villebro opened a new pull request, #341: URL: https://github.com/apache/superset-kubernetes-operator/pull/341
## Summary This PR brings **first-class, stable support for Global Async Queries (GAQ) and the realtime websocket transport** to the operator, tracking Apache Superset's migration of GAQ onto the Global Task Framework and the promotion of the websocket server to GA ([apache/superset#43407](https://github.com/apache/superset/pull/43407)). It requires a Superset image that includes that work (**Superset 7.0+**). A new top-level `spec.realtime` block centralizes the cross-component wiring that GAQ and the websocket transport need, so operators no longer have to hand-assemble feature flags, coordination config, a shared JWT secret, and a bespoke websocket image. The websocket server now ships in the official Superset image and is configured entirely by operator-injected environment variables, and a new `spec.baseUrl` centralizes the deployment's external URL so the operator can derive the websocket URL, its origin allowlist, and the Alerts & Reports link base from a single field. ## Details ### New API: `spec.realtime` - `realtime.asyncQueries` — presence enables the `GLOBAL_ASYNC_QUERIES` feature flag (which auto-enables the Global Task Framework upstream). The operator also renders the `superset.tasks.async_queries` Celery import (the one module the Celery app does not auto-import) and a short `reap_orphaned_tasks` beat schedule (every 60s), so orphaned GTF tasks — those abandoned by a worker that died mid-execution — are recovered automatically. A Celery worker **and** beat are required for the reaper to run. GAQ tuning knobs (`GLOBAL_ASYNC_QUERIES_POLLING_*`, `*_MIN_CACHE_TTL`, `*_QUERY_TIMEOUT`, `GTF_ORPHAN_TASK_TIMEOUT`) remain available via `spec.config`. - `realtime.webSocket` — turns on the push transport (`WEBSOCKET_ENABLE`). Fields: `jwtSecret` (dev-only) / `jwtSecretFrom` (the shared `WEBSOCKET_JWT_SECRET`), `url` (auto-derived when unset), `allowedOrigins`, `cookieName`, `jwtExpirationSeconds`. - Both require `spec.valkey.distributedCoordination` (the Redis/Valkey coordination backend the operator already renders). ### Websocket server promoted to GA The `websocketServer` component now inherits `spec.image` and runs from the official Superset image via the `/app/docker/entrypoints/run-websocket.sh` entrypoint — no separate/custom websocket image. It is configured entirely through operator-injected env vars (`JWT_SECRET`, `JWT_COOKIE_NAME`, `ALLOWED_ORIGINS`, and the coordination `REDIS_*` connection). Readiness now probes `/ready` (liveness stays `/health`). The previous `config.json` model (`websocketServer.config`/`configFrom`) and the custom-image CEL requirement are **removed** (the component was experimental). ### Centralized `spec.baseUrl` and security defaults `spec.baseUrl` (external, browser-visible base URL) drives three things: - the websocket `WEBSOCKET_URL` (falling back to `spec.networking` when unset); - the websocket server's `ALLOWED_ORIGINS`, defaulting to that single origin to mitigate Cross-Site WebSocket Hijacking (empty `ALLOWED_ORIGINS` upstream skips the origin check entirely) — overridable via `realtime.webSocket.allowedOrigins`; - `WEBDRIVER_BASEURL_USER_FRIENDLY`, so Alerts & Reports hyperlinks point at the real external host. The internal `WEBDRIVER_BASEURL` (the in-cluster URL the headless browser renders against) is now **operator-managed** — it targets the web-server Service — and is no longer something users must configure. ### Validation, tests, docs - CEL rules: `asyncQueries` ⇒ `valkey`; `webSocket` ⇔ `websocketServer` (+ `valkey`); inline `jwtSecret` dev-only + mutually exclusive with `jwtSecretFrom`; `webSocket` requires a URL source (`url`, `baseUrl`, or `networking`); `baseUrl` must be an `http(s)` URL. - Unit + envtest coverage for config rendering, websocket env injection, URL/origin derivation, and the CEL matrix; regenerated CRDs, DeepCopy, Helm CRDs, and API reference. - Docs updated (configuration, migration, security, architecture internals, index) and a release note added; the websocket server is no longer described as experimental. > Draft: opened for early review while Superset 7.0 (apache/superset#43407) lands. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
