Need help setting up Superset chart in AWS EKS behind ALB

[SB-MFJ]

Hi all.
I'm trying to set superset up for our org but keep getting a
2025-11-26 17:27:37,642:warning:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped
Followed by nothing loading and an eventual gateway timeout.

i've tried adding some logging into logging.py to figure out what's going wrong to no avail. It just hangs.

This is behind AWS alb running in k8, if that helps narrow it down.

I've tried 5.0.0 and now on 6.0.0r3 with same results

superset 10.17.0.219 - - [26/Nov/2025:17:27:37 +0000] "GET / HTTP/1.1" 302 223 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
superset 2025-11-26 17:27:37,642:DEBUG:root:<flask_login.mixins.AnonymousUserMixin object at 0x7fef2c2757b0>
superset 2025-11-26 17:27:37,642:WARNING:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped
superset 2025-11-26 17:27:37,645:DEBUG:superset.stats_logger:[stats_logger] (incr) welcome
# added debug prints to the classes for the sqlalchemy session and flask global context
superset debug_print of: <flask.g of 'superset.app'>
superset                 user: <flask_login.mixins.AnonymousUserMixin object at 0x7fef2c2757b0>
superset          _login_user: <flask_login.mixins.AnonymousUserMixin object at 0x7fef2c2757b0>
# this at least confirms that I have a db session
superset debug_print of: <sqlalchemy.orm.scoping.scoped_session object at 0x7fef2ede8580>
superset      session_factory: sessionmaker(class_='CustomSignallingSession', db=<SQLA engine=postgresql+psycopg2://db-sa:***@db.myorg.local:5432/uns>, query_cls=<class 'flask_sqlalchemy.BaseQuery'>, bind=None, autoflush=True, autocommit=False, expire_on_commit=True)
superset             registry: <sqlalchemy.util._collections.ScopedRegistry object at 0x7fef2ede8d00>
superset 10.17.0.219 - - [26/Nov/2025:17:27:37 +0000] "GET /superset/welcome/ HTTP/1.1" 302 261 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"

[dosubot[bot]]

Hi @SB-MFJ! I'm Dosu and I’m helping the superset team.

The “LocalProxy is not mapped” warning and the hanging/gateway timeout are usually caused by proxy/session misconfiguration or health check issues when running Superset behind AWS ALB in EKS—not by a bug in Superset itself, especially since you’re on 5.0.0+ where the main LocalProxy fix is present (source).

Here’s a focused checklist to resolve this setup:

1. Superset config:
   In your superset_config.py (or Helm configOverrides), set:

   ENABLE_PROXY_FIX = True
   PROXY_FIX_CONFIG = {"x_proto": 1, "x_host": 1, "x_prefix": 1, "x_port": 0}
   SESSION_COOKIE_SECURE = True  # if using HTTPS
   SESSION_COOKIE_SAMESITE = "None"  # if cross-domain or HTTPS

   Make sure your SECRET_KEY is a strong, random value (not the default), and your SQLALCHEMY_DATABASE_URI is correct (source).

2. Ingress/ALB annotations:
   In your Helm values.yaml under ingress.annotations, include:

   alb.ingress.kubernetes.io/scheme: internet-facing
   alb.ingress.kubernetes.io/target-type: ip
   alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}]'
   alb.ingress.kubernetes.io/healthcheck-path: /health
   alb.ingress.kubernetes.io/healthcheck-port: traffic-port
   alb.ingress.kubernetes.io/healthcheck-protocol: HTTP
   

   Set ingressClassName: alb and ensure the hosts field is a valid DNS name (source).

3. Health checks:
   Superset pods must respond with HTTP 200 on /health at port 8088. Check pod health with:

   kubectl get pods
   kubectl exec <pod> -- curl localhost:8088/health
   

   In AWS, confirm the ALB target group shows healthy targets.

4. Timeouts:
   Set ALB, Nginx, and Kubernetes timeouts higher than Superset’s SUPERSET_WEBSERVER_TIMEOUT (default 60s) to avoid premature disconnects. For long queries, add ingress annotations like:

   nginx.ingress.kubernetes.io/proxy-read-timeout: "120"
   nginx.ingress.kubernetes.io/proxy-send-timeout: "120"
   nginx.ingress.kubernetes.io/proxy-connect-timeout: "120"
   

5. Proxy headers:
   Ensure ALB forwards all X-Forwarded-* headers. Misconfigured headers or session cookies can cause redirect loops, login failures, or the LocalProxy error (source).

6. Debugging:
   If you still see timeouts or login loops, increase logging in Superset and your OAuth provider. Try switching to NGINX ingress as a test—some users have found ALB-specific issues with header forwarding and session stickiness.

If you follow these steps and still see the issue, please share your relevant values.yaml and superset_config.py (with secrets redacted) for more targeted help.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[SB-MFJ]

Configured values (we use terraform):

    "image.repository" = "docker.myorg.io/superset",
    "image.tag" = "latest",
    "image.pullPolicy" = "Always",
    "imagePullSecrets[0].name" = "nexus-pull",
    "service.type" = "NodePort",
    "service.nodePort.http" = "31080",
    "init.adminUser.email" ="[email protected]",
    "init.adminUser.firstname" = "Dev",
    "init.adminUser.lastname" = "Admin",
    "postgresql.enabled" = false,
    "postgresql.primary.persistance.enabled" = false,
    "supersetNode.connections.db_host" = "db.myorg.io", 
    "supersetNode.connections.db_name" = "uns",
    "supersetNode.connections.db_port" = "5432",
    "redis.enabled" = false,
    "supersetNode.connections.redis_cache_db" =	"14",
    "supersetNode.connections.redis_celery_db" = "13",
    "supersetNode.connections.redis_host" = "redis.myorg.org",
    "supersetNode.connections.redis_port" = "6379",
    "supersetNode.connections.redis_user" = "",

    "priorityClassName" = dependency.priority.outputs.name,
    "runAsUser" = "1000",
    "supersetCeleryBeat.enabled" = true,
    # "supersetCeleryFlower.enabled" = true,
    "prometheus.server.global.external_labels.cluster_id" = dependency.k8_cluster.outputs.name,

config overrides:

extraEnv:
      FLASK_DEBUG: "true"
    bootstrapScript: |
      #!/bin/bash
      if [ ! -f ~/bootstrap ]; then echo "Running Superset with uid {{ .Values.runAsUser }}" > ~/bootstrap; fi
    configOverrides:
      feature_flags: |
        import ast
        ENABLE_PROXY_FIX = True
        PROXY_FIX_CONFIG = {"x_proto": 1, "x_host": 1, "x_prefix": 1, "x_port": 0}
        # SESSION_COOKIE_SECURE = True  # if using HTTPS
        FEATURE_FLAGS = {
          "ALERT_REPORTS": True,
          "ALERT_REPORT_SLACK_V2": True,
          # "PLAYWRIGHT_REPORTS_AND_THUMBNAILS": True,
        }
      secret: |
        SECRET_KEY = "${local.superset_secret}"
        SLACK_API_TOKEN = "${local.slack_token}"

dockerfile:

FROM apache/superset:6.0.0rc3

USER root

RUN . /app/.venv/bin/activate && \
    uv pip install \
    # package needed for storing to db
    psycopg2-binary \
    # package needed for using single-sign on authentication
    Authlib \
    # needed for flower workers
    flower \
    # openpyxl to be able to upload Excel files
    openpyxl \
    # Pillow for Alerts & Reports to generate PDFs of dashboards
    Pillow \
    # install Playwright for taking screenshots for Alerts & Reports. This assumes the feature flag PLAYWRIGHT_REPORTS_AND_THUMBNAILS is enabled
    # That feature flag will default to True starting in 6.0.0
    # Playwright works only with Chrome.
    playwright \
    && playwright install-deps \
    && PLAYWRIGHT_BROWSERS_PATH=/usr/local/share/playwright-browsers playwright install chromium

ADD app /app/

USER superset

CMD ["/app/docker/entrypoints/run-server.sh"]

End goal is to use OAuth yes, but for testing I've paired the config down to this to make troubleshooting simpler.
The only thing that changes with OAuth is there is an additional redirect from /welcome to /login before it again ends up hanging in the same way as originally mentioned.

[dosubot[bot]]

Your config is close, but there are a few critical tweaks and checks needed for Superset behind AWS ALB in EKS:

1. SESSION_COOKIE_SECURE and SAMESITE:
   Uncomment and set SESSION_COOKIE_SECURE = True in your configOverrides if you're using HTTPS. Also add SESSION_COOKIE_SAMESITE = "None" if you have cross-domain or HTTPS traffic. This ensures cookies are sent securely and avoids login/session issues behind ALB (source).

2. ALB/Ingress annotations:
   Double-check your ingress annotations. You need:

   alb.ingress.kubernetes.io/scheme: internet-facing
   alb.ingress.kubernetes.io/target-type: ip
   alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}]'
   alb.ingress.kubernetes.io/healthcheck-path: /health
   alb.ingress.kubernetes.io/healthcheck-port: traffic-port
   alb.ingress.kubernetes.io/healthcheck-protocol: HTTP
   

   And make sure the hosts field is a valid DNS name (not empty) (source).

3. Health checks:
   Superset must respond with HTTP 200 on /health at port 8088. Use:

   kubectl exec <pod> -- curl localhost:8088/health
   

   Check that your ALB target group shows healthy targets (source).

4. Proxy headers:
   ALB must forward all X-Forwarded-* headers. Your ENABLE_PROXY_FIX and PROXY_FIX_CONFIG are correct for SSL termination at ALB, but if headers are missing, you'll see redirect loops or session issues (source). Use browser dev tools or add logging to confirm headers are present.

5. Timeouts:
   Set ALB, Nginx, and Kubernetes timeouts higher than Superset’s SUPERSET_WEBSERVER_TIMEOUT (default 60s) to avoid disconnects during login/OAuth (source).

6. OAuth checklist:
   When you enable OAuth, make sure:

   • redirect_uri in Superset and your OAuth provider match exactly (protocol, port, path).
   • AUTH_TYPE = AUTH_OAUTH and OAUTH_PROVIDERS are set in configOverrides.
   • Authlib is installed (your Dockerfile covers this).
   • If you see intermittent login issues, test with NGINX ingress—some users report ALB-specific header/stickiness problems (source).

If you still see hanging or gateway timeouts, focus on ALB health checks and header forwarding. Most issues are due to unhealthy pods, missing headers, or session cookie misconfig (source).

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}