run_launcher:      
  module: dagster_celery_k8s
  class: CeleryK8sRunLauncher
  config:
    dagster_home:
      env: DAGSTER_HOME
    instance_config_map:
      env: DAGSTER_K8S_INSTANCE_CONFIG_MAP
    postgres_password_secret:
      env: DAGSTER_K8S_PG_PASSWORD_SECRET
    broker: "<pyamqp://test:test@dagster-rabbitmq:5672//>"
    backend: "rpc://"

`

    Error 2: Post processing at path root:postgres_password_secret of original value {'env': 'DAGSTER_K8S_PG_PASSWORD_SECRET'} failed:
dagster.config.errors.PostProcessingError: You have attempted to fetch the environment variable "DAGSTER_K8S_PG_PASSWORD_SECRET" which is not set. In order for this execution to succeed it must be set in this environment.

kubectl get configmaps

<name>-pipeline-env

dagster-pipeline-env

execution:
  celery-k8s:
    config:
      env_config_maps:
        - "<NAME>-pipeline-env"

compute_logs:      
  module: dagster_aws.s3.compute_log_manager
  class: S3ComputeLogManager
  config:
    bucket: "xxxxxx-dev-null"
    prefix: "dagster-test-"

botocore.exceptions.NoCredentialsError: Unable to locate credentials

AWS_ACCESS_KEY_ID

env_secrets

env_secrets (Optional[List[str]]): A list of custom Secret names from which to
            draw environment variables (using ``envFrom``) for the Job. Default: ``[]``. See:
            <https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#configure-all-key-value-pairs-in-a-secret-as-container-environment-variables>

One option is to create a secret in your cluster with the 

AWS_ACCESS_KEY_ID

 etc. variables, then use 

env_secrets

 in run launcher config (or executor config, if it differs per run).

`runLauncher = {
      type = "CeleryK8sRunLauncher"
      config = {
        celeryK8sRunLauncher = {
          image = {
            repository = "<http://docker.io/dagster/dagster-celery-k8s|docker.io/dagster/dagster-celery-k8s>"
            tag        = "0.12.2"
            pullPolicy = "IfNotPresent"
          }
          envSecrets = [
            {
              name = local.dagster_poc_external_secrets.resources[0].metadata.name
            },
          ]
          annotations = {
            "<http://iam.amazonaws.com/role|iam.amazonaws.com/role>" = aws_iam_role.dagster_poc.name
          }

          workerQueues = [
            {
              name         = "dagster"
              replicaCount = 1
            },
            {
              name         = "redis"
              replicaCount = 1
            },
          ]
        }
      }
    }

kubectl describe

dagster-job-…

@solid(
tags = {
    'dagster-celery/queue': 'redis',
    'dagster-k8s/config': {
      'container_config': {
        'resources': {
          'requests': { 'cpu': '250m', 'memory': '64Mi' },
          'limits': { 'cpu': '500m', 'memory': '2560Mi' },
        },
       },
       'pod_template_spec_metadata': {
           'annotations': { "<http://iam.amazonaws.com/role|iam.amazonaws.com/role>": "dagster-poc-20211014204833791300000001"}
       },
    },
  },
)
def not_much():
    return

I’m actually surprised that those env vars are appearing on the k8s workers-

execution:
  celery-k8s:
    config:
      job_image: '<http://my_repo.com/image_name:latest|my_repo.com/image_name:latest>'
      job_namespace: 'some-namespace'
      broker: '<pyamqp://guest@localhost//>'  # Optional[str]: The URL of the Celery broker
      backend: 'rpc://' # Optional[str]: The URL of the Celery results backend
      include: ['my_module'] # Optional[List[str]]: Modules every worker should import
      ...
      config_source: # Dict[str, Any]: Any additional parameters to pass to the
          #...       # Celery workers. This dict will be passed as the `config_source`
          #...       # argument of celery.Celery().

env_secrets

envSecrets

kubectl -n dagster-poc exec -it dagster-celery-workers-redis-697f8bb695-jtfg9  -- env | grep ACCE

resources:
  io_manager:
    config:
      s3_bucket: "loom-dev-null"
      s3_prefix: "dagster-poc-"
execution:
  celery-k8s:
    config:
      job_namespace: 'dagster-poc'
      env_config_maps:
        - "dagster-pipeline-env"
      env_secrets:
        - "dagster-poc-secrets"

botocore.exceptions.ClientError: An error occurred (403) when calling the HeadBucket operation: Forbidden