fix: consolidate env vars

Author: maltesander

rust/operator-binary/src/controller/build/resource/mod.rs

@@ -174,9 +174,10 @@ pub(crate) fn build_superset_container_builder(
         );
     }
 
-    // SECRET_KEY from auto-generated secret
+    // The Flask `SECRET_KEY` env var is sourced from the auto-generated Secret. Superset requires the
+    // env var name to equal the Secret data key, so both use `INTERNAL_SECRET_SECRET_KEY`.
     superset_cb.add_env_var_from_secret(
-        "SECRET_KEY",
+        INTERNAL_SECRET_SECRET_KEY,
         validated.cluster_config.secret_key_secret_name.clone(),
         INTERNAL_SECRET_SECRET_KEY,
     );

rust/operator-binary/src/crd/authentication.rs

@@ -154,6 +154,10 @@ pub fn default_user_registration() -> bool {
 /// Default Superset role assigned to users on registration.
 pub const DEFAULT_USER_REGISTRATION_ROLE: &str = "Public";
 
+/// The OIDC principal claim Superset enforces for the Keycloak provider, due to the Flask-AppBuilder
+/// implementation (see <https://github.com/dpgaspar/Flask-AppBuilder/blob/6d44e6d581433dcea475764c4bb1270c24bbd6de/flask_appbuilder/security/manager.py#L719>).
+pub const ENFORCED_PRINCIPAL_CLAIM: &str = "preferred_username";
+
 pub fn default_user_registration_role() -> String {
     DEFAULT_USER_REGISTRATION_ROLE.to_string()
 }
@@ -310,15 +314,14 @@ impl SupersetClientAuthenticationDetailsResolved {
             }
         );
 
-        // We have to enforce preferred_username here due to the flask implementation
-        // https://github.com/dpgaspar/Flask-AppBuilder/blob/6d44e6d581433dcea475764c4bb1270c24bbd6de/flask_appbuilder/security/manager.py#L719
+        // We have to enforce `ENFORCED_PRINCIPAL_CLAIM` here due to the Flask-AppBuilder implementation.
         match oidc_provider {
             oidc::v1alpha1::IdentityProviderHint::Keycloak => {
                 ensure!(
-                    &provider.principal_claim == "preferred_username",
+                    provider.principal_claim == ENFORCED_PRINCIPAL_CLAIM,
                     OidcPrincipalClaimNotSupportedSnafu {
                         configured: provider.principal_claim.clone(),
-                        supported: "preferred_username".to_owned(),
+                        supported: ENFORCED_PRINCIPAL_CLAIM.to_owned(),
                         auth_class_name,
                     }
                 );

rust/operator-binary/src/druid_connection_controller/mod.rs

@@ -29,7 +29,10 @@ use strum::{EnumDiscriminants, IntoStaticStr};
 use crate::{
     APP_NAME, OPERATOR_NAME,
     built_info::PKG_VERSION,
-    controller::{CONTAINER_IMAGE_BASE_NAME, build::properties::ConfigFileName},
+    controller::{
+        CONTAINER_IMAGE_BASE_NAME,
+        build::{properties::ConfigFileName, resource::bash_wrapper_command},
+    },
     crd::{
         INTERNAL_SECRET_SECRET_KEY, METADATA_DATABASE_ENV_PREFIX, PYTHONPATH, druidconnection,
         v1alpha1,
@@ -318,6 +321,10 @@ fn build_druid_db_yaml(druid_cluster_name: &str, sqlalchemy_str: &str) -> Result
     ))
 }
 
+/// Name of the env var (and the matching `superset_config.py` setting) holding the metadata
+/// database connection string for the import job.
+const SQLALCHEMY_DATABASE_URI_ENV: &str = "SQLALCHEMY_DATABASE_URI";
+
 /// Builds the import job.  When run it will import the druid connection into the database.
 async fn build_import_job(
     superset_cluster: &v1alpha1::SupersetCluster,
@@ -328,7 +335,9 @@ async fn build_import_job(
 ) -> Result<Job> {
     let mut commands = vec![];
 
-    let config = "import os; SQLALCHEMY_DATABASE_URI = os.path.expandvars(os.environ.get('SQLALCHEMY_DATABASE_URI'))";
+    let config = format!(
+        "import os; {SQLALCHEMY_DATABASE_URI_ENV} = os.path.expandvars(os.environ.get('{SQLALCHEMY_DATABASE_URI_ENV}'))"
+    );
     commands.push(format!("mkdir -p {PYTHONPATH}"));
     commands.push(format!(
         "echo \"{config}\" > {PYTHONPATH}/{config_file}",
@@ -356,10 +365,10 @@ async fn build_import_job(
         .expect("ContainerBuilder not created");
     container_builder
         .image_from_product_image(resolved_product_image)
-        .command(vec!["/bin/bash".to_string()])
-        .args(vec![String::from("-c"), commands.join("; ")])
+        .command(bash_wrapper_command())
+        .args(vec![commands.join("; ")])
         .add_env_var(
-            "SQLALCHEMY_DATABASE_URI",
+            SQLALCHEMY_DATABASE_URI_ENV,
             metadata_database_connection_details.url_template.clone(),
         )
         .add_env_var_from_secret(