GitHub user FrancescoCastaldi added a comment to the discussion: Redis password
no longer loaded from `REDIS_PASSWORD` env var
The inconsistency you observed between Helm chart versions happens because of
how Helm templates evaluate string parameters versus environment variable
lookups.
### Explanation
In the official Superset Helm chart (0.20+ and 0.22.x), the base template in
`_helpers.tpl` generates `REDIS_BASE_URL` using `env('REDIS_PASSWORD')`.
However, for cache dictionaries like `GLOBAL_ASYNC_QUERIES_CACHE_BACKEND` or
`RESULTS_BACKEND`, when values are passed through Helm variables, the Helm
template quotes the value (`{{ $redisPasswordForBackend | quote }}`), turning
placeholder strings like `"from-secret"` into literal string constants instead
of Python variable lookups.
### Recommended Fix in `values.yaml`
Because `configOverrides` is evaluated via `tpl` and appended at the end of
`superset_config.py`, Python's last-assignment-wins semantics allow you to
re-declare the backend configurations cleanly using `os.environ`:
```yaml
# values.yaml
configOverrides:
redis_secrets: |
import os
from urllib.parse import quote
from superset.utils.core import RedisCache
_redis_pass = os.environ.get("REDIS_PASSWORD", "")
_redis_user = os.environ.get("REDIS_USER", "")
_redis_host = os.environ.get("REDIS_HOST", "superset-redis-headless")
_redis_port = int(os.environ.get("REDIS_PORT", "6379"))
RESULTS_BACKEND = RedisCache(
host=_redis_host,
port=_redis_port,
password=_redis_pass,
key_prefix="superset_results",
)
GLOBAL_ASYNC_QUERIES_CACHE_BACKEND = {
"CACHE_TYPE": "RedisCache",
"CACHE_REDIS_HOST": _redis_host,
"CACHE_REDIS_PORT": _redis_port,
"CACHE_REDIS_PASSWORD": _redis_pass,
"CACHE_REDIS_DB": 1,
"CACHE_KEY_PREFIX": "qc-",
"CACHE_DEFAULT_TIMEOUT": 86400,
}
GLOBAL_ASYNC_QUERIES_RESULTS_BACKEND = {
"backend": "redis",
"host": _redis_host,
"port": _redis_port,
"password": _redis_pass,
"db": 1,
"prefix": "qc-",
}
```
Ensure your Redis secret is mapped to the container environment:
```yaml
extraEnv:
REDIS_PASSWORD:
valueFrom:
secretKeyRef:
name: superset-redis-secret
key: redis-password
```
With this setup, passwords are read dynamically from the pod environment at
runtime rather than baked into rendered ConfigMaps or Secret templates.
GitHub link:
https://github.com/apache/superset/discussions/43172#discussioncomment-19164459
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
