Spike/argocd demo

demos/argo-cd-git-ops/README.md

@@ -0,0 +1,23 @@
+# argo-cd-git-ops
+
+## How to create sealed secrets
+
+This demo uses [Sealed Secrets](https://github.com/bitnami-labs/sealed-secrets) to decrypt secrets stored in a Git repository.
+
+The CLI tool `kubeseal` must be installed as described in the [Sealed Secrets readme](https://github.com/bitnami-labs/sealed-secrets?tab=readme-ov-file#kubeseal).
+
+The easiest way to seal secrets via `kubeseal` is to have the `argo-cd-git-ops` Stack installed. It provides the Sealed Secrets controller and
+a generated certificate that is automatically used for signing via `kubeseal`.
+
+```sh
+kubeseal -n stackable-airflow --format=yaml < airflow-credentials.yaml > sealed-airflow-credentials.yaml
+```
+
+For "offline" usage you can first fetch the CA from the `sealed-secrets-controller` and use that for encryption when the demo / stack is not available.
+
+```sh
+kubeseal --fetch-cert --controller-name sealed-secrets-controller --controller-namespace sealed-secrets > sealed-secrets.crt
+kubeseal --cert sealed-secrets.crt -n stackable-airflow --format=yaml < airflow-credentials.yaml > sealed-airflow-credentials.yaml
+```
+
+TODO: We should probably create a script that seals all secrets and puts them in the respective stack / demo folders

demos/argo-cd-git-ops/applications/airflow-postgres.yaml

@@ -0,0 +1,35 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: airflow-postgres
+spec:
+  project: airflow
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: stackable-airflow
+  sources:
+    - repoURL: "registry-1.docker.io/bitnamicharts"
+      path: postgresql
+      # helm inspect chart oci://registry-1.docker.io/bitnamicharts/postgresql
+      targetRevision: 16.6.3 # 17.4.0
+      chart: postgresql
+      helm:
+        # TODO this breaks naming as long as we use the airflow stack yaml which needs this svc name
+        releaseName: postgresql-airflow
+        valuesObject:
+          commonLabels:
+            stackable.tech/vendor: Stackable
+          auth:
+            database: airflow
+            username: airflow
+            existingSecret: postgresql-credentials
+    - repoURL: "{{ customGitUrl }}"
+      targetRevision: "{{ customGitBranch }}"
+      path: demos/argo-cd-git-ops/manifests/airflow-postgres/
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      selfHeal: true
+      prune: true

demos/argo-cd-git-ops/applications/airflow.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: airflow
+spec:
+  project: airflow
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: stackable-airflow
+  source:
+    repoURL: "{{ customGitUrl }}"
+    targetRevision: "{{ customGitBranch }}"
+    path: demos/argo-cd-git-ops/manifests/airflow/
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      selfHeal: true
+      prune: true

demos/argo-cd-git-ops/applications/minio.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: minio
+spec:
+  project: minio
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: minio
+  source:
+    repoURL: "{{ customGitUrl }}"
+    targetRevision: "{{ customGitBranch }}"
+    path: demos/argo-cd-git-ops/manifests/minio/
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      selfHeal: true
+      prune: true

demos/argo-cd-git-ops/dags/date_demo.py

@@ -0,0 +1,20 @@
+"""Example DAG returning the current date"""
+from datetime import datetime, timedelta
+
+from airflow import DAG
+from airflow.operators.bash import BashOperator
+
+with DAG(
+    dag_id='date_demo',
+    schedule='0-59 * * * *',
+    start_date=datetime(2021, 1, 1),
+    catchup=False,
+    dagrun_timeout=timedelta(minutes=5),
+    tags=['example'],
+    params={},
+) as dag:
+
+    run_this = BashOperator(
+        task_id='run_every_minute',
+        bash_command='date',
+    )

demos/argo-cd-git-ops/manifests/airflow-postgres/sealed-airflow-postgres-credentials.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: postgresql-credentials
+  namespace: stackable-airflow
+spec:
+  encryptedData:
+    database: AgAlOcdpjYAaeiHbIwmGM3lb7okU4DROr+4bs7oQBPBY924XdamqlSw4Y7V8svvHRqD5Hz8SRx0SY2dkLaBQZBaXKV8qaMaVdqX0zK8zvoIbw/bQFXMTFpPq/kUD/kBdTwGJdAd/VpdY1m4Dcn247AhsQuNbqcZ8xibH2IW1e41f1/5nidHY+0a0O2qrSjAU8RxBAuBlLS6ZZiT2vmgahe6CUarJ3Dzr8InZRmtgwT7F8Zzli6cqgOPDsUg768KwDOIxpO+tnOT9b57SAbLUn5SOedFbAodWgQAg913URTiPOCrt5Loyp9B4tQXv1s74WFmgPlEkQmavkIyQg3R2Yki0QhkFysOFtp41ilRFTvgauxV3irryTv/frgA+XJDwfYexG2whgWH/VbT/HHIMoHBuRD864lpWZ/qDdLhFx7A5Eflli+YO+xuOQP4eFEsWeVYtcBNEi8Epy86LBiDCttCYWJ96XEmriqTpBebjxpaihxfCnPEbq5bkLv9RhO9vgzgYPgceLvPJ9GSpSJFv2s+ohvvJYyeAiuNLRkPR++tHFaofCVnuIfbeFgS1WVi/F4TrNsq2JlNfUnrzGTkc1CIkx/u02cE7K+Smfi/Dz30iDE7A+TLxDz7pguozMHX0eQCYDJ4ehehkArfH/XXe/ZH7Hb5MV6nMV32ZxkNi4x5iMdIsuLUdXJHWqSi0Ue9cZFBsP2rqmr5S
+    password: AgB/x1/DNC9uYWCTH1xu17qSr9GrnTcQ4LD5BCTu/5wUd/TK2rWM8zHce0mF97e6km+FyT+G96utiRThutNkAOpzT7xrZwkp45F0HqF0aD+NOYMzMn4duVLaK7JXLm6u7187Ci6kFMkmZ+Npb94wX+iUa+kgTQTkMP1HsdgQj4c8gj1ldpnoUDQt8/wsTF/gEukXD14E0BbEMkRTPh8PzkiirlLVWCff3YauQVRKXL2yWa79Fo47zkZ/WMJXyB8PVBQot2OIDL1ygddTBklBoP6ts2MOo3G7blmQWu5cgS/+IAw837pEWpDg5+UnUkM1+OQ+52PWLRXPbiSMFFlcbZIHwuASx7lRRm482q+kfJBb4oALd7EPHmjcBg1lV1iR74NetJ2wkMMcqnvkITxw8U8To1ZKseBpNH7mBWB9u2lvpjT5EWMOveVLCq6NwU2IcdgHhUaMByrxq5I3u1k1Y1hZvM0txQp8Mr/Zas/EEJ/w3sN+i9O/JWIonRx84Y9OJxIQEXManz7LzzzIxXikCvenm/8oQMfPHa7w5Scdb6sEQKsFXZ+aMQMcUTp7xuZbYzuX/7CmVdPHlFOhAXGAbRE2J739uWmyMVQkJ9cHSKzbCJdXDD3+oJB42Xz37tJg08xvMGBTPJjJoKnXfHIPS2yQISg1VgfyWNg/T2LZLuqt5htpUbQsWsL6K9/z7qtsama5pUiVTsmu
+    postgres-password: AgBpGdazaNMQ2j2jI1sK5D1PCFvhXn/kH7Xhj2P2GgHesCxml2WN8B99dtk2O81BDt7IYNqadhwdXe+pmvJU48qkbfcmgE+Kbjbbdo8bv9GxMQcYPPH0ahqIfFAxNgMBHnbQ0Zxy+a3vzNiXLeD4FAwU0Pxa7kSwED0/EiyfmZcvph2J5JTi4FwhU2ITycMwsjQnt7KVw1SGWMZkro6HoJ9wGSj7GRSeHX7HEMBCehf8TOMEo1Emy6IqYHAywdcNgfBEoLvgUUFElBxYLshCP2NTTCU2o374Xw2fiErjiR7Q075Mshpxl4bqGf2HgGT44Lsn5KDupPNnV7FPx0xTk3OmmE5Ja5gUAeLYU3bF8B7DSm61ltQnkL+FQ5sy3tjCTsH3wyYbg4zVoQlJuyRXJdG48Y0aHkQHwMpZlZEkB8IWGZZ9Kd9UKTTFnS3odca8OhdWYQ28ARz4Mj0Jio0dEO/63EyCJZiL4/Ck4rj8I49Wz832GjHVkMNFqthK6jN+HmlGcKXRKRMFLyIrvH7mUv1EuOsvh2+qtrsGGWSYwfETmb1J/iUp7X2+KhPnn6GP/poXLKeeDtiRfRSXTP70vRDllOMgSRTorRxS44FD/ac3KVA4RlpA+Ho+XU4QhYnNx8Q6haTQINY8Yypw/JRAPO4l379EFZtFdCSrKZ9XmRPsSZkZPZZJSVUe2ByGs/SScOR1xf1pwdPjWoOd
+    username: AgC716fxKUrMXCsRsWeiSTliHKP8NrwBr0TD7/w2F1HO93pqjSVU5/6hKOiFdNllbyPRudSHAeYWqJhQxxl5tS9kSaEp29zkxAUnmNwfLL3MKdCohxz2LZzC7saaOdjDkX2x8jcy68STPupsdg5bX40D4tO/s8qXnWWZJrW0ht/J+orgjbnfHk51JBMRBh6WD43yKLOBTHGO5U/TqRKg20kn+jDm2hcdec8axcjn2E57B3wrL8tvUcVRElO0XOcLHHBrav/BumRkwS4bMGqa+Vcarrr8U9MuQXVUzbCuwt326q/Kg862ozYY9uWAVtUy+Yfb4SAcEUC9Y+Ioo776H3YIr6q8P6RI+lFNmz4Q8AFDN9D5IRNjQ/D73llHw944dYRJl8CVjoJJYvRXv8z+4GzL7O+eF+smx4EhcY3sFxjkNCv+s+EDbUXvQR0ULqTEc5WZlBqp9TQEvzBwN3CVYO0k76FQYdjoU6xb/32gALe6zMxOLTliR9axqDvCL3OCj97/HJy8RLL2sYH82NZ1sGHqfTkTKYGk24Zfzd+a+p0PDbU14ZBuXKWBDkzNaVdpLvWhtdBczarfVp4Z2b6IutbT2C43fcmi7WYJOtV5em1sGhKOtbEy+wC+r5GKr6qRV58jm88cwtqZgm6IirDt/bzJDqhPndBzW5iQZzkko/1Tr4y/6oaTleTcmkDlSg2Cn8q/R7MNYUjT
+  template:
+    metadata:
+      creationTimestamp: null
+      name: postgresql-credentials
+      namespace: stackable-airflow
+    type: Opaque

demos/argo-cd-git-ops/manifests/airflow/airflow.yaml

@@ -0,0 +1,109 @@
+---
+apiVersion: airflow.stackable.tech/v1alpha1
+kind: AirflowCluster
+metadata:
+  name: airflow
+spec:
+  image:
+    # Currently does not work with the kubernetes executor S3 logging
+    # (and its still marked experimental as of release 25.7). See:
+    # https://github.com/apache/airflow/issues/50583
+    # https://github.com/apache/airflow/issues/52501
+    # productVersion: 3.0.1
+    productVersion: 2.10.5
+  clusterConfig:
+    loadExamples: false
+    exposeConfig: false
+    credentialsSecret: airflow-credentials
+    # NOTE: This cannot be parameterized via stackablectl since it is synced via ArgoCD.
+    #
+    # In terms of forking the repository, this should not be a problem since the DAGs are the same.
+    # You can still change this locally and point to the fork in case of any changes to DAGs.
+    #
+    # TODO(@maltesander): Adapt branch to main / 25.7.0
+    dagsGitSync:
+      - repo: https://github.com/stackabletech/demos/
+        branch: spike/argocd-demo
+        gitFolder: "demos/argo-cd-git-ops/dags"
+        depth: 2
+    volumes:
+      - name: minio-tls
+        ephemeral:
+          volumeClaimTemplate:
+            metadata:
+              annotations:
+                secrets.stackable.tech/class: tls
+                secrets.stackable.tech/scope: pod
+            spec:
+              accessModes:
+                - ReadWriteOnce
+              resources:
+                requests:
+                  storage: "1"
+              storageClassName: secrets.stackable.tech
+    volumeMounts:
+      - name: minio-tls
+        mountPath: /stackable/minio-tls
+  webservers:
+    roleConfig:
+      listenerClass: external-unstable
+    envOverrides: &envOverrides
+      AIRFLOW_CONN_KUBERNETES_IN_CLUSTER: "kubernetes://?__extra__=%7B%22extra__kubernetes__in_cluster%22%3A+true%2C+%22extra__kubernetes__kube_config%22%3A+%22%22%2C+%22extra__kubernetes__kube_config_path%22%3A+%22%22%2C+%22extra__kubernetes__namespace%22%3A+%22%22%7D"
+      # Via sealed secrets and pod overrides, just kept for reference here
+      # AIRFLOW_CONN_MINIO: "aws://admin:adminadmin@/?endpoint_url=https%3A%2F%2Fminio.minio.svc.cluster.local%3A9000"
+      AWS_CA_BUNDLE: "/stackable/minio-tls/ca.crt"
+      AIRFLOW__LOGGING__REMOTE_LOGGING: "True"
+      AIRFLOW__LOGGING__REMOTE_BASE_LOG_FOLDER: s3://demo/airflow-task-logs/
+      AIRFLOW__LOGGING__REMOTE_LOG_CONN_ID: minio
+    podOverrides: &podOverrides
+      spec:
+        containers:
+          - name: airflow
+            env:
+              - name: AIRFLOW_CONN_MINIO
+                valueFrom:
+                  secretKeyRef:
+                    name: airflow-minio-connection
+                    key: airflow-minio-connection
+    config:
+      gracefulShutdownTimeout: 30s
+      resources:
+        cpu:
+          min: 400m
+          max: "1"
+        memory:
+          limit: 2Gi
+    roleGroups:
+      default:
+        # NOTE: In order to properly show ArgoCD in action - syncing changes via Git - do the following:
+        # - Fork this repository
+        # - Use the demo parameters `customGitUrl` and `customGitBranch` to point the
+        #   the repository to your fork and branch
+        # - Change the replicas here and push that to the provided `customGitBranch` in your fork
+        replicas: 1
+  kubernetesExecutors:
+    envOverrides: *envOverrides
+    podOverrides:
+      spec:
+        containers:
+          - name: base
+            env:
+              - name: AIRFLOW_CONN_MINIO
+                valueFrom:
+                  secretKeyRef:
+                    name: airflow-minio-connection
+                    key: airflow-minio-connection
+  schedulers:
+    envOverrides: *envOverrides
+    podOverrides: *podOverrides
+    config:
+      gracefulShutdownTimeout: 30s
+      resources:
+        cpu:
+          min: 400m
+          max: "1"
+        memory:
+          limit: 1Gi
+    roleGroups:
+      default:
+        replicas: 1

demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-credentials.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: airflow-credentials
+  namespace: stackable-airflow
+spec:
+  encryptedData:
+    adminUser.email: AgBJq/dTwq0biM8b8bl2/daQSbWPRXSnOHOMnrJRjxM7A5KX68HI0Ifp4r47gSTZDQuKxNx5PaFuyU6W0tT9CvbFSPdhTXb6G5xLXITafrpd2he9LiTRzI0wzh/xa8sOChTNHK3rXBpU8n0Y7aYVDp7mibFk6CQKhMMq8s/OL5Scp2R4mbiajAtXMwQ2wt1fF3CAqR4QgxqGGr0cEugGf8zl/Z3GryUjJsqjNyhkjDxBN2E6oiP8Q1NCMV7AGGxdqHyi3PJH6hFddk07fTKu24oV1/IkdPZ7QgTXzhV2dk57KcSX8wB9gksWsCiFGlL4RnKwkmMbNzXq5m9zAk9YkN0QyMu0pRBI/NqhFTfhXIBcVsIbEa/37rGxV6oIaLqndneSG4fDTu0HP6ga98pM/nD2Nrzlj1gS+KwaBSGWq+CWs3HSah35treHxne3U2nuG98+nnIvUQUYI36b7MAP9xQ5Koykk4iU6LrVoxyck42k3VxeWNLc4W1axOBLGyjSxxUmZMWF4lmlz4Z045/SuBF8O4mmIHj/3cK5EEcAlme3lebNKht9/w3iaxDd+dG04CP8RMQGE7i3OdHpteilZMszXyjYz8m08u/wgiKG8aEkh8ad9fNeR4RnGP5CMpifrLZeCsismj4R9JN6B3lr3q2s1Ot/aedPsk4JMj0RgJAnLkSQHbYI3twJAOq4C/6HH+fSsripLIL4CjC39Hevp6Nku6ef
+    adminUser.firstname: AgC+TLraEdynGLvTTBkzXgBEvnK0c+97PsdcVTK3BIFD0L4APn3HM6V2WiUcyBH//YJqUiNvg5mnJZx3EA1EakPdzkXlitYNFy6XoMDTkrMZTgiD/VAiABBmPyVJesGz5xxlovqFGpbGWQbXjr+fGOINqSciQi1JMzN/jQ9EJQRnyxr7Xq3rmF4/NsWo8s+fEbQHx8SmNrS8mu9BFd+QSL5pTskZJkcaUuzduCXIheacJcRE+YwiufQVOFSo2AkgGcbwzLBRJuL6+u6MST3qr/xapsBuGSwHtEoVcI/NApTYsGZCeNN6H8e083BnRGCunfnw/R9/5Xg4uxdUEbGT16gP4H5/o8V22AmH2opSgPgxVSntAn6h5cxva2YUc5Bezn+pKFZmK0KCmC8tUSDusje3X0emMIs9+fC+ksj81UwSikC+hKbuZz+HuzS23UCy+w5R9X2SDGk802zxdLVhsXn/46dgaEqzOEa1pYJEyCRZUUv4KTdM0/XXfkid4r1uP0d6bZ7jlS9tSDQ/ajm5dAhl5W7nIYdRVAqM5KhvvY3mWpqIdscdr+bhpE46mJPstP6O4FM3/0OYPntmjxSVTFf0Uc8mHY4RRAM2sN/ViqcDGumn3Q8xlQtG4vMO2Tx+GAStzIu9AGsTFYcak3fI8kpZhs7mhYCXeigSusaIcsH5bfC7uekMrqhrKraY5hOU/xaxjydPIzN6
+    adminUser.lastname: AgBzqzvmZLHUVDcG6f5cyBxUef4Ov0PNBGaqrYLKPMk4a681XpPlfJnNvMk87aV8Ts1xunoozWs4uM2Z6pQa6ZIYoR5oRkO4bLqK16frBaVypKVsKRPkol+bSyWPLGuI0izIKdAcHrtuaEffb6Sr98i6ColIqGLEYlzUalnPIuK/W7QqKXO91jHYnTv4m6LUMere1N/x1cmeZ3+W+BukWLkfiLko4wgCSauUCene9azY5ehtmlIAUo9xNC3oDA+rTGTI1SkG2Xe/ytI92sedCEMmVX7oU9PI0KGfckchc6azmOTsWN0hSnUdIHPPDn+9L0x77HwHeMfiVgO2Bai76lC5fO2b9Pw0OxID5EKY4jvIrtQ2uQANCtYupge6Z37njpzI070U/H65NDtCKAGmcuy4pFgdF60VrEPrfAN+uaVJXmJGu75QmaKqGWE0RAW9UcjiKD9YaQf7pN2tx6v2oga/OR/cDTR+LJYIcwAC2HI+v9t2cb3LqznnoixVwU83qOOqDelq/Pd1vV3Sf1R2Kj5E4UlYm/lEtSczKJyxX4Rim34kzMqZnmYP/56bs4NwXjJ8vmMHEeFkO5tL3NaVgeJ3yKvLG4yUtasXxlrSUgLdXXTu6wN7PuBUkzCN4maYHrDjJYApo1iIXhObtgRbDatosCUCJOSvE0BEEf9CKP++SkUdipWVk84QK3ryNYQOZ12Lc4rnkw==
+    adminUser.password: AgAXw2meNuLCnWIDeBdrUI1osShroov1kjvRJ5+mLtGHD9cOTfQlAJpGXN+QwVWXz/hsRl0zhMxI1EomJhXOOyNI67ptlaMnSV/Wtt5X92ISmHReR/1R2cXv0e/NQLbD4M3AmCpvSz0agYMBxtIFh6mVeMah2RRjVD74Xc3P3SrHjnY7CiLYe58JWVkxGAp6WO2JTpopUJI1Iagr9MHfkGzPp3ygFVxwiMjPIVCM+IeAbtHLNi2w6slrcKa3IJduLSaGOQEr/p8YcPm2Qx2TGHOpiM6Lw9api8JtN28mS5hArc7qj5kkwkfEiHW2exYMXVSdWy7glgEGFuTr7MRi0LpLqS72DT55E9uxAObnlWuiKVmk6UfExX2mMfze+Iz4sKXrqOFoLAIXx8+yjO3t5oDvJf9pxLNihl4rYyLg9v8+UkkGJLQZPOqjQoeuH9ighDkHdfkiUDdprnG9iZAQBFzKN7On+tMA09McwHkC6jV+RIv47zty1CMoEPQ2wEM+zDHU6DG2HvtHQYov1pCpXzyvMz48hcKiAwIjZQM1RZBL0tN5qd8Tp38MqtAvVt7PvllwAN2LKt9HdV5j82kyWseE6MPYkB1l8Q6ctUn5YY0kw+tWwgtmYbeRY9+kSIUphxntX+unzhCKCAY1oBOc/cdim3YQInGGe6lx3JGUQvz5LpP6+aVBPyy8HOPnUSyxdu2ZaBkG5SKhKvfH
+    adminUser.username: AgCVVTX2c+4moS0v6mXuNQ5v6EtxZ43hN0QYg8wgYG+GPR3qZ2Ep+FkUJq86q9dFcuX6EXXtS2h8BJr2sUrRW6QySFnhtmg7A1d4anslN3yAjLipwrreNT9cn1t4PsdIhU0q5Z2uPmMsnLF28D73AxWA59iiveIId2KSuB2lsaC8S8CeW3Df48LW3cnukHtOvc+j84YQgFdagujBtwAMCiym2pdBJG5GojTHQ/5P3AnV+iM5wzXaYIeF5UZ0wLs5WU3CqHLxsY3q7NrLKGzS0xTqqdc6H++tJQFZY5G3q4NcCx+jq9oRErE0ARz3ok2pOHPArUEbyas9+iibA9HJcCmrKguQ8QBvaIQh9L0YtHCtwvaMbR12ZmMfRtMW6pZnM/d2K648JFekuezGTOVEjLk+ZvVm45L4USZpB0MD5LXEy3m8cDdkn2wqTWvblfjgfi7opoLgpwLyf/BZuunrFWT08x9K1WmNQ7OkM4WxscLRyccFOtZQfoUtT8hW+K5/mxLjOQDpryWPCUeBDAMnBvbGG/0AABp7a+vWG9KVus2ZyfUHVFIHgJBsHXXDtONIkmRvTal5bjlRsVk4Y0O3DoJa+UjXYoIBSm1JwdUJMOnL1MoS7Ijk+iXKPMc/3fcbrnfqYxw3ymr485bL8fKh2n99MsCdR1yX/mTxw3f6bRZdN5O7IUTkkKVxx1b08FD1svSwNKHBZQ==
+    connections.celeryBrokerUrl: AgAD1Iu/Oggx5NbNY29aJweDDVHlnL2KnsSJwBufPSxsaQouGdIIMIsWr/y2z+qCtd+TBG7f/ZK6vvTlT8kGeq9PGguGTOs+jQObFsqOWoWMn+zbZl+H3SsXHE9ohlrq36n6b68vRrpR/zIvI/QcFg7FC8qhH7GhxzYoUfXbIVEg9ZUyg8W9GgznIM8pJD7v1blz16fXerC3D3wcY449wvQuygZucGyGNfCK9+y75/HQldYVg5lG0Gb914uT5hQ4lATlH7xnHQcxwXhT+30qphNcIJSNZW2D6S0kovtoZ8xk6P/xoO5uZNzNyFnRxIu/AhVi3T2L/dzlO9ztbxwjCu19xxDo16/vhXQ5awGcyJjHqZc8Pu4v5e7sJTElguAHooQraL/dcx9fJvVOxk+3GUMwixfzSR3R/BD2Na4l9mT3fwiW53UTYIcDm/jRwZ8EPZz6GtWVPtwoOkpe6y/OLoRtGNlJEW2fR2d4VwsrqnPV57716FuI5ETwvCSJcqaoMk1kPZBzWGjgf02owizSD7gKONBLX8G34981JsTu/vloPD9uPYQoQ9oFlKVtdmYKhL6u08ekiwLoojp51T/JB5I0RYLKSu4nR8O8SK49RH2CF/4viBs5cCezP8Cfq4qxSBHsd12PXHocUWK3v5e7xgQXi4wJzoLifNcS2FXwV+97DvHaYCM9KUogdL3K/MnPSfb6SGI5WHJkExK5Hr2WqKG+3zFIr+TfIf8V5QcrXaFEz6m0iK49x5hIvjgmnQ==
+    connections.celeryResultBackend: AgAEg3o3zzMI1fqVt119TiNZ2U9Uvg5ua1gSW1klHtI8P49n/ZTmYftFJcPkJfw8mjawxuSzwTvPWNirkcTyF0jpauyn2W3L7q2SwuMMmS96z4R0FBwa4a1AjP7Rovq9r4lPjtjn45IPX5VPDG2gBiscVhBFLzozFucgXVk6bLo3bu8/lXuf+5PXaTH7TtRfYuTipiY4jbvlCx5jR3omzgnLThOWaoplnfIQPQbhnLF4t9ydipLxV+Dr2ccGnT+yehHxbmROK5kRD8DgPe0oe1+qFS5zIRyG6KZBgI3+ru3wAkbREeuE/Bq9nDWmRS5JVDlOKaFqFtYU2h12LB/f+MKPhwPdvzCiWLmT+XU8WW25pjUXHDakXRm4RJI2J+24cTjue2jv9GbNF4+n+ywunUpNqEagJ3q0VFZ8o5evZWjw55qMnsE6eMpSoPygssD1sfQ5jf4W00onxjSEijR7STqi/6zBEZzKzPSij3fH5HeWmsd9MwnQ+1/J8VIighxKm2RSRn6ClRsXggMvzCCf/wg5zwYClMWage65fytKYH12lR4Dl2fNHFYexTIWvrL/36xuuKhP/Glpz6dJHKm5bHOjeNo+RMtKLTWvr3NVqMQMzK9yl0JdPJKByoqLy+xR5pKy9TacihXJXZhpEPd2IDK2/zxCI+71OIN0iNqL1KnfI5VMtFJu/jEmkgzD+Hqg4UlI3a2frgxtv5chMvIusHIxf/2fv3OoWVhfIjObD9nlnbwFQHhAfnMemeMhaxlnxQ34aI4gFZJ1m3hg
+    connections.secretKey: AgB9N48o16//pMoE7YPHGHQUDd6n5gQGJcsDK2kmsxM1fj4POpG8eRwxXpRlNwBcH8VhgJAWJKLWUrIy5cQ4DM77gDGcG1YOpHIXDMDzTtocLmLJmpxoFGrswv0lEB0dCZwSpOph3btBzCDuKNA/nzHD/iwoVkZiDao/CyC+wjRrudamIfC0aJJsnSo1NAzcmsP1IEaURF0LoWdAPXWCqzEHbJ6FjCdQe/5F2md30PHGt1p0x3/ro4i4gv54ZePWBAStZml/a5i219UBvGROJgBCAJYEb0wlQ5Aut+7PVzjgUfLgWpvGEl1XBXGjuR5NUOiEwcYok+QsonQcUGaNScMzzqrfWRIagAlcGnSzs4TsLUgA2opBlKClVdEqnyS1QEH062ZTrxoFJ0mGg6T1oh6rElGfzmOTMhU95nRIF3wtYh4Si20IDAbWkIJgk1j5+Vvg31KHOTQXR6WdXc1CqYuo3LVzjP4JeIvrsdyqIJC4dg2WAKDTrQ3qixDv9Yq+bT9jMHrdQPQBz1clb8g6OEqtuDeobkTJFU/vdlZRSz86/mtsujpBNHr2SPa5IwIr2ALBx61NXfalc+gp2lUDTQSZPRf/oHIyD/SbARFDCNGmf0rPO1yQ2dg85+kLLSE2+K6uPYPwqippSIyiazIzCi5FLa6B6IEqAxjdrPyBdrMu3Qgkzdhp23UaL7yRnXJkHnPtb+URhrbnqPVIDiNeF0Nt
+    connections.sqlalchemyDatabaseUri: AgBGW3Nva7kn/GxNKinig8hj/b0KSa6nESiU2zKPwW6ZDhwTA3Kf3jcJCfKE2ISSLY3L7qNeihVnYP3f6S00y+b7oixLxvYxUxCGaVvNON/xtK+dFYoYQfh3hXevLWYuf7Bg5et6Rr2hoDJbkq6Nix2uIEMDiRjWyll3ma3ajlVSxbt4xdboXb/OqRzlCLS433nAruu2woSvw2d4ypoDHYd0uGw/W4ushxOEIDVC61kJU3T9K7UqzUK4bTMljiYxrwMAb3cZ0dnPw2FU/fpT9SDomCWtjnktMkfbzgVWgD/oIh+2IZH0p3Y9GoIDJUhHlBFudDu/t+tQ91F2Xpy3gqmWFSHkfnCex699hx4dBqAeSlf2Frwfz0ZR0CM4aSIKlPH1eyumz8VA5z8AmK8fDcWCvwYeRdS67qPcu0SDKodAlhA0XR3CSj+357TmId8KHS+DZCisrxAuMJGMt6FbCbTRxY6lM4yJHrkP+L9Hv3474deDApZix4h64pqiH5P1hYIsiDM02EkdI5JwrRuZewcfVMDzGhve/u9nSa5dMADrDdjKZAys8hCUgi//ynfJzpOKi/WbfvNeGcYbQdvDX9dyXTbvsSYQ/+jq8DnU69RwQWF3lYIwZAWeoGAThX4jvSppuDY+FtS/1TsrymLQSpPH4lXjgSw7yomRvNx2x2n4Pa3mPpgQ2SR4qKQX4lLeE2t+R39xKQreA4FO3XItLFnZ8ddLj1mcmatGhSMmD6AWI2hmxxxJJ3Of4AnBDrCoV68fYdPk/HeY3C8JfHQnSKcG
+  template:
+    metadata:
+      creationTimestamp: null
+      name: airflow-credentials
+      namespace: stackable-airflow
+    type: Opaque

demos/argo-cd-git-ops/manifests/airflow/sealed-airflow-minio-connection.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: airflow-minio-connection
+  namespace: stackable-airflow
+spec:
+  encryptedData:
+    airflow-minio-connection: AgAHQL1NIeZiWH1opQYqHINixw0muWaNsYKMhtgJqqdVMLeKIU/sckZ7Z6aokaEYXGVQRe+Tp+D9AaYaF5CdKeMQKQ3MmhxXYZh0EuAcNRyvz4u4K696KEIa4XpaT5k6oRbIwRUGCc4hiRVApmMOgGYl4iEwVQ/1Twd5ffEAohMsySgZQBn17zB+hKC3u2AcIrZ1btHvBrVhC4pil/kyytBwjTkMq1iAkF8lwt7gatLukD9ldLaVdYTe21R+nP/UT7DwHRnBlI1dzkfrMdplFud2XIEmSrFF7ihzc5r+Lsm2vsnjaV5OgzDjIPI3RRA7g8/06Lebpru/E9h6HB5RIu59ga72g02QIHh5HffGUCnbEsLTDDbBcuAQB2jSodotfsofVKOhZChOIJDchvohhrQ86wqlkQyjfNMq2Gh46Nc7ZjomlpL/p0afmak34GFoPYMCD7IJ2DafEsmKA8dYfjTI1kVzLhYuoeDB3f82tu8xL9cXCEUsw7Y7EosZjeITeLcV1oMm+jeHzNHGaLmCI9k1sY5bL6xjbG59sOvuEgI302tS9ua592u9uqOOKKjE4eZM7CAmEjgMmDPbeteXGnZcOqfj8FWmlp0f4gm9s+68KH5PDtkKdtBckNjDeLj3QhMC2gstXnPJR3Hnm/bFQ4i/6XpnkuOFCvQT/Baar5scw4vhJ0tN8TGeMd651YXU7N2MEB+2WtiO0StbzhcWIoiGmvN+SRLawPZ87Sqlt26/bs5+jnuEv4Fy1oXhxbZwuf/YsZjEaKFI+HbFVvwM0K2d00/z9DYAB44oY2PmrZwsk0KqP2hkuumq
+  template:
+    metadata:
+      creationTimestamp: null
+      name: airflow-minio-connection
+      namespace: stackable-airflow
+    type: Opaque