fix(argo-cd):demo fixes for 26.7

demos/argo-cd-git-ops/README.md

@@ -10,14 +10,63 @@ The easiest way to seal secrets via `kubeseal` is to have the `argo-cd-git-ops`
 It provides the Sealed Secrets controller and a generated certificate that is automatically used for signing via `kubeseal`.
 
 ```sh
-kubeseal -n stackable-airflow --format=yaml < airflow-credentials.yaml > sealed-airflow-credentials.yaml
+kubeseal -n stackable-airflow --format=yaml < airflow-admin-credentials.yaml > sealed-airflow-admin-credentials.yaml
+kubeseal -n stackable-airflow --format=yaml < airflow-postgresql-credentials.yaml > sealed-airflow-postgresql-credentials.yaml
 ```
 
 For "offline" usage you can first fetch the CA from the `sealed-secrets-controller` and use that for encryption when the demo / stack is not available.
 
 ```sh
 kubeseal --fetch-cert --controller-name sealed-secrets-controller --controller-namespace sealed-secrets > sealed-secrets.crt
-kubeseal --cert sealed-secrets.crt -n stackable-airflow --format=yaml < airflow-credentials.yaml > sealed-airflow-credentials.yaml
+kubeseal --cert sealed-secrets.crt -n stackable-airflow --format=yaml < airflow-admin-credentials.yaml > sealed-airflow-admin-credentials.yaml
+```
+
+After sealing, re-add the Stackable labels to `spec.template.metadata` of the generated SealedSecret manually (they are not part of the encrypted payload):
+
+```yaml
+      labels:
+        stackable.tech/vendor: Stackable
+        stackable.tech/demo: argo-cd-git-ops
+```
+
+IMPORTANT: These manifests are synced by Argo CD directly from Git, so Jinja2 template expressions like `"{{ DEMO }}"` are never rendered here.
+Kubernetes rejects them as invalid label values, which breaks unsealing — label values must be hardcoded in everything under `manifests/`.
+
+## Plaintext secrets used in this demo
+
+The sealed secrets under `manifests/airflow/` were created from the following plaintext manifests.
+These are demo-only credentials: the Sealed Secrets controller key for this stack is committed to this repository (`stacks/argo-cd-git-ops/secrets/sealed-secrets-key.yaml`), so the sealed secrets provide no confidentiality here — sealing only demonstrates the GitOps workflow.
+Never use this pattern for real credentials.
+
+`airflow-admin-credentials.yaml`:
+
+```yaml
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: airflow-admin-credentials
+type: Opaque
+stringData:
+  adminUser.username: admin
+  adminUser.firstname: Airflow
+  adminUser.lastname: Admin
+  adminUser.email: airflow@airflow.com
+  adminUser.password: adminadmin
+```
+
+`airflow-postgresql-credentials.yaml` (must match the credentials the PostgreSQL chart is provisioned with, see `manifests/airflow-postgres/`):
+
+```yaml
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: airflow-postgresql-credentials
+type: Opaque
+stringData:
+  username: airflow
+  password: airflow
 ```
 
 TODO: We should probably create a script that seals all secrets and puts them in the respective stack / demo folders

demos/argo-cd-git-ops/manifests/airflow-postgres/sealed-airflow-postgres-credentials.yaml

@@ -18,5 +18,5 @@ spec:
       namespace: stackable-airflow
       labels:
         stackable.tech/vendor: Stackable
-        stackable.tech/demo: "{{ DEMO }}"
+        stackable.tech/demo: argo-cd-git-ops
     type: Opaque

demos/argo-cd-git-ops/manifests/airflow/airflow.yaml

@@ -5,15 +5,20 @@ metadata:
   name: airflow
   labels:
     stackable.tech/vendor: Stackable
-    stackable.tech/demo: "{{ DEMO }}"
+    stackable.tech/demo: argo-cd-git-ops
 spec:
   image:
     productVersion: 3.2.2
     pullPolicy: IfNotPresent
   clusterConfig:
     loadExamples: false
     exposeConfig: false
-    credentialsSecret: airflow-credentials
+    metadataDatabase:
+      postgresql:
+        host: postgresql-airflow
+        database: airflow
+        credentialsSecretName: airflow-postgresql-credentials
+    credentialsSecretName: airflow-admin-credentials
     # NOTE: This cannot be parameterized via stackablectl since it is synced via ArgoCD.
     #
     # In terms of forking the repository, this should not be a problem since the DAGs are the same.

demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-admin-credentials.yaml

@@ -0,0 +1,23 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: airflow-admin-credentials
+  namespace: stackable-airflow
+spec:
+  encryptedData:
+    adminUser.email: AgDCOe0HVbkLNfxo6bCXr0zBhQzo5XKv0i+CtPAOdsVnaIp0YT8mcbIh24Sof//YDYtX9/8tTgFwnKfBpwTC+5aUiUabAkJifGMzEON40+nNnfMpTXRjCk3boLvucDtd2YE6+dlKvpksiIrn3Xf8ktn2B13ildfnEXQHwm7ddMxxScxlsUOP4axdQLAEuiRZoq7TWUkDXCQK6piSDfSadjcWSSxbsVdEGk//GLA4Mz2rodauHp5oVWp7sKamnyDZeNvyLkVbnZ+nqBljSdYReqsG/pg+S0pTR2bc+R11bVWnbw7Iw4YeReRsQbPD2rQmnIxWWwCjwzXgKtm211gFB4WyCBmnx1S8z4J3EWBhkQVb0pUVV0NWwa5X8FukzDBA0W/ZsxNmxlXeYrj8dFPBXmGxon4rbawITCmm7PvzLV3MG6vYpbWqO8UfP5bGVXJKNr2Aiz9piiPzWGiuHcxBB6xxrRjh0Y42HNq/IltI67Z7VFAf/aL4PSLR/oBGol7li/qSObdYny2waJH7W+wAE1x5AkbHU44lR9AX5eYKvtO3n9vS3GGY2b244qnDjqseVM23p/oiFyUFzLUHWa6z8vHzZqGiVvt1vHm2oYVYjq83641vdYArYTCfKq4KP+ZuGZ9XnX1cR4MTPisENZez2iYeFuAT0tQPJXs0V43igqJsWXTC1NW1qpknF6PRDLZ0zLaz7secGUObQ44o+qvxa8N7a1ba
+    adminUser.firstname: AgB9RjO3GWAevCNiew6vsD2RvnYjvYl6VW6pPrevoPpmxkczaXQMHY9iR88254fUFyOATLHrHfSxMmucvIgc4WuMR6xR4MhGNczDWOZ37khN8XvvbxW/7BlPWuhRheQUXuXJRhYEgeZywCUBMuJ+enJbjJg5z/5NoEb+NGmrl4lGcJrVbOPV4Bgw+oSdqdvT+yNTWjUaVie7shb8mwXr2AbcMAyIqsmmg6cnl4ehj3t5pk+666RLchIn0J8HN0EmDPp1mNFRVu0o7whSzF2FcZpcvkMGHD4K7lgoy6AwgMmCdJLiRQZSq7FVG2fdtRH0JqPCJOHBhfPYhWpDuyDXRxT/xQCmLQbAKgZeXoukyc6Knd74UJ0hfb7nfyFJftxdJbczKwPHkk+SpL/MUCmiYyYVsuvyx9De1CjBEcjGBBfh38NAg4l2ZpNYQpj4i4I9rQ2OEW/dykEikVFyvKFJWrrNV8EoJmG8IjW8Zmvtbf1Fw3Giq8Um+dgilQdrkEc0tWn+cANLYIS7avsQmukrrBpkLDH3i/OMr+VrieNOYtET8CuQS/NBvQeiiG0AL7BN4YNDW3oLenZz0CeO/iYZGAwMvWUpKeDKfXAI2jd8vrQl0lAIrSklY3MvGhc6eAHS8qYOk+owVdQ1wpmivhLcdT+/93+5IrZIjfd6hEoRb9mvYI/GJGJXLpnLCKvAU8xIuNUbCTcF0DdP
+    adminUser.lastname: AgCuOHWFCt6zSOtjh30bcdr+ykfal4Xn/MVy67kCh0I4bjdwMDbk1gjVtDZJ/J4LKVcJMMhs56zckgAqTR6L+Ly8ip4yLAnrBmH6hJMiQ0Isp/w0wAuZIo+GmiszX/g2YGKr73DMiPaijECpPn1G8E2yD5n8aksvxUtOsVLKPV/14f3TTl84m/SMFkuJu9E3tPQdz9QaNaBfG5dXMCldZZ9gn7vJ06SxnRC8y84gbLpYRTRE6MxpImC/R9gmrjefLV3+7RNgNjfBuzpTiA4PeK8nPaZ1b13aN3w3a4wwfruhquPyZiWjtN6QB7XebD9Iiw8PutMEUm3H1ftBnDVGVw2yTDCgXRteJMaZD2ENHC1zkiU0MtjCaiWLCBnrubYXNZ1PdV5z1YE+sWB3imeHLMBQeQCVbanIkAi43JpisJUAL+SeejkgoWKHtTzkq3DJb1h94yu2+6KVw0/eIqke5dOU7tLcGUNt4neeVlDHk0zh+caZUCERoQy0yCVVewKfvOo79g+SF+ln6AB4XxHkOfHK7PMJlaqdiDFIbjANeGFf8b/gmtPZ4UNeAKlu1iLyro8xpQ+43yF2VFtJLODUM+/H54ySKDEs5lPAtRhtkscL6r3E4HbkyDwXug+Bt8/4zn1UILtPluJt9pFMmuAo4If+lCSHfgnJsbgV3TSaTnkHPJdtMyapZamZRly0PzD13qtwoJJUcw==
+    adminUser.password: AgCPK0OegmhKpz+4NP2iu0n8uFp3ug68bcxE5EiTgVIqrMQo7R4Q38fQjzraCEHaSb34XpRPs2OgWQIkXybeDTFveeJooIe5UgqoLQlpHhJEFNxcQlYvrn5MNRERADqeEJP9VvcETIFWPZww3hq8JnFXn6IuGjhywWpILJGvjg4v1cwGFtAgvfEvis5Q5ciYuveFfCkcgsHfIfGvFElM1yY730aGe/RQQI5PextMfAnfA2PUF4IrrGtBBj+1EfYG3wL6Xcm9j+jb77hPkfpE0hxFzh/QnJOmkr2RGfMke+y/Z85PK5CVP6+OzYfl0BKDzLHvvqrpw+m53CrGNXajbKmeFNFCKQNuRXCU1INDr1BMZIaywWSvcKu7HSDD1cx0kDyFFMRozGADhydG8b7dqJjWRn8qLPWd54vqnzBx2JSE63RP4vF4aH93IwEDwqqaZ0IxDcS3IXeEfwYm1GuhVHrhLlrBS2ORZHzqBkJ+qpzaC2F1WgIqaHQzzH+Skuu9JXuOuyXZkSuxBVjTTOuVkVMvTh5iyzAKb5MuTFCpFzqg4dDsBEAzch/BDVsyinIaoveUj1fuDejRkG9H1S5gDeYdKISwbCq+7AzzM0s+GmcnrT1ELvvErQfYxZZuzbZYYnm/TYZPIehiqNnTZ5m0jB2wD1sLIW+wQk2tiRWlm9Vg4C619m7xGW5h+HEYYOymLVvYYYBBQmkSHuHf
+    adminUser.username: AgAGZ926kV4RdzOqW4IbWgPPzt/YU3WFaupIIYxaVmCtELTuKzZ8AVRWFDa3y9I4pU0MntkfORPJsZLxbUUmCEqogicTtUQMA0yQMLp/Wwfe736mUx0oBXP24juQQroeKg4sMUk0DRt9UF6Y/EiBv3iBIBC80tGNmbIq2MECUVkyx6sp2DmcIkLwuGJdMaKc0Jdju66mddmIx2eqKJ/VW1tBCkcYAa0ulcWHMNI4Q6uU/fhsqVLeQ6W5Mef7RyOw0bHLhb8a8puRiIik8GNYHklY3bbZlwBJZvwkcYKP2tiqVO+AbUh5q38PNIYsHcfumEVp1U3Gag58ck4XZ279m/8J3hz665jEszPxpeh0AwGbGBPVhu9EgPWP0jQoreCZhZ5UwRlHYIEs8ftrwHxl5z+RoR4rg1e8/4Bpe6tC6y+MZBW92iK5DCBFNcy15ik0cWBhe7XISWiCN6UTY92yg51RFHIgwv4XuwVj/71Y3Rr51yOp3oQ5cwIMB+bLieO0hrUGEDpG466qNkcN21SgQDZzh0KJ6W05VmPJB85NTDQ0O19yZ35N2XeUKI3ffm7MpQTm/JcKPqlllaQRBNIsjvR7Dj+evLD80txMHZGm5tboG9MfBZIncIAHqvmw5Za6BCzDUgOc2FhSE1cIuGb485EEnLqy0EUj7s5LjloMTp/bnk/YU7w4FSwd9fZkFnnqO3OGRukKVA==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: airflow-admin-credentials
+      namespace: stackable-airflow
+      labels:
+        stackable.tech/vendor: Stackable
+        stackable.tech/demo: argo-cd-git-ops
+    type: Opaque

demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-minio-connection.yaml

@@ -15,5 +15,5 @@ spec:
       namespace: stackable-airflow
       labels:
         stackable.tech/vendor: Stackable
-        stackable.tech/demo: "{{ DEMO }}"
+        stackable.tech/demo: argo-cd-git-ops
     type: Opaque

demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-postgresql-credentials.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: airflow-postgresql-credentials
+  namespace: stackable-airflow
+spec:
+  encryptedData:
+    password: AgBc32xJVX5MxFZIBfJ7KsgGxLTJHCxPIVhXT3rYbLaPPojIDfu+8ygtdc3UqzFc//nuxbg8WkCUI6UclxGkL9ODUknvQTYCd8ZtmbGfI7BaSbZLhQe5qzd1LLnKtVil2xvYKidtPiob2nn76I8BfiAoenWl9cEqJT3aAYdbau5rMO+WTmc6Sl2+Dl2tBGQBajZRPOB2474NFpEVHf+wOZrIRZhslYBL4i905wkUrpp3G6EPWJRVbeqNFRBYpAxJhMJgny84wLN9xt25L+B6XMagNuo6jXfHBpYkEuyb07k1vJd+4ij1w9w31Lf7HEmsFuLeQnYszyohecCBosORsNI0jwcs4QPbaCerBBZiLftIjAZEOrlU1EoF3I/K3SKJXtxN8ofq0IvNksJ5O+Ofgudi+eOdrdiVHQcDfh6afn0o0bFyQ5CB+/BbeA+nmOlcj0A1xNf8OmBEu6ARA7YQs8vwUMqvfh5BTxv0nmH/OMQkpIVqx8Ik0n7bUoJZNh21uYFATnfONx6R0kvz/WcLSW6qVt8xlr08sKjJh8BQi8WTnXISzZDbTG/j2O2vCD5TGgQ/JFGKzii32KCXw5d4Uk02nAvJhkbM8Xm+A5kC5d1g/w1W0/lnU4nVlkyJPq81A5R3+Pk/8jh96/u0oKjiBaqrQA3Qmam0mMt1k0ITmtMZy583y+BTqtrcU1H9HRV87n05DIZ4Z1ug
+    username: AgBmgNVPYGAsq2spiGiEqAHFqlww9hy8hFX9xhkJW3UWE+/DYzOCqfCIt+e5SMOD1sV+iTsbY/M7pRtGCafyq/pZPraQjs3tSYVC9ggUe/ApsQgWvVGnJJyENnBJAsyN/hH5PzQrgONFOS/B8Sdd4fYlngIEGkvZW/r5oXPmhiXfnUOKgT9f4E2GBVJPrmwZ4c2y34AxCv6Xf+qR7szNPOPYC4ELNPIGWUffOU0AYZHKXczz01fLbif5q/d8f7S6EbeU206xinGheEtsY6G2gDkP9cjgASJUqOq1Uq9tVvIlC1vU4fxo3v+D1pSDPbdHJj+shOtW26nUlNtmVbMCfMALnMbJ0Fowso6sCQY0Us+8FjuLoNHNUO+UFDMQgEVZuxCZGAVUoABAg05xdJCimmMgpvz632EslLcDtUJWpkpXcOzXFOgnrlr9vYHhm1catLUwrthOvV9xT+t6z1j00ztyxCYt9CEob5jNmtt/XEOWUl3iW0a6+Z/BHhwRN5/TjVi48n9WOWDGU66u7ZksDDv1eSgLumPFQUKjQVNUh9YgQdtUabATG6t2O5ttko6XGCTyZTBuCSoi/ZmVWrenF1gg8WoLCOFPk7UQvD8QlQsr/KEut2iZZUe4q3Hqp+KOwEnlXXZ10P+Da1Lr1StlA6FBdTy5YzTOmezkBI7nNwyM7udqB+/hmKDvpV9vA14JkZtjRGUUWn/I
+  template:
+    metadata:
+      creationTimestamp: null
+      name: airflow-postgresql-credentials
+      namespace: stackable-airflow
+      labels:
+        stackable.tech/vendor: Stackable
+        stackable.tech/demo: argo-cd-git-ops
+    type: Opaque

demos/argo-cd-git-ops/manifests/minio/minio.yaml

@@ -6,7 +6,7 @@ metadata:
   name: "minio-sa"
   labels:
     stackable.tech/vendor: Stackable
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: argo-cd-git-ops
 ---
 # Source: minio/templates/configmap.yaml
 apiVersion: v1
@@ -19,7 +19,7 @@ metadata:
     release: minio
     heritage: Helm
     stackable.tech/vendor: Stackable
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: argo-cd-git-ops
 data:
   initialize: |-
     #!/bin/sh
@@ -414,7 +414,7 @@ metadata:
     release: minio
     heritage: Helm
     stackable.tech/vendor: Stackable
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: argo-cd-git-ops
 spec:
   accessModes:
     - "ReadWriteOnce"
@@ -433,7 +433,7 @@ metadata:
     release: minio
     heritage: Helm
     stackable.tech/vendor: Stackable
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: argo-cd-git-ops
 spec:
   type: NodePort
   externalTrafficPolicy: "Cluster"
@@ -458,7 +458,7 @@ metadata:
     heritage: Helm
     monitoring: "true"
     stackable.tech/vendor: Stackable
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: argo-cd-git-ops
 spec:
   type: NodePort
   externalTrafficPolicy: "Cluster"
@@ -482,7 +482,7 @@ metadata:
     release: minio
     heritage: Helm
     stackable.tech/vendor: Stackable
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: argo-cd-git-ops
 spec:
   strategy:
     type: RollingUpdate
@@ -501,7 +501,7 @@ spec:
         app: minio
         release: minio
         stackable.tech/vendor: Stackable
-        stackable.tech/demo: {{ DEMO }}
+        stackable.tech/demo: argo-cd-git-ops
       annotations:
         checksum/secrets: fa63e34a92c817c84057e2d452fa683e66462a57b0529388fb96a57e05f38e57
         checksum/config: ebea49cc4c1bfbd1b156a58bf770a776ff87fe199f642d31c2816b5515112e72
@@ -597,7 +597,7 @@ metadata:
     release: minio
     heritage: Helm
     stackable.tech/vendor: Stackable
-    stackable.tech/demo: {{ DEMO }}
+    stackable.tech/demo: argo-cd-git-ops
   annotations:
     "helm.sh/hook": post-install,post-upgrade
     "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation

demos/argo-cd-git-ops/manifests/minio/sealed-minio-credentials.yaml

@@ -16,5 +16,5 @@ spec:
       namespace: minio
       labels:
         stackable.tech/vendor: Stackable
-        stackable.tech/demo: "{{ DEMO }}"
+        stackable.tech/demo: argo-cd-git-ops
     type: Opaque