codeant-ai-for-open-source[bot] commented on code in PR #43635:
URL: https://github.com/apache/superset/pull/43635#discussion_r3877830151
##########
docs/admin_docs/installation/kubernetes.mdx:
##########
@@ -319,6 +320,42 @@ configOverrides:
AUTH_USER_REGISTRATION_ROLE = "Admin"
```
+### Exposing Superset via Gateway API (HTTPRoute)
+
+As an alternative to `Ingress`, the chart can create a [Gateway
API](https://gateway-api.sigs.k8s.io/)
+`HTTPRoute` that attaches to a Gateway already running in your cluster. This
requires the Gateway
+API CRDs (`gateway.networking.k8s.io/v1`) to be installed, along with a
Gateway resource for the
+route to attach to.
+
+```yaml
+httproute:
+ enabled: true
+ parentRefs:
+ - name: my-gateway
+ namespace: gateway-system
Review Comment:
**Suggestion:** The example uses a cross-namespace `parentRef` to
`gateway-system`, but an HTTPRoute is accepted by a Gateway only when the
listener's `allowedRoutes` permits routes from the release namespace. With the
usual default of same-namespace routes, copying this configuration creates an
HTTPRoute that remains unattached even though the Gateway and CRDs are
installed. Document the required `allowedRoutes` configuration or use a
same-namespace Gateway example. [api mismatch]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ❌ Documented cross-namespace route may remain unattached.
- ⚠️ Gateway access fails despite valid CRDs and Gateway.
```
</details>
[](https://docs.codeant.ai/cli/resolve-pr-comments-skill)
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=eeb5eebace194eefbb603883f5fe1ee6&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=eeb5eebace194eefbb603883f5fe1ee6&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** docs/admin_docs/installation/kubernetes.mdx
**Line:** 333:335
**Comment:**
*Api Mismatch: The example uses a cross-namespace `parentRef` to
`gateway-system`, but an HTTPRoute is accepted by a Gateway only when the
listener's `allowedRoutes` permits routes from the release namespace. With the
usual default of same-namespace routes, copying this configuration creates an
HTTPRoute that remains unattached even though the Gateway and CRDs are
installed. Document the required `allowedRoutes` configuration or use a
same-namespace Gateway example.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43635&comment_hash=0b5b98e63947c1dfe85d4e5d182856f0a3578fb95ab922be9879baa161a6ac39&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43635&comment_hash=0b5b98e63947c1dfe85d4e5d182856f0a3578fb95ab922be9879baa161a6ac39&reaction=dislike'>👎</a>
##########
docs/admin_docs/installation/kubernetes.mdx:
##########
@@ -319,6 +320,42 @@ configOverrides:
AUTH_USER_REGISTRATION_ROLE = "Admin"
```
+### Exposing Superset via Gateway API (HTTPRoute)
+
+As an alternative to `Ingress`, the chart can create a [Gateway
API](https://gateway-api.sigs.k8s.io/)
+`HTTPRoute` that attaches to a Gateway already running in your cluster. This
requires the Gateway
+API CRDs (`gateway.networking.k8s.io/v1`) to be installed, along with a
Gateway resource for the
+route to attach to.
+
+```yaml
+httproute:
+ enabled: true
+ parentRefs:
+ - name: my-gateway
+ namespace: gateway-system
+ hostnames:
+ - superset.example.com
+ rules:
+ - matches:
+ - path:
+ type: PathPrefix
+ value: /
+```
+
+- `httproute.parentRefs` lists the Gateway(s) the route attaches to.
+- `httproute.hostnames` matches against the HTTP `Host` header; it's
templated, so values like
+ `{{ .Release.Name }}` can be used.
+- `httproute.rules` are routing rules backed by the Superset service; each
rule accepts standard
+ `matches`, `filters`, and `timeouts` fields, and an optional `weight`
(defaults to `1`) to leave
+ room for traffic splitting across multiple rules.
+- If `supersetWebsockets.enabled` is set, an extra rule routing
`supersetWebsockets.ingress.path`
+ (default `/ws`) to the `-ws` service is appended automatically, mirroring
the `Ingress` behavior
+ so global async queries keep working behind a Gateway.
+- If `supersetMcp.enabled` and `supersetMcp.httproute.enabled` are both set,
an extra rule routing
+ `supersetMcp.httproute.path` to the `-mcp` service is appended as well.
Review Comment:
**Suggestion:** This instruction exposes the MCP service through the
externally reachable Gateway but does not warn that MCP development mode has
authentication disabled and executes operations as `MCP_DEV_USERNAME`. Users
following the section can therefore publish a privileged MCP endpoint without
realizing that production authentication must be enabled; link to the MCP
authentication guidance and explicitly require authentication before enabling
this route. [security]
<details>
<summary><b>Severity Level:</b> Critical 🚨</summary>
```mdx
- ❌ Public Gateway can expose unauthenticated MCP operations.
- ⚠️ Requests execute using `MCP_DEV_USERNAME` permissions.
```
</details>
[](https://docs.codeant.ai/cli/resolve-pr-comments-skill)
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=eed01ce62cf24eb0b46a40262179173b&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=eed01ce62cf24eb0b46a40262179173b&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** docs/admin_docs/installation/kubernetes.mdx
**Line:** 354:355
**Comment:**
*Security: This instruction exposes the MCP service through the
externally reachable Gateway but does not warn that MCP development mode has
authentication disabled and executes operations as `MCP_DEV_USERNAME`. Users
following the section can therefore publish a privileged MCP endpoint without
realizing that production authentication must be enabled; link to the MCP
authentication guidance and explicitly require authentication before enabling
this route.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43635&comment_hash=692c1375bdc81468f97967d371d7a8089974d8f4ebe222c64fe34d2cad288b7b&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43635&comment_hash=692c1375bdc81468f97967d371d7a8089974d8f4ebe222c64fe34d2cad288b7b&reaction=dislike'>👎</a>
##########
docs/admin_docs/installation/kubernetes.mdx:
##########
@@ -319,6 +320,42 @@ configOverrides:
AUTH_USER_REGISTRATION_ROLE = "Admin"
```
+### Exposing Superset via Gateway API (HTTPRoute)
+
+As an alternative to `Ingress`, the chart can create a [Gateway
API](https://gateway-api.sigs.k8s.io/)
+`HTTPRoute` that attaches to a Gateway already running in your cluster. This
requires the Gateway
+API CRDs (`gateway.networking.k8s.io/v1`) to be installed, along with a
Gateway resource for the
+route to attach to.
+
+```yaml
+httproute:
+ enabled: true
+ parentRefs:
+ - name: my-gateway
+ namespace: gateway-system
+ hostnames:
+ - superset.example.com
+ rules:
+ - matches:
+ - path:
+ type: PathPrefix
+ value: /
+```
+
+- `httproute.parentRefs` lists the Gateway(s) the route attaches to.
+- `httproute.hostnames` matches against the HTTP `Host` header; it's
templated, so values like
+ `{{ .Release.Name }}` can be used.
+- `httproute.rules` are routing rules backed by the Superset service; each
rule accepts standard
+ `matches`, `filters`, and `timeouts` fields, and an optional `weight`
(defaults to `1`) to leave
+ room for traffic splitting across multiple rules.
+- If `supersetWebsockets.enabled` is set, an extra rule routing
`supersetWebsockets.ingress.path`
Review Comment:
**Suggestion:** The documented `weight` does not provide traffic splitting
across multiple rules. The template creates one backend reference inside each
rule, while Gateway API weighting distributes traffic among multiple
`backendRefs` within the same rule; separate HTTPRoute rules are selected by
matching and precedence. Clarify that `weight` has no splitting effect with the
generated structure, or document a configuration/template that supports
multiple backend references in one rule. [logic error]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ⚠️ Weighted rules do not provide documented traffic splitting.
- ⚠️ Canary or backend distribution configuration is misleading.
```
</details>
[](https://docs.codeant.ai/cli/resolve-pr-comments-skill)
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=77a50c43fcd4482e8563ab7384780eeb&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=77a50c43fcd4482e8563ab7384780eeb&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** docs/admin_docs/installation/kubernetes.mdx
**Line:** 348:351
**Comment:**
*Logic Error: The documented `weight` does not provide traffic
splitting across multiple rules. The template creates one backend reference
inside each rule, while Gateway API weighting distributes traffic among
multiple `backendRefs` within the same rule; separate HTTPRoute rules are
selected by matching and precedence. Clarify that `weight` has no splitting
effect with the generated structure, or document a configuration/template that
supports multiple backend references in one rule.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43635&comment_hash=93d3154e584ca1dc6162dce87cba153a453e9d7bf2f4ecef2171433f0b64cccf&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43635&comment_hash=93d3154e584ca1dc6162dce87cba153a453e9d7bf2f4ecef2171433f0b64cccf&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
