GitHub user dosubot[bot] added a comment to the discussion: Superset 5.0.0 Upgrade — Invalid Decryption Key Error After psycopg2 Fix
<!-- Answer --> The change in Python package path (from `/usr/local/lib/python3.10/site-packages/` to `/app/.venv/`) does not affect how Superset loads the `SECRET_KEY` or cause decryption errors. Superset loads the key from the `SUPERSET_SECRET_KEY` environment variable if set, or from `superset_config.py` (mounted via your `configMountPath` and `configOverrides`)—the package path is not involved in this process. So, your issue is not caused by the virtualenv path change, but by a key mismatch or config issue [ref](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py#L19-L2008) [ref](https://github.com/apache/superset/discussions/23598). Since you can't exec into the pod, the best way to verify the key being used is: - Check your Helm `values.yaml` for any `SUPERSET_SECRET_KEY` or `SECRET_KEY` values in `extraEnv`, `extraSecretEnv`, or `configOverrides`. The value in `SUPERSET_SECRET_KEY` (if set) always takes precedence. - Inspect the rendered `superset_config.py` in your Kubernetes secret or Helm release manifest (e.g., with `helm get manifest <release>` or by checking the Kubernetes secret/configmap that mounts your config). - Make sure there are no typos, whitespace, or accidental changes in the key, and that only one `configOverrides` block is present. - If you rotated the key, ensure `PREVIOUS_SECRET_KEY` is set to the old value and `SECRET_KEY` (or `SUPERSET_SECRET_KEY`) to the new one, and that the `superset re-encrypt-secrets` command is run during init [ref](https://github.com/apache/superset/issues/36139). If you confirm the key is correct everywhere and still see the error, it's possible the key was changed at some point, or the database contains data encrypted with a different key. In that case, you may need to set `PREVIOUS_SECRET_KEY` and run the re-encryption command, or clear encrypted fields in the database if the previous key is lost [ref](https://github.com/apache/superset/issues/33595). Let me know if you want a step-by-step for any of these checks! <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/24bf39aa-378b-47b3-a6d7-7166a4aefbad?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/24bf39aa-378b-47b3-a6d7-7166a4aefbad?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/24bf39aa-378b-47b3-a6d7-7166a4aefbad?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/24bf39aa-378b-47b3-a6d7-7166a4aefbad?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/24bf39aa-378b-47b3-a6d7-7166a4aefbad?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/24bf39aa-378b-47b3-a6d7-7166a4aefbad?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/24bf39aa-378b-47b3-a6d7-7166a4aefbad?feedback_type=other)</sup> [](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=The%20change%20in%20Python%20package%20path%20%28from%20%60/usr/local/lib/python3.10/site-packages/%60%20to%20%60/app/.venv/%60%29%20does%20not%20affect%20how%20Superset%20loads%20the%20%60SECRET_KEY%60%20or%20cause%20decryption%20errors.%20Superset%20loads%20the%20key%20from%20the%20%60SUPERSET_SECRET_KEY%60%20environment%20variable%20if%20set%2C%20or%20from%20%60superset_config.py%60%20%28mounted%20via%20your%20%60configMountPath%60%20and%20%60configOverrides%60%29%E2%80%94the%20package%20path%20is%20not%20involved%20in%20this%20process.%20So%2C%20your%20issue%20is%20not%20caused%20by%20the%20virtualenv%20path%20change%2C%20but%20by%20a%20key%20mismatch%20or%20config%20issue%C2%A0%5Bref%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4 b43b1ed3b063ffe45377799c/superset/config.py%23L19-L2008%29%C2%A0%5Bref%5D%28https%3A//github.com/apache/superset/discussions/23598%29.%0A%0ASince%20you%20can%27t%20exec%20into%20the%20pod%2C%20the%20best%20way%20to%20verify%20the%20key%20being%20used%20is%3A%0A-%20Check%20your%20Helm%20%60values.yaml%60%20for%20any%20%60SUPERSET_SECRET_KEY%60%20or%20%60SECRET_KEY%60%20values%20in%20%60extraEnv%60%2C%20%60extraSecretEnv%60%2C%20or%20%60configOverrides%60.%20The%20value%20in%20%60SUPERSET_SECRET_KEY%60%20%28if%20set%29%20always%20takes%20precedence.%0A-%20Inspect%20the%20rendered%20%60superset_config.py%60%20in%20your%20Kubernetes%20secret%20or%20Helm%20release%20manifest%20%28e.g.%2C%20with%20%60helm%20get%20manifest%20%3Crelease%3E%60%20or%20by%20checking%20the%20Kubernetes%20secret/configmap%20that%20mounts%20your%20config%29.%0A-%20Make%20sure%20there%20are%20no%20typos%2C%20whitespace%2C%20or%20accidental%20changes%20in%20the%20key%2C%20and%20that%20only%20one%20%60configOverride s%60%20block%20is%20present.%0A-%20If%20you%20rotated%20the%20key%2C%20ensure%20%60PREVIOUS_SECRET_KEY%60%20is%20set%20to%20the%20old%20value%20and%20%60SECRET_KEY%60%20%28or%20%60SUPERSET_SECRET_KEY%60%29%20to%20the%20new%20one%2C%20and%20that%20the%20%60superset%20re-encrypt-secrets%60%20command%20is%20run%20during%20init%C2%A0%5Bref%5D%28https%3A//github.com/apache/superset/issues/36139%29.%0A%0AIf%20you%20confirm%20the%20key%20is%20correct%20everywhere%20and%20still%20see%20the%20error%2C%20it%27s%20possible%20the%20key%20was%20changed%20at%20some%20point%2C%20or%20the%20database%20contains%20data%20encrypted%20with%20a%20different%20key.%20In%20that%20case%2C%20you%20may%20need%20to%20set%20%60PREVIOUS_SECRET_KEY%60%20and%20run%20the%20re-encryption%20command%2C%20or%20clear%20encrypted%20fields%20in%20the%20database%20if%20the%20previous%20key%20is%20lost%C2%A0%5Bref%5D%28https%3A//github.com/apache/superset/issues/33595%29.%0A%0ALet%20me%20know%20if%20you%20want%20a%20step-by -step%20for%20any%20of%20these%20checks%21) [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/36340) GitHub link: https://github.com/apache/superset/discussions/36340#discussioncomment-15120573 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
