Redis password no longer loaded from REDIS_PASSWORD env var

[MiniaczQ]

Bug description

I'm migrating from 0.15.2/5.0.0 to 0.22.4/6.1.0.
The most glaring issue is how sometimes REDIS_PASSWORD env var is used in superset_config.py, but other times the password is inserted as plaintext.

In 0.15.2:

REDIS_BASE_URL=f"{env('REDIS_PROTO')}://{env('REDIS_USER', '')}:{env('REDIS_PASSWORD')}@{env('REDIS_HOST')}:{env('REDIS_PORT')}"

RESULTS_BACKEND = RedisCache(
      host=env('REDIS_HOST'),
      password=env('REDIS_PASSWORD'),
      port=env('REDIS_PORT'),
      key_prefix='superset_results',
)

both load the password from environment.

In 0.22.4:

_redis_user = quote(env('REDIS_USER', ''), safe='')
_redis_password = quote(env('REDIS_PASSWORD', ''), safe='')
_redis_auth = f"{_redis_user}:{_redis_password}@" if (_redis_user or _redis_password) else ""
REDIS_BASE_URL = f"redis://{_redis_auth}{env('REDIS_HOST')}:{env('REDIS_PORT')}"

RESULTS_BACKEND = RedisCache(
    host="***.svc.cluster.local",
    password="from-secret",
    port=6379,
    key_prefix="superset_results",
)
GLOBAL_ASYNC_QUERIES_CACHE_BACKEND = {
    "CACHE_TYPE": "RedisCache",
    "CACHE_REDIS_HOST": "***.svc.cluster.local",
    "CACHE_REDIS_PORT": 6379,
    "CACHE_REDIS_USER": "",
    "CACHE_REDIS_PASSWORD": "from-secret",
    "CACHE_REDIS_DB": 1,
    "CACHE_KEY_PREFIX": "qc-",
    "CACHE_DEFAULT_TIMEOUT": 86400,
    "CACHE_REDIS_SSL": False,
    "CACHE_REDIS_SSL_CERTFILE": None,
    "CACHE_REDIS_SSL_KEYFILE": None,
    "CACHE_REDIS_SSL_CERT_REQS": "required",
    "CACHE_REDIS_SSL_CA_CERTS": None,
}
GLOBAL_ASYNC_QUERIES_RESULTS_BACKEND = {
    "backend": "redis",
    "host": "***.svc.cluster.local",
    "port": 6379,
    "prefix": "qc-",
    "db": 1,
    "password": "from-secret",
}

the first part is correct, while the second inserts my placeholder from-secret phrase.

Screenshots/recordings

No response

Superset version

master / latest-dev

Python version

3.11

Node version

16

Browser

Chrome

Additional context

No response

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot[bot]]

Hi @MiniaczQ! I'm Dosu and I'm helping the Apache Superset team.

This isn't a bug in the Helm chart itself — the base superset_config.py template in _helpers.tpl correctly uses env('REDIS_PASSWORD') for both REDIS_BASE_URL and RESULTS_BACKEND [1].

The GLOBAL_ASYNC_QUERIES_CACHE_BACKEND and GLOBAL_ASYNC_QUERIES_RESULTS_BACKEND blocks you're seeing with hard-coded passwords are not part of the Helm chart's base template — there is no such block in _helpers.tpl. They must be coming from your own configOverrides in values.yaml [2], where the password was written as a literal string ("from-secret") instead of being read from the environment.

The fix is to use env('REDIS_PASSWORD') in those overrides, just like the base template does:

GLOBAL_ASYNC_QUERIES_CACHE_BACKEND = {
    "CACHE_TYPE": "RedisCache",
    "CACHE_REDIS_HOST": env("REDIS_HOST"),
    "CACHE_REDIS_PORT": int(env("REDIS_PORT", "6379")),
    "CACHE_REDIS_PASSWORD": env("REDIS_PASSWORD", ""),
    ...
}
GLOBAL_ASYNC_QUERIES_RESULTS_BACKEND = {
    "backend": "redis",
    "host": env("REDIS_HOST"),
    "port": int(env("REDIS_PORT", "6379")),
    "password": env("REDIS_PASSWORD", ""),
    ...
}

The env() helper is defined at the top of the generated config [3], so it's available in any configOverrides snippet. As long as supersetNode.connections.redis_password is set in your values.yaml, the REDIS_PASSWORD environment variable will be present in the pods and env('REDIS_PASSWORD') will resolve correctly at runtime.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[MiniaczQ]

Here is the snippet that creates the Python config:

{{- if $redisPasswordForBackend }}
"CACHE_REDIS_PASSWORD": {{ $redisPasswordForBackend | quote }},
{{- else }}
"CACHE_REDIS_PASSWORD": "",
{{- end }}

the password gets quoted which means I cannot overwrite it with arbitrary code which loads env vars

[dosubot[bot]]

@MiniaczQ Right — the | quote in the Helm template bakes the password as a Python string literal at render time, so there's no way to inject env('REDIS_PASSWORD') into those specific blocks directly.

The workaround is to use configOverrides in your values.yaml. The chart's _helpers.tpl appends configOverrides after the generated config blocks and passes them through tpl, so raw Python ends up in the file as-is [1]. Since Python uses last-assignment-wins, you can simply redeclare the affected variables:

configOverrides:
  redis_backends: |
    RESULTS_BACKEND = RedisCache(
        host=env('REDIS_HOST'),
        password=env('REDIS_PASSWORD'),
        port=env('REDIS_PORT'),
        key_prefix='superset_results',
    )
    GLOBAL_ASYNC_QUERIES_CACHE_BACKEND = {
        "CACHE_TYPE": "RedisCache",
        "CACHE_REDIS_HOST": env("REDIS_HOST"),
        "CACHE_REDIS_PORT": int(env("REDIS_PORT", "6379")),
        "CACHE_REDIS_PASSWORD": env("REDIS_PASSWORD", ""),
        "CACHE_REDIS_DB": 1,
        "CACHE_KEY_PREFIX": "qc-",
    }
    GLOBAL_ASYNC_QUERIES_RESULTS_BACKEND = {
        "backend": "redis",
        "host": env("REDIS_HOST"),
        "port": int(env("REDIS_PORT", "6379")),
        "password": env("REDIS_PASSWORD", ""),
        "db": 1,
    }

This keeps the secret out of the rendered config — env('REDIS_PASSWORD') is emitted as Python source and evaluated at pod startup. The env() helper is available because it's defined earlier in the same generated file.

One broader note: the official Helm chart is deprecated in favor of the Superset Kubernetes Operator, which has a more structured secrets/config model and a migration guide if you're considering longer-term options [2].

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[dosubot[bot]]

@MiniaczQ Looking at the current chart's _helpers.tpl, the snippet you're referencing does quote the password at Helm render time in certain places, which prevents injecting arbitrary Python expressions like env('REDIS_PASSWORD').

However, the current chart already provides a workaround: configOverrides is appended after the generated config blocks [1] and is processed via tpl [2], so any Python code you put there passes through as-is. Since Python uses last-assignment-wins semantics, you can simply re-declare the affected variables in a configOverrides block:

configOverrides:
  redis_backends: |
    RESULTS_BACKEND = RedisCache(
        host=env('REDIS_HOST'),
        password=env('REDIS_PASSWORD'),
        port=env('REDIS_PORT'),
        key_prefix='superset_results',
    )

This keeps the password out of the rendered Secret entirely — env('REDIS_PASSWORD') ends up in the generated superset_config.py as Python source that reads the env var at runtime.

Worth noting: PR #41777 (merged, chart bumped to 0.20.0) restructures how the config is rendered with a new structured values schema, which may give you more flexibility going forward [3].

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[sadpandajoe]

Sounds like this isn't an issue so going to move this over to a discussion. Feel free to continue there.

[MiniaczQ]

One can argue that you can overwrite anything in settings.py, i don't see the point in exposing basic configuration in the chart YAML if I have to dabble in Python anyways :|

Wheteher you agree with the statement above, the fact is settings.py template handles the password inconsistently and it should be fixed.