GitHub user dosubot[bot] added a comment to the discussion: Production
deployment issue in
<!-- Answer -->
The root cause is that Superset (and its Helm chart) does not encode special
characters in DB_USER or DB_PASS when building the SQLALCHEMY_DATABASE_URI—they
are injected as-is from your Kubernetes secret or values.yaml. If your password
contains characters like @ or $, they must be percent-encoded at the moment the
URI is constructed, not before.
Here’s the robust pattern:
- Store your raw (unencoded) password in the Kubernetes secret (e.g.,
DB_PASS='JjJ0Fkk@rEP$UlHr').
- In your superset_config.py, use Python’s urllib.parse.quote_plus to encode
DB_USER and DB_PASS when building the URI:
```python
import os
from urllib.parse import quote_plus
DB_USER = os.getenv("DB_USER")
DB_PASS = os.getenv("DB_PASS")
DB_HOST = os.getenv("DB_HOST")
DB_PORT = os.getenv("DB_PORT")
DB_NAME = os.getenv("DB_NAME")
SQLALCHEMY_DATABASE_URI = (
f"postgresql+psycopg2://{quote_plus(DB_USER)}:{quote_plus(DB_PASS)}@{DB_HOST}:{DB_PORT}/{DB_NAME}?sslmode=require"
)
```
- Do NOT encode the password in the secret or values.yaml—let Python handle it
at runtime. If you encode it twice, you’ll get errors like %2540 instead of
%40, which breaks the connection string.
This approach matches how the Helm chart and Superset config expect to receive
secrets and environment variables: raw, and only encoded at the point of URI
construction
([reference](https://github.com/apache/superset/blob/2e9939baf253e607a54722b1996baaf625e72133/helm/superset/templates/_helpers.tpl)).
After this change, redeploy and check logs. If you still see errors, exec into
a pod and run `env | grep DB_PASS` to confirm the variable is set as expected.
If you see a password authentication error, double-check the password in your
secret matches exactly what’s set in Azure.
Let me know if you need a working superset_config.py example or run into any
other issues!
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do?
[Good](https://app.dosu.dev/response-feedback/9959e694-649b-43b4-b7e6-f5c608f3e48d?feedback_type=great_response)
|
[Irrelevant](https://app.dosu.dev/response-feedback/9959e694-649b-43b4-b7e6-f5c608f3e48d?feedback_type=irrelevant_answer)
|
[Incorrect](https://app.dosu.dev/response-feedback/9959e694-649b-43b4-b7e6-f5c608f3e48d?feedback_type=incorrect_sources)
|
[Verbose](https://app.dosu.dev/response-feedback/9959e694-649b-43b4-b7e6-f5c608f3e48d?feedback_type=too_verbose)
|
[Hallucination](https://app.dosu.dev/response-feedback/9959e694-649b-43b4-b7e6-f5c608f3e48d?feedback_type=hallucination)
| [Report
🐛](https://app.dosu.dev/response-feedback/9959e694-649b-43b4-b7e6-f5c608f3e48d?feedback_type=bug_report)
|
[Other](https://app.dosu.dev/response-feedback/9959e694-649b-43b4-b7e6-f5c608f3e48d?feedback_type=other)</sup> [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/33957)
GitHub link:
https://github.com/apache/superset/discussions/33957#discussioncomment-13603910
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
