Add placeholder Secret manifest and link it from the README

secrets-example.yaml shows the two Secrets the deployments expect
(slurm-munge-key, slurm-sssd-conf) with dummy values, plus a note on
delivering slurmdbd.conf as a Secret via subPath for sites that prefer
that over shared storage.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: rahimkhoja

README.md

@@ -178,7 +178,8 @@ All containers require:
 - **SSSD config** (if using LDAP): Kubernetes Secret mounted at `/etc/sssd/.secret/` (`kubectl -n slurm create secret generic slurm-sssd-conf --from-file=sssd.conf=...`)
 - **Mail relay** (slurmctld, optional): Set `SMTP_HOST`, `SMTP_PORT`, `MAIL_FROM` env vars
 
-See each service README for the exact secret-creation commands.
+See each service README for the exact secret-creation commands, or
+[`secrets-example.yaml`](secrets-example.yaml) for a placeholder manifest.
 
 ## 🔧 Service Details
 

secrets-example.yaml

@@ -0,0 +1,53 @@
+# =============================================================================
+# Example Secrets for the vulcan-slurm images  -- PLACEHOLDER VALUES ONLY
+# =============================================================================
+# The deployment manifests in slurmctld/, slurmdbd/ and slurmrestd/ mount two
+# Kubernetes Secrets. Create them from your real files instead of editing
+# this manifest (base64 in YAML is easy to get wrong for binary keys):
+#
+#   kubectl -n slurm create secret generic slurm-munge-key \
+#     --from-file=munge.key=/etc/munge/munge.key
+#
+#   kubectl -n slurm create secret generic slurm-sssd-conf \
+#     --from-file=sssd.conf=/etc/sssd/sssd.conf
+#
+# The munge key must be byte-identical to the one on your compute/login
+# nodes or every Slurm RPC fails with "Unauthorized credential".
+# sssd.conf typically contains your LDAP bind credentials - that is why it
+# is a Secret and not a ConfigMap.
+#
+# NOTE: slurmdbd.conf (database password) is mounted from shared storage in
+# these examples because several tools parse it in place, but nothing stops
+# you from delivering it as a Secret the same way if that suits your site
+# better - mount it at /etc/slurm via subPath.
+# =============================================================================
+apiVersion: v1
+kind: Secret
+metadata:
+  name: slurm-munge-key
+  namespace: slurm
+type: Opaque
+data:
+  # base64 of your real munge.key (binary) - placeholder below
+  munge.key: UkVQTEFDRS1XSVRILVlPVVItUkVBTC1NVU5HRS1LRVk=
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: slurm-sssd-conf
+  namespace: slurm
+type: Opaque
+stringData:
+  sssd.conf: |
+    # REPLACE with your real sssd.conf (LDAP bind credentials live here)
+    [sssd]
+    config_file_version = 2
+    services = nss, pam
+    domains = example
+
+    [domain/example]
+    id_provider = ldap
+    ldap_uri = ldaps://ldap.example.org
+    ldap_search_base = dc=example,dc=org
+    ldap_default_bind_dn = cn=readonly,dc=example,dc=org
+    ldap_default_authtok = REPLACE-ME