codeant-ai-for-open-source[bot] commented on code in PR #41396:
URL: https://github.com/apache/superset/pull/41396#discussion_r3615013457
##########
helm/superset/templates/_helpers.tpl:
##########
@@ -685,6 +685,14 @@ TALISMAN_CONFIG = {
{{- define "superset.initScript" -}}
#!/bin/sh
set -eu
+{{- if dig "istio" "terminateSidecarOnExit" false .Values.init }}
+# Notify the Istio pilot-agent sidecar to exit when this script completes
+# (whether successfully or via `set -e`), so that the Job can reach the
+# Completed state instead of hanging on a still-running envoy-proxy.
+# See https://github.com/apache/superset/issues/25798
+ISTIO_QUIT_ENDPOINT={{ dig "istio" "quitEndpoint"
"http://localhost:15020/quitquitquit"; .Values.init | replace "'" "'\\''" |
squote }}
+trap 'rc=$?; curl -fsS -m 5 -X POST "$ISTIO_QUIT_ENDPOINT" >/dev/null 2>&1 ||
true; exit $rc' EXIT
Review Comment:
**Suggestion:** The sidecar-termination call is unconditionally masked with
`|| true`, so when the POST fails (for example endpoint not reachable or `curl`
not present) the script still exits normally and the Job can continue hanging
with the sidecar running. Make this path observable/failable when the feature
is enabled (or at least emit an explicit error and fail the init script) so the
mitigation does not silently no-op. [logic error]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ❌ init-db Job may still hang with terminateSidecarOnExit enabled.
- ⚠️ Failure to contact Istio admin endpoint is fully silent.
- ⚠️ Operators cannot easily distinguish config vs. feature failure.
```
</details>
<details>
<summary><b>Steps of Reproduction ✅ </b></summary>
```mdx
1. In `helm/superset/values.yaml`, enable the feature by setting
`init.istio.terminateSidecarOnExit: true` and configure an incorrect or
unreachable
endpoint in `init.istio.quitEndpoint` (e.g., wrong port or path), so the
POST will fail
when called from the init container.
2. Deploy the chart so that the `init-db` Job uses the `superset.initScript`
helper
defined at `helm/superset/templates/_helpers.tpl:685-703`, which renders the
`trap` line
at `helm/superset/templates/_helpers.tpl:694` into the init script executed
in the init-db
pod.
3. Ensure Istio sidecar injection is enabled on the namespace so the
`init-db` pod gets an
`istio-proxy` sidecar; when the Job runs, the main container runs the
rendered init
script, finishes all `superset db upgrade` / `superset init` steps, and
exits with status
0.
4. On script exit, the EXIT trap at
`helm/superset/templates/_helpers.tpl:694` executes
`curl -fsS -m 5 -X POST "$ISTIO_QUIT_ENDPOINT" >/dev/null 2>&1 || true`;
because the
endpoint is unreachable, `curl` returns non‑zero but the `|| true` masks the
failure, so
the script still exits with the original status 0, the istio-proxy sidecar
keeps running,
and the Kubernetes Job remains stuck in `Running` without any log message
indicating the
sidecar shutdown POST failed.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=263afc6e0ef2470295c5b3a8a91516d2&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=263afc6e0ef2470295c5b3a8a91516d2&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** helm/superset/templates/_helpers.tpl
**Line:** 694:694
**Comment:**
*Logic Error: The sidecar-termination call is unconditionally masked
with `|| true`, so when the POST fails (for example endpoint not reachable or
`curl` not present) the script still exits normally and the Job can continue
hanging with the sidecar running. Make this path observable/failable when the
feature is enabled (or at least emit an explicit error and fail the init
script) so the mitigation does not silently no-op.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41396&comment_hash=001f30c4e212fd0b75a320cf8aec9a4a72014ed2ecda57e60a1828899313a0c9&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41396&comment_hash=001f30c4e212fd0b75a320cf8aec9a4a72014ed2ecda57e60a1828899313a0c9&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
