Airflow DAGs unable to read credentials from k8s secret

[aliaksandr-d]

Currently Airflow Hooks are trying to get credentials connections from K8s secrets, but it's forbidden for them to read any secrets from k8s. Need to update RBAC

[kirillmakhonin]

As we discussed previously DAGs can load credentials in two ways:

1. AWS creds using kube2iam
2. Non-aws creds using Airflow Connections. Airflow Connections are configurable using deployment secret (section airflow.connections)

[aliaksandr-d]

@kirillmakhonin airflow.connections are set only during cluster creation and legion deployment. we need the ability to update non-aws credentials without cluster recreation and not in Airflow UI. The idea is that non-aws credentials can be stored in k8s secret, that is updated directly.

[aliaksandr-d]

After discussion with @dsuslov , we decided to store all connections credentials in one k8s secret map.
It requires:

1. hooks update to read credentials from one k8s secret
2. worker rbac update to give access to a single k8s secret.