feat: Custom superset_config.py + secret envs

[Yann-J]

SUMMARY

This update to the Helm chart provides support for:

• Specifying custom variables to be passed to the pods as secrets
• Specifying extra conf snippets to append to superset_config.py

TEST PLAN

• Deploy updated chart passing custom values for:
  • extraSecretEnv
  • configOverrides

helm upgrade --install --values my-values.yaml superset helm/superset

Sample values.yaml:

additionalRequirements:
  - Authlib

extraSecretEnv:
  MAPBOX_API_KEY: ...
  GOOGLE_KEY: ...
  GOOGLE_SECRET: ...

configOverrides:
  # requires Authlib
  enable_oauth: |
    from flask_appbuilder.security.manager import AUTH_OAUTH
    AUTH_TYPE = AUTH_OAUTH

    OAUTH_PROVIDERS = [
        {
            "name": "google",
            "icon": "fa-google",
            "token_key": "access_token",
            "remote_app": {
                "client_id": os.environ.get("GOOGLE_KEY"),
                "client_secret": os.environ.get("GOOGLE_SECRET"),
                "api_base_url": "https://www.googleapis.com/oauth2/v2/",
                "client_kwargs": {"scope": "email profile"},
                "request_token_url": None,
                "access_token_url": "https://accounts.google.com/o/oauth2/token",
                "authorize_url": "https://accounts.google.com/o/oauth2/auth",
            },
        }
    ]

    # Will allow user self registration, allowing to create Flask users from Authorized User
    AUTH_USER_REGISTRATION = True

    # The default user self registration role
    AUTH_USER_REGISTRATION_ROLE = "Public"

### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Changes UI
- [ ] Requires DB Migration.
- [ ] Confirm DB Migration upgrade and downgrade tested.
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API

[amitmiran137]

this is a major upgrade to the flexibility of managing multiple supersets at scale
left one comment

[amitmiran137]

Can this be injected from a separate file called enable_oauth_config.py?
by that, we can upgrade configOverrides solution with multiple config modules that can be independent separately and can be mixed with other modules seamlessly

we could have a config_modules folder from which all different config will be loaded from

[Yann-J]

Yes, I think this is indeed probably a better approach... I went for appending to the existing file because that was the easiest for me, as I'm not 100% confident with my python / FAB skills and didn't want to break things...

I see that /app/pythonpath already had other files:

superset_bootstrap.sh
superset_config.py
superset_init.sh

But I suppose it's safe to simply create those separate config modules in the same directory?

[Yann-J]

Sorry I just realize you meant loading from a separate file and not into a separate file... :)

I'm not sure if there's a really convenient way to do that in the chart definition itself... it IS possible to read files but I seem to remember this comes with a few limitations...

At install time however, I think something like helm upgrade --set-file configOverrides.enable_oauth_config=oauth.py would work - but AFAIK not with a full directory...