Is there a way to use AWS Secrets manager in helm chart for metadataConnection, fernetKey and webserverSecretKey?

[deathwebo]

Hello, I wanted to ask, because I couldn't find something either in github or the docs, is there a way to utilize AWS Secrets manager to retrive the values used in values-override.yml for metadataConnection, fernetKey and webserverSecretKey?

As an alternative to Kubernetes Secrets.

Thanks in advanced.

[potiuk]

Have you seen this page: https://airflow.apache.org/docs/apache-airflow-providers-cncf-kubernetes/stable/operators.html#how-to-use-cluster-configmaps-secrets-and-volumes-with-pod (Specifically how Secret is used) ?

Does it answer your question?

[deathwebo]

Hello @potiuk, my question is more related to how to use values from AWS Secrets Manager in the helm chart's values override, like the metadataConnection values https://airflow.apache.org/docs/helm-chart/stable/parameters-ref.html#database as opposed to using kubernetes secrets for this kind of config, as explained in the prod guide https://airflow.apache.org/docs/helm-chart/stable/production-guide.html#database

Thanks for your reply

[potiuk]

No idea. But I think your idea is bad because it will reveal secrets in Resource which are submitted to Kubernetes which makes them visible to anyone who can see the resources. Kubernetes resources are pretty bad storage for secret information.

[mint-flavor]

Hello @deathwebo, How about using the AWS Secrets and Configuration Provider (ASCP)? Here are related docs.

[1] https://aws.amazon.com/ko/blogs/security/how-to-use-aws-secrets-configuration-provider-with-kubernetes-secrets-store-csi-driver/
[2] https://github.com/aws/secrets-store-csi-driver-provider-aws