support vault sidecar-injection with `airflow.usersTemplates`

[thesuperzapper]

We support referencing Secrets/Configmaps with airflow.usersTemplates, which allows users to integrate with their HashiCorp Vault using tools like kubernetes-external-secrets.

However, the first-class method of secret injection in Vault is the sidecar-injection method, which makes use of annotations that tell vault to sync a file into a Pods filesystem.

We should let users reference a file in the Pods filesystem with airflow.usersTemplates, for example:

airflow:
  users:
    - username: admin
      password: ${MY_PASSWORD}
      role: Admin
      email: admin@example.com
      firstName: admin
      lastName: admin

  usersTemplates:
    MY_PASSWORD:
      kind: file
      path: /vault/secrets/MY_PASSWORD

  sync:
    podAnnotations:
      vault.hashicorp.com/agent-inject: "true"
      vault.hashicorp.com/role: "airflow"
      vault.hashicorp.com/agent-inject-secret-MY_PASSWORD: "airflow/users/admin/password"

We should also:

• explicitly document using vault in the README
• also make this change for airflow.{connections,pools,variables}

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[thesuperzapper]

Bumping for bot.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.