dominicl-proxora opened a new pull request, #42753:
URL: https://github.com/apache/superset/pull/42753
### SUMMARY
This change adds support for sourcing Superset init admin credentials from
an existing Kubernetes Secret.
Previously, admin credentials for `init.createAdmin` were expected from
literal `init.adminUser.*` values (especially `init.adminUser.password`).
With this change, users can set `init.adminUser.existingSecret` and map key
names via `init.adminUser.secretKeys` to provide:
- username
- firstname
- lastname
- email
- password
Key implementation details:
- `init-job.yaml` now injects admin env vars from `secretKeyRef` when
`existingSecret` is set.
- `superset_init.sh` generation in `_helpers.tpl` now uses env-based admin
values when secret mode is enabled, otherwise keeps literal values behavior.
- Security validation was updated: if `init.createAdmin=true`, either
`init.adminUser.password` **or** `init.adminUser.existingSecret` must be set.
- Helm docs and upgrading docs were updated (`README.md`, `UPGRADING.md`,
`values.yaml`, `values.schema.json`).
- Helm chart tests were extended to cover both literal and secret-based
credential paths.
This enables setups where admin credentials are automatically provisioned
(for example with randomly generated passwords) without storing them directly
in `values.yaml`.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
Not applicable (Helm chart/template behavior only).
### TESTING INSTRUCTIONS
1. Render chart with default/literal admin values and verify init script
uses literal assignments:
```yaml
# values.yaml
init:
createAdmin: true
adminUser:
username: admin
firstname: Superset
lastname: Admin
email: [email protected]
password: adminpass
```
- `helm template ...`
- check generated `superset_init.sh` contains `ADMIN_USERNAME="admin"`
(or configured value).
2. Render chart with:
```yaml
# values.yaml
init:
createAdmin: true
adminUser:
existingSecret: superset-admin-credentials
secretKeys:
username: user
firstname: firstname
lastname: lastname
email: email
password: password
```
and verify render succeeds.
example for corresponding secret:
```yaml
# Kubernetes Secret example
apiVersion: v1
kind: Secret
metadata:
name: superset-admin-credentials
type: Opaque
stringData:
user: admin
firstname: Superset
lastname: Admin
email: [email protected]
password: "<RANDOM_PASSWORD>"
```
3. Verify generated init job contains `env` entries with `secretKeyRef` for:
- `SUPERSET_ADMIN_USERNAME`
- `SUPERSET_ADMIN_FIRSTNAME`
- `SUPERSET_ADMIN_LASTNAME`
- `SUPERSET_ADMIN_EMAIL`
- `SUPERSET_ADMIN_PASSWORD`
4. Run Helm chart tests and ensure they pass - `helm unittest helm/superset`
- `helm/superset/tests/config_test.yaml`
- `helm/superset/tests/initscript_test.yaml`
5. (Optional runtime check) Deploy with an existing secret and confirm init
job can create or detect admin user successfully.
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [x] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
