Superset Configuration

ChartVersion3.0.1TypeapplicationAppVersion5.0.0

CompatibilityKubernetes1.32+OpenShift4.19+Rancher2.10.x+

What is Apache Superset?

Apache Superset is the data visualization layer of TDP.
It is where analysts and managers create dashboards, explore tables, and generate charts without having to write SQL directly — although SQL is also supported for advanced users.

In TDP Kubernetes, Superset connects to Trino and ClickHouse as data sources.
Trino provides federated access to all data in the data lake; ClickHouse provides high-speed analytical queries.
Superset is the frontend that makes this data accessible to everyone in the organization.

To find out more

See Apache Superset — Concepts for a complete overview of the tool, its architecture, and operation.

Helm value structure

Apache Superset values must be placed under the tdp-superset: key (the upstream subchart alias in Chart.yaml). TDP platform-specific settings go under TDP-Settings:.

TDP-Settings:
  externalDatabase:
    enabled: false

tdp-superset:
  supersetNode:
    replicaCount: 1

Architecture

The tdp-superset chart deploys the following components:

Component	Role
Superset Web	Web interface and API (Flask/Python)
Celery Workers	Process asynchronous queries and caches in the background
Celery Beat	Periodic task scheduler (dashboard refresh, alerts)
Redis (built-in)	Message broker for Celery and results cache
PostgreSQL (internal or external)	Superset metadata database (dashboards, users, datasources)
TDP auxiliary Jobs	External database bootstrap and Secret cleanup when enabled

Superset does not store analysis data — it only stores dashboard, chart, connection, and user definitions.
For metadata, the chart can use the embedded PostgreSQL for simple installations or an external PostgreSQL when the environment requires a shared database.

Overview

Property	Value
Chart	tdp-superset
Superset Version	5.0.0
Chart Version	3.0.1
Registry	oci://registry.tecnisys.com.br/tdp/charts/tdp-superset

Related pages

• Security — Superset: SUPERSET_SECRET_KEY, credentials, LDAP, and best practices.
• Integrations — Superset: Trino/ClickHouse datasource import.
• External exposure — Superset: Ingress configuration and duplicate resource precautions.

Prerequisites

Before installing or customizing the tdp-superset chart, confirm:

• Kubernetes 1.32+, Red Hat OpenShift 4.19+, or Rancher Manager 2.10.x+.
• Helm 3.2.0+.
• A StorageClass available for persistent volumes, especially when using the embedded PostgreSQL.
• Tecnisys OCI registry reachable from the installation environment.
• A strong SUPERSET_SECRET_KEY defined securely.
• If using external PostgreSQL: an instance reachable from the cluster and the administrative Secret expected by the chart.
• If using datasource auto-import: Trino/ClickHouse and their credentials reachable during initialization.

Installation

Installation

Example

helm install <RELEASE_NAME> oci://registry.tecnisys.com.br/tdp/charts/tdp-superset -n <NAMESPACE> --create-namespace --timeout 10m

Example:

helm upgrade <RELEASE_NAME> oci://registry.tecnisys.com.br/tdp/charts/tdp-superset --namespace <NAMESPACE> --values values.yaml

Before the first installation, decide where Superset will store its metadata.
Use the embedded PostgreSQL for a simple initial installation, or configure external PostgreSQL with TDP-Settings.externalDatabase when the environment already has a shared database.
Set SUPERSET_SECRET_KEY before installation — it cannot be changed without planning after the first deploy.

Main parameters

Main parameters

Parameter	Description	Chart default
tdp-superset.enabled	Enable Superset	true
tdp-superset.fullnameOverride	Resource base name	tdp-superset
tdp-superset.image.repository	TDP Superset image with drivers and dependencies	TDP Superset image
tdp-superset.extraSecretEnv.SUPERSET_SECRET_KEY	Superset secret key (required)	placeholder
global.compatibility.openshift.adaptSecurityContext	Automatic OpenShift adaptation	force
supersetPostgresqlPassword	Superset DB user password (Secret managed by chart)	""
TDP-Settings.externalDatabase.enabled	Enable bootstrap job db-create-job	false
TDP-Settings.externalDatabase.externalSecret.releaseName	PostgreSQL admin Secret name	tdp-postgresql
TDP-Settings.gateway.ingress.enabled	Render TDP Ingress	false
TDP-Settings.gateway.gatewayApi.enabled	Render Gateway API HTTPRoute	false
tdp-superset.postgresqlSecrets.name	Superset DB password Secret name	""
tdp-superset.postgresqlSecrets.passwordKey	Password key within the Secret	superset-postgresql-password
tdp-superset.supersetNode.connections.db_host	Metadata PostgreSQL host	<SERVICE_NAME>.<NAMESPACE>.svc.cluster.local
tdp-superset.service.port	Web/API interface port	8088
tdp-superset.datasources.autoImport.enabled	Datasource auto-import on init	false
tdp-superset.datasources.clickhouse.enabled	ClickHouse block	false
tdp-superset.datasources.trino.enabled	Trino block	false

OpenShift

In OpenShift environments, the chart automatically applies global.compatibility.openshift.adaptSecurityContext: force and uses tdp-superset.postgresql.postgresqlDataDir: /bitnami/postgresql/data/pgdata to avoid permission errors at the root of the embedded PostgreSQL volume.
No additional configuration is required for basic compatibility.

Configuration details

Metadata PostgreSQL

With TDP-Settings.externalDatabase.enabled=false (default), the chart uses the embedded PostgreSQL subchart.
With enabled=true, Superset connects to an external PostgreSQL and tdp-superset.postgresql.enabled must be false.

In that case, the chart creates the database and user via a Helm hook — the db-create-job job — when all of the following are true:

• TDP-Settings.externalDatabase.enabled=true
• tdp-superset.postgresql.enabled=false
• tdp-superset.supersetNode.connections.db_type=postgresql

The job reads the PostgreSQL administrator password from a Secret named <RELEASE_NAME>, key postgres-password, following the TDP standard.
This Secret must exist in the namespace before the upgrade.

tdp-superset:
  postgresql:
    enabled: false
  supersetNode:
    connections:
      db_type: postgresql
      db_host: <POSTGRESQL_SERVICE>.<NAMESPACE>.svc.cluster.local
      db_name: <DATABASE_NAME>
      db_user: <DATABASE_USER>

Datasources: ClickHouse and Trino

Superset needs to know its data sources before analysts can create charts or dashboards.
This configuration — called a datasource — registers the connection with its name, host, port, and credentials in the Superset metadata database.

The chart can perform this registration automatically during the first initialization, through the init job.
Two controls must be enabled for this to work:

• tdp-superset.datasources.autoImport.enabled: true — enables the auto-import mechanism in the init job.
• tdp-superset.datasources.clickhouse.enabled: true and/or tdp-superset.datasources.trino.enabled: true — enables each datasource block individually.

If autoImport.enabled is false (default), Superset starts without any pre-registered datasources.
In that case, the administrator registers connections manually through the interface after the first login.

For detailed configuration examples for each datasource, available parameters, and ordering dependencies, see Integrations — Superset.

Replicas and resources

Superset is composed of processes with distinct roles and independent scaling configurations.
Understanding the role of each one helps to correctly size the environment.

The web node (supersetNode) handles HTTP requests and the Superset API.
Multiple replicas improve availability and distribute concurrent access load.

Celery workers (supersetWorker) execute asynchronous tasks: long-running SQL queries, cache refresh, and alert delivery.
Increase the number of workers when the volume of asynchronous queries is high or a backlog is forming.

Celery Beat (supersetCeleryBeat) is the periodic task scheduler — automatic dashboard refresh and scheduled alerts.
A single instance is sufficient; it is not designed for horizontal scaling.

The embedded Redis is the message broker connecting the web node to Celery workers and storing the results cache.
For larger environments, consider a dedicated external Redis.

requests define the minimum resource guaranteed to the pod; limits define the maximum allowed.
Size workers with requests appropriate for the size of queries that will be processed.

Parameter	Description
tdp-superset.supersetNode.replicas.enabled	Enable multiple replicas for the web node
tdp-superset.supersetNode.replicas.replicaCount	Number of web node replicas
tdp-superset.supersetWorker.replicas.enabled	Enable multiple Celery worker replicas
tdp-superset.supersetWorker.replicas.replicaCount	Number of Celery workers
tdp-superset.supersetCeleryBeat.enabled	Enable Celery Beat scheduler
tdp-superset.resources	Web node resources (requests/limits)
tdp-superset.supersetWorker.resources	Celery worker resources (requests/limits)
tdp-superset.init.resources	Initialization job resources
tdp-superset.redis.enabled	Built-in Redis
tdp-superset.postgresql.postgresqlDataDir	Data directory for the embedded PostgreSQL

Access & Security

Security

Superset security covers the session key, initial admin user, LDAP authentication, and external PostgreSQL Secret.
See Security — Superset for those parameters, group mapping, best practices, and troubleshooting.

External exposure

Ingress and Gateway API are mutually exclusive alternatives controlled by TDP-Settings.gateway.
Keep tdp-superset.ingress.enabled=false when using the TDP Ingress to avoid duplicate Ingress creation by the upstream subchart.

See External exposure — Superset for Ingress configuration and duplicate resource precautions.

Local access

kubectl -n <NAMESPACE> port-forward svc/tdp-superset 8088:8088

Open http://127.0.0.1:8088.
Initial credentials come from the tdp-superset.init block in your values file.
Change them after the first login.

Troubleshooting

Troubleshooting

kubectl -n <NAMESPACE> get pods
kubectl -n <NAMESPACE> get jobs
kubectl -n <NAMESPACE> get events --sort-by=.lastTimestamp

Uninstallation

Uninstallation

helm uninstall <RELEASE_NAME> -n <NAMESPACE>

For the full list of parameters, run helm show values for the chart version you have installed.