops/secrets/sealed-secrets-key.yaml index 0f2cd25e..e22050b6 100644 --- a/stacks/argo-cd-git-ops/secrets/sealed-secrets-key.yaml +++ b/stacks/argo-cd-git-ops/secrets/sealed-secrets-key.yaml @@ -5,12 +5,18 @@ metadata: name: sealed-secrets-key labels: stackable.tech/vendor: Stackable - stackable.tech/stack: "{{ STACK }}" - # The following is a Jinja2 template directive, not a regular comment. - # The `#` prefix is required to prevent YAML parsing errors, but Jinja2 still processes it. - # {% if DEMO is defined %} - stackable.tech/demo: "{{ DEMO }}" - # {% endif %} + # NOTE: No Jinja2 templating in this file! It is synced raw from Git by Argo CD + # (see ../applications/sealed-secrets.yaml), so template expressions are never + # rendered and would be rejected as invalid label values. + stackable.tech/stack: argo-cd-git-ops + # Required so the Sealed Secrets controller adopts this key instead of + # generating its own (keys are loaded via this label at controller startup). + sealedsecrets.bitnami.com/sealed-secrets-key: active + annotations: + # Apply the key before the Helm chart resources so the controller finds it + # on first start. If the controller ever starts before this Secret exists, + # it must be restarted to pick the key up. + argocd.argoproj.io/sync-wave: "-1" stringData: # Generated on 2025/04/12 # openssl req -x509 -nodes -newkey rsa:4096 -keyout tls.key -out tls.crt -subj "/CN=sealed-secrets" -days 3650