#2859 [Core feature] Per-domain secrets mounting Issue created by slauth-io-tal ### Motivation: Why do you think this is important? When running a task within a certain domain (production/staging/development), it should be (security-)isolated from other domains. Meaning, secrets should be bound to a single domain and shouldn't be accessible to other domains. An example - while the same task in different domains might require a database secret, the tasks running in the development domain shouldn't have access to the production database. Nor should a task determine what secret to request/use based on its domain - secrets should be treated like an environment configuration. ### Goal: What should the final outcome look like, ideally? Tasks are able to request a secret, and during runtime the control plane determines which secret to mount according to the task domain. So, a task running in development and requesting the database secret will get a secret representing the development database. ### Describe alternatives you've considered Currently implementing this mechanism within the code of tasks. Preferably this'll be included in Flyte itself. ### Propose: Link/Inline OR Additional context No response ### Are you sure this issue hasn't been raised already? • Yes ### Have you read the Code of Conduct? • Yes flyteorg/flyte