Add multi-team lookup to Kubernetes secrets backend

[PrithviBadiga]

Adds multi-team lookup support to KubernetesSecretsBackend.

Updates:

• add team_label support for discovering team-scoped secrets
• look up team-scoped secrets first when team_name is provided
• fall back to unlabeled global secrets when no team-scoped secret exists
• avoid resolving team-scoped identifiers as global secrets when team_name is not provided
• document the Kubernetes team label selector behavior

Lookup behavior:

• team-scoped: {id_label}={secret_id},{team_label}={team_name}
• global fallback: {id_label}={secret_id},!{team_label}

Verification:

• AIRFLOW_HOME=$(mktemp -d) PYTHONPATH=/Users/prith/Desktop/Codex/airflow-65682/airflow-core/src:/Users/prith/Desktop/Codex/airflow-65682/providers/cncf/kubernetes/src /Users/prith/Desktop/Codex/airflow/.venv/bin/python -m pytest /Users/prith/Desktop/Codex/airflow-65689-kubernetes/providers/cncf/kubernetes/tests/unit/cncf/kubernetes/secrets/test_kubernetes_secrets_backend.py
• /Users/prith/Desktop/Codex/airflow/.venv/bin/python -m ruff check /Users/prith/Desktop/Codex/airflow-65689-kubernetes/providers/cncf/kubernetes/src/airflow/providers/cncf/kubernetes/secrets/kubernetes_secrets_backend.py /Users/prith/Desktop/Codex/airflow-65689-kubernetes/providers/cncf/kubernetes/tests/unit/cncf/kubernetes/secrets/test_kubernetes_secrets_backend.py
• /Users/prith/Desktop/Codex/airflow/.venv/bin/python -m ruff format --check /Users/prith/Desktop/Codex/airflow-65689-kubernetes/providers/cncf/kubernetes/src/airflow/providers/cncf/kubernetes/secrets/kubernetes_secrets_backend.py /Users/prith/Desktop/Codex/airflow-65689-kubernetes/providers/cncf/kubernetes/tests/unit/cncf/kubernetes/secrets/test_kubernetes_secrets_backend.py

Part of: #65682

[jscheffl]

Looks good to me. @o-nikolas can you make a second pass as multi-team expert?

[Copilot]

Pull request overview

Adds multi-team lookup behavior to the KubernetesSecretsBackend so Connections/Variables can be resolved as team-scoped secrets first (via a configurable team label), with a global (unlabeled) fallback and a guard to prevent team-scoped identifiers being accessed without a team context.

Changes:

• Add team_label configuration and implement team-first then global-fallback label selection.
• Add a guard preventing team-scoped secret identifiers from being resolved when team_name is not provided.
• Update unit tests and provider docs to reflect the new selector behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
providers/cncf/kubernetes/src/airflow/providers/cncf/kubernetes/secrets/kubernetes_secrets_backend.py	Implements team-aware secret lookup and the “team-scoped accessed as global” guard.
providers/cncf/kubernetes/tests/unit/cncf/kubernetes/secrets/test_kubernetes_secrets_backend.py	Updates selectors in existing tests and adds new multi-team tests.
providers/cncf/kubernetes/docs/secrets-backends/kubernetes-secrets-backend.rst	Documents the new team_label parameter and multi-team selector behavior.

[vincbeck]

Can you update the documentation to explain how to use this secret backend with multi-team?

[PrithviBadiga]

@vincbeck
Yes. I updated the documentation to explain how to use the backend in multi-team mode.
It now includes:

• how to configure team_label
• how to label team-scoped secrets
• how the global fallback works
• examples for both team-scoped and global secrets