You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by vi...@apache.org on 2026/05/29 02:57:36 UTC
(superset-kubernetes-operator) branch main updated: docs: pre-0.1.0 release-audit cleanup (versions, RBAC, tags) (#95)
This is an automated email from the ASF dual-hosted git repository.
villebro pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/superset-kubernetes-operator.git
The following commit(s) were added to refs/heads/main by this push:
new 3100ea1 docs: pre-0.1.0 release-audit cleanup (versions, RBAC, tags) (#95)
3100ea1 is described below
commit 3100ea1c58438ec548f5083110aba47dd560636b
Author: Ville Brofeldt <33...@users.noreply.github.com>
AuthorDate: Thu May 28 19:57:31 2026 -0700
docs: pre-0.1.0 release-audit cleanup (versions, RBAC, tags) (#95)
---
config/prometheus/monitor.yaml | 11 ++++++-----
config/samples/superset_v1alpha1_superset_prod.yaml | 2 +-
docs/getting-started.md | 10 ++++++----
docs/index.md | 2 +-
docs/reference/security.md | 5 +++--
docs/user-guide/configuration.md | 4 ++--
docs/user-guide/installation.md | 4 ++--
7 files changed, 21 insertions(+), 17 deletions(-)
diff --git a/config/prometheus/monitor.yaml b/config/prometheus/monitor.yaml
index 4ca6aa0..5435e13 100644
--- a/config/prometheus/monitor.yaml
+++ b/config/prometheus/monitor.yaml
@@ -15,11 +15,12 @@ spec:
scheme: https
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
tlsConfig:
- # TODO(user): The option insecureSkipVerify: true is not recommended for production since it disables
- # certificate verification, exposing the system to potential man-in-the-middle attacks.
- # For production environments, it is recommended to use cert-manager for automatic TLS certificate management.
- # To apply this configuration, enable cert-manager and use the patch located at config/prometheus/servicemonitor_tls_patch.yaml,
- # which securely references the certificate from the 'metrics-server-cert' secret.
+ # Note: insecureSkipVerify: true disables certificate verification,
+ # exposing scrapes to potential man-in-the-middle attacks. It ships
+ # enabled so Prometheus can scrape the manager's self-signed serving
+ # certificate out of the box. For production, enable cert-manager and
+ # apply the patch at config/prometheus/servicemonitor_tls_patch.yaml,
+ # which references the certificate from the 'metrics-server-cert' secret.
insecureSkipVerify: true
selector:
matchLabels:
diff --git a/config/samples/superset_v1alpha1_superset_prod.yaml b/config/samples/superset_v1alpha1_superset_prod.yaml
index 16c91b5..6b12114 100644
--- a/config/samples/superset_v1alpha1_superset_prod.yaml
+++ b/config/samples/superset_v1alpha1_superset_prod.yaml
@@ -29,7 +29,7 @@ metadata:
name: superset
spec:
image:
- tag: "6.0.1"
+ tag: "6.1.0"
secretKeyFrom:
name: superset-secret
key: secret-key
diff --git a/docs/getting-started.md b/docs/getting-started.md
index 6fe6d5b..f0b4554 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -33,12 +33,14 @@ Superset instance using dev mode.
```bash
helm install superset-operator \
oci://ghcr.io/apache/superset-kubernetes-operator/charts/superset-operator \
- --version 0.0.0-dev \
+ --version <version> \
--namespace superset-operator-system \
- --create-namespace \
- --set image.pullPolicy=Always
+ --create-namespace
```
+Replace `<version>` with a published chart version (e.g., `0.1.0`); see
+[Downloads](reference/downloads.md) for published tags.
+
## 2. Deploy Superset
Create a minimal Superset instance in dev mode (inline credentials for simplicity):
@@ -52,7 +54,7 @@ metadata:
spec:
environment: Development
image:
- tag: "6.0.1"
+ tag: "6.1.0"
secretKey: thisIsNotSecure_changeInProduction!
metastore:
uri: postgresql+psycopg2://superset:superset@postgres:5432/superset
diff --git a/docs/index.md b/docs/index.md
index e7f227d..2fae173 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -91,7 +91,7 @@ metadata:
name: my-superset
spec:
image:
- tag: "6.0.1"
+ tag: "6.1.0"
secretKeyFrom:
name: superset-secret
key: secret-key
diff --git a/docs/reference/security.md b/docs/reference/security.md
index db5515f..497031c 100644
--- a/docs/reference/security.md
+++ b/docs/reference/security.md
@@ -269,7 +269,7 @@ across namespaces. Each permission is justified below:
| `serviceaccounts` | CRUD | Creates per-instance ServiceAccount for pod identity |
| `pods` | get, list, watch | Reads Job pods to verify drain progress and component readiness |
| `jobs` | CRUD | Manages deterministic lifecycle task Jobs |
-| `events` | create, patch | Records reconciliation events |
+| `events` | create, patch, update | Records reconciliation events |
| `deployments` | CRUD | Manages component Deployments |
| `horizontalpodautoscalers` | CRUD | Manages HPA for scalable components |
| `poddisruptionbudgets` | CRUD | Manages PDBs for availability |
@@ -277,7 +277,8 @@ across namespaces. Each permission is justified below:
| `httproutes` | CRUD | Optional Gateway API support |
| `servicemonitors` | CRUD | Optional Prometheus integration |
| `tokenreviews`, `subjectaccessreviews` | create | Metrics endpoint auth/authz (controller-runtime secure metrics) |
-| `supersets` + `supersets/status` | get, list, watch, update, patch + status update | Reads `Superset` CRs and updates status |
+| `supersets` | get, list, watch | Reads `Superset` CRs (no write access to the CR spec) |
+| `supersets/status` | get, update, patch | Updates reconciliation status only |
The operator does **not** request:
diff --git a/docs/user-guide/configuration.md b/docs/user-guide/configuration.md
index 534097a..5dc7f67 100644
--- a/docs/user-guide/configuration.md
+++ b/docs/user-guide/configuration.md
@@ -56,7 +56,7 @@ Use `secretKeyFrom` and `metastore.uriFrom` to reference Kubernetes Secrets. The
```yaml
spec:
image:
- tag: "6.0.1"
+ tag: "6.1.0"
secretKeyFrom:
name: superset-secret
key: secret-key
@@ -836,7 +836,7 @@ podTemplate → PodSpec-level
```yaml
spec:
image:
- tag: "6.0.1"
+ tag: "6.1.0"
webServer:
replicas: 2
```
diff --git a/docs/user-guide/installation.md b/docs/user-guide/installation.md
index 5d6f452..fe288f5 100644
--- a/docs/user-guide/installation.md
+++ b/docs/user-guide/installation.md
@@ -156,7 +156,7 @@ metadata:
name: my-superset
spec:
image:
- tag: "6.0.1"
+ tag: "6.1.0"
secretKeyFrom:
name: superset-secrets
@@ -224,7 +224,7 @@ metadata:
name: my-superset
spec:
image:
- tag: "6.0.1"
+ tag: "6.1.0"
secretKeyFrom:
name: superset-secrets