Superset 4.1.1 Migration Causes CrashLoopBackOff Due to Missing flask_cors Module

[suryansh-ksolves]

Bug description

Issue Summary
I attempted to migrate Apache Superset from version 3.1.2 to 4.1.1 in a Kubernetes environment. However, after deploying the new image, both the Superset pod and Worker pod are stuck in a CrashLoopBackOff state.

The logs show the following error:

File "/usr/local/lib/python3.10/site-packages/gunicorn/app/wsgiapp.py", line 58, in load
return self.load_wsgiapp()
File "/usr/local/lib/python3.10/site-packages/gunicorn/app/wsgiapp.py", line 48, in load_wsgiapp
return util.import_app(self.app_uri)
File "/usr/local/lib/python3.10/site-packages/gunicorn/util.py", line 424, in import_app
app = app(*args, **kwargs)
File "/app/superset/app.py", line 40, in create_app
app_initializer.init_app()
File "/app/superset/initialization/init.py", line 483, in init_app
self.configure_middlewares()
File "/app/superset/initialization/init.py", line 585, in configure_middlewares
from flask_cors import CORS
ModuleNotFoundError: No module named 'flask_cors'

Steps to Reproduce
Deploy Superset 4.1.1 using Kubernetes (upgraded from 3.1.2).
Observe that the Superset pod and Worker pod fail to start and enter CrashLoopBackOff.
Check logs, which indicate that flask_cors is missing.
Expected Results
Superset should start successfully after the upgrade without missing dependencies.

Actual Results
Both pods fail to start due to a missing flask_cors module.

Additional Information

Superset Version: 4.1.1
Previous Superset Version: 3.1.2
Deployment Method: Kubernetes
Python Version: 3.10
Error Module: flask_cors missing

Possible Workarounds Tried

I found some references suggesting manually installing flask_cors, but since I am using Kubernetes, I cannot install it manually in the pods.
The issue persists even after rebuilding the image and redeploying.
Request for Help
How can I resolve this issue in a Kubernetes environment? Should flask_cors be explicitly included in the requirements for Superset 4.1.1? How can I ensure it is installed when deploying via Kubernetes?

Screenshots/recordings

Superset version

master / latest-dev

Python version

3.10

Node version

16

Browser

Chrome

Additional context

No response

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot]

A similar issue was previously reported and resolved by installing the flask-cors module, which is an optional dependency necessary for the ENABLE_CORS feature ^[1]. In Superset 4.1.1, flask_cors is listed as a dependency with version 4.0.2 ^[2].

To resolve this issue in a Kubernetes environment, you can modify your Helm chart's values.yaml or dev-values.yaml file to include a bootstrap script that installs the flask-cors module. Here's an example of how you can do this:

bootstrapScript: |
  #!/bin/bash
  set -e
  # Update system packages and install dependencies
  apt update && apt install -y gcc libpq-dev python3-dev pkg-config libmariadb-dev-compat && \
  
  # Install Python dependencies
  /app/.venv/bin/pip install \
    flask-cors==4.0.2 && \

  # Create a bootstrap log file if not already created
  if [ ! -f ~/bootstrap ]; then 
    echo "Running Superset with uid {{ .Values.runAsUser }}" > ~/bootstrap
  fi

This script ensures that the flask-cors module is installed during the deployment process, preventing the ModuleNotFoundError and allowing your Superset pods to start successfully ^[3].

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[mistercrunch]

Looks like using ENABLE_CORS requires installing the additional extra_requires-configured cors, as in pip install .[cors] or pip install apache-superset[cors], and that's not in the lean image anymore.

Potential solutions:

• clarify the dependency as a comment in superset/config.py
• move cors to base python package (I hate to bundle a bunch of things people may not need...)
• add to the lean Docker image (?) Might not subscribe to the idea behind lean...
• combo of 1 and 3 (?)

[mistercrunch]

Here -> #32662, should be sufficient I think