dheerenmohta opened a new pull request, #72483: URL: https://github.com/apache/airflow/pull/72483
Implements the design maintainers agreed on in 2023 (see issue thread) for `KubernetesPodOperator` to consume Connection-derived credentials as Kubernetes secrets, instead of requiring a pre-existing secret name. - New `KubernetesConnectionSecret(Secret)` (`secret.py`), identified by `conn_id` rather than a pre-existing secret name. - New `connection_secrets: list[KubernetesConnectionSecret]` param on `KubernetesPodOperator`. - `_materialize_connection_secret()` creates a real Kubernetes secret (containing `BaseHook.get_connection(conn_id).get_uri()`) immediately before the pod is built, named via the existing `create_unique_id()` pod-naming helper, capped at Kubernetes' 253-char DNS-subdomain limit. - `_delete_connection_secrets()` runs from both `cleanup()` and `on_kill()`, so the secret never outlives the task whether it succeeds, fails, or is killed. Two prior attempts (#33680, #39003) were abandoned for contributor capacity, not design rejection — this implements the design that was already agreed. closes: #28086 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Sonnet 5) Generated-by: Claude Code (Sonnet 5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
