apache / apache/superset

Superset Helm Chart: configOverrides applied during install causes authentication failures (401 / anonymous user)

Open
#41,153 2 comments 0 reactions 0 assignees View on GitHub
#bug:regression authentication deploy:helm
Dominant language
Python
Stars
74.8k
Forks
18.3k
Avg merge
2d 5h
Merged PRs (30d)
685

Description

### Bug description

## Bug Description

When deploying Apache Superset using the official Helm chart, authentication breaks when configuration is provided via `configOverrides` helm value.

Without `configOverrides`, everything works correctly.

Adding `configOverrides` provided in this report, authentication fails and APIs behave as if the user is anonymous.

Issue starts in Superset **6.1.0**. Superset **6.0.0 works fine**.

---

## To Reproduce

### Working deployment

Install Superset with default Helm values (no `configOverrides`).

Result:
- `/api/v1/security/login` returns valid JWT
- `/api/v1/me/` returns authenticated user
- dashboards load correctly

---

### Broken deployment

Add this to `values.yaml`:

```python
configOverrides:
superset: |
RATELIMIT_STORAGE_URI = CACHE_REDIS_URL

FEATURE_FLAGS = {
"EMBEDDED_SUPERSET": True,
"DASHBOARD_RBAC": True,
}

GUEST_ROLE_NAME = env("SUPERSET_GUEST_ROLE_NAME", "EmbeddedAnalyzer")
GUEST_TOKEN_JWT_SECRET = env("GUEST_TOKEN_JWT_SECRET")
PUBLIC_ROLE_LIKE = "Public"

X_FRAME_OPTIONS = "NONE"

TALISMAN_CONFIG = {
"force_https": True,
"force_https_permanent": True,
"frame_options": None,
"content_security_policy": {
"frame-ancestors": ["'self'", "https://*.mydomain.com"],
},
}

ENABLE_PROXY_FIX = True
```

Deploy:

```bash
helm upgrade --install superset apache/superset -f values.yaml
```

---

## Observed behavior

- `/api/v1/security/login` succeeds
- JWT token is issued
- `/api/v1/me/` returns:

```json
{
"result": {
"is_active": false,
"is_anonymous": true
}
}
```

OR returns `401 Unauthorized`

- dashboards return empty results

---

## Expected behavior

Same config should work whether:

- applied via Helm `configOverrides`, OR
- added manually to `superset_config.py` secret after deployment

---

## Important finding

If I:

1. Deploy without `configOverrides`
2. Manually patch `superset-config` secret and add the config at the end of `superset_config.py` data
3. Restart pods

➡️ Everything works fine

---

## Environment

- Superset: 6.1.0
- Helm chart: official Superset chart
- Kubernetes: DOKS

---

## Notes

This started in Superset 6.1.0.
Same setup works in 6.0.0.

### Screenshots/recordings

_No response_

### Superset version

master / latest-dev

### Python version

3.9

### Node version

16

### Browser

Chrome

### Additional context

_No response_

### Checklist

- [ ] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [ ] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [ ] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

Contributor guide

Open the contributing guide

Research direction

Compare the Helm configOverrides deployment with the manually patched superset_config.py in the superset-config secret, using the supplied values.yaml and Superset 6.0.0/6.1.0 behavior as references. Reproduce with helm upgrade --install, then check /api/v1/security/login and /api/v1/me/. Done means configOverrides preserves authenticated users and dashboard access without manual secret changes.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes, python
Domain
authentication, devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.