fix(superset): fix SQL Lab migration error

superset/README.md

@@ -332,6 +332,35 @@ Expected packages:
 - Test query in SQL Lab first
 - Check Superset logs for errors
 
+### "Unable to migrate query editor state to backend" Error
+
+**Symptom**: Repeated error message in SQL Lab:
+
+```plain
+Unable to migrate query editor state to backend. Superset will retry later.
+Please contact your administrator if this problem persists.
+```
+
+**Root Cause**: Known Apache Superset bug ([#30351](https://github.com/apache/superset/issues/30351), [#33423](https://github.com/apache/superset/issues/33423)) where `/tabstateview/` endpoint returns HTTP 400 errors. Multiple underlying causes:
+
+- Missing `dbId` in query editor state (KeyError)
+- Foreign key constraint violations in `tab_state` table
+- Missing PostgreSQL development tools in container images
+
+**Solution**: Disable SQL Lab backend persistence in `configOverrides`:
+
+```python
+# Disable SQL Lab backend persistence to avoid tab state migration errors
+SQLLAB_BACKEND_PERSISTENCE = False
+```
+
+**Impact**:
+
+- Query editor state stored in browser local storage only (not in database)
+- Browser cache clear may lose unsaved queries
+- Use "Saved Queries" feature for important queries
+- This configuration is already applied in this deployment
+
 ## References
 
 - [Apache Superset Documentation](https://superset.apache.org/docs/)

superset/justfile

@@ -257,3 +257,48 @@ uninstall delete-db='true':
         just vault::delete superset/config || true
         just vault::delete superset/oauth || true
     fi
+
+# Restore Superset datasets, charts, and dashboards from backup
+restore backup_file charts_only='false':
+    #!/bin/bash
+    set -euo pipefail
+
+    BACKUP_FILE="{{ backup_file }}"
+    CHARTS_ONLY="{{ charts_only }}"
+
+    # Convert to absolute path if relative
+    if [[ ! "${BACKUP_FILE}" = /* ]]; then
+        BACKUP_FILE="../${BACKUP_FILE}"
+    fi
+
+    if [ ! -f "${BACKUP_FILE}" ]; then
+        echo "Error: Backup file '${BACKUP_FILE}' not found"
+        exit 1
+    fi
+
+    POD_NAME=$(kubectl get pods -n postgres -l cnpg.io/cluster=postgres-cluster \
+        -o jsonpath='{.items[0].metadata.name}')
+
+    if [ -z "${POD_NAME}" ]; then
+        echo "Error: PostgreSQL pod not found"
+        exit 1
+    fi
+
+    echo "Uploading backup file to PostgreSQL pod..."
+    kubectl cp "${BACKUP_FILE}" postgres/${POD_NAME}:/var/lib/postgresql/data/superset-restore.sql
+
+    echo "Running restore script..."
+    if [ "${CHARTS_ONLY}" = "true" ]; then
+        bash restore-datasets-charts.sh --charts-only
+    else
+        bash restore-datasets-charts.sh
+    fi
+
+    echo ""
+    echo "Restarting Superset pods to clear cache..."
+    kubectl delete pod -n ${SUPERSET_NAMESPACE} -l app=superset --wait=false || true
+    kubectl delete pod -n ${SUPERSET_NAMESPACE} -l app.kubernetes.io/component=worker --wait=false || true
+
+    echo ""
+    echo "Restore completed successfully!"
+    echo "Please wait for Superset pods to restart."

superset/restore-datasets-charts.sh

@@ -0,0 +1,113 @@
+#!/bin/bash
+# Restore only Superset datasets, charts, and dashboards from backup
+#
+# Usage:
+#   ./restore-datasets-charts.sh [--charts-only]
+#
+# Options:
+#   --charts-only    Restore only charts and datasets (skip dashboards)
+
+set -euo pipefail
+
+NAMESPACE="superset"
+POSTGRES_NAMESPACE="postgres"
+BACKUP_FILE="${BACKUP_FILE:-/var/lib/postgresql/data/superset-restore.sql}"
+DB_NAME="superset"
+DB_USER="postgres"  # Use superuser for restore
+
+# Get PostgreSQL pod name
+POD_NAME=$(kubectl get pods -n postgres -l cnpg.io/cluster=postgres-cluster \
+    -o jsonpath='{.items[0].metadata.name}')
+
+# Get database password from secret
+DB_PASSWORD=$(kubectl get secret -n postgres postgres-cluster-superuser -o jsonpath='{.data.password}' | base64 -d)
+
+# Core tables for datasets and charts
+CORE_TABLES=(
+    "tables"           # Dataset metadata
+    "table_columns"    # Dataset columns
+    "sql_metrics"      # Dataset metrics
+    "slices"           # Chart definitions
+)
+
+# Dashboard tables (restored by default)
+DASHBOARD_TABLES=(
+    "dashboards"           # Dashboard metadata
+    "dashboard_slices"     # Chart-Dashboard relationships
+    "dashboard_user"       # Dashboard-User relationships
+    "dashboard_roles"      # Dashboard-Role relationships
+    "embedded_dashboards"  # Embedded dashboard configurations
+)
+
+# Parse command line arguments
+RESTORE_DASHBOARDS=true  # Default: restore dashboards
+for arg in "$@"; do
+    case $arg in
+        --charts-only)
+            RESTORE_DASHBOARDS=false
+            shift
+            ;;
+        *)
+            echo "Unknown option: $arg"
+            echo "Usage: $0 [--charts-only]"
+            exit 1
+            ;;
+    esac
+done
+
+# Build table list
+TABLES=("${CORE_TABLES[@]}")
+if [ "$RESTORE_DASHBOARDS" = true ]; then
+    TABLES+=("${DASHBOARD_TABLES[@]}")
+fi
+
+echo "Restoring the following tables in database '$DB_NAME':"
+for table in "${TABLES[@]}"; do
+    echo "  - $table"
+done
+echo ""
+
+# Restore each table
+for table in "${TABLES[@]}"; do
+    echo "Restoring table: $table"
+
+    # First, truncate the existing table (with CASCADE to handle foreign keys)
+    kubectl exec -n "$POSTGRES_NAMESPACE" "$POD_NAME" -- \
+        bash -c "PGPASSWORD='$DB_PASSWORD' psql -h localhost -U $DB_USER -d $DB_NAME -c 'TRUNCATE TABLE $table CASCADE;'" || {
+        echo "Warning: Failed to truncate $table (table might not exist yet)"
+    }
+
+    # Disable foreign key constraints temporarily
+    kubectl exec -n "$POSTGRES_NAMESPACE" "$POD_NAME" -- \
+        bash -c "PGPASSWORD='$DB_PASSWORD' psql -h localhost -U $DB_USER -d $DB_NAME -c 'ALTER TABLE $table DISABLE TRIGGER ALL;'" || {
+        echo "Warning: Failed to disable triggers on $table"
+    }
+
+    # Restore the table data (without --disable-triggers as we're managing it manually)
+    kubectl exec -n "$POSTGRES_NAMESPACE" "$POD_NAME" -- \
+        bash -c "PGPASSWORD='$DB_PASSWORD' pg_restore -h localhost -U $DB_USER -d $DB_NAME \
+        --table=$table \
+        --data-only \
+        $BACKUP_FILE" || {
+        echo "Error: Failed to restore $table"
+        exit 1
+    }
+
+    # Re-enable foreign key constraints
+    kubectl exec -n "$POSTGRES_NAMESPACE" "$POD_NAME" -- \
+        bash -c "PGPASSWORD='$DB_PASSWORD' psql -h localhost -U $DB_USER -d $DB_NAME -c 'ALTER TABLE $table ENABLE TRIGGER ALL;'" || {
+        echo "Warning: Failed to enable triggers on $table"
+    }
+
+    echo "  ✓ Successfully restored $table"
+done
+
+echo ""
+echo "Restoration completed successfully!"
+echo ""
+echo "Restored tables:"
+for table in "${TABLES[@]}"; do
+    count=$(kubectl exec -n "$POSTGRES_NAMESPACE" "$POD_NAME" -- \
+        bash -c "PGPASSWORD='$DB_PASSWORD' psql -h localhost -U $DB_USER -d $DB_NAME -tAc 'SELECT COUNT(*) FROM $table;'")
+    echo "  - $table: $count rows"
+done

superset/superset-values.gomplate.yaml

@@ -23,6 +23,7 @@ ingress:
 # Init job settings (disable to use external database initialization)
 init:
   enabled: true
+  createAdmin: false
   loadExamples: false
 
 # Superset node configuration
@@ -160,6 +161,9 @@ configOverrides:
     ENABLE_PROXY_FIX = True
     PREFERRED_URL_SCHEME = "https"
 
+    # Disable SQL Lab backend persistence to avoid tab state migration errors
+    SQLLAB_BACKEND_PERSISTENCE = False
+
 # Bootstrap script for initial setup
 # Note: Superset 5.0+ uses 'uv' instead of 'pip' for package management
 bootstrapScript: |