PrithviBadiga opened a new pull request, #65689:
URL: https://github.com/apache/airflow/pull/65689
Adds multi-team lookup support to three secrets backends:
- `AzureKeyVaultBackend`
- `KubernetesSecretsBackend`
- `LockboxSecretBackend`
This update makes the backends:
- look up team-scoped secrets first when `team_name` is provided
- fall back to the global secret when no team-scoped secret is found
- avoid resolving team-scoped identifiers as global secrets when `team_name`
is not provided
Updates:
- Azure Key Vault:
- looks up `{prefix}-{team_name}-{secret_id}` before `{prefix}-{secret_id}`
- Kubernetes:
- adds `team_label` support
- looks up `{id_label}={secret_id},{team_label}={team_name}` before
falling back to unlabeled global secrets
- Yandex Lockbox:
- looks up `{prefix}/{team_name}/{secret_id}` before `{prefix}/{secret_id}`
Also updates unit tests and backend docs for all three providers.
Verification:
- `AIRFLOW_HOME=$(mktemp -d)
PYTHONPATH=/Users/prith/Desktop/Codex/airflow-65682/airflow-core/src:/Users/prith/Desktop/Codex/airflow-65682/providers/cncf/kubernetes/src
/Users/prith/Desktop/Codex/airflow/.venv/bin/python -m pytest
/Users/prith/Desktop/Codex/airflow-65682/providers/cncf/kubernetes/tests/unit/cncf/kubernetes/secrets/test_kubernetes_secrets_backend.py`
- `AIRFLOW_HOME=$(mktemp -d)
PYTHONPATH=/Users/prith/Desktop/Codex/airflow-65682/airflow-core/src:/Users/prith/Desktop/Codex/airflow-65682/providers/microsoft/azure/src
/Users/prith/Desktop/Codex/airflow/.venv/bin/python -m pytest
/Users/prith/Desktop/Codex/airflow-65682/providers/microsoft/azure/tests/unit/microsoft/azure/secrets/test_key_vault.py`
- `AIRFLOW_HOME=$(mktemp -d)
PYTHONPATH=/Users/prith/Desktop/Codex/airflow-65682/airflow-core/src:/Users/prith/Desktop/Codex/airflow-65682/providers/yandex/src
/Users/prith/Desktop/Codex/airflow/.venv/bin/python -m pytest
/Users/prith/Desktop/Codex/airflow-65682/providers/yandex/tests/unit/yandex/secrets/test_lockbox.py`
- `/Users/prith/Desktop/Codex/airflow/.venv/bin/python -m ruff check
/Users/prith/Desktop/Codex/airflow-65682/providers/microsoft/azure/src/airflow/providers/microsoft/azure/secrets/key_vault.py
/Users/prith/Desktop/Codex/airflow-65682/providers/cncf/kubernetes/src/airflow/providers/cncf/kubernetes/secrets/kubernetes_secrets_backend.py
/Users/prith/Desktop/Codex/airflow-65682/providers/yandex/src/airflow/providers/yandex/secrets/lockbox.py
/Users/prith/Desktop/Codex/airflow-65682/providers/microsoft/azure/tests/unit/microsoft/azure/secrets/test_key_vault.py
/Users/prith/Desktop/Codex/airflow-65682/providers/cncf/kubernetes/tests/unit/cncf/kubernetes/secrets/test_kubernetes_secrets_backend.py
/Users/prith/Desktop/Codex/airflow-65682/providers/yandex/tests/unit/yandex/secrets/test_lockbox.py`
- `/Users/prith/Desktop/Codex/airflow/.venv/bin/python -m ruff format
--check
/Users/prith/Desktop/Codex/airflow-65682/providers/microsoft/azure/src/airflow/providers/microsoft/azure/secrets/key_vault.py
/Users/prith/Desktop/Codex/airflow-65682/providers/cncf/kubernetes/src/airflow/providers/cncf/kubernetes/secrets/kubernetes_secrets_backend.py
/Users/prith/Desktop/Codex/airflow-65682/providers/yandex/src/airflow/providers/yandex/secrets/lockbox.py
/Users/prith/Desktop/Codex/airflow-65682/providers/microsoft/azure/tests/unit/microsoft/azure/secrets/test_key_vault.py
/Users/prith/Desktop/Codex/airflow-65682/providers/cncf/kubernetes/tests/unit/cncf/kubernetes/secrets/test_kubernetes_secrets_backend.py
/Users/prith/Desktop/Codex/airflow-65682/providers/yandex/tests/unit/yandex/secrets/test_lockbox.py`
This closes: #65682
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
