Skip to main content
Version: current [26.x]

Configure a Kubernetes Deployment

You can configure your Dremio Kubernetes deployment by editing a values override file and passing it to Helm during installation. Dremio's Helm chart defines default configurations in values.yaml. Dremio recommends maintaining your customizations in a separate values-overrides.yaml file — this makes it simpler to carry your configuration forward during Helm chart updates.

Configure Your Values​

  1. Download the values-overrides.yaml configuration file and save it locally.

  2. Edit the values-overrides.yaml file. The sections below walk through each required setting.

OPENSHIFT DEPLOYMENTS

If you are deploying on OpenShift, you must also download the values-openshift-overrides.yaml file and pass it to Helm alongside your values-overrides.yaml. Without it, Dremio will fail to start. See Deploy Dremio on Kubernetes — Prerequisites for the download link and setup instructions.

Configure the License​

Provide your license key. To obtain a license, see Licensing.

License key configuration 
dremio:
  license: "<your-license-key>"
  ...

Configure the Pull Secret​

Provide the secret used to pull images from Quay.io.

  1. Log in to Quay.io, select your account name at the top right corner, and select Account Settings.

  2. Click Generate Encrypted Password, enter your password, and click Verify.

  3. On the next dialog, select Kubernetes Secret, and follow steps 1 and 2 to download the secret and submit it to the cluster.

  4. Add the configuration as follows:

    Pull secret configuration 
    imagePullSecrets:
      - <your-quayio-secret-name>

Configure the Coordinator​

Configure Resources​

Configure the coordinator's CPU request, memory request, memory limit, and volume size. Refer to the sizing tables in Size Your Deployment for recommended values.

Coordinator resource configuration 
coordinator:
  resources:
    requests:
      cpu: 15
      memory: 30Gi
  volumeSize: 100Gi
  ...

Configure Authentication​

By default, Dremio uses internal authentication (type: "internal"). To configure an external identity provider, set the authentication type and provide the corresponding configuration file.

TypeIdentity provider
azureadMicrosoft Entra ID
ldapLDAP
oauthOpenID Connect
oauth+ldapHybrid OpenID+LDAP
Authentication type configuration 
coordinator:
  web:
    auth:
      type: <your-auth-type>
  ...

You can embed the identity provider configuration file directly in values-overrides.yaml using the ssoFile option:

Embedded identity provider configuration for Microsoft Entra ID 
coordinator:
  web:
    auth:
      enabled: true
      type: "azuread"
      ssoFile: |
      {
        "oAuthConfig": {
          "clientId": "<your-client-id>",
          "clientSecret": "<your-secret>",
          "redirectUrl": "<your-redirect-url>",
          "authorityUrl": "https://login.microsoftonline.com/<your-tenant-id>/v2.0",
          "scope": "openid profile",
          "jwtClaims": {
            "userName": "<your-preferred-username>"
          }
        }
      }
  ...

For examples for other identity provider types, see Identity Providers.

Configure TLS (Optional)​

You can enable TLS for the coordinator's web interface, JDBC/ODBC client connections, and Arrow Flight connections. For full instructions, see Configure TLS.

Configure Distributed Storage​

Distributed storage is required for Dremio to be operational. It stores metadata, Reflections, uploaded files, and backups.

note

Distributed storage is also used to store Open Catalog backups. Some authentication methods require two sets of credentials — one for Dremio and one for the backup service. Where applicable, this is noted in the relevant section below.

Set distStorage.type to your storage provider and complete the authentication configuration for that provider.

Set distStorage.type to "aws" for Amazon S3 or S3-compatible storage, then select your authentication method:

warning

Use only one authentication method in your YAML configuration. Do not mix metadata, accessKeySecret, and awsProfile in the same block. Multiple authentication methods will prevent Dremio from starting.

Dremio uses the Identity and Access Management (IAM) role to retrieve credentials. Metadata authentication is only supported in Amazon Web Services Elastic Kubernetes Service (AWS EKS) and requires that the EKS worker node IAM role has sufficient access rights.

Metadata authentication for distributed storage
distStorage:
  type: "aws"
  aws:
    bucketName: "<your-bucket-name>"
    path: "/"
    authentication: "metadata"
    region: "<your-bucket-region>"
    #extraProperties: |
    #  <property>
    #    <name>the-property-name</name>
    #    <value>the-property-value</value>
    #  </property>

Where:

  • bucketName — The name of your S3 bucket for distributed storage.
  • path — The path relative to your bucket to create Dremio's directories.
  • region — The AWS region in which your bucket resides. Required for Amazon S3 and optional for S3-compatible storage.
  • extraProperties — Additional parameters to configure distributed storage in the generated core-site.xml file. Important for S3-compatible and customer-managed KMS encryption.

Add Extra Properties for Amazon S3 and S3-Compatible​

Use extraProperties to pass additional parameters to the generated core-site.xml file.

S3-compatible extra properties
extraProperties: |
  <property>
    <name>fs.s3a.endpoint</name>
    <value>0.0.0.0</value>
  </property>
  <property>
    <name>fs.s3a.connection.ssl.enabled</name>
    <value>false</value>
  </property>
Customer-managed KMS extra properties
extraProperties: |
  <property>
      <name>fs.s3a.connection.ssl.enabled</name>
      <value>true</value>
  </property>
  <property>
      <name>fs.s3a.server-side-encryption-algorithm</name>
      <value>SSE-KMS</value>
  </property>
  <property>
      <name>fs.s3a.server-side-encryption.key</name>
      <value>KEY_ARN</value>
  </property>

Configure Open Catalog​

Configure Storage​

Configuring Open Catalog storage is required. This is where Iceberg tables created in the catalog are written.

The catalog.storage.location property can be a single URI or a list of URIs.

Single location — all catalog folders store data under the same base URI:

catalog.storage.location as a single URI 
catalog:
  storage:
    location: s3://<your-bucket>/<your-folder>

Multiple locations — assign different catalog folders to different URIs, for example to separate data by environment, region, or business unit:

catalog.storage.location as a list of URIs 
catalog:
  storage:
    location:
      - s3://<your-bucket>/<your-folder>
      - s3://<your-additional-bucket>/<your-folder>

When using a list, the catalog base URI must be the first element and is immutable. To add locations to an existing cluster, update catalog.storage.location and run a Helm upgrade. For more information, see Multiple Storage Locations.

Select the tab for your storage provider and follow the steps to complete the configuration.

  1. Configure access to the storage, as described in Configure Storage Access. Creating a Kubernetes secret may be required.

  2. Configure the Open Catalog in your values-overrides.yaml file:

    Open Catalog storage configuration for Amazon S3 
    catalog:
      storage:
        location: s3://<your-bucket>/<your-folder>
        type: S3
        s3:
          region: <bucket_region>
          roleArn: <dremio_catalog_iam_role>
          userArn: <dremio_catalog_user_arn>
          externalId: <dremio_catalog_external_id>
          useAccessKeys: false
      ...

  3. If using EKS Pod Identities, ensure the catalog's Kubernetes ServiceAccount (default: dremio-catalog-server) is associated with the userArn provided above.

Configure MongoDB Backup​

MongoDB is the backing store for Open Catalog. Backup is enabled by default and writes to your distributed storage location. The configuration below performs a backup every day at midnight and retains the last three backups.

MongoDB backup configuration 
mongodb:
  backup:
    enabled: true
    schedule: "0 0 * * *"
    keep: 3

To disable backup, set enabled: false.

Enable External Access (Optional)​

Enable external access to connect to the Open Catalog from engines outside the namespace that support Iceberg REST, such as Spark.

Open Catalog external access configuration 
catalog:
  externalAccess:
    enabled: true
  ...

To require TLS for external access, see Configure TLS for Open Catalog External Access.

If you also enable TLS on the coordinator's web interface, additional configuration is required. See Configure Open Catalog When Coordinator Web Uses TLS.

Size Your Deployment​

Before deploying, determine the appropriate resource sizes for your environment.

Dremio recommends the following configuration values for production environments:

Dremio ComponentMemoryCPUVolume SizePod Count
Coordinator64Gi32512Gi1
Catalog Server8Gi4-1
Catalog Server (External)8Gi4-1
Catalog Service Server8Gi4-1
Engine Operator1Gi1-1
OpenSearch16Gi2100Gi3
MongoDB4Gi8512Gi13
NATS1Gi700m-3
ZooKeeper1Gi500m-3
Open Telemetry1Gi1-1
M Engine120Gi16521Gi4

1 You can use a smaller volume size if you do not heavily use Iceberg.

Deploy​

After saving your values-overrides.yaml file, deploy Dremio to Kubernetes. See Deploy Dremio on Kubernetes.

Download Dremio's Helm Charts​

You can download Dremio's Helm charts to implement configurations beyond those outlined in this topic.

warning

Modifications to chart files without a clear understanding of their structure can lead to unexpected behavior and limit Dremio Support's ability to assist. Dremio recommends engaging with the Professional Services team through your Account Executive or Customer Success Manager before making manual chart modifications.

Run helm pull to download Dremio's Helm charts 
helm pull oci://quay.io/dremio/dremio-helm --version <tag> --untar

Where --version <tag> is optional — for example, --version 3.0.0. If not specified, the latest version is pulled. The command creates a local directory called dremio-helm containing the Helm charts.

For more information, see Helm Pull in the Helm documentation.

Override Additional Values​

After downloading the charts:

  1. Open values.yaml and identify the settings you want to override.
  2. Copy those settings to your values-overrides.yaml and configure them.
  3. Save the values-overrides.yaml file.

Apply Manual Chart Modifications​

note

For modifications to chart files to take effect, you must install Dremio using a local version of the Helm charts. The helm install command must reference a local folder, not the OCI repository. For more information, see Helm install.

After downloading, you can edit the charts directly. This is typically necessary for deployment-specific modifications not available through values-overrides.yaml — usually in files under the /config directory. Customizations propagate to all pods on install or upgrade.