--- title: Charmhub | Deploy Superset using Charmhub - The Open Operator Collection description: Deploy the latest version of Superset as a Kubernetes Operator on any cloud. url: https://charmhub.io/superset-k8s/configurations --- # Superset [Business Data](https://charmhub.io/publisher/businessdata "View all packages from Business Data") * [Business Data](https://charmhub.io/publisher/businessdata "View all packages from Business Data") Platform: 6/stable 659fc199 ``` juju deploy superset-k8s --channel 6/stable ``` [Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications) * [allow-image-domains](https://charmhub.io/superset-k8s/configurations#allow-image-domains) * [cache-warmup](https://charmhub.io/superset-k8s/configurations#cache-warmup) * [celery-worker-concurrency](https://charmhub.io/superset-k8s/configurations#celery-worker-concurrency) * [charm-function](https://charmhub.io/superset-k8s/configurations#charm-function) * [dashboard-size-limit](https://charmhub.io/superset-k8s/configurations#dashboard-size-limit) * [data-access-request-url](https://charmhub.io/superset-k8s/configurations#data-access-request-url) * [email-subject-prefix](https://charmhub.io/superset-k8s/configurations#email-subject-prefix) * [enable-raise-for-access-patch](https://charmhub.io/superset-k8s/configurations#enable-raise-for-access-patch) * [external-url](https://charmhub.io/superset-k8s/configurations#external-url) * [extra-categorical-color-schemes](https://charmhub.io/superset-k8s/configurations#extra-categorical-color-schemes) * [extra-sequential-color-schemes](https://charmhub.io/superset-k8s/configurations#extra-sequential-color-schemes) * [feature-flags](https://charmhub.io/superset-k8s/configurations#feature-flags) * [global-async-queries-polling-delay](https://charmhub.io/superset-k8s/configurations#global-async-queries-polling-delay) * [gunicorn-timeout](https://charmhub.io/superset-k8s/configurations#gunicorn-timeout) * [html-sanitization](https://charmhub.io/superset-k8s/configurations#html-sanitization) * [html-sanitization-schema-extensions](https://charmhub.io/superset-k8s/configurations#html-sanitization-schema-extensions) * [load-examples](https://charmhub.io/superset-k8s/configurations#load-examples) * [log-retention-days](https://charmhub.io/superset-k8s/configurations#log-retention-days) * [log-retention-enabled](https://charmhub.io/superset-k8s/configurations#log-retention-enabled) * [max-content-length](https://charmhub.io/superset-k8s/configurations#max-content-length) * [max-form-memory-size](https://charmhub.io/superset-k8s/configurations#max-form-memory-size) * [max-form-parts](https://charmhub.io/superset-k8s/configurations#max-form-parts) * [oauth-admin-email](https://charmhub.io/superset-k8s/configurations#oauth-admin-email) * [redis-timeout](https://charmhub.io/superset-k8s/configurations#redis-timeout) * [report-dry-run](https://charmhub.io/superset-k8s/configurations#report-dry-run) * [screenshot-timeout](https://charmhub.io/superset-k8s/configurations#screenshot-timeout) * [self-registration-role](https://charmhub.io/superset-k8s/configurations#self-registration-role) * [sentry-dsn](https://charmhub.io/superset-k8s/configurations#sentry-dsn) * [sentry-environment](https://charmhub.io/superset-k8s/configurations#sentry-environment) * [sentry-redact-params](https://charmhub.io/superset-k8s/configurations#sentry-redact-params) * [sentry-release](https://charmhub.io/superset-k8s/configurations#sentry-release) * [sentry-sample-rate](https://charmhub.io/superset-k8s/configurations#sentry-sample-rate) * [server-alias](https://charmhub.io/superset-k8s/configurations#server-alias) * [server-worker-amount](https://charmhub.io/superset-k8s/configurations#server-worker-amount) * [signing-keys-secret-id](https://charmhub.io/superset-k8s/configurations#signing-keys-secret-id) * [sqlalchemy-max-overflow](https://charmhub.io/superset-k8s/configurations#sqlalchemy-max-overflow) * [sqlalchemy-pool-size](https://charmhub.io/superset-k8s/configurations#sqlalchemy-pool-size) * [sqlalchemy-pool-timeout](https://charmhub.io/superset-k8s/configurations#sqlalchemy-pool-timeout) * [webserver-timeout](https://charmhub.io/superset-k8s/configurations#webserver-timeout) [Learn about configurations >](https://juju.is/docs/juju/configuration#heading--application-configuration) * allow-image-domains | string Comma separated list of domains from which to allow images according to the CSP. Applies to: the UI application, which is what serves the policy. * cache-warmup | boolean Boolean representing if the cache warm-up functionality should be enabled. It adds a daily `cache-warmup` entry to the beat schedule; the warm-up itself is run by the worker. Applies to: the beat application, which holds the schedule. * celery-worker-concurrency | int Number of concurrent Celery worker processes per worker pod. Valid range: 0-128. Zero leaves the Celery default, which is one process per CPU. Applies to: the worker application. * charm-function | string Default: app-gunicorn The Superset function this application fulfills. A complete deployment runs one application of each: 'app-gunicorn' serves the web UI and is the only one that migrates the metadata database, 'worker' executes Celery tasks, and 'beat' schedules them. Allowed options are: 'app-gunicorn', 'worker', 'beat' Applies to: every application. It is what makes them differ. * dashboard-size-limit | int Default: 65535 Integer representing how many characters to allow in a dashboard definition. Applies to: the UI application. * data-access-request-url | string URL users are directed to when they hit a Trino/Ranger permission-denied error while viewing a dashboard, so they can request access to the restricted data. When unset, the message tells users to contact their administrator instead. Applies to: the UI application, which rewrites the error for the browser. * email-subject-prefix | string Default: [Superset] The prefix put in front of the subject line of every alert and report email. The `smtp` interface carries no field for it, so it is set here. Applies to: the worker application, and only when `ALERT_REPORTS` is set. * enable-raise-for-access-patch | boolean Enables the Superset 6.1.0 SQL Lab-to-chart access workaround. This changes Superset's upstream access authorization behavior and is disabled by default. Applies to: the UI application, which authorizes the request. * external-url | string The URL report recipients open from an alert or report email. The worker holds no ingress relation and cannot learn it, so it is not derived from anything and has to be set. Applies to: the worker application, which writes the link into the email. The UI application also reads it, as one of the hosts its `/redirect` page treats as internal, but every link a report email sends there is external by construction. Only takes effect when `ALERT_REPORTS` is set. * extra-categorical-color-schemes | string JSON string representation of EXTRA\_CATEGORICAL\_COLOR\_SCHEMES array. It allows to add custom color schemes to customise dashboards coloring. Example value: '[{"id": "custom\_greyscale", "description": "Clean greyscale palette optimized for high-contrast category differentiation.", "label": "Smooth Greyscale", "colors": ["#333333", "#AEA79F", "#CECAC5", "#DEDBD8", "#666666", "#F2F1F0"]}]' Applies to: the UI application * extra-sequential-color-schemes | string JSON string representation of EXTRA\_SEQUENTIAL\_COLOR\_SCHEMES array. It allows to add custom color schemes to customise dashboards coloring. Example value: '[{"id": "custom\_grey\_sequential", "description": "Smooth greyscale sequential gradient using warm grey brand assets.", "label": "Smooth Grey Sequential", "isLinear": true, "colors": ["#F6F6F5", "#E6E4E2", "#D6D3CF", "#C6C1BB", "#B6AFA8", "#AEA79F"]}]' Applies to: the UI application * feature-flags | string A comma-separated list of feature defined in https://github.com/apache/superset/blob/HEAD/RESOURCES/FEATURE\_FLAGS.md. To disable features enabled by default, precede them with a ! symbol. E.g: ENABLED\_FEATURE,!DISABLED\_FEATURE. Two flags span the applications and only work when set on all three. `ALERT_REPORTS` makes the UI offer alerts and reports, makes the beat scheduler add `reports.scheduler` to its schedule, and makes the worker load the SMTP and screenshot settings it needs to deliver them. It is what turns on every worker option in the report group below: `screenshot-timeout`, `report-dry-run`, `server-alias`, `external-url` and `email-subject-prefix`. It also requires the `smtp` relation to deliver with, so the charm blocks when it is set without one, unless `report-dry-run` says nothing is to be delivered. `GLOBAL_ASYNC_QUERIES` splits query execution between the UI and the worker, which both have to agree that it is enabled. Applies to: every application, and the two flags above must be set on all three to take effect. * global-async-queries-polling-delay | int Default: 500 The timedelay in milliseconds for polling during asynchronous query execution. It only takes effect when the `GLOBAL_ASYNC_QUERIES` feature flag is set on every application. Applies to: the UI application, which serves the delay to the browser. * gunicorn-timeout | int Default: 60 Gunicorn worker timeout in seconds. Valid range: 30-600. Applies to: the UI application. * html-sanitization | boolean Default: True Sanitizes the HTML content used in markdowns to allow its rendering in a safe manner. Disabling this option is not recommended for security reasons Applies to: the UI application, which renders the markdown. * html-sanitization-schema-extensions | string Use this configuration to extend the HTML sanitization schema. Applies to: the UI application, as for `html-sanitization`. * load-examples | boolean Loads example data source with corresponding data sets and charts for testing. The examples are loaded by the one-time initialisation the UI runs, which can add several minutes to a first deployment. Applies to: the UI application, which is the only one that initialises the metadata database. * log-retention-days | int Default: 730 Number of days to retain rows in the `logs` table (user action audit log) before they are pruned by the daily `prune_logs` Celery beat task. Only takes effect if `log-retention-enabled` is true. The beat scheduler puts the value in the task message, so changing it takes effect on the next scheduled run. Applies to: the beat application, which holds the schedule. * log-retention-enabled | boolean Default: True Whether to automatically prune old rows from the `logs` table (user action audit log) via the daily `prune_logs` Celery beat task. Disable if you don't want the `logs` table pruned at all. Applies to: the beat application, which holds the schedule. * max-content-length | int Werkzeug limit for the number of bytes to allow in a request body as measured by the 'Content-Length' header. Applies to: the UI application, which is what receives requests. * max-form-memory-size | int Werkzeug limit for the number of bytes to allow in a single part of a multipart form. Applies to: the UI application, as for `max-content-length`. * max-form-parts | int Werkzeug limit for the number of parts to allow in a multipart form. Applies to: the UI application, as for `max-content-length`. * oauth-admin-email | string Default: admin@superset.com Email(s) to be given an Admin role on initialization. Either a single email or a comma separated list. eg. "example.email@company.com, example.email2@company.com" Applies to: the UI application, which is where users authenticate. * redis-timeout | int Default: 300 The time in seconds cached data will remain valid in Redis. It is the default timeout for every cache backend, including the results and the asynchronous query caches. Applies to: the UI and the worker, which are the applications that read and write the caches. * report-dry-run | boolean When true, render alert and report screenshots but do not deliver email or Slack notifications. Intended for testing the rendering pipeline; leave false in production. Applies to: the worker application, and only when `ALERT_REPORTS` is set. * screenshot-timeout | int Default: 600 Maximum time in seconds to wait for report and alert screenshots to render. The screenshots are taken by the worker, with Playwright. Applies to: the worker application, and only when `ALERT_REPORTS` is set. * self-registration-role | string Default: Public The default role to be provided to users that self-register via OAuth. This role must exist already in Superset and is case sensitive. Applies to: the UI application, which is where users authenticate. Note that every application validates the value against the roles in the metadata database, so a role that does not exist blocks all three. * sentry-dsn | string The unique key for the Sentry project in which to log exceptions. Exception reporting is only turned on when `sentry-dsn`, `sentry-environment` and `sentry-release` are all set. Applies to: every application. Set it on all three to see worker and scheduler exceptions as well as UI ones. * sentry-environment | string The environment to log errors to in Sentry. Applies to: every application. * sentry-redact-params | boolean Indicates whether or not event parameters sent to Sentry should be redacted. Applies to: every application. * sentry-release | string The version of code deployed to an environment. Applies to: every application. * sentry-sample-rate | string Default: 1 A number between 0 and 1 representing what % of errors should be sent to Sentry. ie for 0.25, 25% of errors will be sent to Sentry. Applies to: every application. * server-alias | string Default: superset-k8s The alias the server charm has been deployed with if it differs from the default. It is the hostname the worker loads dashboards from when rendering a report screenshot, so it has to resolve to the UI application. Applies to: the worker application, and only when `ALERT_REPORTS` is set. * server-worker-amount | int Default: 1 Number of Gunicorn worker processes per UI pod. Valid range: 1-32. Applies to: the UI application. * signing-keys-secret-id | string ID of the Juju secret holding the signing keys for this deployment. The secret must contain `secret-key`, used to sign the session cookie and to encrypt the database connection passwords stored in the metadata database, and `async-queries-jwt`, used to sign the asynchronous query channel cookie. It must be granted with `juju grant-secret` to the UI, worker and beat applications of one deployment, which must all name the same secret. Keep `secret-key` stable for the lifetime of a deployment: changing it makes every stored connection password unreadable. Applies to: every application, which must all be given the same secret. * sqlalchemy-max-overflow | int Default: 5 Sets the maximum number of connections that can be created beyond the pool size when the pool is exhausted. Applies to: every application, as for `sqlalchemy-pool-size`. * sqlalchemy-pool-size | int Default: 5 Specifies the maximum number of database connections that can be kept in the connection pool. Applies to: every application. The UI and the worker query the metadata database throughout their run; a beat scheduler only does so while starting up. * sqlalchemy-pool-timeout | int Default: 300 Defines the maximum time (in seconds) a thread is allowed to wait for a connection from the pool. Applies to: every application, as for `sqlalchemy-pool-size`. * webserver-timeout | int Default: 180 The time in seconds the server can maintain a database connection. Applies to: the UI application.