Remove core flyteadmin init-secret initContainer

- A separate container instance that requires Kubernetes API access is unnecessary when Helm is able to generate the same secret values in the client before submitting resources to Kubernetes. The declarative approach here is identical to what the code does in https://github.com/flyteorg/flyte/blob/master/flyteadmin/auth/init_secrets.go#L80-L151 - The lookup function is used so that on upgrades, the secret is not regenerated -- the existing values in the cluster are used. - Note that Helm always creates secret resources before deployment resources, so the secret values are guaranteed to be available before flyteadmin starts - Update helm chart regenerate check so that it only fails if the diff has new or removed lines Signed-off-by: ddl-ebrown <[email protected]>
flyteorg · Jul 12, 2024 · 25158b0 · 25158b0
1 parent 81afb76
commit 25158b0
Show file tree

Hide file tree

Showing 9 changed files with 55 additions and 158 deletions.
diff --git a/charts/flyte-core/templates/admin/deployment.yaml b/charts/flyte-core/templates/admin/deployment.yaml
@@ -107,31 +107,6 @@ spec:
             {{- end }}
             {{- end }}
         {{- end }}
-        - name: generate-secrets
-          image: "{{ .Values.flyteadmin.image.repository }}:{{ .Values.flyteadmin.image.tag }}"
-          imagePullPolicy: "{{ .Values.flyteadmin.image.pullPolicy }}"
-          command: ["/bin/sh", "-c"]
-          args:
-            [
-                "flyteadmin --config={{ .Values.flyteadmin.configPath }} secrets init --localPath /etc/scratch/secrets && flyteadmin --config=/etc/flyte/config/*.yaml secrets create --name flyte-admin-secrets --fromPath /etc/scratch/secrets",
-            ]
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
-          volumeMounts:
-            - mountPath: /etc/flyte/config
-              name: base-config-volume
-            - mountPath: /etc/scratch
-              name: scratch
-          env:
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-            {{- with .Values.flyteadmin.env -}}
-            {{- tpl (toYaml .) $ | nindent 12 }}
-            {{- end }}
       containers:
       - command:
         - flyteadmin

diff --git a/charts/flyte-core/templates/admin/secret.yaml b/charts/flyte-core/templates/admin/secret.yaml
@@ -1,11 +1,28 @@
 {{- if .Values.flyteadmin.enabled }}
+{{- $secret := (lookup "v1" "Secret" (include "flyte.namespace" .) "flyte-admin-secrets") -}}
 apiVersion: v1
 kind: Secret
 metadata:
   name: flyte-admin-secrets
   namespace: {{ template "flyte.namespace" . }}
 type: Opaque
+data:
+{{- if $secret }}
+  token_rsa_key.pem: |
+    {{ index $secret.data "token_rsa_key.pem" }}
+  cookie_hash_key: {{ index $secret.data "cookie_hash_key" }}
+  cookie_block_key: {{ index $secret.data "cookie_block_key" }}
+  claim_symmetric_key: {{ index $secret.data "claim_symmetric_key" }}
+{{- else }}
+  token_rsa_key.pem: |
+    {{ genPrivateKey "rsa" | b64enc }}
+{{- end }}
 stringData:
+{{- if not $secret }}
+  cookie_hash_key: {{ trimSuffix "==" (randBytes 64) | quote }}
+  cookie_block_key: {{ trimSuffix "=" (randBytes 32) | quote }}
+  claim_symmetric_key: {{ trimSuffix "=" (randBytes 32) | quote }}
+{{- end }}
 {{- with .Values.flyteadmin.secrets -}}
 {{ tpl (toYaml .) $ | nindent 2 }}
 {{- end }}

diff --git a/deployment/eks/flyte_aws_scheduler_helm_generated.yaml b/deployment/eks/flyte_aws_scheduler_helm_generated.yaml
@@ -56,7 +56,13 @@ metadata:
   name: flyte-admin-secrets
   namespace: flyte
 type: Opaque
+data:
+  token_rsa_key.pem: |
+    LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS0FJQkFBS0NBZ0VBb0MzaFU0eml4QjNVbG9hY0FNaVYvME9OejdTVjVlbzBoVGw4OVluYmpvL2RqVWZECmpJbENZTUhxd2RKTHo2SXRsaUh6MmZCY3pwQndST1ovSVpvenhBbkZINWNoRkRMQjVydnJDeHBRQzJMZzRFRTYKQlpPenZYa1A2cVo2YnpMZmwxQ2tKWVN0cHAzcjlJMXBhVEtTYWQyRGxuUkl2ZzhxUUJWcHRpcmlLSHFvVzNMZgo1ZVBSZy91M0VaMTY5ekdoWisraFpGM1JTSFJEOEZKN0dqZXJtMjJyNkFGRzlWM2dSOTN4aVY5ZHJoR3BCNUpQCjBzQzcyOUtuT3U0OXByL0daKzhVZnlJY2JFaXhWUWFFUWNvZ2V2RDRnWmRoY0xRQmEyVlp0WXZ2Y1RDcFJvbisKMDFvbGhnQ04xU0lZK1cxK1ZuMlJ4emRWUjh2TEpTWm1aY1FvQmNleXpwbmtOditwbTV5WjRIOUcvT0V1Mm1GbQp2ZTRsVTJJZFJtWEZJV2FOUFQ1T0J2anpaVUlteXNZdlBmdXJwQXoxUms5aERKR2FKeURXQ05wdFB3Q1RyV3J0CmpDUFVDbUt3MUhWOGJhWFBOOFVUNWtWV1F3ODdOOExpVi9Rd0ZxZURHYlIyZTQ2M01YNFE4MkoxRGhnTkZwZ1cKTFlKWjhiSlU2VWRLZ1lZZFl1S095WjlybDd2UGpuT3NvSVRocmJ4YnlkbTE2U3FKTisrbmx3WWowT0hYa1E2OQprUHNKcWVPcTVZUzBVeG5McUp3Y0dMcHFabEpBTlhMUk5JR2FEM1pjLzdzZFhtWUlBY3pCeTlTcDE3cmdLUWZrCjY0LzFLWkJuV3pZR2lWYTNCSmlYOXBRYmdDY1ZEMTVuNmZPWlFYL2xEVWVJQ1M2VnFjVEhEcVBjMk1NQ0F3RUEKQVFLQ0FnQnJycXhlV01aU0JhUFhGZU5tZTNLclNxVFpUNU8rSHZiejRUUHFkYVVPY0JVSFY0bFV2eW5LbGxMVgp2aVNORDRBS0FBVkpMRmVYM200N1E2R1AyM1NWZytQcld0UTRHZTlVeUZ3NCtKVjdNaHZ2WnFvMCtaako5Y3NICmVxZXdmY2ptbHFYak94RHFoQndPS2NzRmw2UHFXNnFNeU52bU9aZXp3VEZ4Nzk1ZVRDZEdZekcyQUxQblFKOVAKemtqT1NhVXlsRnd4ZHdpczVzeU5rVVdFMkl3YlQxMVQrUmZVK0NsQTV5bnJxaHIyWEpUL3JCTFJvaFFvc2JNTwo0UDY5VFF0Njc3VWR5cmJFN1JHYUVXbDBPUWdnM2tLU0RFekxVWmZxdFJYY0FKa1Z4UnJuZXZtKzZFbDFqb1hMCkZNTXBXN3lsTklGK0plckUrM0kwSlY2Tlo1Tm5UeE1VUHR4T1Mrdkh1REdlOXJETVZtbnRWdXhiSmFBaEt3RjMKcXUrVWpETmtPbmdSd0h2TjJKUjB3YTFtMmFHajBaYUhRWXpCOC91QlpCTXhSalRDSjN2SnNNZ1VRYVduQ2hKQgp3bWh4STZpbVhDNUtFNGJRUFhjRkMxYlRuRUdKbzZDMy80T0dmTzJxSWFoL28zWG5PdFNlREU3YWNpTmE0ZXE4CkZSMzZ2UGU0UDJqMnBnZDNCSHdKYVN6R0pxQlRIRkV0YnMyU015R1BUV3FPS0pBejhFaElTNVNMWC9SV1RpK00KUlZVMzJtdTBpd0lvb21sNE9CSjlyaDZJc3Y4TzBicWNMM2FvWWZlcXJHd2o1ZXd6TkFhbjdrUGE4RVFFZ2w5LwpGRXRZTFNucU1TUTVOd0dObGI3MWU4aFNjOHZabmpaT1VJUllLMWFjWG15U1lYQXNBUUtDQVFFQXlKQ0ZiVzBWCllrSklOL1BpbVJ1dXBER3pXZ3I5UGkzL1NEM3ZjeFJnS3lUMmVpdXdZOEdNOEtHV2NZcjhlWlRERGpxR1A0MncKcTFHWGhZZEZzdllQcDJ5Z2Vma1p1bXRsUTlRcEdSMmFTamtVRDNoM21vQjFCamFhZTFnY1Q4cWJnRU9EaGxvNwp2aHNpdUREclphYUdHcVV0TyswVENseEczQnBMNXNDeFVMVnFaNWNwK0lzYUxVVnorbFZlRHFUWWEwQy9rZytHCnlNU2pqREVBdVNOZmVLYTUyamphUi8wZ1RsRjdoREV3cEZXUkFjUk54NXV5VWdXdG5sSDF0cUF3M2RrVXh6amoKZGlWZzVIWWRyWkVRaFFHQlIwS0h6NzIwbDdvd25LNUdMdCt4cnFRYWo2Y2FMeUN6dXR2QnB0SExla2VKZFZYUQpKTERUY2h4RXNoYlR3d0tDQVFFQXpIUEp4Y1JZcjRneE1VeUF4Z1BlazRHS2RCWXdUcitvdXdTTDJ6VnNkVEw2CjFjWHRKMGtTMUFManpzRXdjVVZYMENaNzZtSHR5UzBGMFlFOGZqUnhkWDhobWFLN3V3TWtqdnhsVkJ0UFdvMnQKNC9LM2FvZmdIYTgrUTRJYXRxVjZrTVB3M3BFcktXSENxTGJacllyU3I0aS9YaWQxMzhTYUlVZW5VRitEZUNlZQpLcWlvaGtwMDZUbFdkMllwWmhUa3JSV2pTRjFYR0FLeERVNDl4dHVmNTJUZ1Z4QWFRUVpqYmEvLzlIRGg5dEZWCnhYYnRlS1Y2eUJKVnQzRjFQWDNDQU9BbmpsZkkvZkpLUExUSGRvYXIvaHpmNW1kcTM3UkFOYWJxM3RNVkdUV3QKeThJNVVNenNpMXBLWm9uREdtbHFVYlhZcVZzaTh1b2dZTGtmNGNxWEFRS0NBUUVBai82U2pQbWdQS2R4eWhvagpPZUdTQlBoWjErL0QyWHlVcDMwd0NPTThHRDIxYUFrdDNyRDdTMWYzOXhUZUp6d1N2b2h1RWZyY09HT2Y4WklwCkRFOTA5Yk1iay9hdjdoTms1TW5ScCtLRS8zenpWaGdiWnFXTFh5YWN5cWw3eWgyZ2Z2bjUxOSs0dk1nbXFTOFcKRWlqNFp2RG9CUG8walYrcTBDTmhFdzZOUDNEQU1CZHJYcklmM1JqY0o0SmF3UkRCQUYvQUtsRlRaNWttQW1TOApMQytsUDY0VUNRU0FVdWI4NXIzQmZDc0V6VGRSb0g4YmlJL1QrdWR3dXhZRTMxVXJRRnUyZTBId3JNWXhSbFUzCkFZSUE1ajBxWDhyNFRzSFlnb1orbUQ3V3pKaDFyUGpNeVE0ajBtb2NINi9lM0xJSzhJT2p3TVlYWmdBK0R0TVUKenZkc21RS0NBUUJyelhIS3Nha0JoUkpMS0VlT0lXUXU2dE1TT3REbDlQRUhDM0tpOXh4ay82aDdKNDNRZFJ0VQpadUd2bHZYd0E5dzFpTlUxMU1VSW1wREMweDRPZmFDRmo2OHJ6ejZsY1JiSnZoTy9zVmE2TEpKUDZ4OERNUG5mCkxSUHJqS0tCUStmSWhVaHdVcU1yZ3J5ZE1TeTk4TUQraFdCQ1NSUkNGT3dnT0NQa29UZzFGczZ6TjVNRW5DWGgKQTdhdjVsSlYzUlptblU0blRmQXFYT0QyWHhiN3o3b1V6SC90NkRPdnJhcW5uM0dhZGhydmhabHdNVEV0dUROeApZeG1IVEcvQktKb3UxQUtIYjRvdlBKNGdQRUlnSVFwM1JzcFlOcGVIdFFkV1F0ajgvTmZYSHhLd3FZeUhLa1pmCmhCQk8yTHpqSkVwSEkxZEdsU05zYWo4QVFSeXFkYVFCQW9JQkFIN21lNE4xU0owbzcwWnVwellPR0M0aGcvdU0KeTJLM2dkK1hRSGs5TEhzdUVhYmFwZFlCM0MxV08rcHZyYWhXbCtqU3ZLcTR2ekljMlFXZkRqOUhYT0ZWK1dISQoyNnVzdkRqTnFMclRzVW9PNGtjVXlTN2U3SUZTVWUvQ2N4Ly9ZYm4xbjgrL1pGR09YZ0tVeUNmNHZpaWxiSkh4Cm9xdWdiVXUwMDdIVU9ZOFNxaDZNK09GWDFHb2pGM050MWVPOTVidHlROGhNNHJWd0d5cFZEdUovU1FMcFIwYzEKNmhXRnFzb0Q2aVpqcmV6ZUgvbzVOLzBEenJuUjJ3MGw1ODNkVUNqZmNPdERXNkJTbHNaWEdVOVpxUU1aN2JlYgpwU2I1NXZ0cDVvQnBQYmhYVEZTdnlnNk82ZWdUa0dicVpqM3oweXVWSXByWHpXR0hzZjRXVTFhN1lVaz0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
 stringData:
+  cookie_hash_key: "MuJrZ6SO749aiiuCUHTt0soA9wTTc1hyL8joh+UWZ9AqwxJ0GH5fjwDM0EF5umqLUg81nl3MGqD108vZPad4eA"
+  cookie_block_key: "4lcZsm7g6hAac3c2O8i5QV04jewLPDUT+QfwdGkfONI"
+  claim_symmetric_key: "seUw6e6wnsbCuAaW1L2U/iLItvtIWxlNAUQ3r9Gozj8"
 ---
 # Source: flyte-core/templates/common/secret-auth.yaml
 apiVersion: v1
@@ -931,28 +937,6 @@ spec:
             name: clusters-config-volume
           - mountPath: /etc/secrets/
             name: admin-secrets
-        - name: generate-secrets
-          image: "cr.flyte.org/flyteorg/flyteadmin:v1.13.0"
-          imagePullPolicy: "IfNotPresent"
-          command: ["/bin/sh", "-c"]
-          args:
-            [
-                "flyteadmin --config=/etc/flyte/config/*.yaml secrets init --localPath /etc/scratch/secrets && flyteadmin --config=/etc/flyte/config/*.yaml secrets create --name flyte-admin-secrets --fromPath /etc/scratch/secrets",
-            ]
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
-          volumeMounts:
-            - mountPath: /etc/flyte/config
-              name: base-config-volume
-            - mountPath: /etc/scratch
-              name: scratch
-          env:
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
       containers:
       - command:
         - flyteadmin

diff --git a/deployment/eks/flyte_helm_controlplane_generated.yaml b/deployment/eks/flyte_helm_controlplane_generated.yaml
@@ -46,7 +46,13 @@ metadata:
   name: flyte-admin-secrets
   namespace: flyte
 type: Opaque
+data:
+  token_rsa_key.pem: |
+    LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS0FJQkFBS0NBZ0VBdzJ5a3pFUm9ieEROM2JndjVHdEdDaDBFT0MraG5ESFM1WUZiUlBma1hBdmZyNFR4ClBoU1hwM0hubytEWm9GaXJtcWNSRE9iS0FlOXhOVncycDN2Y3V0SnEzdlRTT2F5UDdrZXBEckk5ZW9XYXY2R08Kbm5Lc3lKU3VuSUt2Kyt2WVlxZFAvUE9tZVBkKzB4MU56RTEzYTViZFdlMjhhMWgvdytmTmViWnJ0bFIvMlFDYwp6ZHQ5TGtUdUQzOXdieXhvNy8wTzNnRVJ2aWc3WXhUSmhOVWFLVWo3ME1UTTNSeCtzTGdQcXV5SGFZd1JUaHFXCm04SmlaU1ZXTCtFYm9CbGQ0aVNHOVRVeWVRVTQ5M2RBRjN4cWc5UFNkU0N1NXdHWUpVTzdTY1FnRnJkRm43YysKVkFBM0p4a3hkRjIrSWg0L3pBdzhWSGV3dFdlUC9qcksyTWxqanBLNmprTE5VbHgycFh4N3RpaDlxQ2dwNVJXTgoyVGZ5Y2htL2l5ZWFuYThVd3lWeHVyNHI4OHk0UEFQUUoyek5KQlgyWDRjd21va1RReFRpRzRjMWlKZEJtb2tzClFWaGhiTnMyTmlCcHpjd2pISjZ3T1RWSitReCs1U3V3Z2o3UzhiUG5hTnlOdm9DZUIvUDhWUTZIZHF4eEFlMG0KSXh1K3NjQzBBT0dYVWZXN2xoaitQaTRuTC85MmR2M09ScjgrOWtNWTFiL1dkSlRGTkFhUkJvUU5JbnZ4UDdZSgpkeWtnS3NtWHp1bGhMWHpyQXRkT3dEVE81NUVwTFRQeFVJNHZidklRdFY5SkhJbG5uc3BCTHJLalpzYW94c1dmCjRrNFpwdVhJVzBQTEw2NklRVUF5N2FOYkc0c2o5SzNKYk82dnhQeHk5ZGJnblEyVDIzYjJGR2NubUtFQ0F3RUEKQVFLQ0FnQUZnR2gvUzZtNC9yc2M4OU45VmJ2S0N4a1VUOXIzMzdzMU5OZ1I3L3lnenNERVd6VERiNmI1VXM2WApvWHZlOU1BWUFYNE1ZKzdwOFFpNTNOZTVEVmFnZDg0RWF0WUVRNlJscStUSmdpRVM4dkh4VlNZRHRlekJWTlk1Cmw4QkdrbFFzS3RPb3BsOVlabmRPa0RPaGZjalA0Wlpuc3Jhc092aVYxay9Gam1vbjN1Y2VmOUxxUkxTWWVkNU4KMTJPZDdaMGlySGdmcmQ0SEFYRHlrQ0pBT0JPZGQrMkc2aE51WWgvNjc2T1pSMEZrcWtuT2JoY3hXVjZWeEdCUgp4citWV1VGNFhWampURlVZYlJvMmRVZjdvVWdLWUFzN3V1alJuZ3pmZDdHdEdQVmlUbFNLYzRrd3FqVGpSK1ZKCmhsNFU3YzhUK29BMFRJNVAvUk5qcjlvSUVsdFlHb1FuellnUUI2a0kzTS80SmowcVpBQWVmcyswM3pLWmpxREgKVEthamlwc3p0YWhVYjdsZEtHN3lrNzluMjhDOW5PQjBYbS9RNlA2dGZQZ1lDamdlb2dNSm51RzVWd2VRNHhaWgpxWjlSdTB2UlUxblQ1bG9Fb0N5K3JoYS9kVDc0YitETzU2c1JiNWQ1YkJMaWliWXZPdDFyM25Kei9HVEhlUThJCnc2dllHcjVITzQ5eVZvSEx0SXNUcklOTEdrZEphaXd3YUh6QlBlUmlUdzg4ZTh3V1N0aWppUFpRTU0zN3FBSU4KaWpiV2l0SGxzS25uNU00YkM4dTR4OGw5ZkJyRkVpcjEwQWYwUk5nRHM0b0tSS2FIWFlqWjR1eGJMcDhqdXVOWAplaWlPWW94akFVOTZkNlpERGkwUjlFOGZPMFhXVUE1bkIrZG5ERkkyc2NoZFExSGhwUUtDQVFFQXlJeExXMDRvCkN3aS9WNzZObVQ5ampsSDhodjJIZjZhTTdFUTdqdy9ESGlkK3A3c04yc2dzejJqZUk5aXpES1lZUU4xV3lJL1MKUFJZV0VXWldzT250MlF3cjluOENLSnZ1SGI0aDFmQVhiOHNJSjBSbUdQUnJlWWhwbXo5bmpVVjNNQW1Fb2wxZgpaQUh4d0E2TmhHK1RZZ0Z0ZDZ5N2NiNkc4bEFpNHI1YTZqM1d2SkRiRUFJMFNwWjFHdjZKVkRHNW1ZdG1ZZW8xClFlUFFTbk12cTk3QWpmMWxXeUoySy8wcktWOUdnQVl0eXZlQWNpTFZvNzF3MUNKdmJ2Si81NitaZGdFcTI0OEcKUXhackdiWmRKSmJXa3RrbktKK0IwcElQWWg4ZVFPZG9xWU4vb2RHbTBSU3VnNkw1UTYzTXBpbUZvVVlRZ1ZLMQpCSTFVdFJGU0tkcVh1d0tDQVFFQStYV3MwUW1RTTVhZXRPMVBxTHJyZjR4Ymw5VUx6UzdLZ1dHRFNwSlIzQ3F4CkJBVjVaenV4cGt3SkFBVmlkRlBRRlRGSUs0WVg5NjhoSVR3VWNDYVQ3UU9yb3JsdEplN2E2NlFaU2pOUXRUVngKcjNUUEQ5dVhpWjFzVXcydVUva3g5OVNnQ0lUYm51bGUxV1VwUngwcktIMWFlbXkzNG9HQS9wc2RsZDJUTXg4ZQovQW5HdjhZTDVNWnlWVW1lWlpZWElwbTBHRDc3WWpINk9JQ3g3bkQ0dzREcGlObk5GQ1ZMRytQMHZhcEN3cTNzClV6Q09lWHJ2NGo2VU5pNDdJV1pIYU9pTjJJbWUxZ2JCSkNqaXFocjl6d3ZJdHpFMEZhUFpSNUlua3VsQWpaVm0KT09KWkhuei9OdkNwRk1PVTJjb255R252YTdIWnBLdWtDTzFhNlhsRlV3S0NBUUFCY29uRXNlNjJEYTBiM0FNMwpuTzZDQTNONElmSk5hSTFSMHpnKzB4Vk1iV3FMbVYwRFBEaWVrcG92MWd1TXh0SWIvYnozbTVvZjJMMzJDREFOCi9OSTdvOHZaYnBjOFpjdTFLVDhqUlNWV0tEZjUySk9JRUpPS0FBTUxITTBKaHZ2U08rOWFJS1JrbTJMOFNONmEKbXhlTU9JaHF1Yk5zb2J4bG1WQjNKSHFSZ0RyQmg2WWRHbmI0SnRmWGh3akVzOHNzSVladXBIc1g2NllBTTQ2ZgpoZThMMTAxWStBbTBUWkozTFBuY1NLOGg3T0ZmY1lMck9KM00yaWJGdlRoUkdzSlh5TEJmZjB2RFJqRWxzVnhBCnZGbjJHMTBkL1BDNTdWWHhGbHBvaTRNRTNpOFlvdU82VkpUaDNGWkNOOG5uVlJ0aXk1ZW81MGpwTEgvMUFwZisKTjFhckFvSUJBQTByalVnci9SVDhLcnphbW80SjhFejNtQTVZRFJ0MEVQVHJ0UWJHMnRPSTNYZWM0bC8wNHRnbwp3NERneCtYa1Z1UUhpZ3ZpTkhtN0lVQ2o3MkJNYVJybVNyVjRuSzZZQWE3WEp3Nm56dWNDUDFKSUZIWjkzVzVDCmhXbU5HMXNMbVB2QW1nSlpJVTh1ZXZkQk5BQ3hKWW9wdEJFcWxEcTlJNVpOa2k1TFdHNG1nbmhEKzk0OEVueXQKalhPN1EwV1J1djcwcG5GeFFjeFpYeUNFaXVCUHpwSmp4L0NWcnlJVkpmWCsvdmpVZUZuVzNOYzNoUTRjMDNWYQpZSERMMkF0WFh3WEc0VlpCVGNWMjdkTis1UmlkL0RCbUt0NmhGbUxlRjZhVHJNc3d6VnVzTzQxZFJkODZNaTh3ClhYemZKb2lwQjVpcEh4N01jUFVrcXJCZDk2TEQ2RWtDZ2dFQkFMUUZJSllVWFRPb05EYXFiQ2pkQlZIK3Vxd2oKaDVtRjNWTll0K1NjZmc2N3NuMkw0a0ZnOUdsaTFTek14aHFvcUk1S3l3TGNlN09vbllOdzc2czlkWitGSGw4dApDZE5vcEE0dE9SS0JGK3JZM01BS2J0NE51cE5sb011SFJDWG96WEJNYzFyMXRzaTFUYlJ4UTNQNkJVbGlOZUdoClJqK1M5S2t3cEtNWDZETFJHODUwK2MzZ3h4T1lWQW8wWStSb0EyekpvNGVJU1ZUcHNveVJqYituMXNsRUR6emoKajR6NWFrK0ZBYkwwaFIxai9lZmF2WEc1SzFjbGxJWmQrVW5Bc3pKVjJmQkJZVmtXZ3RVdjVPY2VFN0l1b29MbQpoWXpibDRkb1dOdWoxVXVMNmlKYW5GZ0Y2SzRMZm9PWFdZd3cxejh3bm44TW44YlpCQ2pLTUQ4dkxEVT0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
 stringData:
+  cookie_hash_key: "1F+qN7eZFwjiFNDsHXCakfzy4/48fQsRgrsRb/afdkNEG6JtQHPH/Z+I7KIa6NC09fX3G2rEIv60Ilalj30MrQ"
+  cookie_block_key: "FYhmYGHm+19l0TKL6iimMoGRuqElhy6XWkBU9IARdI8"
+  claim_symmetric_key: "6uOdTrZ70G3osUcym8w2koLkwI+peRgwX0O/V9oSawU"
 ---
 # Source: flyte-core/templates/common/secret-auth.yaml
 apiVersion: v1
@@ -636,28 +642,6 @@ spec:
             name: clusters-config-volume
           - mountPath: /etc/secrets/
             name: admin-secrets
-        - name: generate-secrets
-          image: "cr.flyte.org/flyteorg/flyteadmin:v1.13.0"
-          imagePullPolicy: "IfNotPresent"
-          command: ["/bin/sh", "-c"]
-          args:
-            [
-                "flyteadmin --config=/etc/flyte/config/*.yaml secrets init --localPath /etc/scratch/secrets && flyteadmin --config=/etc/flyte/config/*.yaml secrets create --name flyte-admin-secrets --fromPath /etc/scratch/secrets",
-            ]
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
-          volumeMounts:
-            - mountPath: /etc/flyte/config
-              name: base-config-volume
-            - mountPath: /etc/scratch
-              name: scratch
-          env:
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
       containers:
       - command:
         - flyteadmin

diff --git a/deployment/eks/flyte_helm_generated.yaml b/deployment/eks/flyte_helm_generated.yaml
@@ -68,7 +68,13 @@ metadata:
   name: flyte-admin-secrets
   namespace: flyte
 type: Opaque
+data:
+  token_rsa_key.pem: |
+    LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS0FJQkFBS0NBZ0VBMzhWc0hFMzlNVGs5b3BVV2ZZa21KMHYzSlpBdUt5ZjhYem5QUVN4bVozNU9HVHRYCmVUZ1lIdmhvd3d3RXRBTzh2WDhyVkN5VlVFS0J3ei94UFdBcGNiWEhaaXdXWDVPWDE5ZC8xK1VRQm9ER3VFRU0Kbzc0SjBpUENuQWdVV0htOVhKZzFuclA1Qms3STRPNmVXZi9TZGFHTmgyVWJFMmd1WWMwWjlGNzJHelMwbkRSUwpvemMxUUFuT25CWVBkZ1FhNE0wMWE2VnA3WUEzdW43cTV2SGlPVTBMbGVOZnNOeXREZzAxWkE1SE9Hc09ob0MxCk5NV2NGaUtPbkdnWHhrMVg3dE5DVFV3eTZFcDZ0b3lQbHp5ZE1IMHVEcVpqZVgvaDRmV3ZnWjJrTjZWSkVrVmoKWmZpV0VWZDZMN3VEOExKaFpGaEUxdGFBSkxPWWM3QVd6QU1lV21hSFVLVlRMa1RNL3dkU0ZLaENsdE5OZWhJawpRMGdZcHk1aEhaSXloVVVTUE0xWUVkS2VtRmFqTVVITjc2dnM0ck9IV1lJUldCQkh3a3BRbWN3R0RHUFZpaFFzCkcvVExXaTZuc2d0SklHb05mVjUrcGRMbGhPQVBVeDRkM2R4NGYzK0Nxa0g2Z0tBeENuKzFnNXJPcHp2RG50MlAKME00Qks4YXMvU0U4NGR6aTcxUXZNNVNMU3g2YjhlS1JyUFlMUHpEWDJLNU9DMEJvZ1VHREpOVlJwaG1sYVFueAorUkppSy9xb0tzcDV3bExtd1E1U3N3VzVmTUdnc0RRbGpWaEdTaHVpamNaWHRHRDJhNjU1Q2RDamhQRnZXcUZBCkZHcE1DZjdlUFV5ZDF3bWdlaUlndVNqc1RaV3hiRHBEeGEyc2xQVDhpYTJ6TDRaRmVZb08xQ3ZwaHVNQ0F3RUEKQVFLQ0FnRUExNGRjdU9wNUt6Y1o0WVc5c3M0dG5IM3pudzkvR0h3Yi9WQStDbVVNZ1RSTFhzd2tWWklzMFcrcgozK21zZ2dKemdRV0NvMEdKMDFNcmp2Y0FrWUFVaXZ4dUFVQUhrS2tsQUhVRkl0bnpGSUJtWnNQb3U3SG4zYW9wCjRJVjdxemdlcHBmSVZZSzlJVkV5OUV1QTQraWVPa1NQZjlCblFzcittWjZtR0JSNjhQdFQxbndpK0NmTnQwOTYKM0NYM1lGRlYzaDVwRExTM0VWV0UxN0UwNlpvaXJkUkNpMjBFRnVLR0lGbWlpaXVpZDNuTjlNajFQODN4cC9SQwo3ZXpvc1V4L25IMkloOUVUMjE4WlVNaVQ2VFF0cHExN2RnclhGd2lRZFVaaGMvTjFYMDlvMFJ0YVFMWXRQS2pICi9EK2RObkZwa3UvZDVodVdNME4wWEVGSHc5cGhHUjVGdnd2enpTWHZ1Vi9CdE9SazNOOGpldTlWWE53N2JUMGoKWE5JaWhTNjFuLzNHL200YkhxWElycEhiMzdqUEtwRUtoaEZZM01WdHNyM1ZXNndhbVRsN2dHU3RxVDFjVSsxbgptY3JoY21la1l0d1doeW8wTlI5bGJIakk5NlZDb01kNWdVSzFHcGtSbzZ5TWpld25PVG1SaFlVOFhjcEZyYnZPCktScUFlQTBrblZJa1ZIbnBiY3h5TW5WYzVJR2crMkpRR3E1Yi9nMjdsbVRjUU0zVGJSTXh0TlFOU2tGVnV3Y2EKZXRDSjg1akhtSi9aTUlZbjlPL1BuK0hocXppLzM3L0RZaFZTQnRDK0YrRSs1RWFrbjZzUlNWdVhKSjBvcmVTTgphcndkemxqaDlNKzM2YkpWRjkrdVd6ZWRJMmpRTVpSdzBSMllPWDllMThnTW1sVHdNZGtDZ2dFQkFPOGZKUnViCmt2N2YzdERMS2owTDZ5RlVsMldNQmdEYk13V240Zzd4dmJLbDVoV2R1RzM1QlQxOEZOREI1VnJkUU5tbUwvOXMKTTZESDdZcjVoTGNRdHZNNjJWT2pYT1BIMFdZM0JWbXZvOXN6dTR5cXpSQjI5WFdXam9aazYwZFBPWHN5ei9XbwpUd0d3SVNBWDhjVU1kTmwvU0E3MjUvL1RjUjBDOEk3ZFNJTzRsV0pJSVBSOWwveG1BdHlETzZRb05RV2RPVjZKCnF4eHo5a2Z6V0g4UGJHMlFoTUFKbk1WZlRZdTBPbHRlaXppRTlzRU0yU1p2dXZHaWhOM3Z2dkpkZ3BOejJCekUKclZ6V1hnQU5ORjJyZDMrQzB3SkREaEREVE5LQ3d3ZVB6WjZkNHNEVUYxR3JCZHA2RmRDSWlkRUNyNEZpZEI0bgpVRGgxTUp1OWZDK2xiUjBDZ2dFQkFPK1E1aDZ6Q0F4N3o5UmVuLytrL2s2bllWbk9tb0pzQUhCb1RzWlFpOTV5CkdsbE5VNCtTb3RXU3l4T1RrQ1ROazl2SC96TDFGK3M2bkJ6OHJYQ1d3SnVxM2w1Uy9HcEFGMG52d0VyWndoVVYKTmJTcm9YQkJubnZsZGtBVFhuR2I1RmlWNmZHVWhvckw2NlhkZi9TRS95V0dDZjNLMzd3S1NxRXVNQzFSZ085eApLT2ZxU0VKYW1rc3pURVozTXR1Y3VGYWVHd1ptSnBXNVFncXBWRkwyOGpUWEszMUZZY3NvN3RybitiL2s4Rjd4CjJ0R0NlT2JzUFQyaURWNDV6d1ZjcGpKVllscWZ2OHNGNmFtVFk4WHpVWUxPdHl4VHdKNzhFamU4YTcrbUNhN1IKYmsrRFFVbnVaMWwzd0sxaWtSVDZGdkYzQzcyU1cxVktiQVFoa1VhOGcvOENnZ0VBZTZOZzdudHNiL2lWSHVSTgpmSzhTN25Mc3JRYlBlOVhhOWN1dWFRZTVqQXVYZ2duQStLdlBkOUVXZWpJblF1b3Z3OW5YNjN1bzNqTkJzWi8rCmJTRnBWeTVRZkp4MVJSbG1QakdveEl5NmJuYTdQS3A3eVUyWThTbmRtOFBHbTJKdFdEUVhydTlObXBQVkxPRDAKazJ3elp0b1hDaFhFTTFUQ29idUpZblVzTDE5YmJpdlpUbEU2S3JrY05hUnRUQjIxL0tja3FLc0tISFloRzJiSgpsVGtHV1VobU8xMDlBQmljNGVWWVh6SHRUbFlCdUNQS2k4TXRxQTdlSUZyOEloa1RrT1pQRWVEbnVwN2tqNlpFCk0wS2JVUVQxMGErV01EaXJHaFdlZmVSdTd0cTRDZmdmN293OVJJL25nNkYxa09xUWtKZTFibm5wVXFmVmNGRnoKU3JlQVNRS0NBUUJEcE0xbGM3WGRHSVNwZVlLQ0E4dU8xL0pFRW5OTVNrU2hlTUp0ZXNiVHE3Skc3dStlUlpCVwo3OWtKa1F3TmFFTE10eDhXKzEraW11MER2bEVXem1wYVNoZjUyRUxQbVlNNTdFbUdtUkFWTmVUeE85a2N3bHFHCnIxY0JacmF2SzQ2QmVPc1N2SlowMEhtY1h2dkhSbHBvOVAwVFBWcUpWUHFYb2x3V0g4SmhXYmxzS3BuMnFuQ1EKdFU1ZlF6OElCYXVEUWFkdDJpQWcvS3RxS1QvWElVVm9xQ3p1ZFUzVXVKMGhFSWxUcHNnOGR0d0xkbVMvQjR1UApRSmUzdUdqOUlaa0g4MVlQTXJaTUZFSlRFSHdHbzlxckxjVkk3ZWtndXhwRnhKMUVBeFVPMkxIbUg3Q3F1SGRVCkt0MHIxLzRSUjBCOU05a0wwU3lhMjZXK1VPQWRjaE52QW9JQkFHcGQ1WVZBKzUxV0xBaXFUNUtmNkFIcks0V0wKS2JQRmVHYXF3d3k2ckFOaXBWczdhVUhwTmx0QVFxakU4ZC9oQkZRQnZmMEpUVmxLeGV2UE5YSDFlYUlrQzJZSwpjL09JanhGSGpYdXd5OGxiNFRKN1JXQ3MwR1grTFRoWEFISmR4cVQ3WEJwSDFBZlQ0Z1F4cElEZldieitrdDlHCk90MTlISVgxc1BRZWlkaGVPOXVtRkFPNjRaMVBwVmZYZStVMlpXL3gvNmtldzJWWklSeXd2elFjM1o0REZZZHoKMUtQa0VZNE1UM1N2OUxXVGI1V2RjejZ5ZUhEZ1VZQjdFdTJUcU1CQyswRzBkbDJRVFBaUUlTZlhtdlZCUm5sNgpLN283SWIxQ0RXdmt1M1d4RTdPUXdESXFBQUcvMG1heXRrR0xCYjl3QlUyZmREOUdwcmpUUjFzci9QTT0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
 stringData:
+  cookie_hash_key: "4EfCL3f4u3SEl7fGNd0hUqnfASxC6W1oFOQH7njT8NSFhZQV78Y4H/xRxa/ttF9QfTd/Th79s3W+w+ATo5IAlA"
+  cookie_block_key: "FivnWNlPDsZ988UdMuUoS7SEghTA91QYfYHi7npCCP8"
+  claim_symmetric_key: "qGeM76T9DLdOoFhoefC7sy9rzvm/EehF8bj2BDNvTU8"
 ---
 # Source: flyte-core/templates/common/secret-auth.yaml
 apiVersion: v1
@@ -962,28 +968,6 @@ spec:
             name: clusters-config-volume
           - mountPath: /etc/secrets/
             name: admin-secrets
-        - name: generate-secrets
-          image: "cr.flyte.org/flyteorg/flyteadmin:v1.13.0"
-          imagePullPolicy: "IfNotPresent"
-          command: ["/bin/sh", "-c"]
-          args:
-            [
-                "flyteadmin --config=/etc/flyte/config/*.yaml secrets init --localPath /etc/scratch/secrets && flyteadmin --config=/etc/flyte/config/*.yaml secrets create --name flyte-admin-secrets --fromPath /etc/scratch/secrets",
-            ]
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
-          volumeMounts:
-            - mountPath: /etc/flyte/config
-              name: base-config-volume
-            - mountPath: /etc/scratch
-              name: scratch
-          env:
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
       containers:
       - command:
         - flyteadmin