Usage

Authentication

Every user has to authenticate themselves before using Superset. There are multiple options to set up the authentication of users.

Webinterface

The default setting is to manually set up users via the Webinterface.

LDAP

Superset supports authentication of users against an LDAP server. Have a look at the LDAP example and the general Stackable Authentication documentation on how to set it up. In general, it requires you to specify a AuthenticationClass which is used to authenticate the users. In this example we assign all the users the Admin role once they log into Superset.

apiVersion: superset.stackable.tech/v1alpha1
kind: SupersetCluster
metadata:
  name: superset-with-ldap-server-veri-tls
spec:
  version: 1.5.1-stackable0.1.0
  [...]
  authenticationConfig:
    authenticationClass: superset-with-ldap-server-veri-tls-ldap
    userRegistrationRole: Admin

Authorization

Superset has a concept called Roles which allows you to grant user permissions based on roles. Have a look at the Superset documentation on Security.

Webinterface

You can see all the available roles in the Webinterface of Superset. You can view all the available roles in the Webinterface of Superset and can also assign users to these roles.

LDAP

Superset supports assigning roles to users based on their LDAP group membership. This is not supported yet. Currently all the users logging in via LDAP get assigned the same role which you can configure via the attribute authenticationConfig.userRegistrationRole on the SupersetCluster object.

Connecting Apache Druid Clusters

The operator can automatically connect Superset to Apache Druid clusters managed by the Stackable Druid Cluster.

To do so, create a DruidConnection resource:

apiVersion: superset.stackable.tech/v1alpha1
kind: DruidConnection
metadata:
  name: superset-druid-connection
spec:
  superset:
    name: superset
    namespace: default
  druid:
    name: my-druid-cluster
    namespace: default

The name and namespace in spec.superset refer to the Superset cluster that you want to connect. Following our example above, the name is superset.

In spec.druid you specify the name and namespace of your Druid cluster.

The namespace part is optional; if it is omitted it will default to the namespace of the DruidConnection.

The namespace for the Superset and Druid cluster can be omitted, in that case the Operator will assume that they are in the same namespace as the DruidConnection.

Once the database is initialized, the connection will be added to the cluster by the operator. You can see it in the user interface under Data > Databases:

Superset databases showing the connected Druid cluster

Monitoring

The managed Superset instances are automatically configured to export Prometheus metrics. See Monitoring for more details.

Configuration & Environment Overrides

The cluster definition also supports overriding configuration properties and environment variables, either per role or per role group, where the more specific override (role group) has precedence over the less specific one (role).

Overriding certain properties which are set by the operator (such as the STATS_LOGGER) can interfere with the operator and can lead to problems.

Configuration Properties

For a role or role group, at the same level of config, you can specify configOverrides for the superset_config.py. For example, if you want to set the CSV export encoding and the preferred databases adapt the nodes section of the cluster resource like so:

nodes:
  roleGroups:
    default:
      config: {}
      configOverrides:
        superset_config.py:
          CSV_EXPORT: "{'encoding': 'utf-8'}"
          PREFERRED_DATABASES: |-
            [
                'PostgreSQL',
                'Presto',
                'MySQL',
                'SQLite',
                # etc.
            ]

Just as for the config, it is possible to specify this at the role level as well:

nodes:
  configOverrides:
    superset_config.py:
      CSV_EXPORT: "{'encoding': 'utf-8'}"
      PREFERRED_DATABASES: |-
        [
            'PostgreSQL',
            'Presto',
            'MySQL',
            'SQLite',
            # etc.
        ]
  roleGroups:
    default:
      config: {}

All override property values must be strings. They are treated as Python expressions. So care must be taken to not produce an invalid configuration.

For a full list of configuration options we refer to the main config file for Superset.

Environment Variables

In a similar fashion, environment variables can be (over)written. For example per role group:

nodes:
  roleGroups:
    default:
      config: {}
      envOverrides:
        FLASK_ENV: development

or per role:

nodes:
  envOverrides:
    FLASK_ENV: development
  roleGroups:
    default:
      config: {}