Airflow secret backend for k8s role missing "audience" parameter setting which is required from vault 1.21+

[JJtheNOOB]

Official Helm Chart version

1.18.0 (latest released)

Apache Airflow version

2.9

Kubernetes Version

v1.32

Helm Chart configuration

env:

  - name: "AIRFLOW__SECRETS__BACKEND_KWARGS"

        value: |

          {

          "auth_type":"kubernetes",

          "kubernetes_role": "airflow-dev",

          "connections_path": "airflow/connections",

          "variables_path": "airflow/variables",

          "auth_mount_point": "xxxxx",

          "mount_point": "stage",

          "url": "xxxxx",

          }

Docker Image customizations

No response

What happened

No response

What you think should happen instead

Dear airflow community:

Hello!

I would like to raise attention that starting from vault 1.21+, we will need to set audience for k8s role for secret backend. Warning messages looks like this A role without an audience was used to authenticate into Vault. Vault v1.21+ will require roles to have an audience.

Below is our current airflow secret backend settings used in the vaules.yaml file:

env:

  - name: "AIRFLOW__SECRETS__BACKEND_KWARGS"

        value: |

          {

          "auth_type":"kubernetes",

          "kubernetes_role": "airflow-dev",

          "connections_path": "airflow/connections",

          "variables_path": "airflow/variables",

          "auth_mount_point": "xxxxx",

          "mount_point": "stage",

          "url": "xxxxx",

          }

This works currently but we are seeing the above warning messages, adding "audience" parameter suppresses the warning however it also make airflow no longer able to connect to vault secret backend. Confirming we had done proper set up on both vault side and k8s side. Either I am missing something or this feature was not yet released by airflow.

I am looking forward to see if someone could add, test and release the audience parameter to ensure it will allow k8s roles to proper access vault secret backend. Thank you!

How to reproduce

1. set up airflow helm chart
2. set up vault
3. connect airflow with vault secret backend with the env variables provided

Anything else

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[boring-cyborg]

Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.

[HsiuChuanHsu]

It looks true that audience will be required based on this PR and this changelog.

I'd like to work on this. May I be assigned? Thanks!😀