> For the complete documentation index, see [llms.txt](https://docs.collibra.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.collibra.com/data-quality-self-hosted/connections/authentication/configure-spark-for-a-password-manager.md).

# Configure Spark for a password manager

To enable DQ Jobs to access password manager scripts, follow these steps:

{% stepper %}
{% step %}
Create a kubernetes secret to hold the password manager script. For example:

```
apiVersion: v1
kind: Secret
metadata:
  name: dq-password-manager-script
data:
  file-name.sh: IA==
```

In the example above, content in file-name.sh is base64.
{% endstep %}

{% step %}
Create a kubernetes secret to hold the spark pod templates. For example:

```
apiVersion: v1
kind: Secret
metadata:
  name: dq-spark-pod-templates
data:
  k8s-driver-template.yml: IA==
  k8s-executor-template.yml: IA==
```

In the example above, the keys are base64.

An example of the Spark pod template is below:

```
bash-5.1$ cat k8s-driver-template.yml
apiVersion: v1
Kind: Pod
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
  volumes:
   - name: dq-password-manager-script
     secret:
       secretName: dq-password-manager-script
       defaultMode: 493
  containers:
   - volumeMounts:
      - name: dq-password-manager-script
        mountPath: /tmp/dq-password-manager-script
```

{% endstep %}

{% step %}
Update the values in the Helm script to attach the password manager secret to the DQ Web pod and attach the Spark pod templates to the DQ Agent pod. For example:

```
web:
  extraStorage:
    volumes:
      - name: dq-password-manager-script
        secret:
          secretName: dq-password-manager-script
          defaultMode: 493
    volumeMounts:
      - name: dq-password-manager-script
        mountPath: /tmp/dq-password-manager-script
 
agent:
  extraStorage:
    volumes:
      - name: dq-spark-pod-templates
        secret:
          secretName: dq-spark-pod-templates
          defaultMode: 493
    volumeMounts:
      - name: dq-spark-pod-templates
        mountPath: /opt/owl/dq-spark-pod-templates
```

{% endstep %}

{% step %}
Create a DQ connection which uses the password manager script located at:

```
/tmp/dq-password-manager-script/file-name.sh
```

{% endstep %}

{% step %}
Update the Run command of the DQ Job with the following `conf-` command.

```
-conf spark.kubernetes.executor.podTemplateFile=local:///opt/owl/dq-spark-pod-templates/k8s-executor-template.yml,spark.executorEnv.ALLOWED_LOCAL_PATHS=/tmp/dq-password-manager-script,spark.kubernetes.driver.podTemplateFile=local:///opt/owl/dq-spark-pod-templates/k8s-driver-template.yml,spark.kubernetes.driverEnv.ALLOWED_LOCAL_PATHS=/tmp/dq-password-manager-script
```

{% hint style="success" %}
To set this configuration globally, open the Agent Configuration> Edit Agent page and add this command to the **Free form (Appended)** field. For more information, go to [Set up a DQ agent](/data-quality-self-hosted/installation/agent/set-up-a-dq-agent.md).
{% endhint %}
{% endstep %}
{% endstepper %}