Add multi-team lookup to Kubernetes secrets backend#65694
Open
PrithviBadiga wants to merge 3 commits intoapache:mainfrom
Open
Add multi-team lookup to Kubernetes secrets backend#65694PrithviBadiga wants to merge 3 commits intoapache:mainfrom
PrithviBadiga wants to merge 3 commits intoapache:mainfrom
Conversation
PrithviBadiga
requested review from
hussein-awala,
jedcunningham and
jscheffl
as code owners
boring-cyborg
Bot
added
area:providers
area:secrets
kind:documentation
provider:cncf-kubernetes
jscheffl
approved these changes
Apr 22, 2026
Contributor
jscheffl
left a comment
jscheffl
left a comment
There was a problem hiding this comment.
Looks good to me. @o-nikolas can you make a second pass as multi-team expert?
Contributor
There was a problem hiding this comment.
Pull request overview
Adds multi-team lookup behavior to the KubernetesSecretsBackend so Connections/Variables can be resolved as team-scoped secrets first (via a configurable team label), with a global (unlabeled) fallback and a guard to prevent team-scoped identifiers being accessed without a team context.
Changes:
- Add
team_labelconfiguration and implement team-first then global-fallback label selection. - Add a guard preventing team-scoped secret identifiers from being resolved when
team_nameis not provided. - Update unit tests and provider docs to reflect the new selector behavior.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| providers/cncf/kubernetes/src/airflow/providers/cncf/kubernetes/secrets/kubernetes_secrets_backend.py | Implements team-aware secret lookup and the “team-scoped accessed as global” guard. |
| providers/cncf/kubernetes/tests/unit/cncf/kubernetes/secrets/test_kubernetes_secrets_backend.py | Updates selectors in existing tests and adds new multi-team tests. |
| providers/cncf/kubernetes/docs/secrets-backends/kubernetes-secrets-backend.rst | Documents the new team_label parameter and multi-team selector behavior. |
potiuk
added
the
ready for maintainer review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds multi-team lookup support to
KubernetesSecretsBackend.Updates:
team_labelsupport for discovering team-scoped secretsteam_nameis providedteam_nameis not providedLookup behavior:
{id_label}={secret_id},{team_label}={team_name}{id_label}={secret_id},!{team_label}Verification:
AIRFLOW_HOME=$(mktemp -d) PYTHONPATH=/Users/prith/Desktop/Codex/airflow-65682/airflow-core/src:/Users/prith/Desktop/Codex/airflow-65682/providers/cncf/kubernetes/src /Users/prith/Desktop/Codex/airflow/.venv/bin/python -m pytest /Users/prith/Desktop/Codex/airflow-65689-kubernetes/providers/cncf/kubernetes/tests/unit/cncf/kubernetes/secrets/test_kubernetes_secrets_backend.py/Users/prith/Desktop/Codex/airflow/.venv/bin/python -m ruff check /Users/prith/Desktop/Codex/airflow-65689-kubernetes/providers/cncf/kubernetes/src/airflow/providers/cncf/kubernetes/secrets/kubernetes_secrets_backend.py /Users/prith/Desktop/Codex/airflow-65689-kubernetes/providers/cncf/kubernetes/tests/unit/cncf/kubernetes/secrets/test_kubernetes_secrets_backend.py/Users/prith/Desktop/Codex/airflow/.venv/bin/python -m ruff format --check /Users/prith/Desktop/Codex/airflow-65689-kubernetes/providers/cncf/kubernetes/src/airflow/providers/cncf/kubernetes/secrets/kubernetes_secrets_backend.py /Users/prith/Desktop/Codex/airflow-65689-kubernetes/providers/cncf/kubernetes/tests/unit/cncf/kubernetes/secrets/test_kubernetes_secrets_backend.pyPart of: #65682