[Argo-Workflows] Lesson8: Secrets as environment variables

Bài này chúng ta tìm hiểu các để bạn lưu sensitive value và đưa nó vào workflow

Mình thực hiện lưu value trong secret của k8s.

echo 'Password123' > test_password_file.txt

kubectl -n default create secret generic test-secret --from-file=test-password=test_password_file.txt 
>>>>secret/test-secret created

kubectl get secret 
NAME                       TYPE                DATA   AGE
argo-artifacts             Opaque              2      24h
test-secret                Opaque              1      105m
tls-oauth2-proxy-ingress   kubernetes.io/tls   3      32d

Và đây là file workflow.

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  name: wf-secret-env
spec:
  entrypoint: dag-template
  arguments:
    parameters:
    - name: message1
      value: Task 1 is executed
    - name: message2
      value: Task 2 is executed
  templates:
  - name: dag-template
    inputs:
      parameters:
        - name: message1
        - name: message2
    dag:
      tasks:
      - name: Task1
        arguments:
          parameters: [{name: text, value: "{{inputs.parameters.message1}}"}]
        template: task-template
      - name: Task2
        arguments:
          parameters: [{name: text, value: "{{inputs.parameters.message2}}"}]
        template: task-template
      - name: Task3
        template: task-secret-env
        dependencies: [Task1]

  - name: task-template
    inputs:
      parameters:
      - name: text
    script:
      image: python:3.8-slim
      command: 
      source: |
        p = "{{inputs.parameters.text}}"
        print(p)
  
  - name: task-secret-env
    script: 
      image: python:3.8-slim
      command: 
      source: |
        import os
        print(os.environ['TEST_PASSWORD'])
      env:
      - name: TEST_PASSWORD
        valueFrom:
          secretKeyRef:
            name: test-secret
            key: test-password