fix(app): inject secret labels/annotations and execution env vars int…

[falloficaruss]

Tracking issue

Closes #7600

Why are the changes needed?

The AppEnvironment path (flyte deploy) produces a Knative Service whose pod template was missing two critical pieces that the TaskAction path already provides:

1. Secret labels/annotations: The flyte-binary-webhook uses objectSelector.matchLabels{inject-flyte-secrets: "true"} to decide which pods to mutate. Without this label on the revision template, the webhook never processes the pod, so SecurityContext.secrets configured on the app are serialized into the proto but never mounted as env vars or files. The scope labels (organization/project/domain) are also required by the embedded secret manager to resolve which secret to fetch.
2. Execution env vars: The Flyte SDK's flyte.init_in_cluster() reads FLYTE_INTERNAL_EXECUTION_PROJECT and FLYTE_INTERNAL_EXECUTION_DOMAIN to construct admin API URLs. Without these, Run.get(...) builds malformed URLs like //RUN_ID (404), and with_runcontext(...) calls fail with "require_project_and_domain" errors.

What changes were proposed in this pull request?

In app/internal/k8s/app_client.go:

1. Secret injection: Added code in buildKService that, when app.Spec.SecurityContext.Secrets is non-empty, injects the following into the Knative revision template's ObjectMeta:

• Labels: organization: "flyte", project: , domain: , inject-flyte-secrets: "true"
• Annotations: flyte.secrets/s from secrets.MarshalSecretsToMapStrings()
  This mirrors what executor/pkg/plugin/task_exec_metadata.go:81-95 does for TaskAction pods.

2. Execution env vars: Added FLYTE_INTERNAL_EXECUTION_PROJECT and FLYTE_INTERNAL_EXECUTION_DOMAIN to the container's env vars, derived from appID.Project and appID.Domain. This mirrors what flyteplugins/.../flytek8s/k8s_resource_adds.go:57-63 (via GetExecutionEnvVars) provides for task pods.

How was this patch tested?

Tests were added in app/internal/k8s/app_client_test.go:

1. TestDeploy_InjectsExecutionEnvVars — deploys an app and asserts the revision template's container env contains FLYTE_INTERNAL_EXECUTION_PROJECT=proj and FLYTE_INTERNAL_EXECUTION_DOMAIN=dev.
2. TestDeploy_InjectsSecretLabelsAndAnnotations — deploys an app with SecurityContext.Secrets: [{group: "my_group", key: "my_key", mount_requirement: ENV_VAR}] and asserts the revision template has labels organization: "flyte", project: "proj", domain: "dev", inject-flyte-secrets: "true", and that flyte.secrets/s0 annotation is present.
3. TestDeploy_NoSecretLabelsOrAnnotationsWhenNoSecrets — deploys an app without a SecurityContext and verifies neither inject-flyte-secrets label nor flyte.secrets/s* annotations appear on the template (negative case).
   All 45 tests in ./app/... pass with -count=1, go build ./app/... compiles clean.

Labels

Please add one or more of the following labels to categorize your PR:

• fixed

This is important to improve the readability of release notes.

Setup process

Screenshots

Check all the applicable boxes

• I updated the documentation accordingly.
• All new and existing tests passed.
• All commits are signed-off.

Related PRs

Stack

If you do use git town to manage PR Stacks, the stack relevant to this PR
will show below. Otherwise, you can ignore this section.

Docs link