The tojson filter created this:

$ env | grep SECRETS__BACKEND
AIRFLOW__SECRETS__BACKEND=airflow.providers.hashicorp.secrets.vault.VaultBackend
AIRFLOW__SECRETS__BACKEND__KWARGS=OrderedDict([('url', 'https://172.27.27.7:8200'), ('auth_type', 'approle'), ('mount_point', 'apps'), ('connections_path', 'airflow/connections'), [...])

Tests passed. Works well, but fail silently if the password contains special characters as such we can't parse the DSN as a valid URL.

In D3275#49866, @dereckson wrote:

The AIRFLOW__DATABASE__SQL_ALCHEMY_CONN environment variable will be removed later, allowing faster container spawn time, but that's for D3273.

To answer that comment, container spawn time is now virtually instant, as it doesn't need to open a bus with Salt so Salt can then query Vault.