Apache Superset

# values.yaml — Superset with bundled PostgreSQL + Redis (defaults)
superset:
  adminUsername: admin
  adminEmail: admin@example.com
  existingSecret: superset-secrets
  existingSecretPasswordKey: admin-password
  existingSecretSecretKeyKey: secret-key # Flask SECRET_KEY

postgresql:
  enabled: true
  auth:
    database: superset
    username: superset
    password: 'strong-db-password'

redis:
  enabled: true
  auth:
    password: 'strong-redis-password'

ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: superset.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: superset-tls
      hosts:
        - superset.example.com

# values.yaml — Superset with scaled web, workers, and beat scheduler
superset:
  existingSecret: superset-secrets

web:
  replicaCount: 2 # web server pods
  workers: 4 # Gunicorn worker processes per web pod (NOT Celery workers)
  timeout: 120

worker:
  enabled: true
  replicaCount: 3 # Celery worker pods
  concurrency: 4 # simultaneous Celery tasks per worker pod

beat:
  enabled: true # Celery Beat: cache warming, alerts, reports

postgresql:
  enabled: true
  auth:
    password: 'strong-db-password'

redis:
  enabled: true
  auth:
    password: 'strong-redis-password'

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: superset.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Superset with external PostgreSQL and Redis
superset:
  existingSecret: superset-secrets

postgresql:
  enabled: false

redis:
  enabled: false

database:
  mode: external
  external:
    host: postgres.database.svc.cluster.local
    port: 5432
    name: superset
    username: superset
    existingSecret: superset-db-credentials
    existingSecretPasswordKey: password

redisConfig:
  mode: external
  external:
    host: redis.cache.svc.cluster.local
    port: 6379
    db: 0
    existingSecret: superset-redis-credentials
    existingSecretPasswordKey: password

backup:
  enabled: true
  schedule: '0 3 * * *'
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: superset-backups
    existingSecret: superset-s3-credentials

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: superset.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Superset with OIDC/OAuth2 via superset.extraConfig
superset:
  existingSecret: superset-secrets
  extraConfig: |
    from flask_appbuilder.security.manager import AUTH_OAUTH
    AUTH_TYPE = AUTH_OAUTH
    OAUTH_PROVIDERS = [
      {
        "name": "keycloak",
        "token_key": "access_token",
        "icon": "fa-key",
        "remote_app": {
          "client_id": "superset",
          "client_secret": "my-client-secret",
          "server_metadata_url": "https://auth.example.com/realms/myrealm/.well-known/openid-configuration",
          "client_kwargs": {"scope": "openid email profile"},
          "redirect_uri": "https://superset.example.com/oauth-authorized/keycloak",
        },
      }
    ]
    AUTH_USER_REGISTRATION = True
    AUTH_USER_REGISTRATION_ROLE = "Gamma"

postgresql:
  enabled: true
  auth:
    password: 'strong-db-password'

redis:
  enabled: true
  auth:
    password: 'strong-redis-password'

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: superset.example.com
      paths:
        - path: /
          pathType: Prefix