villebro opened a new pull request, #43524: URL: https://github.com/apache/superset/pull/43524
### SUMMARY Adds verify-only websocket JWT secret rotation support to the `superset-websocket` service. The Flask app continues minting realtime cookies with `WEBSOCKET_JWT_SECRET`; the websocket service validates against `JWT_SECRET` and, during rotation, optional `PREVIOUS_JWT_SECRET` / `previousJwtSecret`. This also renames the Superset-side enable flag from `ENABLE_WEBSOCKET` to `WEBSOCKET_ENABLE` so the websocket config surface is consistently `WEBSOCKET_*` before the feature branch merges. The docs now spell out the Kubernetes deployment model: run `superset-websocket` as a horizontally scalable, stateless Deployment/Service, not a singleton. Each browser socket is owned by exactly one replica after HTTP Upgrade; Redis Pub/Sub events are broadcast to all websocket replicas, and each replica fans out only to matching sockets it owns locally. Sticky sessions are not required, and polling remains the correctness backstop for reconnects/drains. A separate `WEBSOCKET_K8S_OPERATOR_REQUIREMENTS.md` captures the operator requirements for ingress, auth config, secret rotation, short-lived sockets, draining, Redis, and HPA/scaling tradeoffs. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A ### TESTING INSTRUCTIONS From the repo root: ```bash pytest tests/unit_tests/websocket/test_channel.py tests/unit_tests/views/test_base.py tests/unit_tests/initialization/check_websocket_secret_test.py npm --prefix superset-websocket run test npm --prefix superset-websocket run type ``` From `superset-frontend/`: ```bash npm run test -- src/middleware/realtime.test.ts src/middleware/asyncEvent.test.ts ``` Also run: ```bash pre-commit run ``` ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
