Skip to content

Commit 1945c43

Browse files
adwk67adwk67
authored
fix(argo-cd):demo fixes for 26.7 (#438)
* fix(argo-cd):demo fixes for 26.7 * corrected host name * update screenshots to airflow 3.2.2 * revert tags so demo works after merging
1 parent 33d0d37 commit 1945c43

13 files changed

Lines changed: 124 additions & 48 deletions

‎demos/argo-cd-git-ops/README.md‎

Lines changed: 51 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,63 @@ The easiest way to seal secrets via `kubeseal` is to have the `argo-cd-git-ops`
1010
It provides the Sealed Secrets controller and a generated certificate that is automatically used for signing via `kubeseal`.
1111

1212
```sh
13-
kubeseal -n stackable-airflow --format=yaml < airflow-credentials.yaml > sealed-airflow-credentials.yaml
13+
kubeseal -n stackable-airflow --format=yaml < airflow-admin-credentials.yaml > sealed-airflow-admin-credentials.yaml
14+
kubeseal -n stackable-airflow --format=yaml < airflow-postgresql-credentials.yaml > sealed-airflow-postgresql-credentials.yaml
1415
```
1516

1617
For "offline" usage you can first fetch the CA from the `sealed-secrets-controller` and use that for encryption when the demo / stack is not available.
1718

1819
```sh
1920
kubeseal --fetch-cert --controller-name sealed-secrets-controller --controller-namespace sealed-secrets > sealed-secrets.crt
20-
kubeseal --cert sealed-secrets.crt -n stackable-airflow --format=yaml < airflow-credentials.yaml > sealed-airflow-credentials.yaml
21+
kubeseal --cert sealed-secrets.crt -n stackable-airflow --format=yaml < airflow-admin-credentials.yaml > sealed-airflow-admin-credentials.yaml
22+
```
23+
24+
After sealing, re-add the Stackable labels to `spec.template.metadata` of the generated SealedSecret manually (they are not part of the encrypted payload):
25+
26+
```yaml
27+
labels:
28+
stackable.tech/vendor: Stackable
29+
stackable.tech/demo: argo-cd-git-ops
30+
```
31+
32+
IMPORTANT: These manifests are synced by Argo CD directly from Git, so Jinja2 template expressions like `"{{ DEMO }}"` are never rendered here.
33+
Kubernetes rejects them as invalid label values, which breaks unsealing — label values must be hardcoded in everything under `manifests/`.
34+
35+
## Plaintext secrets used in this demo
36+
37+
The sealed secrets under `manifests/airflow/` were created from the following plaintext manifests.
38+
These are demo-only credentials: the Sealed Secrets controller key for this stack is committed to this repository (`stacks/argo-cd-git-ops/secrets/sealed-secrets-key.yaml`), so the sealed secrets provide no confidentiality here — sealing only demonstrates the GitOps workflow.
39+
Never use this pattern for real credentials.
40+
41+
`airflow-admin-credentials.yaml`:
42+
43+
```yaml
44+
---
45+
apiVersion: v1
46+
kind: Secret
47+
metadata:
48+
name: airflow-admin-credentials
49+
type: Opaque
50+
stringData:
51+
adminUser.username: admin
52+
adminUser.firstname: Airflow
53+
adminUser.lastname: Admin
54+
adminUser.email: airflow@airflow.com
55+
adminUser.password: adminadmin
56+
```
57+
58+
`airflow-postgresql-credentials.yaml` (must match the credentials the PostgreSQL chart is provisioned with, see `manifests/airflow-postgres/`):
59+
60+
```yaml
61+
---
62+
apiVersion: v1
63+
kind: Secret
64+
metadata:
65+
name: airflow-postgresql-credentials
66+
type: Opaque
67+
stringData:
68+
username: airflow
69+
password: airflow
2170
```
2271

2372
TODO: We should probably create a script that seals all secrets and puts them in the respective stack / demo folders

‎demos/argo-cd-git-ops/manifests/airflow-postgres/sealed-airflow-postgres-credentials.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,5 @@ spec:
1818
namespace: stackable-airflow
1919
labels:
2020
stackable.tech/vendor: Stackable
21-
stackable.tech/demo: "{{ DEMO }}"
21+
stackable.tech/demo: argo-cd-git-ops
2222
type: Opaque

‎demos/argo-cd-git-ops/manifests/airflow/airflow.yaml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,20 @@ metadata:
55
name: airflow
66
labels:
77
stackable.tech/vendor: Stackable
8-
stackable.tech/demo: "{{ DEMO }}"
8+
stackable.tech/demo: argo-cd-git-ops
99
spec:
1010
image:
1111
productVersion: 3.2.2
1212
pullPolicy: IfNotPresent
1313
clusterConfig:
1414
loadExamples: false
1515
exposeConfig: false
16-
credentialsSecret: airflow-credentials
16+
metadataDatabase:
17+
postgresql:
18+
host: postgresql-airflow
19+
database: airflow
20+
credentialsSecretName: airflow-postgresql-credentials
21+
credentialsSecretName: airflow-admin-credentials
1722
# NOTE: This cannot be parameterized via stackablectl since it is synced via ArgoCD.
1823
#
1924
# In terms of forking the repository, this should not be a problem since the DAGs are the same.

‎demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-admin-credentials.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
apiVersion: bitnami.com/v1alpha1
3+
kind: SealedSecret
4+
metadata:
5+
creationTimestamp: null
6+
name: airflow-admin-credentials
7+
namespace: stackable-airflow
8+
spec:
9+
encryptedData:
10+
adminUser.email: AgDCOe0HVbkLNfxo6bCXr0zBhQzo5XKv0i+CtPAOdsVnaIp0YT8mcbIh24Sof//YDYtX9/8tTgFwnKfBpwTC+5aUiUabAkJifGMzEON40+nNnfMpTXRjCk3boLvucDtd2YE6+dlKvpksiIrn3Xf8ktn2B13ildfnEXQHwm7ddMxxScxlsUOP4axdQLAEuiRZoq7TWUkDXCQK6piSDfSadjcWSSxbsVdEGk//GLA4Mz2rodauHp5oVWp7sKamnyDZeNvyLkVbnZ+nqBljSdYReqsG/pg+S0pTR2bc+R11bVWnbw7Iw4YeReRsQbPD2rQmnIxWWwCjwzXgKtm211gFB4WyCBmnx1S8z4J3EWBhkQVb0pUVV0NWwa5X8FukzDBA0W/ZsxNmxlXeYrj8dFPBXmGxon4rbawITCmm7PvzLV3MG6vYpbWqO8UfP5bGVXJKNr2Aiz9piiPzWGiuHcxBB6xxrRjh0Y42HNq/IltI67Z7VFAf/aL4PSLR/oBGol7li/qSObdYny2waJH7W+wAE1x5AkbHU44lR9AX5eYKvtO3n9vS3GGY2b244qnDjqseVM23p/oiFyUFzLUHWa6z8vHzZqGiVvt1vHm2oYVYjq83641vdYArYTCfKq4KP+ZuGZ9XnX1cR4MTPisENZez2iYeFuAT0tQPJXs0V43igqJsWXTC1NW1qpknF6PRDLZ0zLaz7secGUObQ44o+qvxa8N7a1ba
11+
adminUser.firstname: AgB9RjO3GWAevCNiew6vsD2RvnYjvYl6VW6pPrevoPpmxkczaXQMHY9iR88254fUFyOATLHrHfSxMmucvIgc4WuMR6xR4MhGNczDWOZ37khN8XvvbxW/7BlPWuhRheQUXuXJRhYEgeZywCUBMuJ+enJbjJg5z/5NoEb+NGmrl4lGcJrVbOPV4Bgw+oSdqdvT+yNTWjUaVie7shb8mwXr2AbcMAyIqsmmg6cnl4ehj3t5pk+666RLchIn0J8HN0EmDPp1mNFRVu0o7whSzF2FcZpcvkMGHD4K7lgoy6AwgMmCdJLiRQZSq7FVG2fdtRH0JqPCJOHBhfPYhWpDuyDXRxT/xQCmLQbAKgZeXoukyc6Knd74UJ0hfb7nfyFJftxdJbczKwPHkk+SpL/MUCmiYyYVsuvyx9De1CjBEcjGBBfh38NAg4l2ZpNYQpj4i4I9rQ2OEW/dykEikVFyvKFJWrrNV8EoJmG8IjW8Zmvtbf1Fw3Giq8Um+dgilQdrkEc0tWn+cANLYIS7avsQmukrrBpkLDH3i/OMr+VrieNOYtET8CuQS/NBvQeiiG0AL7BN4YNDW3oLenZz0CeO/iYZGAwMvWUpKeDKfXAI2jd8vrQl0lAIrSklY3MvGhc6eAHS8qYOk+owVdQ1wpmivhLcdT+/93+5IrZIjfd6hEoRb9mvYI/GJGJXLpnLCKvAU8xIuNUbCTcF0DdP
12+
adminUser.lastname: AgCuOHWFCt6zSOtjh30bcdr+ykfal4Xn/MVy67kCh0I4bjdwMDbk1gjVtDZJ/J4LKVcJMMhs56zckgAqTR6L+Ly8ip4yLAnrBmH6hJMiQ0Isp/w0wAuZIo+GmiszX/g2YGKr73DMiPaijECpPn1G8E2yD5n8aksvxUtOsVLKPV/14f3TTl84m/SMFkuJu9E3tPQdz9QaNaBfG5dXMCldZZ9gn7vJ06SxnRC8y84gbLpYRTRE6MxpImC/R9gmrjefLV3+7RNgNjfBuzpTiA4PeK8nPaZ1b13aN3w3a4wwfruhquPyZiWjtN6QB7XebD9Iiw8PutMEUm3H1ftBnDVGVw2yTDCgXRteJMaZD2ENHC1zkiU0MtjCaiWLCBnrubYXNZ1PdV5z1YE+sWB3imeHLMBQeQCVbanIkAi43JpisJUAL+SeejkgoWKHtTzkq3DJb1h94yu2+6KVw0/eIqke5dOU7tLcGUNt4neeVlDHk0zh+caZUCERoQy0yCVVewKfvOo79g+SF+ln6AB4XxHkOfHK7PMJlaqdiDFIbjANeGFf8b/gmtPZ4UNeAKlu1iLyro8xpQ+43yF2VFtJLODUM+/H54ySKDEs5lPAtRhtkscL6r3E4HbkyDwXug+Bt8/4zn1UILtPluJt9pFMmuAo4If+lCSHfgnJsbgV3TSaTnkHPJdtMyapZamZRly0PzD13qtwoJJUcw==
13+
adminUser.password: AgCPK0OegmhKpz+4NP2iu0n8uFp3ug68bcxE5EiTgVIqrMQo7R4Q38fQjzraCEHaSb34XpRPs2OgWQIkXybeDTFveeJooIe5UgqoLQlpHhJEFNxcQlYvrn5MNRERADqeEJP9VvcETIFWPZww3hq8JnFXn6IuGjhywWpILJGvjg4v1cwGFtAgvfEvis5Q5ciYuveFfCkcgsHfIfGvFElM1yY730aGe/RQQI5PextMfAnfA2PUF4IrrGtBBj+1EfYG3wL6Xcm9j+jb77hPkfpE0hxFzh/QnJOmkr2RGfMke+y/Z85PK5CVP6+OzYfl0BKDzLHvvqrpw+m53CrGNXajbKmeFNFCKQNuRXCU1INDr1BMZIaywWSvcKu7HSDD1cx0kDyFFMRozGADhydG8b7dqJjWRn8qLPWd54vqnzBx2JSE63RP4vF4aH93IwEDwqqaZ0IxDcS3IXeEfwYm1GuhVHrhLlrBS2ORZHzqBkJ+qpzaC2F1WgIqaHQzzH+Skuu9JXuOuyXZkSuxBVjTTOuVkVMvTh5iyzAKb5MuTFCpFzqg4dDsBEAzch/BDVsyinIaoveUj1fuDejRkG9H1S5gDeYdKISwbCq+7AzzM0s+GmcnrT1ELvvErQfYxZZuzbZYYnm/TYZPIehiqNnTZ5m0jB2wD1sLIW+wQk2tiRWlm9Vg4C619m7xGW5h+HEYYOymLVvYYYBBQmkSHuHf
14+
adminUser.username: AgAGZ926kV4RdzOqW4IbWgPPzt/YU3WFaupIIYxaVmCtELTuKzZ8AVRWFDa3y9I4pU0MntkfORPJsZLxbUUmCEqogicTtUQMA0yQMLp/Wwfe736mUx0oBXP24juQQroeKg4sMUk0DRt9UF6Y/EiBv3iBIBC80tGNmbIq2MECUVkyx6sp2DmcIkLwuGJdMaKc0Jdju66mddmIx2eqKJ/VW1tBCkcYAa0ulcWHMNI4Q6uU/fhsqVLeQ6W5Mef7RyOw0bHLhb8a8puRiIik8GNYHklY3bbZlwBJZvwkcYKP2tiqVO+AbUh5q38PNIYsHcfumEVp1U3Gag58ck4XZ279m/8J3hz665jEszPxpeh0AwGbGBPVhu9EgPWP0jQoreCZhZ5UwRlHYIEs8ftrwHxl5z+RoR4rg1e8/4Bpe6tC6y+MZBW92iK5DCBFNcy15ik0cWBhe7XISWiCN6UTY92yg51RFHIgwv4XuwVj/71Y3Rr51yOp3oQ5cwIMB+bLieO0hrUGEDpG466qNkcN21SgQDZzh0KJ6W05VmPJB85NTDQ0O19yZ35N2XeUKI3ffm7MpQTm/JcKPqlllaQRBNIsjvR7Dj+evLD80txMHZGm5tboG9MfBZIncIAHqvmw5Za6BCzDUgOc2FhSE1cIuGb485EEnLqy0EUj7s5LjloMTp/bnk/YU7w4FSwd9fZkFnnqO3OGRukKVA==
15+
template:
16+
metadata:
17+
creationTimestamp: null
18+
name: airflow-admin-credentials
19+
namespace: stackable-airflow
20+
labels:
21+
stackable.tech/vendor: Stackable
22+
stackable.tech/demo: argo-cd-git-ops
23+
type: Opaque

‎demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-credentials.yaml‎

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-minio-connection.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,5 +15,5 @@ spec:
1515
namespace: stackable-airflow
1616
labels:
1717
stackable.tech/vendor: Stackable
18-
stackable.tech/demo: "{{ DEMO }}"
18+
stackable.tech/demo: argo-cd-git-ops
1919
type: Opaque

‎demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-postgresql-credentials.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
apiVersion: bitnami.com/v1alpha1
3+
kind: SealedSecret
4+
metadata:
5+
creationTimestamp: null
6+
name: airflow-postgresql-credentials
7+
namespace: stackable-airflow
8+
spec:
9+
encryptedData:
10+
password: AgBc32xJVX5MxFZIBfJ7KsgGxLTJHCxPIVhXT3rYbLaPPojIDfu+8ygtdc3UqzFc//nuxbg8WkCUI6UclxGkL9ODUknvQTYCd8ZtmbGfI7BaSbZLhQe5qzd1LLnKtVil2xvYKidtPiob2nn76I8BfiAoenWl9cEqJT3aAYdbau5rMO+WTmc6Sl2+Dl2tBGQBajZRPOB2474NFpEVHf+wOZrIRZhslYBL4i905wkUrpp3G6EPWJRVbeqNFRBYpAxJhMJgny84wLN9xt25L+B6XMagNuo6jXfHBpYkEuyb07k1vJd+4ij1w9w31Lf7HEmsFuLeQnYszyohecCBosORsNI0jwcs4QPbaCerBBZiLftIjAZEOrlU1EoF3I/K3SKJXtxN8ofq0IvNksJ5O+Ofgudi+eOdrdiVHQcDfh6afn0o0bFyQ5CB+/BbeA+nmOlcj0A1xNf8OmBEu6ARA7YQs8vwUMqvfh5BTxv0nmH/OMQkpIVqx8Ik0n7bUoJZNh21uYFATnfONx6R0kvz/WcLSW6qVt8xlr08sKjJh8BQi8WTnXISzZDbTG/j2O2vCD5TGgQ/JFGKzii32KCXw5d4Uk02nAvJhkbM8Xm+A5kC5d1g/w1W0/lnU4nVlkyJPq81A5R3+Pk/8jh96/u0oKjiBaqrQA3Qmam0mMt1k0ITmtMZy583y+BTqtrcU1H9HRV87n05DIZ4Z1ug
11+
username: AgBmgNVPYGAsq2spiGiEqAHFqlww9hy8hFX9xhkJW3UWE+/DYzOCqfCIt+e5SMOD1sV+iTsbY/M7pRtGCafyq/pZPraQjs3tSYVC9ggUe/ApsQgWvVGnJJyENnBJAsyN/hH5PzQrgONFOS/B8Sdd4fYlngIEGkvZW/r5oXPmhiXfnUOKgT9f4E2GBVJPrmwZ4c2y34AxCv6Xf+qR7szNPOPYC4ELNPIGWUffOU0AYZHKXczz01fLbif5q/d8f7S6EbeU206xinGheEtsY6G2gDkP9cjgASJUqOq1Uq9tVvIlC1vU4fxo3v+D1pSDPbdHJj+shOtW26nUlNtmVbMCfMALnMbJ0Fowso6sCQY0Us+8FjuLoNHNUO+UFDMQgEVZuxCZGAVUoABAg05xdJCimmMgpvz632EslLcDtUJWpkpXcOzXFOgnrlr9vYHhm1catLUwrthOvV9xT+t6z1j00ztyxCYt9CEob5jNmtt/XEOWUl3iW0a6+Z/BHhwRN5/TjVi48n9WOWDGU66u7ZksDDv1eSgLumPFQUKjQVNUh9YgQdtUabATG6t2O5ttko6XGCTyZTBuCSoi/ZmVWrenF1gg8WoLCOFPk7UQvD8QlQsr/KEut2iZZUe4q3Hqp+KOwEnlXXZ10P+Da1Lr1StlA6FBdTy5YzTOmezkBI7nNwyM7udqB+/hmKDvpV9vA14JkZtjRGUUWn/I
12+
template:
13+
metadata:
14+
creationTimestamp: null
15+
name: airflow-postgresql-credentials
16+
namespace: stackable-airflow
17+
labels:
18+
stackable.tech/vendor: Stackable
19+
stackable.tech/demo: argo-cd-git-ops
20+
type: Opaque

‎demos/argo-cd-git-ops/manifests/minio/minio.yaml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ metadata:
66
name: "minio-sa"
77
labels:
88
stackable.tech/vendor: Stackable
9-
stackable.tech/demo: {{ DEMO }}
9+
stackable.tech/demo: argo-cd-git-ops
1010
---
1111
# Source: minio/templates/configmap.yaml
1212
apiVersion: v1
@@ -19,7 +19,7 @@ metadata:
1919
release: minio
2020
heritage: Helm
2121
stackable.tech/vendor: Stackable
22-
stackable.tech/demo: {{ DEMO }}
22+
stackable.tech/demo: argo-cd-git-ops
2323
data:
2424
initialize: |-
2525
#!/bin/sh
@@ -414,7 +414,7 @@ metadata:
414414
release: minio
415415
heritage: Helm
416416
stackable.tech/vendor: Stackable
417-
stackable.tech/demo: {{ DEMO }}
417+
stackable.tech/demo: argo-cd-git-ops
418418
spec:
419419
accessModes:
420420
- "ReadWriteOnce"
@@ -433,7 +433,7 @@ metadata:
433433
release: minio
434434
heritage: Helm
435435
stackable.tech/vendor: Stackable
436-
stackable.tech/demo: {{ DEMO }}
436+
stackable.tech/demo: argo-cd-git-ops
437437
spec:
438438
type: NodePort
439439
externalTrafficPolicy: "Cluster"
@@ -458,7 +458,7 @@ metadata:
458458
heritage: Helm
459459
monitoring: "true"
460460
stackable.tech/vendor: Stackable
461-
stackable.tech/demo: {{ DEMO }}
461+
stackable.tech/demo: argo-cd-git-ops
462462
spec:
463463
type: NodePort
464464
externalTrafficPolicy: "Cluster"
@@ -482,7 +482,7 @@ metadata:
482482
release: minio
483483
heritage: Helm
484484
stackable.tech/vendor: Stackable
485-
stackable.tech/demo: {{ DEMO }}
485+
stackable.tech/demo: argo-cd-git-ops
486486
spec:
487487
strategy:
488488
type: RollingUpdate
@@ -501,7 +501,7 @@ spec:
501501
app: minio
502502
release: minio
503503
stackable.tech/vendor: Stackable
504-
stackable.tech/demo: {{ DEMO }}
504+
stackable.tech/demo: argo-cd-git-ops
505505
annotations:
506506
checksum/secrets: fa63e34a92c817c84057e2d452fa683e66462a57b0529388fb96a57e05f38e57
507507
checksum/config: ebea49cc4c1bfbd1b156a58bf770a776ff87fe199f642d31c2816b5515112e72
@@ -597,7 +597,7 @@ metadata:
597597
release: minio
598598
heritage: Helm
599599
stackable.tech/vendor: Stackable
600-
stackable.tech/demo: {{ DEMO }}
600+
stackable.tech/demo: argo-cd-git-ops
601601
annotations:
602602
"helm.sh/hook": post-install,post-upgrade
603603
"helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation

‎demos/argo-cd-git-ops/manifests/minio/sealed-minio-credentials.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,5 +16,5 @@ spec:
1616
namespace: minio
1717
labels:
1818
stackable.tech/vendor: Stackable
19-
stackable.tech/demo: "{{ DEMO }}"
19+
stackable.tech/demo: argo-cd-git-ops
2020
type: Opaque

‎docs/modules/demos/images/argo-cd-git-ops/airflow-dag-overview.png‎

-1.96 KB
Loading

0 commit comments

Comments
 (0)