#954 Add trusted identity header injection for in-cluster queue service calls Pull request opened by pmahindrakar-oss Summary In self-hosted deployments with authz enabled, executor pods need to call queue service over the internal service URL instead of ingress. Those internal calls must include trusted identity headers so queue-service middleware and downstream authz checks can authorize them. This PR updates the SDK to automatically inject trusted identity headers on outbound ConnectRPC requests when the executor pod is configured with: • _U_EXTERNAL_IDENTITY_CLAIM • _U_EXTERNAL_IDENTITY_TYPE_CLAIM These are translated into: • X-User-Subject • X-User-Claim-Identitytype What Changed • Added env-driven trusted identity header injection in the shared ConnectRPC metadata interceptor. • Reused the existing interceptor path, so this applies to controller/queue-service RPCs without adding a new auth mode. • Preserved existing caller-provided headers by using non-overriding injection. • Added focused tests for: • header injection from env • non-overwrite behavior • no regression in session/interceptor behavior Why This lets self-hosted executor pods talk directly to queue service via _U_EP_OVERRIDE while still providing the identity context required by authz- enabled deployments, avoiding the need to route through ingress just to obtain X-User-Subject. Notes • This change is opt-in via pod env vars. If the env vars are not present, the SDK behavior is unchanged. • Routing is still controlled separately via _U_EP_OVERRIDE. • TLS / ingress certificate issues for build-image are not addressed in this PR. Validation Ran: uv run pytest tests/flyte/remote/test_connectrpc_interceptors.py tests/flyte/remote/test_session.py Result: 55 passed flyteorg/flyte-sdk