Clean up stale KubernetesPodOperator pods

[fat-catTW]

Why:

KubernetesPodOperator pods can remain in Kubernetes after their TaskInstance is no longer active when a sidecar container keeps the pod running.

This can leave stale pods consuming cluster resources even though Airflow has already moved on from the task attempt.

Related: #58968

Solution:

Add an optional KubernetesPodOperator zombie pod cleanup path for KubernetesExecutor.

When enabled, the executor periodically lists pods with the kubernetes_pod_operator=True label and compares them with unfinished TaskInstances in the Airflow DB.

A pod is deleted only when Airflow can identify the TaskInstance it belongs to from the pod labels, and either:

• the matching TaskInstance is no longer unfinished in the Airflow DB, or
• the pod belongs to an older try than the current TaskInstance try number.

A pod is not deleted when:

• its required identity labels are missing or malformed
• it still has a matching unfinished TaskInstance
• the cleanup has already reached kpo_zombie_pod_cleanup_max_deletes_per_loop for the current loop

Pods selected for deletion are processed oldest first by metadata.creation_timestamp.

The cleanup is disabled by default. Users can enable and tune it with the following [kubernetes_executor] config options:

• kpo_zombie_pod_cleanup_enabled
• kpo_zombie_pod_cleanup_interval
• kpo_zombie_pod_cleanup_max_deletes_per_loop
• kpo_zombie_pod_deletion_grace_period_seconds

This is scoped to KubernetesExecutor for now, with the cleanup logic kept in a reusable helper so it can be wired into other scheduler-side cleanup paths later.

Was generative AI tooling used to co-author this PR?

• [X] Yes (please specify the tool below)

Generated-by: [Codex] following the guidelines

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

[potiuk]

Hello @fat-catTW - thank you for your contributions to Apache Airflow!

The Airflow community has introduced a limit of 5 open pull requests at a time for contributors without write access to the repository. You currently have 17 open pull requests, so - as a one-time step of introducing the limit - we closed the ones where maintainers have not engaged yet:

• Clarify Task Instance terminal state reporting #69482 - Clarify Task Instance terminal state reporting
• Restrict asset state store access to registered tasks #69764 - Restrict asset state store access to registered tasks
• Clean up stale KubernetesPodOperator pods #70140 - Clean up stale KubernetesPodOperator pods
• Skip maxed out queued DagRun candidates #71112 - Skip maxed out queued DagRun candidates
• Optimize scheduler backfill completion updates #71216 - Optimize scheduler backfill completion updates
• Isolate scheduled DagRun creation failures with savepoints #71287 - Isolate scheduled DagRun creation failures with savepoints
• Flush scheduled DagRun creation state promptly #71331 - Flush scheduled DagRun creation state promptly
• Allow paused Dags to finish running DagRuns #71697 - Allow paused Dags to finish running DagRuns
• Respect SMTP connection sender for task email alerts #72561 - Respect SMTP connection sender for task email alerts
• Reduce XCom requests when resolving mapped task inputs #72871 - Reduce XCom requests when resolving mapped task inputs
• Handle Dag run clear errors in task SDK client #72917 - Handle Dag run clear errors in task SDK client
• Deduplicate API response result conversions #73037 - Deduplicate API response result conversions

These pull requests stay open because maintainers are already engaged in them - they count towards your limit:

• Store executor callback DagRun references in the database #71214 - Store executor callback DagRun references in the database
• Limit Glue retry task UUID scan #71546 - Limit Glue retry task UUID scan
• Fix Dag run filtering for null start dates #71654 - Fix Dag run filtering for null start dates
• Allow API clients to refresh Dag bundles #72715 - Allow API clients to refresh Dag bundles
• Add missing Amazon provider unit tests #73169 - Add missing Amazon provider unit tests

This is not a judgement of you or of your changes. We never told contributors before that opening many pull requests at once was a problem, so there is nothing to feel bad about - and nothing is lost: your branches, commits and the review history stay where they are.

What we ask you to do is to make your first prioritization decision: choose which of the pull requests above matter most to you, and reopen them (up to 5 open at a time, including the ones still open) with the "Reopen pull request" button or gh pr reopen <PR_NUMBER> --repo apache/airflow. Reopen the ones you are ready to follow through - keep them rebased, respond to review comments and fix failing checks.

While your pull requests are waiting for review, the most valuable thing you can do is help in other ways - reviewing other contributors' pull requests, helping with issues, and taking part in the discussions on the devlist and Slack.

Why we introduced the limit, what it means for you and how to reopen or restore a pull request is explained in https://github.com/apache/airflow/blob/main/contributing-docs/32_open_pull_request_limit.rst.

---

Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting