How to configure credentials for external postgresql from a secret using helm

[moritzsanne]

We are trying to deploy superset with the helmchart (0.12.6) with an external postgresql instance.
We pass the postgres credentials to the Helm chart as suggested by the comment https://github.com/apache/superset/blob/7330125fe9233b4cbae71ea343243f89c383a557/helm/superset/values.yaml#L84, as such:

extraEnvRaw:
  - name: DB_HOST
    valueFrom:
      secretKeyRef:
        name: postgres-secret
        key: host
  - name: DB_PORT
    valueFrom:
      secretKeyRef:
        name: postgres-secret
        key: port
  - name: DB_PASS
    valueFrom:
      secretKeyRef:
        name: postgres-secret
        key: password
  - name: DB_USER
    valueFrom:
      secretKeyRef:
        name: postgres-secret
        key: username
  - name: DB_NAME
    valueFrom:
      value: superset
postgresql:
  enabled: false

The relevant section of the generated manifests looks like this:

---
apiVersion: v1
kind: Secret
metadata:
  labels:
    app: superset
    chart: superset-0.12.4
    heritage: Helm
    release: superset
  name: superset-env
  namespace: data
stringData:
  DB_HOST: superset-postgresql
  DB_NAME: superset
  DB_PASS: superset
  DB_PORT: "5432"
  DB_USER: superset
  REDIS_CELERY_DB: "0"
  REDIS_DB: "1"
  REDIS_HOST: superset-redis-headless
  REDIS_PORT: "6379"
  REDIS_PROTO: redis
  REDIS_USER: ""
type: Opaque
---
[...]
---
apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    helm.sh/hook: post-install,post-upgrade
    helm.sh/hook-delete-policy: before-hook-creation
  labels:
    app: superset
  name: superset-init-db
  namespace: data
spec:
  template:
    metadata:
      name: superset-init-db
    spec:
      containers:
        - command:
            - /bin/sh
            - -c
            - . /app/pythonpath/superset_bootstrap.sh; . /app/pythonpath/superset_init.sh
          env:
            - name: DB_HOST
              valueFrom:
                secretKeyRef:
                  key: host
                  name: postgres-secret
                [...]
          envFrom:
            - secretRef:
                name: superset-env // We suspect this takes priority over env
          image: apachesuperset.docker.scarf.sh/apache/superset:3.1.0
          imagePullPolicy: IfNotPresent
          name: superset-init-db
          resources: {}
          volumeMounts:
            - mountPath: /app/pythonpath
              name: superset-config
              readOnly: true
      initContainers:
        - command:
            - /bin/sh
            - -c
            - dockerize -wait "tcp://$DB_HOST:$DB_PORT" -timeout 120s
          envFrom:
            - secretRef:
                name: superset-env
          image: apache/superset:dockerize
          imagePullPolicy: IfNotPresent
          name: wait-for-postgres
      restartPolicy: Never
      securityContext:
        runAsUser: 1000
      serviceAccountName: superset-chart-service-account-c8a9c81b
      volumes:
        - name: superset-config
          secret:
            secretName: superset-config

We observe the init-db container using not our credentials but instead the default credentials:

│ 2024/02/22 09:36:28 Timeout after 2m0s waiting on dependencies to become available: [tcp://superset-postgresql:5432]

We suspect, that this part in the init-db job is overwriting our credentials with the default values,

 envFrom:
            - secretRef:
                name: superset-env

How can we configure the Helm chart so that the generated manifest no longer passes the default credentials to the pods but uses our credentials instead?

Many Thanks

[Xeimn]

Are there any solutions or possible work-arounds for this? We are facing the exact same issue in our project.

[gnieser]

While not ideal, I override all the initContainers definitions in values.yaml.
This way, one can also set a custom image, resources requests and limits.

    initContainers:
      - name: wait-for-postgres-redis
        image: "{{ .Values.initImage.repository }}:{{ .Values.initImage.tag }}"
        imagePullPolicy: "{{ .Values.initImage.pullPolicy }}"
        envFrom:
          - secretRef:
              name: "{{ tpl .Values.envFromSecret . }}"
        command:
          ...
        resources:
          ...

The same can be done for the wait-for-postgres-redis initContainer.

Note that in my case, the secret-env is created from a vault.

  secretEnv:
    create: false

Hence the details on how you ref yours may vary.