Superset Kubernetes Deployment#

Superset is deployed on Kubernetes via the official Helm chart, maintained in helm/superset/ 1. The chart bundles PostgreSQL (via bitnami) and Redis as subchart dependencies and manages all Superset components — web nodes, Celery workers, Celery beat, and init jobs 2.

Quick start:

helm repo add superset https://apache.github.io/superset
helm upgrade --install --values my-values.yaml superset superset/superset

3

Maintainer direction: Project maintainers have indicated that a Superset Kubernetes Operator is the supported long-term path, with the Helm chart described as having limited longevity. 4 5 New deployments should consider the Operator.

Supplying superset_config.py#

Via Helm configOverrides (standard approach)#

The most common approach is to add keyed Python snippets under configOverrides in your values.yaml. The chart concatenates all snippets and mounts the resulting superset_config.py as a Kubernetes Secret at configMountPath (default /app/pythonpath) 6 7.

configOverrides:
  secret: |
    SECRET_KEY = 'YOUR_OWN_RANDOM_GENERATED_SECRET_KEY'
  my_override: |
    ENABLE_PROXY_FIX = True
    FEATURE_FLAGS = {"DYNAMIC_PLUGINS": True}

Snippet values are evaluated as Helm templates, so they can reference values.yaml variables (e.g., {{ .Values.ingress.hosts[0] }}). A complete .py file can be provided via --set-file configOverrides.mykey=my-file.py 8.

Warning: The order in which configOverrides entries are appended is not guaranteed 9. Avoid using multiple overrides that depend on each other's ordering.

Via Custom Docker Image#

For production deployments — especially when using a non-Helm Kubernetes setup or a custom image pipeline — embed superset_config.py directly in the image 10:

FROM apache/superset:latest
USER root
COPY superset_config.py /app/
ENV SUPERSET_CONFIG_PATH=/app/superset_config.py
USER superset

Setting SUPERSET_CONFIG_PATH tells Superset to load the file from that absolute path via importlib, bypassing PYTHONPATH entirely 11. This is the recommended approach when PYTHONPATH manipulation is impractical (e.g., in pex environments or stripped-down images).

Alternatively, place superset_config.py anywhere on PYTHONPATH; Superset will discover and import it as a module if SUPERSET_CONFIG_PATH is not set 11.

Via Kubernetes ConfigMap (manual volume mount)#

The Helm chart's extraConfigs value mounts additional files as a ConfigMap at extraConfigMountPath (/app/configs by default), but this path is not automatically on PYTHONPATH 12 7.

To supply superset_config.py from a ConfigMap, use extraVolumes / extraVolumeMounts to mount it at /app/pythonpath/superset_config.py (the configMountPath), or set SUPERSET_CONFIG_PATH via extraEnv to point to the mount location:

extraVolumes:
  - name: custom-config
    configMap:
      name: my-superset-config
extraVolumeMounts:
  - name: custom-config
    mountPath: /app/pythonpath/superset_config.py
    subPath: superset_config.py
    readOnly: true

13

Note: If you use a custom Docker image that already generates its own superset_config.py during build, do not also rely on Helm configOverrides — the chart-generated Secret will shadow or conflict with the image-baked file unless mount paths are carefully coordinated.

Environment Variables and Secrets#

Sensitive values should not be hardcoded in configOverrides. Use these Helm values to inject them at runtime 14 15:

Read these in superset_config.py with os.environ.get("VAR") or os.getenv("VAR") 16.

The configFromSecret value (default: <release-name>-config) names the Secret that holds the chart-generated superset_config.py; you can point it at a pre-existing Secret you control 17.

Other Key Configuration Concerns#

Security (required for production)#

• Change the default SECRET_KEY (thisISaSECRET_1234) via configOverrides before going to production 18.
• Change the default PostgreSQL password from superset 19.
• Default login is admin/admin 20.

Database Drivers and Bootstrap#

Install extra Python packages (DB drivers, etc.) via bootstrapScript. For production, the official guidance is to build a custom image with drivers pre-installed in CI rather than installing at pod startup 10.

Ingress and Proxy Fix#

When using an ingress controller with TLS termination, enable proxy fix in configOverrides 21:

configOverrides:
  proxy_fix: |
    ENABLE_PROXY_FIX = True

Alerts and Reports#

The Celery worker pod needs a webdriver (e.g., Chrome) for screenshot-based reports. This can be installed at startup via a command override or pre-baked into a custom worker image 22. Enable the scheduler pod with supersetCeleryBeat.enabled: true 23.

Data Source Auto-Import#

Database connection definitions can be declared under extraConfigs as YAML files 12. These are mounted as a ConfigMap at /app/configs and processed during init.

Key Files for Reference#