codeant-ai-for-open-source[bot] commented on code in PR #42753:
URL: https://github.com/apache/superset/pull/42753#discussion_r4140613177
##########
helm/superset/templates/_helpers.tpl:
##########
@@ -208,8 +208,10 @@ Helper to safely read
.Values.supersetNode.connections.<key> without erroring wh
{{- define "superset.config" }}
{{- /* SECURITY: Validate admin password is set if admin creation is enabled
*/}}
-{{- if and .Values.init.createAdmin (or (not .Values.init.adminUser.password)
(eq .Values.init.adminUser.password "")) }}
-{{- fail "SECURITY ERROR: init.createAdmin is true but init.adminUser.password
is empty. You must set a secure password using --set
init.adminUser.password='your-password' or via external secret." }}
+{{- $adminPasswordSet := and .Values.init.adminUser.password (not (eq
.Values.init.adminUser.password "")) }}
+{{- $adminSecretSet := and .Values.init.adminUser.existingSecret (not (eq
.Values.init.adminUser.existingSecret "")) }}
+{{- if and .Values.init.createAdmin (not (or $adminPasswordSet
$adminSecretSet)) }}
+{{- fail "SECURITY ERROR: init.createAdmin is true but neither
init.adminUser.password nor init.adminUser.existingSecret is set. You must set
a secure password using --set init.adminUser.password='your-password' or
provide an existing Kubernetes secret via init.adminUser.existingSecret." }}
{{- end }}
Review Comment:
✅ **CodeAnt verified this suggestion was addressed in subsequent commits and
marked this thread resolved** as of `95093d7`.
The validation condition now includes `.Values.init.enabled` alongside
`.Values.init.createAdmin`, so it only fails when the init job will run.
<sub>If that's not right, unresolve this thread and CodeAnt will leave it
open.</sub>
<!-- codeant-auto-resolve-reply -->
##########
helm/superset/templates/_helpers.tpl:
##########
@@ -700,15 +703,28 @@ superset init
echo "Init job: Creating admin user and loading initial data..."
{{- if .Values.init.createAdmin }}
echo "Creating admin user (if not present)..."
-if superset fab list-users 2>/dev/null | grep -qF {{ printf "username:%s"
.Values.init.adminUser.username | squote }}; then
+{{- if $adminSecretSet }}
+ADMIN_USERNAME="$SUPERSET_ADMIN_USERNAME"
+ADMIN_FIRSTNAME="$SUPERSET_ADMIN_FIRSTNAME"
+ADMIN_LASTNAME="$SUPERSET_ADMIN_LASTNAME"
+ADMIN_EMAIL="$SUPERSET_ADMIN_EMAIL"
+ADMIN_PASSWORD="$SUPERSET_ADMIN_PASSWORD"
+{{- else }}
+ADMIN_USERNAME={{ .Values.init.adminUser.username | quote }}
+ADMIN_FIRSTNAME={{ .Values.init.adminUser.firstname | quote }}
+ADMIN_LASTNAME={{ .Values.init.adminUser.lastname | quote }}
+ADMIN_EMAIL={{ .Values.init.adminUser.email | quote }}
+ADMIN_PASSWORD={{ .Values.init.adminUser.password | quote }}
Review Comment:
✅ **CodeAnt verified this suggestion was addressed in subsequent commits and
marked this thread resolved** as of `95093d7`.
The literal admin values are rendered with Helm's `squote` rather than
`quote`, producing shell-safe single-quoted assignments.
<sub>If that's not right, unresolve this thread and CodeAnt will leave it
open.</sub>
<!-- codeant-auto-resolve-reply -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
