chore: Use internal secret for JWT key

CHANGELOG.md

@@ -8,6 +8,10 @@
 - Add new roles for dag-processor and triggerer processes ([#679]).
 - Added a note on webserver workers to the trouble-shooting section ([#685]).
 
+### Changed
+
+- Use internal secrets for secret- and jwt-keys ([#686]).
+
 ### Fixed
 
 - Don't panic on invalid authorization config. Previously, a missing OPA ConfigMap would crash the operator ([#667]).
@@ -24,6 +28,7 @@
 [#679]: https://github.com/stackabletech/airflow-operator/pull/679
 [#683]: https://github.com/stackabletech/airflow-operator/pull/683
 [#685]: https://github.com/stackabletech/airflow-operator/pull/685
+[#686]: https://github.com/stackabletech/airflow-operator/pull/686
 
 ## [25.7.0] - 2025-07-23
 

Cargo.toml

@@ -20,6 +20,7 @@ const_format = "0.2"
 fnv = "1.0"
 futures = { version = "0.3", features = ["compat"] }
 indoc = "2.0"
+openssl = "0.10"
 rstest = "0.26"
 semver = "1.0"
 serde = { version = "1.0", features = ["derive"] }

docs/modules/airflow/examples/example-airflow-secret.yaml

@@ -10,7 +10,6 @@ stringData:
   adminUser.lastname: Admin
   adminUser.email: [email protected]
   adminUser.password: airflow
-  connections.secretKey: thisISaSECRET_1234
   connections.sqlalchemyDatabaseUri: postgresql+psycopg2://airflow:[email protected]/airflow
   # Only needed when using celery workers (instead of Kubernetes executors)
   connections.celeryResultBackend: db+postgresql://airflow:[email protected]/airflow

docs/modules/airflow/examples/getting_started/code/airflow-credentials.yaml

@@ -10,7 +10,6 @@ stringData:
   adminUser.lastname: Admin
   adminUser.email: [email protected]
   adminUser.password: airflow
-  connections.secretKey: thisISaSECRET_1234
   connections.sqlalchemyDatabaseUri: postgresql+psycopg2://airflow:[email protected]/airflow
   # Only needed when using celery workers (instead of Kubernetes executors)
   connections.celeryResultBackend: db+postgresql://airflow:[email protected]/airflow

docs/modules/airflow/pages/getting_started/first_steps.adoc

@@ -23,9 +23,6 @@ And apply it:
 [source,bash]
 include::example$getting_started/code/getting_started.sh[tag=apply-airflow-credentials]
 
-The `connections.secretKey` is used for securely signing the session cookies and can be used for any other security related needs by extensions.
-It should be a long random string of bytes.
-
 `connections.sqlalchemyDatabaseUri` must contain the connection string to the SQL database storing the Airflow metadata.
 
 `connections.celeryResultBackend` must contain the connection string to the SQL database storing the job metadata (the example above uses the same PostgreSQL database for both).

examples/simple-airflow-cluster-dags-cmap.yaml

@@ -10,7 +10,6 @@ stringData:
   adminUser.lastname: Admin
   adminUser.email: [email protected]
   adminUser.password: airflow
-  connections.secretKey: thisISaSECRET_1234
   connections.sqlalchemyDatabaseUri: postgresql+psycopg2://airflow:[email protected]/airflow
   # Only needed when using celery workers (instead of Kubernetes executors)
   connections.celeryResultBackend: db+postgresql://airflow:[email protected]/airflow

examples/simple-airflow-cluster-ldap-insecure-tls.yaml

@@ -138,7 +138,6 @@ stringData:
   adminUser.lastname: Admin
   adminUser.email: [email protected]
   adminUser.password: airflow
-  connections.secretKey: thisISaSECRET_1234
   connections.sqlalchemyDatabaseUri: postgresql+psycopg2://airflow:[email protected]/airflow
   # Only needed when using celery workers (instead of Kubernetes executors)
   connections.celeryResultBackend: db+postgresql://airflow:[email protected]/airflow

examples/simple-airflow-cluster-ldap.yaml

@@ -136,7 +136,6 @@ stringData:
   adminUser.lastname: Admin
   adminUser.email: [email protected]
   adminUser.password: airflow
-  connections.secretKey: thisISaSECRET_1234
   connections.sqlalchemyDatabaseUri: postgresql+psycopg2://airflow:[email protected]/airflow
   # Only needed when using celery workers (instead of Kubernetes executors)
   connections.celeryResultBackend: db+postgresql://airflow:[email protected]/airflow

examples/simple-airflow-cluster.yaml

@@ -10,7 +10,6 @@ stringData:
   adminUser.lastname: Admin
   adminUser.email: [email protected]
   adminUser.password: airflow
-  connections.secretKey: thisISaSECRET_1234
   connections.sqlalchemyDatabaseUri: postgresql+psycopg2://airflow:[email protected]/airflow
   # Only needed when using celery workers (instead of Kubernetes executors)
   connections.celeryResultBackend: db+postgresql://airflow:[email protected]/airflow

rust/operator-binary/Cargo.toml

@@ -17,14 +17,15 @@ clap.workspace = true
 const_format.workspace = true
 fnv.workspace = true
 futures.workspace = true
+indoc.workspace = true
+openssl.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 serde_yaml.workspace = true
 snafu.workspace = true
 strum.workspace = true
 tokio.workspace = true
 tracing.workspace = true
-indoc.workspace = true
 
 [build-dependencies]
 built.workspace = true