chore(superset): Add support for version 6.0.0 (rc2)

[lfrancke]

Part of https://github.com/stackabletech/docker-images/issues/xxx.

• Add: 6.0.0 (rc2 for now)
• Remove: y.y.y

Tip

Please add the scheduled-for/YY.M.X label, and add to the Stackable Engineering project.

Update tasks

• Update boil-config.toml to reflect the agreed upon versions in the spreadsheet (including the removal of old versions).
• Create a new constraints file (see superset/README.md).
• Create a file: superset/stackable/patches/x.y.z/.gitkeep, add patches if applicable.
• Delete old constraint files and patch directories.
• Update other dependencies if applicable (eg: python, auth_lib, cyclonedx-bom, etc).
• Check other operators (getting_started / kuttl / supported-versions) for usage of the versions. Add the PR(s) to the list below.
• Ensure prerequisites are up to date (required-external-components.adoc).
• Update the version in demos. Add the PR(s) to the list below.

Related Pull Requests

Tip

Delete any items that do not apply so that all applicable items can be checked.
For example, if you add release notes to the documentation repository, you do not need the latter two criteria.

• feat(superset): Add 6.0.0-rc2 #1337
• chore: Add support Superset 6.0.0-rc2 superset-operator#680
• Link to any other operator PRs (getting_started / kuttl)
• Link to demo PR (raise against the main branch)
• Link to the Release Notes PR in the documentation repo (if not a comment below)

Acceptance

Tip

This list should be completed by the assignee(s), once respective PRs have been merged. Once all items have been
checked, the issue can be moved into Development: Done.

• Can build image (either locally, or in CI)
• Kuttl smoke tests passes (either locally, or in CI)
• Release notes added to documentation and linked as a PR above
• Release notes written in a comment below
• Applicable release-note label added to this issue

Testing instructions

# Where x.y.z is the new version added in this PR
boil build superset=x.y.z --strip-architecture --load

kind load docker-image oci.stackable.tech/sdp/superset:x.y.z-stackable0.0.0-dev

# Change directory into the superset-operator repository and update the
# product version in tests/test-definition.yaml
./scripts/run-tests --test-suite smoke-latest # or similar

Please consider updating this template if these instructions are wrong, or
could be made clearer.

[sbernauer]

I suggest to rename it to chore(superset): Add support for version 5.0.0 to better reflect the content (it's out of release cycle)

[NickLarsenNZ]

I suggest to rename it to chore(superset): Add support for version 5.0.0 to better reflect the content (it's out of release cycle)

I'll do so once we decide if we're going v5 or v6.

[NickLarsenNZ]

5.0.0

• https://github.com/apache/superset/releases/tag/5.0.0
  • https://github.com/apache/superset/blob/5.0.0/CHANGELOG/5.0.0.md
  • https://github.com/apache/superset/blob/5.0.0/UPDATING.md
    • I checked both the superset-operator and superset Dockerfile for removed env vars.
    • Can use python 3.11 (3.10 still works)
    • Do we need to worry about UPLOAD_FOLDER changing from /app/static/uploads/ to /static/uploads/ (It doesn't look like we ever did anything for that, but users who override the mount would need to know).
    • "If you are using custom frontend extensions or plugins, you may need to update them to be compatible with React 17."

6.0.0 (rc2)

• https://github.com/apache/superset/releases/tag/6.0.0rc2
  • https://github.com/apache/superset/blob/6.0.0rc2/CHANGELOG/6.0.0.md
  • https://github.com/apache/superset/blob/6.0.0rc2/UPDATING.md
    • Upgraded to FAB (Flask AppBuilder) 5. AUTH_OID has been removed, and needs to be removed from rust/operator-binary/src/config.rs
    • Mapbox -> OpenStreetView as the default (because it doesn't require an API key). Might need some handling around that in case people still want to configure Mapbox (and the secret, via the CRD)
    • "Moves the List Roles FAB view to the frontend and requires FAB_ADD_SECURITY_API to be enabled in the configuration and superset init to be executed."

[NickLarsenNZ]

I managed to build 6.0.0rc2 (untested) after a few Dockerfile changes.
I'm now checking that the builds for the older versions still work with those changes.

Worst case, we can make a second Dockerfile since boil supports that.

[NickLarsenNZ]

I have superset 6.0.0rc2 running now, and can login. The operator needed the following changes to the generated config:

• Remove the import for AUTH_OID (it seems we never used it, so it was likely there for people who loaded a custom config).
• The login page could not be shown until some Recaptcha configs existed (even though they were unused):
  • RECAPTCHA_ENABLED (I had hoped this was enough, but the next was still needed)
  • RECAPTCHA_PUBLIC_KEY (FAB was complaining about this not being set. I had hoped the above key was enough).
  • RECAPTCHA_PRIVATE_KEY (I assumed FAB would complain about this next, so I added it).

I will run the kuttl tests, then demos.

[NickLarsenNZ]

Initial test run failed:

--- FAIL: kuttl (1795.38s)
    --- FAIL: kuttl/harness (0.00s)
        --- PASS: kuttl/harness/druid-connection_superset-6.0.0,oci.stackable.tech_sandbox_nick_superset_6.0.0rc2-stackable0.0.0-dev-amd64_openshift-false (93.87s)
        --- PASS: kuttl/harness/logging_superset-6.0.0,oci.stackable.tech_sandbox_nick_superset_6.0.0rc2-stackable0.0.0-dev-amd64_openshift-false (167.25s)
        --- PASS: kuttl/harness/external-access_superset-6.0.0,oci.stackable.tech_sandbox_nick_superset_6.0.0rc2-stackable0.0.0-dev-amd64_openshift-false (112.08s)
        --- PASS: kuttl/harness/ldap_superset-6.0.0,oci.stackable.tech_sandbox_nick_superset_6.0.0rc2-stackable0.0.0-dev-amd64_ldap-authentication-server-verification-tls_openshift-false (143.13s)
        --- PASS: kuttl/harness/ldap_superset-6.0.0,oci.stackable.tech_sandbox_nick_superset_6.0.0rc2-stackable0.0.0-dev-amd64_ldap-authentication-no-tls_openshift-false (142.83s)
        --- FAIL: kuttl/harness/ldap_superset-6.0.0,oci.stackable.tech_sandbox_nick_superset_6.0.0rc2-stackable0.0.0-dev-amd64_ldap-authentication-insecure-tls_openshift-false (37.27s)
        --- PASS: kuttl/harness/resources_superset-latest-6.0.0,oci.stackable.tech_sandbox_nick_superset_6.0.0rc2-stackable0.0.0-dev-amd64_openshift-false (109.91s)
        --- PASS: kuttl/harness/smoke_superset-6.0.0,oci.stackable.tech_sandbox_nick_superset_6.0.0rc2-stackable0.0.0-dev-amd64_openshift-false (135.18s)
        --- FAIL: kuttl/harness/opa_superset-6.0.0,oci.stackable.tech_sandbox_nick_superset_6.0.0rc2-stackable0.0.0-dev-amd64_opa-latest-1.8.0_openshift-false (553.28s)
        --- PASS: kuttl/harness/oidc_superset-6.0.0,oci.stackable.tech_sandbox_nick_superset_6.0.0rc2-stackable0.0.0-dev-amd64_openshift-false (169.83s)
        --- PASS: kuttl/harness/cluster-operation_superset-latest-6.0.0,oci.stackable.tech_sandbox_nick_superset_6.0.0rc2-stackable0.0.0-dev-amd64_openshift-false (130.73s)
FAIL

I can see we'll need some changes in the opa-authorizer, as there are breaking changes (which are not listed as breaking):

File "/stackable/app/lib64/python3.11/site-packages/opa_authorizer/opa_manager.py", line 60, in __init__
  config = appbuilder.get_app.config
           ^^^^^^^^^^^^^^^^^^
AttributeError: 'AppBuilder' object has no attribute 'get_app'. Did you mean: 'init_app'?

---

The LDAP test passed on the second go.

---

And now the OPA test passes (since 2d73c1d)

--- PASS: kuttl (357.86s)
    --- PASS: kuttl/harness (0.00s)
        --- PASS: kuttl/harness/opa_superset-6.0.0,oci.stackable.tech_sandbox_nick_superset_6.0.0rc2-stackable0.0.0-dev-amd64_opa-latest-1.8.0_openshift-false (357.85s)
PASS