Added Superset Installation scripts

kubernetes/superset/install.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+. ../utils/common.sh
+
+export SANDBOX_HOSTNAME=${SANDBOX_HOSTNAME:-openg2p.sandbox.net}
+export KEYCLOAK_HOSTNAME=${KEYCLOAK_HOSTNAME:-keycloak.$SANDBOX_HOSTNAME}
+export SUPERSET_HOSTNAME=${SUPERSET_HOSTNAME:-superset.$SANDBOX_HOSTNAME}
+export KEYCLOAK_REALM_NAME=${KEYCLOAK_REALM_NAME:-openg2p}
+export SUPERSET_SECRET_KEY=$(generate_random_secret)
+
+helm repo add superset https://apache.github.io/superset
+helm repo update
+
+COPY_UTIL=../utils/copy_cm_func.sh
+NS=superset
+
+echo Create $NS namespace
+kubectl create ns $NS
+
+$COPY_UTIL secret keycloak-client-secrets keycloak $NS
+
+envsubst < values-superset.template.yaml | helm -n $NS upgrade --install superset superset/superset --version 0.11.2 --wait $@ -f -
+
+envsubst < istio-virtualservice.template.yaml | kubectl -n $NS apply -f -

kubernetes/superset/istio-virtualservice.template.yaml

@@ -0,0 +1,19 @@
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: superset
+spec:
+  gateways:
+    - istio-system/all-hosts
+  hosts:
+    - ${SUPERSET_HOSTNAME}
+  http:
+    - route:
+        - destination:
+            host: superset
+            port:
+              number: 8088
+      headers:
+        request:
+          set:
+            x-forwarded-proto: https

kubernetes/superset/values-superset.template.yaml

@@ -0,0 +1,78 @@
+init:
+  createAdmin: false
+
+bootstrapScript: |
+  #!/bin/bash
+  pip install authlib==1.3.0
+
+extraSecretEnv:
+  SUPERSET_SECRET_KEY: ${SUPERSET_SECRET_KEY}
+
+extraEnvRaw:
+  - name: OAUTH_CLIENT_ID
+    value: openg2p-superset-client
+  - name: OAUTH_CLIENT_SECRET
+    valueFrom:
+      secretKeyRef:
+        name: keycloak-client-secrets
+        key: openg2p_superset_client_secret
+
+
+configOverrides:
+  enable_oauth: |
+    # This will make sure the redirect_uri is properly computed, even with SSL offloading
+    ENABLE_PROXY_FIX = True
+
+    from flask_appbuilder.security.manager import AUTH_OAUTH
+    AUTH_TYPE = AUTH_OAUTH
+    OAUTH_PROVIDERS = [
+        {
+            "name": "keycloak",
+            "icon": "fa-key",
+            "token_key": "access_token",
+            "remote_app": {
+                "client_id": os.getenv("OAUTH_CLIENT_ID"),
+                "client_secret": os.getenv("OAUTH_CLIENT_SECRET"),
+                "api_base_url": "http://keycloak.keycloak/realms/${KEYCLOAK_REALM_NAME}/protocol/openid-connect",
+                "client_kwargs": {"scope": "email profile openid"},
+                "access_token_url": "http://keycloak.keycloak/realms/${KEYCLOAK_REALM_NAME}/protocol/openid-connect/token",
+                "jwks_uri": "http://keycloak.keycloak/realms/${KEYCLOAK_REALM_NAME}/protocol/openid-connect/certs",
+                "authorize_url": "https://${KEYCLOAK_HOSTNAME}/realms/${KEYCLOAK_REALM_NAME}/protocol/openid-connect/auth",
+                "request_token_url": None
+            },
+        }
+    ]
+
+    # Map Authlib roles to superset roles
+    AUTH_ROLES_MAPPING = {
+      "superset_Public": ["Public"],
+      "superset_Admin": ["Admin"],
+    }
+
+    AUTH_ROLES_SYNC_AT_LOGIN = True
+
+    # Will allow user self registration, allowing to create Flask users from Authorized User
+    AUTH_USER_REGISTRATION = True
+
+    # The default user self registration role
+    # AUTH_USER_REGISTRATION_ROLE = "Public"
+
+    from superset.security import SupersetSecurityManager
+    class CustomSsoSecurityManager(SupersetSecurityManager):
+      def oauth_user_info(self, provider, response=None):
+          if provider == "keycloak":
+              me = self.appbuilder.sm.oauth_remotes[provider].get(
+                  "openid-connect/userinfo"
+              )
+              me.raise_for_status()
+              data = me.json()
+              return {
+                  "username": data.get("preferred_username", ""),
+                  "first_name": data.get("given_name", ""),
+                  "last_name": data.get("family_name", ""),
+                  "email": data.get("email", ""),
+                  "role_keys": data.get("groups", []),
+              }
+          return {}
+
+    CUSTOM_SECURITY_MANAGER = CustomSsoSecurityManager