apache · lucargir · Jul 5, 2026
@@ -29,7 +29,7 @@ maintainers:
   - name: craig-rueda
     email: craig@craigrueda.com
     url: https://github.com/craig-rueda
-version: 0.19.0 # See [README](https://github.com/apache/superset/blob/master/helm/superset/README.md#versioning) for version details.
+version: 0.20.0 # See [README](https://github.com/apache/superset/blob/master/helm/superset/README.md#versioning) for version details.
 dependencies:
   - name: postgresql
     version: 16.7.27

@@ -23,7 +23,7 @@ NOTE: This file is generated by helm-docs: https://github.com/norwoodj/helm-docs
 
 # superset
 
-![Version: 0.19.0](https://img.shields.io/badge/Version-0.19.0-informational?style=flat-square)
+![Version: 0.20.0](https://img.shields.io/badge/Version-0.20.0-informational?style=flat-square)
 
 Apache Superset is a modern, enterprise-ready business intelligence web application
 
@@ -74,10 +74,42 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 |-----|------|---------|-------------|
 | affinity | object | `{}` |  |
 | bootstrapScript | string | see `values.yaml` | Install additional packages and do any other bootstrap configuration in this script For production clusters it's recommended to build own image with this step done in CI |
+| cache | object | `{"asyncQueries":{"keyPrefix":"qc-","timeout":86400},"cacheDb":1,"cacheUrl":null,"celeryDb":0,"celeryUrl":null,"defaultTimeout":86400,"driver":"","enabled":true,"host":null,"keyPrefix":"superset_","password":null,"port":6379,"resultsBackendKeyPrefix":"superset_results","sentinel":null,"ssl":{"ca_certs":null,"certfile":null,"enabled":false,"keyfile":null,"ssl_cert_reqs":"required"},"user":""}` | Redis cache configuration for Superset Redis is optional but recommended for caching and Celery. If redis.enabled (chart dependency) is true, defaults point to the chart's Redis instance. |
+| cache.asyncQueries | object | `{"keyPrefix":"qc-","timeout":86400}` | Async queries configuration |
+| cache.cacheDb | int | `1` | Redis database number for cache |
+| cache.cacheUrl | string | `nil` | Full Redis cache URL (overrides host/port/user/pass if set) |
+| cache.celeryDb | int | `0` | Redis database number for Celery |
+| cache.celeryUrl | string | `nil` | Full Redis Celery URL (overrides host/port/user/pass if set) |
+| cache.defaultTimeout | int | `86400` | Default cache timeout in seconds |
+| cache.driver | string | `""` | Custom Redis driver (e.g. TLS/managed variants); overrides the redis proto in URLs when set. Ports the legacy supersetNode.connections.redis_driver escape hatch. |
+| cache.enabled | bool | `true` | Enable Redis-based features (cache, Celery). Set to false to disable Redis usage entirely. |
+| cache.host | string | `nil` | Redis host (default: {{ .Release.Name }}-redis-headless) |
+| cache.keyPrefix | string | `"superset_"` | Cache key prefix |
+| cache.password | string | `nil` | Redis password |
+| cache.port | int | `6379` | Redis port |
+| cache.resultsBackendKeyPrefix | string | `"superset_results"` | Results backend key prefix |
+| cache.sentinel | string | `nil` | Redis Sentinel configuration (optional) |
+| cache.ssl | object | `{"ca_certs":null,"certfile":null,"enabled":false,"keyfile":null,"ssl_cert_reqs":"required"}` | Redis SSL configuration |
+| cache.user | string | `""` | Redis user (optional, for Redis ACL) |
+| cluster | object | `{"databaseServiceName":null,"domain":".svc.cluster.local","redisServiceName":null,"websocketServiceName":null}` | Kubernetes cluster configuration Used for constructing service URLs between chart components |
+| cluster.databaseServiceName | string | `nil` | Database service name (default: {{ .Release.Name }}-postgresql) Override if using a different service name for the database |
+| cluster.domain | string | `".svc.cluster.local"` | Kubernetes cluster domain (default: .svc.cluster.local) Override if using a custom cluster domain |
+| cluster.redisServiceName | string | `nil` | Redis service name (default: {{ .Release.Name }}-redis-headless) Override if using a different service name for Redis |
+| cluster.websocketServiceName | string | `nil` | WebSocket service name (default: {{ .Release.Name }}-ws) Override if using a different service name for the WebSocket service |
+| config | object | `{}` | Superset configuration properties Set any configuration property from superset/config.py here See https://github.com/apache/superset/blob/master/superset/config.py for all available options |
 | configFromSecret | string | `"{{ template \"superset.fullname\" . }}-config"` | The name of the secret which we will use to generate a superset_config.py file Note: this secret must have the key superset_config.py in it and can include other files as well |
 | configMountPath | string | `"/app/pythonpath"` |  |
 | configOverrides | object | `{}` | A dictionary of overrides to append at the end of superset_config.py - the name does not matter WARNING: the order is not guaranteed Files can be passed as helm --set-file configOverrides.my-override=my-file.py |
 | configOverridesFiles | object | `{}` | Same as above but the values are files |
+| database | object | `{"driver":"postgresql+psycopg2","host":null,"name":null,"password":null,"port":5432,"ssl":{"enabled":false,"mode":"require"},"uri":null,"user":null}` | Database connection configuration for the Superset metadata database |
+| database.driver | string | `"postgresql+psycopg2"` | Database driver (used when uri is not set) |
+| database.host | string | `nil` | Database host (default: {{ .Release.Name }}-postgresql) |
+| database.name | string | `nil` | Database name (default: superset, resolved via superset.db.name) |
+| database.password | string | `nil` | Database password (default: superset, resolved via superset.db.password) ⚠️ CHANGE THIS for production |
+| database.port | int | `5432` | Database port |
+| database.ssl | object | `{"enabled":false,"mode":"require"}` | Database SSL configuration |
+| database.uri | string | `nil` | Full database URI (overrides host/port/user/pass/name if set) Example: "postgresql+psycopg2://user:pass@host:5432/dbname" |
+| database.user | string | `nil` | Database user (default: superset, resolved via superset.db.user) |
 | envFromSecret | string | `"{{ template \"superset.fullname\" . }}-env"` | The name of the secret which we will use to populate env vars in deployed pods This can be useful for secret keys, etc. |
 | envFromSecrets | list | `[]` | This can be a list of templated strings |
 | extraConfigMountPath | string | `"/app/configs"` |  |
@@ -89,7 +121,9 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 | extraSecrets | object | `{}` | Extra files to be mounted as Secrets on the path specified in `configMountPath` |
 | extraVolumeMounts | list | `[]` |  |
 | extraVolumes | list | `[]` |  |
+| featureFlags | object | `{}` | Feature flags configuration See https://github.com/apache/superset/blob/master/RESOURCES/FEATURE_FLAGS.md |
 | fullnameOverride | string | `nil` | Provide a name to override the full names of resources |
+| globalPodAnnotations | object | `{}` | Global pod annotations to be added to all pods Use this to set annotations that apply to all Superset components Component-specific podAnnotations will be merged with these global annotations |
 | hostAliases | list | `[]` | Custom hostAliases for all superset pods # https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ |
 | image.pullPolicy | string | `"IfNotPresent"` |  |
 | image.repository | string | `"apachesuperset.docker.scarf.sh/apache/superset"` |  |
@@ -116,7 +150,7 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 | init.enabled | bool | `true` |  |
 | init.extraContainers | list | `[]` | Launch additional containers into init job pod |
 | init.initContainers | list | a container waiting for postgres | List of initContainers |
-| init.initscript | string | a script to create admin user and initialize roles | A Superset init script |
+| init.initscript | string | unused; kept for backwards-compatibility only | DEPRECATED: this field is no longer used by the chart. The init script is rendered entirely from the internal `superset.initScript` template (which runs `superset db upgrade`, `superset init`, admin creation, and examples). Any customization placed here is silently ignored. See UPGRADING.md. |
 | init.jobAnnotations."helm.sh/hook" | string | `"post-install,post-upgrade"` |  |
 | init.jobAnnotations."helm.sh/hook-delete-policy" | string | `"before-hook-creation"` |  |
 | init.loadExamples | bool | `false` |  |
@@ -143,6 +177,7 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 | service.type | string | `"ClusterIP"` |  |
 | serviceAccount.annotations | object | `{}` |  |
 | serviceAccount.create | bool | `false` | Create custom service account for Superset. If create: true and serviceAccountName is not provided, `superset.fullname` will be used. |
+| serviceAccount.name | string | `""` | Service account name to use (if not specified, defaults to release name + chart name) |
 | serviceAccountName | string | `nil` | Specify service account name to be used |
 | supersetCeleryBeat.affinity | object | `{}` | Affinity to be added to supersetCeleryBeat deployment |
 | supersetCeleryBeat.command | list | a `celery beat` command | Command |
@@ -214,20 +249,7 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 | supersetNode.autoscaling.minReplicas | int | `1` |  |
 | supersetNode.autoscaling.targetCPUUtilizationPercentage | int | `80` |  |
 | supersetNode.command | list | See `values.yaml` | Startup command |
-| supersetNode.connections.db_host | string | `"{{ .Release.Name }}-postgresql"` |  |
-| supersetNode.connections.db_name | string | `"superset"` |  |
-| supersetNode.connections.db_pass | string | `"superset"` |  |
-| supersetNode.connections.db_port | string | `"5432"` |  |
-| supersetNode.connections.db_type | string | `"postgresql"` | Database type for Superset metadata (Supported types: "postgresql", "mysql") |
-| supersetNode.connections.db_user | string | `"superset"` |  |
-| supersetNode.connections.redis_cache_db | string | `"1"` |  |
-| supersetNode.connections.redis_celery_db | string | `"0"` |  |
-| supersetNode.connections.redis_driver | string | `""` |  |
-| supersetNode.connections.redis_host | string | `"{{ .Release.Name }}-redis-headless"` | Change in case of bringing your own redis and then also set redis.enabled:false |
-| supersetNode.connections.redis_port | string | `"6379"` |  |
-| supersetNode.connections.redis_ssl.enabled | bool | `false` |  |
-| supersetNode.connections.redis_ssl.ssl_cert_reqs | string | `"CERT_NONE"` |  |
-| supersetNode.connections.redis_user | string | `""` |  |
+| supersetNode.connections | object | `{}` |  |
 | supersetNode.containerSecurityContext | object | `{}` |  |
 | supersetNode.deploymentAdditionalPodSpec | object | `{}` | Custom pod spec to be added to supersetNode deployment |
 | supersetNode.deploymentAnnotations | object | `{}` | Annotations to be added to supersetNode deployment |

@@ -0,0 +1,161 @@
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+
+# Upgrading the Superset Helm Chart
+
+## Upgrading to chart 0.20.0
+
+Chart 0.20.0 introduces a structured connection schema. The old keys listed below are **DEPRECATED** — they still work (auto-mapped to the new keys at render time) and a deprecation warning is printed in `helm install`/`helm upgrade` NOTES, but they will be removed in a future release. Migrate as soon as possible.
+
+### 1. Connection schema: `supersetNode.connections.*` → `database.*` / `cache.*`
+
+**Before (deprecated — still honored):**
+
+```yaml
+supersetNode:
+  connections:
+    db_host: "pg-host"
+    db_port: "5432"
+    db_user: "superset"
+    db_pass: "superset"
+    db_name: "superset"
+    redis_host: "redis-host"
+    redis_port: "6379"
+    redis_cache_db: "1"
+    redis_celery_db: "0"
+    redis_driver: "rediss"
+```
+
+**After (new structured keys — recommended):**
+
+```yaml
+database:
+  host: "pg-host"
+  port: 5432
+  user: "superset"
+  password: "superset"
+  name: "superset"
+
+cache:
+  host: "redis-host"
+  port: 6379
+  cacheDb: 1
+  celeryDb: 0
+  driver: "rediss"   # optional: custom Redis driver / TLS variant
+```
+
+Key-by-key mapping summary:
+
+| Old key | New key |
+|---|---|
+| `supersetNode.connections.db_host` | `database.host` |
+| `supersetNode.connections.db_port` | `database.port` |
+| `supersetNode.connections.db_user` | `database.user` |
+| `supersetNode.connections.db_pass` | `database.password` |
+| `supersetNode.connections.db_name` | `database.name` |
+| `supersetNode.connections.redis_host` | `cache.host` |
+| `supersetNode.connections.redis_port` | `cache.port` |
+| `supersetNode.connections.redis_cache_db` | `cache.cacheDb` |
+| `supersetNode.connections.redis_celery_db` | `cache.celeryDb` |
+| `supersetNode.connections.redis_driver` | `cache.driver` |
+
+### 2. Service account: root `serviceAccountName` → `serviceAccount.name`
+
+**Before (deprecated — still honored):**
+
+```yaml
+serviceAccountName: my-sa
+```
+
+**After (new key — recommended):**
+
+```yaml
+serviceAccount:
+  name: my-sa
+```
+
+### 3. Init script: `init.initscript` is deprecated and replaced by the built-in template
+
+> **This is a behavior change.** The chart no longer uses `init.initscript`. The init script is rendered
+> entirely from an internal chart template (`superset.initScript`), which runs the full initialization
+> sequence:
+>
+> 1. `superset db upgrade` — applies all pending database schema migrations
+> 2. `superset init` — initializes roles and permissions
+> 3. Admin user creation (when `init.createAdmin: true`)
+> 4. Example data loading (when `init.loadExamples: true`)
+> 5. Datasource import (when `import_datasources.yaml` is present)
+>
+> A future PR will optionally split the database migration step into a dedicated upgrade Job for
+> zero-downtime deployments. Until that PR lands, migrations run as part of the init Job above.
+
+If you customized `init.initscript` in your `values.yaml`, that customization is silently ignored.
+Move any customizations to `config` or `configOverrides`:
+
+```yaml
+# Move custom Python config here:
+config:
+  MY_SETTING: "value"
+
+configOverrides:
+  my_custom_override: |
+    # Python snippet appended to superset_config.py
+    MY_SETTING = "value"
+```
+
+If your use case cannot be covered by `config` or `configOverrides`, please open an issue so the maintainers
+can evaluate extending the template.
+
+### 4. New top-level sections: `config.*` and `featureFlags.*`
+
+Two new sections provide direct Superset configuration passthrough without needing raw `configOverrides`.
+
+**`config.*` — direct Superset config properties:**
+
+```yaml
+config:
+  SECRET_KEY: "$(SUPERSET_SECRET_KEY)"
+  ROW_LIMIT: 50000
+  WTF_CSRF_ENABLED: true
+  SQLALCHEMY_POOL_SIZE: 10
+```
+
+Each key is injected verbatim into `superset_config.py`. String values are quoted; non-string values
+(integers, booleans) are rendered as-is.
+
+**`featureFlags.*` — feature flag overrides:**
+
+```yaml
+featureFlags:
+  ALERT_REPORTS: true
+  DASHBOARD_RBAC: true
+  ENABLE_TEMPLATE_PROCESSING: false
+```
+
+This is equivalent to setting `FEATURE_FLAGS = {...}` in `superset_config.py`, but is more readable and
+schema-validated.
+
+### 5. `values.schema.json` — early validation
+
+The chart now ships a `values.schema.json` that validates the values you provide. Wrong types (e.g., a string
+where an integer is expected) or unknown keys in structured sections will cause `helm install`/`helm upgrade`
+to fail immediately with a descriptive error instead of producing a broken deployment.
+
+If you get a validation error after upgrading, check that your overridden values match the types documented in
+`values.yaml` and the schema.
@@ -35,3 +35,9 @@
   echo "Visit http://127.0.0.1:8088 to use your application"
   kubectl port-forward service/superset 8088:8088 --namespace {{ .Release.Namespace }}
 {{- end }}
+{{- $warnings := include "superset.deprecationWarnings" . }}
+{{- if trim $warnings }}
+
+⚠️  DEPRECATION WARNINGS
+{{ $warnings }}
+{{- end }}