Adding a secretMap instead of adding multiple secrets (#22587)

Signed-off-by: Edward Vella <hello@dwardu.com>

stable/airflow/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 description: Airflow is a platform to programmatically author, schedule and monitor workflows
 name: airflow
-version: 7.1.1
+version: 7.1.2
 appVersion: 1.10.10
 icon: https://airflow.apache.org/_images/pin_large.png
 home: https://airflow.apache.org/

stable/airflow/README.md

@@ -572,6 +572,7 @@ __Airflow WebUI Values:__
 | `web.livenessProbe.*` | configs for the web Service liveness probe | `<see values.yaml>` |
 | `web.secretsDir` | the directory in which to mount secrets on web containers | `/var/airflow/secrets` |
 | `web.secrets` | secret names which will be mounted as a file at `{web.secretsDir}/<secret_name>` | `[]` |
+| `web.secretsMap` | you can use secretsMap to specify a map and all the secrets will be stored within it secrets will be mounted as files at `{web.secretsDir}/<secrets_in_map>`. If you use web.secretsMap, then it overrides `web.secrets`.| `""` |
 
 __Airflow Worker Values:__
 
@@ -593,6 +594,7 @@ __Airflow Worker Values:__
 | `workers.terminationPeriod` | how many seconds to wait for tasks on a worker to finish before SIGKILL | `60` |
 | `workers.secretsDir` | directory in which to mount secrets on worker containers | `/var/airflow/secrets` |
 | `workers.secrets` | secret names which will be mounted as a file at `{workers.secretsDir}/<secret_name>` | `[]` |
+| `workers.secretsMap` | you can use secretsMap to specify a map and all the secrets will be stored within it secrets will be mounted as files at `{workers.secretsDir}/<secrets_in_map>`. If you use workers.secretsMap, then it overrides `workers.secrets`.| `""` |
 
 __Airflow Flower Values:__
 

stable/airflow/templates/deployments-web.yaml

@@ -154,11 +154,17 @@ spec:
           volumeMounts:
             - name: scripts
               mountPath: /home/airflow/scripts
+            {{- if .Values.web.secretsMap }}
+            - name: {{ .Values.web.secretsMap }}-volume
+              readOnly: true
+              mountPath: {{ $.Values.web.secretsDir }}
+            {{- else }}
             {{- range .Values.web.secrets }}
             - name: {{ . }}-volume
               readOnly: true
               mountPath: {{ $.Values.web.secretsDir }}/{{ . }}
             {{- end }}
+            {{- end }}
             {{- if .Values.dags.persistence.enabled }}
             - name: dags-data
               mountPath: {{ .Values.dags.path }}
@@ -255,11 +261,17 @@ spec:
           configMap:
             name: {{ include "airflow.fullname" . }}-scripts
             defaultMode: 0755
+        {{- if .Values.web.secretsMap }}
+        - name: {{ .Values.web.secretsMap }}-volume
+          secret:
+            secretName: {{ .Values.web.secretsMap }}
+        {{- else }}
         {{- range .Values.web.secrets }}
         - name: {{ . }}-volume
           secret:
             secretName: {{ . }}
         {{- end }}
+        {{- end }}
         {{- if .Values.dags.persistence.enabled }}
         - name: dags-data
           persistentVolumeClaim:

stable/airflow/templates/statefulsets-workers.yaml

@@ -159,11 +159,17 @@ spec:
             - name: scripts
               mountPath: /home/airflow/scripts
             {{- $secretsDir := .Values.workers.secretsDir }}
+            {{- if .Values.workers.secretsMap }}
+            - name: {{ .Values.workers.secretsMap }}-volume
+              readOnly: true
+              mountPath: {{ $secretsDir }}
+            {{- else }}
             {{- range .Values.workers.secrets }}
             - name: {{ . }}-volume
               readOnly: true
               mountPath: {{ $secretsDir }}/{{ . }}
             {{- end }}
+            {{- end }}
             {{- if .Values.dags.persistence.enabled }}
             - name: dags-data
               mountPath: {{ .Values.dags.path }}
@@ -234,11 +240,17 @@ spec:
           configMap:
             name: {{ include "airflow.fullname" . }}-scripts
             defaultMode: 0755
+        {{- if .Values.workers.secretsMap }}
+        - name: {{ .Values.workers.secretsMap }}-volume
+          secret:
+            secretName: {{ .Values.workers.secretsMap }}
+        {{- else }}
         {{- range .Values.workers.secrets }}
         - name: {{ . }}-volume
           secret:
             secretName: {{ . }}
         {{- end }}
+        {{- end }}
         {{- if .Values.dags.persistence.enabled }}
         - name: dags-data
           persistentVolumeClaim:

stable/airflow/values.yaml

@@ -432,6 +432,15 @@ web:
   ##
   secrets: []
 
+  ## you can use secretsMap to specify a map and all the secrets will be stored within it
+  ## secrets will be mounted as files at `{web.secretsDir}/<secrets_in_map>`
+  ## If you use web.secretsMap, then it overrides web.secrets.
+  ##
+  ## EXAMPLE:
+  ## secretsMap: airflow-secrets
+  ##
+  secretsMap:
+
 ###################################
 # Airflow - Worker Configs
 ###################################
@@ -544,6 +553,15 @@ workers:
   ##
   secrets: []
 
+  ## you can use secretsMap to specify a map and all the secrets will be stored within it
+  ## secrets will be mounted as files at `{workers.secretsDir}/<secrets_in_map>`
+  ## If you use web.secretsMap, then it overrides workers.secrets.
+  ##
+  ## EXAMPLE:
+  ## secretsMap: airflow-secrets
+  ##
+  secretsMap:
+
 ###################################
 # Airflow - Flower Configs
 ###################################