Metabase

Open-source business intelligence and analytics platform. Metabase lets teams build interactive dashboards, run SQL queries, and share insights without writing code. It stores all metadata (dashboards, saved questions, user accounts, data source credentials) in a PostgreSQL database.

Key Features

• Interactive dashboards — drag-and-drop visualization builder, no SQL required
• SQL editor — native query editor with autocomplete and result visualization
• PostgreSQL metadata store — bundled subchart or external database
• Encrypted credential storage — data source passwords encrypted with encryptionSecretKey
• JVM tuning — configurable Java memory options and timezone
• S3 backup — scheduled pg_dump of the Metabase metadata database to S3-compatible storage
• Ingress support — TLS via cert-manager with configurable ingress class
• Gateway API support — optional HTTPRoute for Kubernetes-native traffic routing
• Dual-stack ready Service — optional ipFamilyPolicy and ipFamilies
• External Secrets support — ESO integration for the Metabase encryption key
• Secure runtime defaults — non-root UID 2000, read-only root filesystem, dropped capabilities, and no API token
• Optional traffic and disruption controls — NetworkPolicy and PodDisruptionBudget templates

Architecture

The chart runs one Metabase Deployment behind a named-port Service. Application metadata is stored in either the bundled HelmForge PostgreSQL StatefulSet or an external PostgreSQL service; analytical source databases remain outside the release boundary. The application Secret supplies the stable encryption key, and the optional backup CronJob exports the PostgreSQL metadata database to S3-compatible storage.

The application container runs as UID/GID 2000 with a read-only root filesystem. Bounded emptyDir volumes provide the only writable paths at /plugins, /tmp, and /target.

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install metabase helmforge/metabase

OCI registry:

helm install metabase oci://ghcr.io/helmforgedev/helm/metabase

After deploying, access Metabase:

kubectl port-forward svc/<release>-metabase 3000:80
# Open http://localhost:3000 to complete the setup wizard

Deployment Examples

# values.yaml — Metabase with bundled PostgreSQL subchart (default)
metabase:
  siteUrl: 'https://metabase.example.com'
  encryptionSecretKey: 'a-random-32-char-secret-key-here'
  javaOpts: '-Xms512m -Xmx1g'

postgresql:
  enabled: true
  auth:
    password: 'postgres-password'

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: metabase.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Metabase pointing to an existing PostgreSQL instance
metabase:
  siteUrl: 'https://metabase.example.com'
  encryptionSecretKey: 'a-random-32-char-secret-key-here'

postgresql:
  enabled: false

database:
  external:
    host: postgresql.database.svc
    port: '5432'
    name: metabase
    username: metabase
    password: 'db-password'

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: metabase.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Daily backup of the Metabase PostgreSQL metadata database
metabase:
  siteUrl: 'https://metabase.example.com'
  encryptionSecretKey: 'a-random-32-char-secret-key-here'

postgresql:
  enabled: true
  auth:
    password: 'postgres-password'

backup:
  enabled: true
  schedule: '0 3 * * *'
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: my-metabase-backups
    accessKey: '<set-me>'
    secretKey: '<set-me>'

# values.yaml — Production-grade setup with secrets, resources, and TLS
metabase:
  siteUrl: 'https://metabase.example.com'
  existingSecret: metabase-secret
  existingSecretKey: encryption-secret-key
  javaOpts: '-Xms1g -Xmx2g'
  javaTimezone: America/Sao_Paulo

postgresql:
  enabled: false

database:
  external:
    host: postgresql.production.svc
    port: '5432'
    name: metabase
    username: metabase
    existingSecret: metabase-db-secret
    existingSecretPasswordKey: password

resources:
  requests:
    memory: 1.5Gi
    cpu: 500m
  limits:
    memory: 2.5Gi
    cpu: 2000m

ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: metabase.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: metabase-tls
      hosts:
        - metabase.example.com

Configuration Reference

Core

Image

Air-Gapped and Proxied Registries

The chart uses a wait-for-db init container before starting Metabase. Configure waitForDatabase.image.* when your cluster must pull helper images from an internal registry or proxy.

image:
  repository: registry.example.com/proxy/metabase/metabase
  tag: v0.64.2

waitForDatabase:
  image:
    repository: registry.example.com/proxy/library/busybox
    tag: '1.37'

Metabase Configuration

Database — Embedded Subchart

Database — External

Service

Dual-Stack Service

service:
  ipFamilyPolicy: PreferDualStack
  ipFamilies:
    - IPv4
    - IPv6

Ingress

Gateway API

Set gateway.enabled to render a Kubernetes Gateway API HTTPRoute for Metabase. The chart expects an existing Gateway and does not create shared Gateway infrastructure.

gateway:
  enabled: true
  parentRefs:
    - name: shared-gateway
      namespace: gateway-system
  hostnames:
    - metabase.example.com

The older gatewayAPI block remains supported as a deprecated compatibility alias.

Probes

Metabase has a slow startup — the JVM initialization and database migrations can take 2–3 minutes.

Backup

The backup CronJob runs pg_dump against the Metabase PostgreSQL metadata database and uploads the archive to S3-compatible storage. This protects dashboards, saved questions, users, and data source definitions.

External Secrets

Set externalSecrets.enabled when External Secrets Operator manages the Metabase application secret. The chart requires metabase.existingSecret so ESO is the only writer for the encryption key.

metabase:
  existingSecret: metabase-app-secret
  existingSecretKey: encryption-secret-key

externalSecrets:
  enabled: true
  secretStoreRef:
    name: cluster-secrets
    kind: ClusterSecretStore
  data:
    - secretKey: encryption-secret-key
      remoteRef:
        key: metabase/credentials
        property: encryption-secret-key

Resources and Security

The reserved runtime-plugins volume can be mounted by extraInitContainers to install JDBC drivers without making the application root filesystem writable.

An extraVolumeMounts entry at /plugins, /tmp, or /target replaces the corresponding chart-managed mount. The reserved emptyDir remains declared but unmounted, so its runtimeStorage.*SizeLimit no longer applies to that path. An extraVolumes entry named runtime-plugins, runtime-tmp, or runtime-target replaces the chart-managed volume with that name and remains safe for override mounts that reference the reserved name.

NetworkPolicy and PodDisruptionBudget

networkPolicy.enabled adds ingress isolation. Same-namespace traffic is allowed by default; ingress controllers in other namespaces must be listed in networkPolicy.ingress.extraFrom. Enabling networkPolicy.egress.enabled also requires rules for every analytical database, SMTP server, webhook, and external API. Use database.external.networkPolicyPeers for an external metadata database and networkPolicy.egress.extraEgress for all other destinations.

The optional pdb.enabled template serializes voluntary disruptions. It does not provide high availability for the single default application replica.

Service Account

Scheduling

Extra

Troubleshooting

Upgrade Notes

Metabase v0.64.2 is a patch release with analytics fixes and query optimizations. Back up the application database and preserve the encryption key before upgrading.

Metabase v0.64.1 is the first public maintenance release in the 0.64 line. Back up the Metabase application database, keep the encryption key stable, and review the official Metabase 64 changelog before upgrading. Validate /api/health after rollout; first startup can take several minutes while database migrations run.

The generated application encryption key is reused from the existing Kubernetes Secret during connected Helm upgrades. For GitOps or offline rendering, set metabase.existingSecret to a stable Secret; helm template cannot look up the cluster’s current key. An explicit metabase.encryptionSecretKey takes precedence and must not change after installation.

Metabase 0.64.1 includes the 0.64 feature line and its first maintenance fixes. The existing startup encryption behavior remains relevant: to refuse automatic cleanup of legacy plaintext fields, set MB_DISABLE_LEGACY_STARTUP_ENCRYPTION=true through metabase.extraEnv. The upstream default is false. This option is separate from enabling encryption on an application database that has never been encrypted. The patch also validates LDAP server certificates; verify the trust chain of your LDAP server before upgrading an LDAP-enabled deployment.

Starting with 0.63.16, adding encryption to an existing unencrypted application database requires an explicit migration. Back up the database and key, stop all Metabase instances, and run the upstream enable-encryption JAR command with the same database environment and MB_ENCRYPTION_SECRET_KEY used by the deployment. Restart with that same key. Existing encrypted databases do not need this command. If encryption was already configured and Metabase reports an unencrypted database, investigate and restore a known-good backup; do not automatically re-encrypt it. See Metabase encryption instructions.

For signed database sessions, inject MB_SESSION_SECRET_KEY through metabase.extraEnv using a Kubernetes secretKeyRef. Use a separate stable secret of at least 16 characters. Setting or changing it logs out existing sessions; coordinate activation with users. See the session secret documentation.

More Information

• Metabase Official Website
• Metabase Documentation
• Metabase GitHub Repository
• HelmForge Metabase Chart Source