apache / apache/superset

Helm chart: database credentials cannot be loaded from existing secret

Open
#42,876 3 comments 0 reactions 0 assignees View on GitHub
deploy:helm infra:container validation:required
Dominant language
Python
Stars
74.8k
Forks
18.3k
Avg merge
2d 5h
Merged PRs (30d)
685

Description

### Bug description

The structured database credentials introduced in https://github.com/apache/superset/pull/41777 only allow for static values, and have no mechanism to load the password value from a secret. This breaks any workflow that only places database credentials as a secret only, such as CNPG or AWS RDS cluster integration.

This also was a problem with the previous credentials under supersetNode, but I have only encountered this now as I switched to an external database with the Superset V6 upgrade.

I have partially worked around this by specifying an additional `envFromSecrets:` entry, which worked for the application container but is not passed in to the init `wait-for-postgres` job and that still fails in a loop with the stub password entry in the values.

### Screenshots/recordings

_No response_

### Superset version

6.1.0

### Python version

Not applicable

### Node version

Not applicable

### Browser

Not applicable

### Additional context

This is using the latest released version of the chart, 0.22.4.

### Checklist

- [x] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

Contributor guide

Open the contributing guide

Research direction

Start by tracing the Helm chart's structured database credentials and envFromSecrets handling, including the init wait-for-postgres job. Check the rendered configuration for both the application container and the init job. Done means a secret-only database password works for both without the stub password causing the job to loop.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm
Domain
databases, devops, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.