Apache Superset

Deploy Apache Superset on Kubernetes — a modern business intelligence platform with 60+ database connectors, interactive dashboards, SQL editor, and chart builder. The chart deploys three independent components: a Gunicorn web server, Celery workers for async queries, and a Celery Beat scheduler for cache warming and alerts.

Key Features

• Three-component architecture — web (Gunicorn), worker (Celery), beat (Celery Beat)
• Init Job — runs superset db upgrade and admin creation on every install/upgrade
• Bundled PostgreSQL and Redis — both enabled by default
• superset_config.py override — arbitrary Python config via superset.extraConfig
• Additional Python packages — optional database drivers shared by web, worker, beat, and init
• Configurable listener — web.containerPort changes the real Gunicorn bind port
• Secure defaults — non-root, read-only containers with seccomp and dropped capabilities
• NetworkPolicy — web-listener ingress isolation with configurable peers and egress
• pg_dump backup — scheduled PostgreSQL S3 backup CronJob

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install superset helmforge/superset -f values.yaml

OCI registry:

helm install superset oci://ghcr.io/helmforgedev/helm/superset -f values.yaml

Upgrading from Superset 4

Review the upstream Superset 5 update notes and Superset 6 update notes before upgrading production.

Additional Database Drivers

Use superset.extraPythonPackages for development and simpler deployments that need optional Python database drivers. Entries accept package names with optional version constraints and are installed consistently in the web, worker, beat, and init processes. Pin a version that you have tested:

superset:
  extraPythonPackages:
    - clickhouse-connect==0.13.0

For Superset 6.1.0, clickhouse-connect>=0.13.0 is the recommended ClickHouse driver. Configure the database with a clickhousedb://user:password@host:port/database SQLAlchemy URI.

FROM apache/superset:6.1.0

USER root

RUN . /app/.venv/bin/activate && \
    uv pip install psycopg2-binary redis "clickhouse-connect==0.13.0"

USER superset

After publishing the image under an immutable tag, disable runtime package installation:

image:
  repository: registry.example.com/superset
  tag: 6.1.0-clickhouse-0.13.0

superset:
  installPythonPackages: false

The custom image must contain psycopg2-binary, redis, and every configured extra package.

Deployment Examples

# values.yaml — Superset with bundled PostgreSQL + Redis (with persistence overrides)
superset:
  adminUsername: admin
  adminEmail: [email protected]
  existingSecret: superset-secrets
  existingSecretPasswordKey: admin-password
  existingSecretSecretKeyKey: secret-key # Flask SECRET_KEY

postgresql:
  enabled: true
  auth:
    database: superset
    username: superset
    password: 'strong-db-password'
  standalone:
    persistence:
      storageClass: fast-storage
      size: 20Gi

redis:
  enabled: true
  auth:
    password: 'strong-redis-password'
  standalone:
    persistence:
      storageClass: fast-storage
      size: 8Gi

ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: superset.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: superset-tls
      hosts:
        - superset.example.com

# values.yaml — Superset with scaled web, workers, and beat scheduler
superset:
  existingSecret: superset-secrets

web:
  replicaCount: 2 # web server pods
  workers: 4 # Gunicorn worker processes per web pod (NOT Celery workers)
  timeout: 120

worker:
  enabled: true
  replicaCount: 3 # Celery worker pods
  concurrency: 4 # simultaneous Celery tasks per worker pod

beat:
  enabled: true # Celery Beat: cache warming, alerts, reports

postgresql:
  enabled: true
  auth:
    password: 'strong-db-password'

redis:
  enabled: true
  auth:
    password: 'strong-redis-password'

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: superset.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Superset with external PostgreSQL and Redis
superset:
  existingSecret: superset-secrets

postgresql:
  enabled: false

redis:
  enabled: false

database:
  mode: external
  external:
    host: postgres.database.svc.cluster.local
    port: 5432
    name: superset
    username: superset
    existingSecret: superset-db-credentials
    existingSecretPasswordKey: password
    sslMode: verify-full

redisConfig:
  mode: external
  external:
    host: redis.cache.svc.cluster.local
    port: 6379
    db: 0
    tls: true
    existingSecret: superset-redis-credentials
    existingSecretPasswordKey: password

backup:
  enabled: true
  schedule: '0 3 * * *'
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: superset-backups
    existingSecret: superset-s3-credentials

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: superset.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Superset with OIDC/OAuth2 via superset.extraConfig
superset:
  existingSecret: superset-secrets
  extraConfig: |
    from flask_appbuilder.security.manager import AUTH_OAUTH
    AUTH_TYPE = AUTH_OAUTH
    OAUTH_PROVIDERS = [
      {
        "name": "keycloak",
        "token_key": "access_token",
        "icon": "fa-key",
        "remote_app": {
          "client_id": "superset",
          "client_secret": "my-client-secret",
          "server_metadata_url": "https://auth.example.com/realms/myrealm/.well-known/openid-configuration",
          "client_kwargs": {"scope": "openid email profile"},
          "redirect_uri": "https://superset.example.com/oauth-authorized/keycloak",
        },
      }
    ]
    AUTH_USER_REGISTRATION = True
    AUTH_USER_REGISTRATION_ROLE = "Gamma"

postgresql:
  enabled: true
  auth:
    password: 'strong-db-password'

redis:
  enabled: true
  auth:
    password: 'strong-redis-password'

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: superset.example.com
      paths:
        - path: /
          pathType: Prefix

Runtime Security

Superset containers run as UID/GID 1000 with a read-only root filesystem, RuntimeDefault seccomp, no privilege escalation, and all Linux capabilities dropped. EmptyDir volumes provide the required writable home and /tmp paths. The initialization and backup Jobs do not receive Kubernetes API tokens. Application pods receive a namespaced token only while init.enabled is true, because their wait container reads the revisioned initialization Job.

NetworkPolicy is enabled by default. It permits ingress only on web.containerPort and allows egress. Restrict networkPolicy.ingressFrom to the ingress-controller namespace and replace the egress rules only after including DNS, PostgreSQL, Redis, package-index access when runtime installs are enabled, and every data source queried by Superset.

Connection URLs are built inside superset_config.py with URL-encoded Secret values. Passwords are never stored in the ConfigMap. Treat superset.extraConfig as trusted Python code.

Configuration Reference

Image

Superset Application

Web Server

Celery Worker

Celery Beat

Init Job

Database

The bundled PostgreSQL runs in standalone mode. Its PVC is configured under postgresql.standalone.persistence; leave storageClass empty to use the cluster’s default StorageClass.

Redis

The bundled Redis also runs in standalone mode. Its PVC is configured under redis.standalone.persistence; leave storageClass empty to use the cluster’s default StorageClass.

Service and Ingress

Security Context and ServiceAccount

Backup

Backup runs pg_dump on PostgreSQL. No backup for Redis data.

More Information

• Apache Superset Official Documentation
• Apache Superset GitHub Repository
• HelmForge Superset Chart Source