<p>We have an Airflow (Celery executor) setup that can run tasks on our K8s cluster. The tasks that use KubernetesPodOperator can access K8s secrets <a href="https://airflow.apache.org/docs/apache-airflow-providers-cncf-kubernetes/stable/operators.html#how-to-use-cluster-configmaps-secrets-and-volumes-with-pod" rel="nofollow noreferrer">as described in the documentation</a>. The rest of the tasks run on Celery workers outside of the K8s cluster.</p>
<p>How can tasks using other operators (e.g., SqlSensor) access the same K8s secrets as the tasks using KubernetesPodOperator?</p>

<p>If you need to pass secrets between MWAA and K8s I would suggest using an external secrets manager.</p>
<p>AWS Secrets Manager can be used natively by MWAA and K8S.
<a href="https://docs.aws.amazon.com/mwaa/latest/userguide/connections-secrets-manager.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/mwaa/latest/userguide/connections-secrets-manager.html</a>
<a href="https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specifying-sensitive-data-secrets.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specifying-sensitive-data-secrets.html</a></p>
<p>Hashicorp Vault is another option.</p>
<p>One thing to note is to not pass Secrets as variables to KubernetesPodOperator</p>
<hr />
<p>Our solution was to actually run MWAA tasks on AWS Fargate using ECS operator</p>
<p><a href="https://airflow.apache.org/docs/apache-airflow-providers-amazon/stable/operators/ecs.html" rel="nofollow noreferrer">https://airflow.apache.org/docs/apache-airflow-providers-amazon/stable/operators/ecs.html</a></p>
<p>Secrets are shared per ECS task definition and used as environmental variables. Developers have a simple YAML configuration file for defining ECS tasks and associated secrets from AWS Secrets Manager and Terraform handles managing Task Definitions based on this YAML. It works really smooth for our particular use case.</p>
