> For the complete documentation index, see [llms.txt](https://docs.collibra.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.collibra.com/data-quality-self-hosted/installation/installing-data-quality-observability-self-hosted-on-self-hosted-kubernetes/deploy-on-self-hosted-kubernetes/securely-pass-sensitive-values-to-the-data-quality-observability-self-hosted-helm-chart.md).

# Securely pass sensitive values to the Data Quality & Observability (self-hosted) Helm Chart

This section shows you how to securely pass sensitive data to the Collibra DQ Helm Chart through Kubernetes or Microsoft Azure Key Vault (AKV) Secrets. Passing sensitive data, such as PostgreSQL Metastore credentials and the license key, through Kubernetes or AKV Secrets helps mitigate potential security risks to your organization by preventing the exposure of such values in the Helm Chart.

### Passing Kubernetes Secrets to the values.yaml file in the Collibra DQ Helm Chart

{% hint style="info" %}
You can use the same Secret to pass additional sensitive data to your Data Quality & Observability (self-hosted) deployment.
{% endhint %}

{% stepper %}
{% step %}
Create a Kubernetes Secret containing the sensitive data, as shown in the example below.

```
---
apiVersion: v1
kind: Secret
metadata:
  name: kubernetes-secret-name
type: Opaque
data:
  username: Cg==
  password: Cg==
```

{% endstep %}

{% step %}
Pass the Secret to values.yaml file in your Collibra DQ Helm Chart, as shown in the example below.

```
global:
  configMap:
    data:
      metastore_secret_name: "kubernetes-secret-name"
      metastore_secret_key_map:
        username: SPRING_DATASOURCE_USERNAME
        password: SPRING_DATASOURCE_PASSWORD
        # Add more key maps to pass additional sensitive data to the DQ web and agent pods.
```

{% endstep %}

{% step %}
If you are updating an existing deployment of Collibra DQ, restart the DQ web and agent pods to complete the updates.
{% endstep %}
{% endstepper %}

### Passing Azure Key Vault secrets to the values.yaml file in the Collibra DQ Helm Chart

{% hint style="info" %}
You can use the same secrets to pass additional sensitive data to your Data Quality & Observability (self-hosted) deployment.
{% endhint %}

#### Prerequisites

* You have an Azure Key Vault secret containing sensitive secret objects.
* Your [Azure Secret Storage CSI driver](https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver) is installed on the Azure Kubernetes Service.
* You have grant access to the Azure Key Vault through [Managed Identity](https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-identity-access#access-with-managed-identity).
* The base UBI 9 Micro image is available in the same container repository as where the Collibra DQ container images are stored.

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>You can pull this image from the same GCR credentials used for Collibra DQ containers.</p></div>

{% stepper %}
{% step %}
Create an Azure Key Vault secret containing the sensitive data, as shown in the screenshot below.

![screenshot of Azure Key Vault (cdq-azure-secret) with secrets holding username and password of the Postgresql metastore](https://4121921244-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWCrP7Albs8DfJjIQxUxw%2Fuploads%2Fgit-blob-2bef9818b5940c96b3875128bc89ca2f3b3e8867%2Fdq-akv-secrets.png?alt=media)
{% endstep %}

{% step %}
Pass the following information to values.yaml file in your Collibra DQ Helm Chart, as shown in the example below.

1. Azure Cloud details, including:
   1. Tenant ID
   2. Azure-managed identity ID given the grant access on the AKV
   3. Resource Group
   4. Subscription ID
2. Secrets from the AKV

```
global:
  configMap:
    data:
      metastore_secret_name: "kubernetes-secret-name"
      metastore_secret_key_map:
        username: SPRING_DATASOURCE_USERNAME
        password: SPRING_DATASOURCE_PASSWORD
        # Optionally add more key maps to pass additional sensitive data to the DQ web and agent pods.
  vault:
    enabled: true
    provider: "akv" # akv is the Azure Key Vault
    vault_name: "cdq-azure-secret" # Azure Vault storage name to create a K8s object of SecretProviderClass. Make sure to set global.configMap.data.metastore_secret_name to secretName value for the sync.
    vault_object_map: # Map Azure Vault object names with the K8s Secret object key names, Azure Vault object name as the key, and the K8s Secret object key as the value.
      username: username # The value should have a corresponding key entry at global.configMap.data.metastore_secret_key_map
      password: password # The value should have a corresponding key entry at global.configMap.data.metastore_secret_key_map
    tenant_id: ""
    identity_id: "" # Azure managed identity id
    resource_group: ""
    subscription_id: ""
    image:
      name: ubi9-micro
      version: latest
      pullPolicy: IfNotPresent
```

{% endstep %}

{% step %}
If you are updating an existing deployment of Collibra DQ, restart the DQ web and agent pods to complete the updates.
{% endstep %}
{% endstepper %}