[bitnami/superset] Set usePasswordFiles=true by default

bitnami/superset/CHANGELOG.md

@@ -1,8 +1,12 @@
 # Changelog
 
-## 1.1.3 (2025-04-02)
+## 2.0.0 (2025-04-04)
 
-* [bitnami/superset] Release 1.1.3 ([#32777](https://github.com/bitnami/charts/pull/32777))
+* [bitnami/superset] Set `usePasswordFiles=true` by default ([#32778](https://github.com/bitnami/charts/pull/32778))
+
+## <small>1.1.3 (2025-04-02)</small>
+
+* [bitnami/superset] Release 1.1.3 (#32777) ([d856953](https://github.com/bitnami/charts/commit/d856953250bfdba841d438923045fdc67808d47c)), closes [#32777](https://github.com/bitnami/charts/issues/32777)
 
 ## <small>1.1.2 (2025-03-25)</small>
 

bitnami/superset/Chart.yaml

@@ -38,4 +38,4 @@ sources:
 - https://github.com/bitnami/charts/tree/main/bitnami/superset
 - https://github.com/bitnami/containers/tree/main/bitnami/superset
 - https://github.com/apache/superset
-version: 1.1.3
+version: 2.0.0

bitnami/superset/README.md

@@ -172,6 +172,7 @@ As an alternative, use one of the preset configurations for pod affinity, pod an
 | `commonAnnotations`      | Annotations to add to all deployed objects                                              | `{}`            |
 | `clusterDomain`          | Kubernetes cluster domain name                                                          | `cluster.local` |
 | `extraDeploy`            | Array of extra objects to deploy with the release                                       | `[]`            |
+| `usePasswordFiles`       | Mount credentials as files instead of using an environment variable                     | `true`          |
 | `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false`         |
 | `diagnosticMode.command` | Command to override all containers in the chart release                                 | `["sleep"]`     |
 | `diagnosticMode.args`    | Args to override all containers in the chart release                                    | `["infinity"]`  |
@@ -516,7 +517,6 @@ As an alternative, use one of the preset configurations for pod affinity, pod an
 | `flower.auth.enabled`                                                   | Enables Apache Celery flower HTTP basic authentication                                                                                                                                                                                          | `true`                     |
 | `flower.auth.username`                                                  | Apache Celery flower username                                                                                                                                                                                                                   | `user`                     |
 | `flower.auth.password`                                                  | Apache Celery flower password                                                                                                                                                                                                                   | `""`                       |
-| `flower.auth.usePasswordFiles`                                          | Mount credentials as files instead of using an environment variable                                                                                                                                                                             | `true`                     |
 | `flower.auth.existingSecret`                                            | Name of existing secret to use for Superset Celery flower                                                                                                                                                                                       | `""`                       |
 | `flower.livenessProbe.enabled`                                          | Enable livenessProbe on Superset celery flower containers                                                                                                                                                                                       | `true`                     |
 | `flower.livenessProbe.initialDelaySeconds`                              | Initial delay seconds for livenessProbe                                                                                                                                                                                                         | `30`                       |
@@ -740,6 +740,12 @@ helm install my-release -f values.yaml oci://REGISTRY_NAME/REPOSITORY_NAME/super
 
 Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues).
 
+## Upgrading
+
+### To 2.0.0
+
+This version replaces the value `flower.auth.usePasswordFiles` with the new value `usePasswordFiles`. When using `usePasswordFiles=true`, , all credentials will be mounted as files instead of using an environment variable.
+
 ## License
 
 Copyright © 2025 Broadcom. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
@@ -754,4 +760,4 @@ Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
-limitations under the License.
+limitations under the License.

bitnami/superset/templates/_helpers.tpl

@@ -201,11 +201,16 @@ Add environment variables to configure database values
 - name: SUPERSET_DATABASE_USER
   value: {{ include "superset.database.user" . | quote }}
 {{- if or (not .Values.postgresql.enabled) .Values.postgresql.auth.enablePostgresUser }}
+{{- if .Values.usePasswordFiles }}
+- name: SUPERSET_DATABASE_PASSWORD_FILE
+  value: {{ printf "/opt/bitnami/superset/secrets/%s" (include "superset.database.secretKey" .) }}
+{{- else }}
 - name: SUPERSET_DATABASE_PASSWORD
   valueFrom:
     secretKeyRef:
       name: {{ include "superset.postgresql.secretName" . }}
       key: {{ include "superset.database.secretKey" . }}
+{{- end }}
 {{- else }}
 - name: ALLOW_EMPTY_PASSWORD
   value: "true"
@@ -222,22 +227,32 @@ Add environment variables to configure redis values
   value: {{ include "superset.redis.port" . | quote }}
 - name: REDIS_USER
   value: {{ ternary "default" .Values.externalRedis.username .Values.redis.enabled  | quote }}
+{{- if .Values.usePasswordFiles }}
+- name: REDIS_PASSWORD_FILE
+  value: {{ printf "/opt/bitnami/superset/secrets/%s" (include "superset.redis.secretKey" .) }}
+{{- else }}
 - name: REDIS_PASSWORD
   valueFrom:
     secretKeyRef:
       name: {{ include "superset.redis.secretName" . }}
       key: {{ include "superset.redis.secretKey" . }}
+{{- end }}
 {{- end -}}
 
 {{/*
 Add environment variables to configure superset common values
 */}}
 {{- define "superset.configure.common" -}}
+{{- if .Values.usePasswordFiles }}
+- name: SUPERSET_SECRET_KEY_FILE
+  value: "/opt/bitnami/superset/secrets/superset-secret-key"
+{{- else }}
 - name: SUPERSET_SECRET_KEY
   valueFrom:
     secretKeyRef:
       name: {{ include "superset.secretName" . }}
       key: superset-secret-key
+{{- end }}
 {{- if or .Values.existingConfigmap .Values.config }}
 - name: SUPERSET_CONF_FILE
   value: "/bitnami/superset/conf/superset_config.py"
@@ -276,6 +291,10 @@ Init container definition to wait for PostgreSQL
         . /opt/bitnami/scripts/liblog.sh
         . /opt/bitnami/scripts/libpostgresql.sh
 
+        {{- if .Values.usePasswordFiles }}
+        export SUPERSET_DATABASE_PASSWORD="$(< $SUPERSET_DATABASE_PASSWORD_FILE)"
+        {{- end }}
+
         check_postgresql_connection() {
             echo "SELECT 1" | postgresql_remote_execute "$SUPERSET_DATABASE_HOST" "$SUPERSET_DATABASE_PORT_NUMBER" "$SUPERSET_DATABASE_NAME" "$SUPERSET_DATABASE_USER" "$SUPERSET_DATABASE_PASSWORD"
         }
@@ -289,6 +308,12 @@ Init container definition to wait for PostgreSQL
         fi
   env:
     {{- include "superset.configure.database" . | nindent 4 }}
+  {{- if .Values.usePasswordFiles }}
+  volumeMounts:
+    - name: superset-secrets
+      mountPath: /opt/bitnami/superset/secrets
+      readOnly: true
+  {{- end }}
 {{- end -}}
 
 {{/*
@@ -320,6 +345,10 @@ Init container definition to wait for Redis
         . /opt/bitnami/scripts/libos.sh
         . /opt/bitnami/scripts/liblog.sh
 
+        {{- if .Values.usePasswordFiles }}
+        export REDIS_PASSWORD="$(< $REDIS_PASSWORD_FILE)"
+        {{- end }}
+
         check_redis_connection() {
             local result="$(redis-cli -h ${REDIS_HOST} -p ${REDIS_PORT_NUMBER} -a ${REDIS_PASSWORD} --user ${REDIS_USER} PING)"
             if [[ "$result" != "PONG" ]]; then
@@ -336,6 +365,12 @@ Init container definition to wait for Redis
         fi
   env:
     {{- include "superset.configure.redis" . | nindent 4 }}
+  {{- if .Values.usePasswordFiles }}
+  volumeMounts:
+    - name: superset-secrets
+      mountPath: /opt/bitnami/superset/secrets
+      readOnly: true
+  {{- end }}
 {{- end }}
 
 {{- define "superset.initContainers.waitForExamples" -}}
@@ -365,6 +400,10 @@ Init container definition to wait for Redis
         . /opt/bitnami/scripts/liblog.sh
         . /opt/bitnami/scripts/libpostgresql.sh
 
+        {{- if .Values.usePasswordFiles }}
+        export SUPERSET_DATABASE_PASSWORD="$(< $SUPERSET_DATABASE_PASSWORD_FILE)"
+        {{- end }}
+
         check_examples_database() {
             echo "SELECT dashboard_title FROM dashboards" | postgresql_remote_execute_print_output "$SUPERSET_DATABASE_HOST" "$SUPERSET_DATABASE_PORT_NUMBER" "$SUPERSET_DATABASE_NAME" "$SUPERSET_DATABASE_USER" "$SUPERSET_DATABASE_PASSWORD" | grep "Dashboard"
         }
@@ -378,6 +417,12 @@ Init container definition to wait for Redis
         fi
   env:
     {{- include "superset.configure.database" . | nindent 4 }}
+  {{- if .Values.usePasswordFiles }}
+  volumeMounts:
+    - name: superset-secrets
+      mountPath: /opt/bitnami/superset/secrets
+      readOnly: true
+  {{- end }}
 {{- end }}
 
 {{/*

bitnami/superset/templates/beat/deployment.yaml

@@ -161,6 +161,11 @@ spec:
             - name: empty-dir
               mountPath: /opt/bitnami/superset/tmp
               subPath: app-tmp-dir
+            {{- if .Values.usePasswordFiles }}
+            - name: superset-secrets
+              mountPath: /opt/bitnami/superset/secrets
+              readOnly: true
+            {{- end }}
             {{- if or .Values.existingConfigmap .Values.config }}
             - name: superset-config
               mountPath: /bitnami/superset/conf
@@ -174,6 +179,22 @@ spec:
       volumes:
         - name: empty-dir
           emptyDir: {}
+        {{- if .Values.usePasswordFiles }}
+        - name: superset-secrets
+          projected:
+            sources:
+              - secret:
+                  name: {{ include "superset.secretName" . }}
+                  items:
+                    - key: superset-secret-key
+                      path: superset-secret-key
+              - secret:
+                  name: {{ include "superset.redis.secretName" . }}
+              {{- if or (not .Values.postgresql.enabled) .Values.postgresql.auth.enablePostgresUser }}
+              - secret:
+                  name: {{ include "superset.postgresql.secretName" . }}
+              {{- end }}
+        {{- end }}
         {{- if or .Values.existingConfigmap .Values.config }}
         - name: superset-config
           configMap:

bitnami/superset/templates/externaldb-secrets.yaml

@@ -3,7 +3,7 @@ Copyright Broadcom, Inc. All Rights Reserved.
 SPDX-License-Identifier: APACHE-2.0
 */}}
 
-{{- if and (not .Values.postgresql.enabled) (not .Values.externalDatabase.existingSecret) .Values.externalDatabase.password -}}
+{{- if and (not .Values.postgresql.enabled) (not .Values.externalDatabase.existingSecret) .Values.externalDatabase.password }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -17,7 +17,7 @@ type: Opaque
 data:
   {{ .Values.externalDatabase.existingSecretPasswordKey }}: {{ .Values.externalDatabase.password | b64enc | quote }}
 {{- end }}
-{{- if and (not .Values.redis.enabled) (not .Values.externalRedis.existingSecret) .Values.externalRedis.password -}}
+{{- if and (not .Values.redis.enabled) (not .Values.externalRedis.existingSecret) .Values.externalRedis.password }}
 ---
 apiVersion: v1
 kind: Secret

bitnami/superset/templates/flower/deployment.yaml

@@ -175,8 +175,8 @@ spec:
             - name: empty-dir
               mountPath: /opt/bitnami/superset/superset_home
               subPath: superset-home
-            {{- if and .Values.flower.auth.enabled .Values.flower.auth.usePasswordFiles }}
-            - name: flower-basic-auth
+            {{- if .Values.usePasswordFiles }}
+            - name: superset-secrets
               mountPath: /opt/bitnami/superset/secrets
               readOnly: true
             {{- end }}
@@ -193,13 +193,25 @@ spec:
       volumes:
         - name: empty-dir
           emptyDir: {}
-        {{- if and .Values.flower.auth.enabled .Values.flower.auth.usePasswordFiles }}
-        - name: flower-basic-auth
-          secret:
-            secretName: {{ template "superset.flower.secretName" . }}
-            items:
-              - key: flower-basic-auth
-                path: flower-basic-auth
+        {{- if .Values.usePasswordFiles }}
+        - name: superset-secrets
+          projected:
+            sources:
+              - secret:
+                  name: {{ include "superset.secretName" . }}
+                  items:
+                    - key: superset-secret-key
+                      path: superset-secret-key
+              - secret:
+                  name: {{ include "superset.redis.secretName" . }}
+              {{- if .Values.flower.auth.enabled }}
+              - secret:
+                  name: {{ include "superset.flower.secretName" . }}
+              {{- end }}
+              {{- if or (not .Values.postgresql.enabled) .Values.postgresql.auth.enablePostgresUser }}
+              - secret:
+                  name: {{ include "superset.postgresql.secretName" . }}
+              {{- end }}
         {{- end }}
         {{- if or .Values.existingConfigmap .Values.config }}
         - name: superset-config

bitnami/superset/templates/init/init-job.yaml

@@ -74,11 +74,16 @@ spec:
               value: {{ .Values.auth.username | quote }}
             - name: SUPERSET_EMAIL
               value: {{ .Values.auth.email | quote }}
+            {{- if .Values.usePasswordFiles }}
+            - name: SUPERSET_PASSWORD_FILE
+              value: "/opt/bitnami/superset/secrets/superset-password"
+            {{- else }}
             - name: SUPERSET_PASSWORD
               valueFrom:
                 secretKeyRef:
                   name: {{ include "superset.secretName" . }}
                   key: superset-password
+            {{- end }}
             - name: SUPERSET_LOAD_EXAMPLES
               value: {{ ternary "true" "false" .Values.loadExamples | quote }}
             {{- if .Values.init.extraEnvVars }}
@@ -105,6 +110,11 @@ spec:
             - name: empty-dir
               mountPath: /opt/bitnami/superset/superset_home
               subPath: superset-home
+            {{- if .Values.usePasswordFiles }}
+            - name: superset-secrets
+              mountPath: /opt/bitnami/superset/secrets
+              readOnly: true
+            {{- end }}
             {{- if or .Values.existingConfigmap .Values.config }}
             - name: superset-config
               mountPath: /bitnami/superset/conf
@@ -118,6 +128,24 @@ spec:
       volumes:
         - name: empty-dir
           emptyDir: {}
+        {{- if .Values.usePasswordFiles }}
+        - name: superset-secrets
+          projected:
+            sources:
+              - secret:
+                  name: {{ include "superset.secretName" . }}
+                  items:
+                    - key: superset-secret-key
+                      path: superset-secret-key
+                    - key: superset-password
+                      path: superset-password
+              - secret:
+                  name: {{ include "superset.redis.secretName" . }}
+              {{- if or (not .Values.postgresql.enabled) .Values.postgresql.auth.enablePostgresUser }}
+              - secret:
+                  name: {{ include "superset.postgresql.secretName" . }}
+              {{- end }}
+        {{- end }}
         {{- if or .Values.existingConfigmap .Values.config }}
         - name: superset-config
           configMap:

bitnami/superset/templates/web/deployment.yaml

@@ -167,6 +167,11 @@ spec:
             - name: empty-dir
               mountPath: /opt/bitnami/superset/superset_home
               subPath: superset-home
+            {{- if .Values.usePasswordFiles }}
+            - name: superset-secrets
+              mountPath: /opt/bitnami/superset/secrets
+              readOnly: true
+            {{- end }}
             {{- if or .Values.existingConfigmap .Values.config }}
             - name: superset-config
               mountPath: /bitnami/superset/conf
@@ -180,6 +185,22 @@ spec:
       volumes:
         - name: empty-dir
           emptyDir: {}
+        {{- if .Values.usePasswordFiles }}
+        - name: superset-secrets
+          projected:
+            sources:
+              - secret:
+                  name: {{ include "superset.secretName" . }}
+                  items:
+                    - key: superset-secret-key
+                      path: superset-secret-key
+              - secret:
+                  name: {{ include "superset.redis.secretName" . }}
+              {{- if or (not .Values.postgresql.enabled) .Values.postgresql.auth.enablePostgresUser }}
+              - secret:
+                  name: {{ include "superset.postgresql.secretName" . }}
+              {{- end }}
+        {{- end }}
         {{- if or .Values.existingConfigmap .Values.config }}
         - name: superset-config
           configMap: