Add JWT/OIDC authentication support to Hashicorp Vault provider

[piotrlinski]

This adds JWT/OIDC authentication method support to the Hashicorp Vault provider, enabling token-less authentication through identity federation.

Key features:

• New 'jwt' auth_type for VaultClient, VaultHook, and VaultBackend
• Support for jwt_token parameter or automatic token retrieval from jwt_path
• Configurable jwt_role for Vault role binding
• Full backwards compatibility with existing auth methods

Use cases enabled:

• Kubernetes workload identity with projected service account tokens
• Cloud provider identity (AWS IAM roles, GCP Workload Identity, Azure AD)
• CI/CD pipelines (GitHub Actions OIDC, GitLab CI)
• External identity providers (Auth0, Okta, Keycloak)

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

[boring-cyborg]

Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide (https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
Here are some useful points:

• Pay attention to the quality of your code (ruff, mypy and type annotations). Our prek-hooks will help you with that.
• In case of a new feature add useful documentation (in docstrings or in docs/ directory). Adding a new operator? Check this short guide Consider adding an example DAG that shows how users should use it.
• Consider using Breeze environment for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
• Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
• Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
• Be sure to read the Airflow Coding style.
• Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
  Apache Airflow is a community-driven project and together we are making it better 🚀.
  In case of doubts contact the developers at:
  Mailing List: dev@airflow.apache.org
  Slack: https://s.apache.org/airflow-slack

[piotrlinski]

there is still one thing I am not sure, I made the default path for the jwt_token_path like for kubernetes (usually it goes with kubernets), however the JWT method does not have to be anyhow related to k8s, therefor not sure if we should keep it as default or remove - you need to pass the jwt_token (string) or jwt_token_path(path to a file with a token)

[Lee-W]

a few nits, but overall looks good

[Lee-W]

there is still one thing I am not sure, I made the default path for the jwt_token_path like for kubernetes (usually it goes with kubernets), however the JWT method does not have to be anyhow related to k8s, therefor not sure if we should keep it as default or remove - you need to pass the jwt_token (string) or jwt_token_path(path to a file with a token)

Pass it might be better as it doesn't always goes with k8s

[Lee-W]

@jason810496 would appreciate a second pair of eyes. Thanks!

[jason810496]

Thank you for the PR! LGTM overall.

[boring-cyborg]

Awesome work, congrats on your first merged pull request! You are invited to check our Issue Tracker for additional contributions.