> For the complete documentation index, see [llms.txt](https://docs.collibra.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.collibra.com/data-quality-self-hosted/installation/installing-data-quality-observability-self-hosted-on-self-hosted-kubernetes/deploy-on-self-hosted-kubernetes.md).

# Deploy on self-hosted Kubernetes

After you have performed the steps in [Install on self-hosted Kubernetes](/data-quality-self-hosted/installation/installing-data-quality-observability-self-hosted-on-self-hosted-kubernetes/install-on-self-hosted-kubernetes.md), you can begin the deployment of Collibra DQ.

{% hint style="warning" %}
The Helm deployment is unique for each customer and Collibra Support may be limited in their ability to assist with some configurations.
{% endhint %}

{% hint style="warning" %}
Use only the files included in the Helm Chart package for the Data Quality & Observability (self-hosted) version you are deploying. Do not reuse files from a Helm Chart package for a different version. Combining files from different versions can cause deployment issues or failures.
{% endhint %}

## Download Helm Chart files

After you have your Collibra DQ license, you will receive an email from Collibra that includes the Helm Charts as zip files. Unzip the files on a Linux-compatible deployment location.

For background information on how Collibra DQ uses Helm charts, go to [Installing Data Quality & Observability (self-hosted) on self-hosted Kubernetes](/data-quality-self-hosted/installation/installing-data-quality-observability-self-hosted-on-self-hosted-kubernetes.md).

{% hint style="info" %}
The Key Tab feature for Snowflake and Livy is only enabled by default if Kerberos is enabled.
{% endhint %}

The root directory, `dq`, contains the following directories and files:

* `drwxrwxr-x -- templates`. Directory that contains a set of YAML files, including:
  * k8s-enpoint.secret.yaml
  * \_helpers.tpl
  * hadoop-conf.yaml
  * serviceaccount.yaml
  * krb5-conf.yaml
  * rbac.yaml
  * dq-secret.yaml
  * keytab-secret.yaml
* `drwxrwxr-x -- charts`. Directory that contains details for the core containers, including.
  * metastore
  * owl-livy
  * owl-agent
  * owl-web
  * spark-history-server
* `-rw-rw-r-- Chart.yaml`. File that contains the DQ Helm chart meta-information.
* `-rw-rw-r-- values.yaml`. File that contains the DQ configuration values.

You may pass parameters using one of the following methods:

* Using the Helm set commands (recommended).
* Using the `values.yaml` file.

We recommend the Helm set commands method. If you manually edit the `values.yaml` file instead, you must reconfigure it for each release to match the new version. Reusing a `values.yaml` file from a previous release can cause the same deployment issues described above.

{% hint style="info" %}
The Helm set commands take precedence over the `values.yaml` file.
{% endhint %}

## Minimal install settings

This example provided in this section installs the DQ Web, DQ Agent, and DQ Metastore. Collibra DQ is inaccessible until you manually add an Ingress or another type of externally accessible service.

{% hint style="danger" %}
All of the following examples will pull containers directly from the Collibra DQ secured container registry. In most cases, InfoSec policies require that containers are sourced from a private container repository controlled by the local Cloud Ops team. Make sure to to add `--set global.image.repo=</url/of/private-repo>` so that you use only approved containers.
{% endhint %}

{% hint style="info" %}
The DQ Metastore container must start first as the other containers use it to write data. On your initial deployment, the other containers might start before the metastore and fail.
{% endhint %}

```
helm upgrade --install --namespace <namespace> \
--set global.version.dq=<cdq-version> \
--set global.version.spark=<cdq-spark-version> \
--set global.configMap.data.license_key=<cdq-license-key> \
--set global.configMap.data.license_name=<your-license-name> \
--set global.web.admin.email=${email} \
--set global.web.admin.password=${password} \
--set global.web.service.type=ClusterIP \
--set global.image.repo=<pathTolmageRepo> \
<deployment-name> \
/path to the helm chart root folder>
```

<table><thead><tr><th width="152">Value</th><th>Description</th></tr></thead><tbody><tr><td><code>&#x3C;namespace></code></td><td>Enter the namespace that you created for this deployment.</td></tr><tr><td><code>&#x3C;cdq-version></code></td><td>Enter the version from the web image suffix. For example, <strong>2026.02</strong> from the image, <strong>dq-web:2026.02</strong>.</td></tr><tr><td><code>&#x3C;cdq-spark-version></code></td><td>Enter the Spark version from the Spark image suffix. For example, <strong>4.1.0-2026.02</strong> from the image, <strong>spark:4.1.0-2026.02</strong>.</td></tr><tr><td><code>&#x3C;cdq-license-key></code></td><td><p>Enter the license key provided to you by Collibra.</p><div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p>If you do not include the license key in the helm chart, you will not be able to access the product after installation.</p></div></td></tr><tr><td><code>&#x3C;your-license-name></code></td><td><p>Enter the license name provided to you by Collibra.</p><div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p>If you do not include the license name in the helm chart, you will not be able to access the product after installation.</p></div></td></tr><tr><td><code>${email}</code></td><td>Enter the default admin user email associated with the admin account.</td></tr><tr><td><code>${password}</code></td><td><p>Enter the default admin user password for the admin account.</p><p>The password must adhere to the following password policy:</p><ul><li>A minimum of 8 characters.</li><li>A maximum of 72 characters.</li><li>At least one upper-case character.</li><li>At least one numeric character.</li><li>At least one supported special character (<code>!@#%$^&#x26;*?_~</code>).</li><li>Cannot contain the user ID (admin).</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>If a password that does not meet the password policy is entered, the install process proceeds as though the password is accepted, but the admin user becomes locked out. If this occurs, rerun the Helm command with a password that meets the password policy and restart the web pod.</p></div></td></tr><tr><td><code>&#x3C;pathTolmageRepo></code></td><td>This is your private registry key, where the Collibra images are available. When this is not provided, you will pull the images from the Collibra image registry, for which you should create a pull secret with the repo key provided by Collibra. See <a href="/data-quality-self-hosted/installation/installing-data-quality-observability-self-hosted-on-self-hosted-kubernetes/install-on-self-hosted-kubernetes.md">Install on self-hosted Kubernetes </a>for more details.</td></tr><tr><td><code>&#x3C;deployment-name></code></td><td>Any name of your choice for this deployment.</td></tr></tbody></table>

{% hint style="info" %}
If you optionally pass credentials for the Postgres Metastore, ensure that you do not use the `$` symbol in the `global.metastore.pass` variable, as it is an unsupported special character for Postgres Metastore passwords.
{% endhint %}

The number of possible customizations is quite extensive and provides a great deal of flexibility for a wide variety of platforms. However, when deploying on a known platform (including EKS, GKE, and AKS), the number of required inputs is limited. In common cases, run a single CLI command including basic parameters like disable history server, configure the storage bucket for logs, specify the image repository, and so on.

## Including an externally accessible service

The following examples install the Collibra DQ with an externally accessible service.

### Minimal install with an externally accessible service

The following example performs the minimal install and adds a preconfigured NodePort or LoadBalancer service to provide access to the Web.

{% hint style="danger" %}
A LoadBalancer service type requires that the Kubernetes platform is integrated with a Software Defined Network solution. This will generally be true for the Kubernetes services offered by major cloud vendors. Private cloud platforms more commonly use Ingress controllers. Check with the infrastructure team before attempting to use LoadBalancer service type.
{% endhint %}

```
helm upgrade --install --namespace <namespace> \
--set global.version.dq=<cdq-version> \
--set global.version.spark=<cdq-spark-version> \
--set global.configMap.data.license_key=<cdq-license-key> \
--set global.configMap.data.license_name=<your-license-name> \
--set global.web.admin.email=${email} \
--set global.web.admin.password=${password} \
--set global.web.service.type=<NodePort || LoadBalancer> \
<deployment-name> \
/path/to/chart/dq
```

### Install with SSL enabled

The following example performs the install with an externally accessible service, but with SSL enabled.

{% hint style="info" %}
Ensure you have already deployed a keystore containing a key to the target namespace with a secret name that matches the `global.web.tls.key.secretName` argument (*dq-ssl-secret* by default). Also, ensure that the secret's key name matches the `global.web.tls.key.store.name` argument (*dqkeystore.jks* by default).
{% endhint %}

```
helm upgrade --install --namespace <namespace> \
--set global.version.dq=<cdq-version> \
--set global.version.spark=<cdq-spark-version> \
--set global.configMap.data.license_key=<cdq-license-key> \
--set global.configMap.data.license_name=<your-license-name> \
--set global.web.admin.email=${email} \
--set global.web.admin.password=${password} \
--set global.web.service.type=<NodePort || LoadBalancer> \
--set global.web.tls.enabled=true \
--set global.web.tls.key.secretName=dq-ssl-secret \
--set global.web.tls.key.alias=<key-alias> \
--set global.web.tls.key.type=<JKS || PKCS12> \
--set global.web.tls.key.pass=<keystore-pass> \
--set global.web.tls.key.store.name=keystore.jks \ 
<deployment-name> \
/path/to/chart/dq
```

### Install with SAML enabled

The following example performs the install with an externally accessible service and SAML authentication enabled, which includes enabling SSL. For additional information on SAML, go to [Configuring SAML authentication](/data-quality-self-hosted/security-configuration/saml-authentication/configuring-saml-authentication.md).

{% hint style="info" %}
Ensure you have already deployed a keystore containing a key to the target namespace with a secret name that matches the `global.web.tls.key.secretName` argument (*dq-ssl-secret* by default). Also, ensure that the secret's key name matches the `global.web.tls.key.store.name` argument (*dqkeystore.jks* by default).
{% endhint %}

```
helm upgrade --install --namespace <namespace> \
--set global.version.dq=<cdq-version> \
--set global.version.spark=<cdq-spark-version> \
--set global.configMap.data.license_key=<cdq-license-key> \
--set global.configMap.data.license_name=<your-license-name> \
--set global.web.admin.email=${email} \
--set global.web.admin.password=${password} \
--set global.web.service.type=<NodePort || LoadBalancer> \
--set global.web.tls.enabled=true \
--set global.web.tls.key.secretName=dq-ssl-secret \
--set global.web.tls.key.alias=<key-alias> \
--set global.web.tls.key.type=<JKS || PKCS12> \
--set global.web.tls.key.pass=<keystore-pass> \
--set global.web.tls.key.store.name=keystore.jks \ 
--set global.web.security.cors.allowedOrigins=<origin-of-dq-and-IDP-comma-separated> \
--set global.web.security.saml.enabled=true \
--set global.web.security.saml.entityId=CollibraDQ \
--set global.web.security.saml.entityBaseUrl=http://<dq-base-url>:port \
--set global.web.security.saml.tenantPropName=<tenant-attribute-name-saml-assertion> \
--set global.web.security.saml.rolePropName=<role-attribute-name-saml-assertion> \
<deployment-name> \
/path/to/chart/dq
```

Optionally, if you want to use custom JKS for SAML, add the following helm options:

```
--set global.web.security.saml.keyStoreFile=/etc/dqkeystore.jks \
--set global.web.security.saml.keyStorePass=<password-of-jks-file> \
--set global.web.security.saml.keyStoreAlias=<alias-used-for-key> \
```

### Install on OpenShift 4.x with SSL enabled

The following example performs the install with an externally accessible service on an OpenShift project with `RunAsAny` enforced, with SSL enabled.

```
helm upgrade --install --namespace <namespace> \
--set global.version.dq=<cdq-version> \
--set global.version.spark=<cdq-spark-version> \
--set global.configMap.data.license_key=<cdq-license-key> \
--set global.configMap.data.license_name=<your-license-name> \
--set global.web.admin.email=${email} \
--set global.web.admin.password=${password} \
--set global.web.service.type=<NodePort || LoadBalancer> \
--set global.web.tls.enabled=true \
--set global.web.tls.key.secretName=dq-ssl-secret \
--set global.web.tls.key.alias=<key-alias> \
--set global.web.tls.key.type=<JKS || PKCS12> \
--set global.web.tls.key.pass=<keystore-pass> \
--set global.web.tls.key.store.name=keystore.jks \
--set global.security.securityContextConstraint.runAsAny=true \
<deployment-name> \
/path/to/chart/dq
```

### Install with History Server for GCS log storage

The following example performs the install with an externally accessible service and Spark History Server enabled. In this example, the target log storage system is GCS.

{% hint style="info" %}
For Collibra DQ to be able to write Spark logs to GCS, create a secret from the JSON key file of a service account that has access to the log bucket. For more detailed information, see [System Requirements](/data-quality-self-hosted/installation/system-requirements.md).
{% endhint %}

```
helm upgrade --install --namespace <namespace> \
--set global.version.dq=<cdq-version> \
--set global.version.spark=<cdq-spark-version> \
--set global.configMap.data.license_key=<cdq-license-key> \
--set global.configMap.data.license_name=<your-license-name> \
--set global.web.admin.email=${email} \
--set global.web.admin.password=${password} \
--set global.web.service.type=<NodePort || LoadBalancer> \
--set global.spark_history.enabled=true \
--set global.spark_history.logDirectory=gs://logs/spark-history/ \
--set global.spark_history.service.type=<NodePort || LoadBalancer> \
--set global.cloudStorage.gcs.enableGCS=true \
<deployment-name> \
/path/to/chart/dq
```

### Install with History Server for S3 log storage

The following example performs the install with an externally accessible service and Spark History Server enabled. In this example, the target log storage system is S3.

{% hint style="info" %}
For Collibra DQ to be able to write Spark logs to S3, make sure that an Instance Profile IAM Role with access to the log bucket is attached to all nodes serving the target namespace. For more detailed information, see [System Requirements](/data-quality-self-hosted/installation/system-requirements.md).
{% endhint %}

{% hint style="warning" %}
We currently only support one set of S3 credentials to be configured in the Spark Server at a time within a single DQ Job. If you are using a Spark History Server bucket and an S3 connection, the S3 credentials must also have access to the S3 Spark History Server bucket.
{% endhint %}

```
helm upgrade --install --namespace <namespace> \
--set global.version.dq=<cdq-version> \
--set global.version.spark=<cdq-spark-version> \
--set global.configMap.data.license_key=<cdq-license-key> \
--set global.configMap.data.license_name=<your-license-name> \
--set global.web.admin.email=${email} \
--set global.web.admin.password=${password} \
--set global.web.service.type=<NodePort || LoadBalancer> \
--set global.spark_history.enabled=true \
--set global.spark_history.logDirectory=s3a://logs/spark-history/ \
--set global.spark_history.service.type=<NodePort || LoadBalancer> \
--set global.cloudStorage.s3.enableS3=true \
<deployment-name> \
/path/to/chart/dq
```

### Install with external DQ Metastore

The following example performs the install with an externally accessible service and an external metastore, for example AWS RDS, Google Cloud SQL, or just PostgresSQL on its own instance.

{% hint style="danger" %}
Collibra DQ currently supports PostgreSQL 9.6 and newer.
{% endhint %}

```
helm upgrade --install --namespace <namespace> \
--set global.version.dq=<cdq-version> \
--set global.version.spark=<cdq-spark-version> \
--set global.configMap.data.license_key=<cdq-license-key> \
--set global.configMap.data.license_name=<your-license-name> \
--set global.web.admin.email=${email} \
--set global.web.admin.password=${password} \
--set global.web.service.type=<NodePort || LoadBalancer> \
--set global.metastore.enabled=false                                        
--set global.configMap.data.metastore_url=jdbc:postgresql://<host>:<port>/<database>
--set global.configMap.data.metastore_user=<user> \
--set global.configMap.data.metastore_pass=<password> \
<deployment-name> \
/path/to/chart/dq
```

{% hint style="danger" %}
The `$` symbol is not a supported special character in your Postgres Metastore password.
{% endhint %}

### Install with History Server for Windows Azure Storage Blob (WASB) log storage

The following example performs the install with an externally accessible service and Spark History Server enabled. In this example, the target log storage system is Windows Azure Storage Blob (WASB). However, wherever you see `azureblobstorage`, you can insert your own storage solution (for example, ADLS, S3, or GCS).

{% hint style="info" %}
To access Azure Blob Storage, you must have the correct permissions to the Storage Account Key. For more information, go to [Connecting to Azure Blob Storage](/data-quality-self-hosted/connections/supported-connections/supported-remote-files/connecting-to-azure-blob-storage.md).
{% endhint %}

```
helm upgrade --install --namespace <namespace> \
--set global.version.dq=<cdq-version> \
--set global.version.spark=<cdq-spark-version> \
--set global.configMap.data.license_key=<cdq-license-key> \
--set global.configMap.data.license_name=<your-license-name> \
--set global.web.admin.email=${email} \
--set global.web.admin.password=${password} \
--set global.web.service.type=<NodePort || LoadBalancer> \
--set global.spark_history.enabled=true \
--set global.spark_history.logDirectory=wasbs://spark-history-logs@azureblobstorage.blob.core.windows.net/ \
--set global.spark_history.service.type=<NodePort || LoadBalancer> \
--set global.cloudStorage.wasbs.enableWASBS=true \
--set global.cloudStorage.wasbs.storageContainerName=spark-history-logs \
--set global.cloudStorage.wasbs.storageAccountName=azureblobstorage \
--set global.cloudStorage.wasbs.storageAccountKey=XXXXXXXXXXXXXXXXXXXXXXXXXXX
<deployment-name> \
/path/to/chart/dq
```

### Install with IPv6 enabled

To deploy Collibra DQ on an IPv6-enabled cluster, add the following Helm property:

```
--set global.ipFamily="IPv6"
```

## Troubleshooting

[Troubleshooting self-hosted Kubernetes Install](/data-quality-self-hosted/installation/installing-data-quality-observability-self-hosted-on-self-hosted-kubernetes/troubleshooting-self-hosted-kubernetes-installations.md)

## What's next

* [Securely pass sensitive values to the Data Quality & Observability (self-hosted) Helm Chart](/data-quality-self-hosted/installation/installing-data-quality-observability-self-hosted-on-self-hosted-kubernetes/deploy-on-self-hosted-kubernetes/securely-pass-sensitive-values-to-the-data-quality-observability-self-hosted-helm-chart.md)
* [Configure custom JDBC data source drivers](/data-quality-self-hosted/installation/installing-data-quality-observability-self-hosted-on-self-hosted-kubernetes/deploy-on-self-hosted-kubernetes/configure-custom-jdbc-data-source-drivers.md)
* [Configure Spark scratch disk space to handle large datasets](/data-quality-self-hosted/installation/installing-data-quality-observability-self-hosted-on-self-hosted-kubernetes/deploy-on-self-hosted-kubernetes/configure-spark-scratch-disk-space-to-handle-large-datasets.md)
* [Add CA certificates to the java keystore](/data-quality-self-hosted/installation/installing-data-quality-observability-self-hosted-on-self-hosted-kubernetes/deploy-on-self-hosted-kubernetes/add-ca-certificates-to-the-java-keystore.md)
* [Pattern validation for commonly used names](/data-quality-self-hosted/admin-configuration/more-admin-settings/pattern-validation-for-commonly-used-names.md)
* [Configure Google Cloud Storage (GCS) connections on Kubernetes](/data-quality-self-hosted/installation/installing-data-quality-observability-self-hosted-on-self-hosted-kubernetes/deploy-on-self-hosted-kubernetes/configure-google-cloud-storage-gcs-connections-on-kubernetes.md)