Deploying Sisense on Amazon EKS

Last updated: October 21, 2026

Tier Deployment
Enterprise On-Prem

Sisense can be provisioned on an existing Kubernetes cluster on Amazon EKS.

Tip: Already have a Kubernetes cluster? You can install Sisense with Helm directly, without sisense.sh, a Linux install host, an SSH key, or sudo. See Installing Sisense with Helm on an Existing Cluster (Multinode/Cloud) and Choosing an Installation Method.

To provision Sisense, you must download and extract the Sisense Linux archive. This archive includes a configuration YAML file, which contains all the configuration settings for deploying a multi-node cluster on Amazon EKS.

Note:

This archive includes a configuration YAML file containing all the settings required to deploy a cluster on Amazon EKS. While single-node deployment is technically supported, it is limited and not recommended for production use.

You can customize your installation by setting various parameters in the cloud configuration YAML file. Once the parameters have been defined, you run the script to deploy Sisense, and then retrieve the URL to access the Sisense application online.

You run sisense.sh from a Linux machine that has kubectl access to your EKS cluster. The installer works only through the Kubernetes API: it does not connect to, or run anything on, the EKS nodes.

A Workers node group should be placed on a private subnet and use a managed EKS node group. For ALB support, you must have at least 2 public subnet additions.

Storage on Amazon EKS

Sisense needs one shared ReadWriteMany volume for the application and ReadWriteOnce (EBS) volumes for MongoDB and ZooKeeper. For the requirements of all installation methods, see Storage Requirements for Self-Deployment.

Shared Storage (FSx for Lustre)

When storage_type is fsx, the installer installs the FSx for Lustre CSI driver in the kube-system namespace and creates the aws-fsx StorageClass. Sisense creates a PersistentVolume for your existing file system from fsx_dns_name and fsx_mount_name, mounted with the flock option.

To share one FSx file system between several Sisense deployments (namespaces), end fsx_mount_name with a slash (/). Each deployment then uses a sub-directory named after its namespace. The installer creates the sub-directory, owned by run_as_user and run_as_group (1000 by default).

EBS Volumes (GP3)

The installer uses the GP3 EBS volume type:

  • Default (ebs_csi.enabled: false in installer/extra_values/installer/installer-values.yaml): When storage_type is fsx, efs, or nfs, the installer installs the AWS EBS CSI driver in the kube-system namespace (unless a CSIDriver named ebs.csi.aws.com already exists). It creates the StorageClass gp3 (encrypted, WaitForFirstConsumer, limited to the availability zones of your nodes) and marks it as the cluster's default StorageClass. MongoDB and ZooKeeper use gp3.

  • ebs_csi.enabled: true: The installer installs the AWS EBS CSI driver if it is not already installed and creates the StorageClass ebs-sc (GP3, encrypted, XFS). It does not mark this class as the default. MongoDB and ZooKeeper use ebs-sc. See Implementing Amazon EBS CSI Driver for GP3 Volumes.

The EBS CSI driver needs AWS permissions to create volumes. See Creating a Service Account for the EBS CSI Driver on EKS.

If you already manage your own storage drivers and StorageClasses, leave storage_type empty and set both rwx_sc_name (ReadWriteMany) and rwo_sc_name (ReadWriteOnce). The installer then installs no storage drivers and only verifies that both StorageClasses exist.

Auto Scaling

Sisense supports auto scaling for your EKS nodes.

When cloud_auto_scaler is set to true, the installer installs the Kubernetes Cluster Autoscaler, which scales your node groups as needed. If a node fails or your load is higher than normal, additional nodes can be added. Apply the Sisense node labels to your node groups so that new nodes receive them (see Node Labels).

Note:

If you are deploying Sisense on EKS offline, the Sisesne Auto-Scaler is not supported. You can implement your own EKS auto-scaler for your subnets.

ulimit Setting

You must increase the default ulimit setting, see Increasing Docker ulimits.

The Docker ulimit restricts a program's resource utilization so a run-away bug or security breach cannot cause your system to shut down. The default limit for Amazon AWS is 1024, which is not enough for Sisense to run properly.

Prerequisites

Before you deploy Sisense, your deployment should meet the prerequisites below:

  • A Linux machine to run the installer (the installation machine), running one of the operating systems that the installer accepts: Red Hat Enterprise Linux 8, 9, or 10; Ubuntu 22.04, 23.04, 24.04, or 26.04; CentOS 8 or 9; Rocky Linux; Oracle Linux; or Amazon Linux 2 or 2023.
  • On the installation machine, a regular (non-root) Linux user that can run sudo without a password (NOPASSWD) for the duration of the installation. You can remove the NOPASSWD rule after the installation. No privileges are required on the EKS nodes. The same user needs kubectl access to the cluster with cluster-admin rights (a working ~/.kube/config, for example after aws eks update-kubeconfig). For details, see Privileges and Permissions for Self-Deployment.

    • Note:

    When using EKS with node groups on AL 2023, the FSX Lustre version must be 2.15 or newer.

  • AWS CLI: Installing, updating, and uninstalling the AWS CLI

  • Deployed cluster that meets the minimum requirements

  • Each node listed in k8s_nodes must report a pod capacity of at least 58. The installer checks this and stops if a node has a lower capacity. On EKS, the pod capacity of a node depends on its instance type. To check a node, run:

    kubectl get node <node-name> -o jsonpath='{.status.capacity.pods}'

  • Sisense node labels. The Sisense Helm chart schedules its pods only on nodes that carry the label node-<namespace>-Application=true, where <namespace> is the value of namespace_name (for example, node-sisense-Application=true). The label key is case-sensitive, and the value is the string true. The installer also applies node-<namespace>-Query=true and node-<namespace>-Build=true according to the roles you assign in k8s_nodes.

    By default, the installer removes these labels from all nodes and applies them with kubectl to the nodes listed in k8s_nodes. Labels applied with kubectl are lost when a node is replaced (for example, by the autoscaler or a node group upgrade). If you use autoscaling, or want nodes to keep their labels, apply the labels in the node group definition and set skip_labeling: true in installer/extra_values/installer/installer-values.yaml. See Autoscaling and Linux.

  • For FSX for Lustre storage_type
  • Create a new Security Group with inbound port 988 to the EKS node groups and attach it to the FSx on the creation step
  • Only if you use a Custom DNS service within EKS, such as a custom CoreDNS, you must add .sisense zone as a conditional forward
  • See Creating a Service Account for the EBS CSI Driver on EKS.

Notes:

  • Sisense does not currently support working with AWS Fargate.

  • EFS performance is not sufficient for building ElastiCubes on it. If EFS is a core requirement, use the Build/Query on local feature or Live models only.

Minimum IAM Policy that Allows Eksctl Main Actions

Minimum IAM policies - Eksctl User Guide

Minimum IAM Policy that Allows Clusters to Manage Nodes

Amazon EKS cluster IAM role - Amazon EKS

Copy 
{
  "Version":"2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags"
      ],
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "ForAnyValue:StringLike": {
          "aws:TagKeys": "kubernetes.io/cluster/*"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeVpcs",
        "ec2:DescribeDhcpOptions",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeInstanceTopology",
        "kms:DescribeKey"
      ],
      "Resource": "*"
    }
  ]
}

Minimum Permissions to Create an Amazon EKS Cluster

Create a Kubernetes cluster on the AWS Cloud

Copy 
{
    "Version":"2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "eks:CreateCluster",
            "Resource": "arn:aws:eks:us-west-2:111122223333:cluster/my-cluster"
        },
        {
            "Effect": "Allow",
            "Action": "iam:CreateServiceLinkedRole",
            "Resource": "arn:aws:iam::111122223333:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS",
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "iam:AWSServiceName": "eks"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::111122223333:role/cluster-role-name"
        }
    ]
}

Deploying Sisense on Amazon EKS

  1. Download a Sisense version package. Contact your Sisense Customer Success Manager for a link to the latest version.
    wget $sisense_url
  2. Create a new FSx in the same VPC of the EKS environment.
  3. Extract the Sisense package.
    tar zxf $package_name
  4. Navigate to the directory where you extracted the tar.gz file.
    cd sisense-$sisense_version
  5. Access the config.yaml file.
    vim cloud_config.yaml
  6. Edit the following values in the cloud_config.yaml file.

    Note:

    The cloud_config.yaml contains many parameters that must be defined when provisioning Sisense on Linux. This table only describes the mandatory parameters when provisioning Sisense on Amazon EKS. For a full explanation of the cloud_config.yaml file, see Installing Sisense on Linux.

    ParametersValue
    k8s_nodes:
- { node: node1, roles: "application, query" } 
- { node: node2, roles: "application, query" } 
- { node: node3, roles: "build" }

    K8S node/nodes are the set of machines that will run Sisense.

    node: Enter the name of your nodes to be included in the cluster. You can retrieve their values with the command:

    kubectl get nodes

    roles: Define the role of the node with one of the following values:

    • Query
    • Application
    • Build

    Note:

    Node names may not include uppercase letters. Node names can only include lowercase letters, digits and hyphens. Hyphens cannot be the last character in the node name.

    The installation machine is only used during installation to run the installation scripts. The Installation machine can be one of the K8S nodes, but it can also be a different machine (remote installation).

    deployment_size: "small"

    Set to large to increase pod resource limits allocated for the application.

    cluster_visibility: true
    		For security restrictions that revoke cluster role permissions, set to false to disable the following Sisense workflows.
    • Watching Sisense Nodes that exist or are added to the cluster (for example, for the data-groups feature). In this case, a customer should use manual labeling method
    • Updating the logging system with the customer registered owner ID.
    offline_installer: false

    (Optional) Only required if you are using an offline installer.

    Enter true when you are using an offline installer.

    #docker_registry: ""

    Enter your server's address.

    #pull_secrets_name: ""

    (Optional) Only required if you have entered a value for the docker_registery parameter

    Enter the docker secret name if your registry is private.

    update: false

    Enter true if you are upgrading Sisense.

    Otherwise, use false as the default value

    notify_on_upgrade: true

    If set to true, the Sisense application will not be accessible during upgrades. Instead, a system maintenance notification will appear.

    is_kubernetes_cloud: true

    Enter true if you already have a Kubernetes cluster.

    kubernetes_cluster_name: ""

    Enter the Kubernetes cluster name.

    kubernetes_cluster_location: ""

    Enter your Kubernetes cluster location.

    For Amazon EKS, the value should be your region.

    kubernetes_cloud_provider: ""

    Enter aws.

    cloud_load_balancer: false

    Enter true if you have defined a load balancer on your Sisense Linux cloud instances to automatically distribute traffic across multiple nodes.

    For more information, see Setting Up a Load Balancer

    cloud_load_balancer_internal: false

    Set this to true to set an internal load balancer. Set this to false to set an internet-facing load balancer.

    For more information, see Setting Up a Load Balancer.

    cloud_auto_scaler: false

    Enter true to install the Kubernetes Cluster Autoscaler for your EKS node groups. See Node Labels.

    high_availability: true
    		True means that Sisense is scaled for service redundancy.

    False means that Sisense will not scale its services.

    application_dns_name: ""

    Enter the DNS name.

    • If no DNS name is entered, the default value is the external IP of the first node in the cluster.
    • If the is_ssl parameter is set to true, enter the Common Name for this parameter.
    • If an external load balancer is used for the Common Name, add the http:// or https:// prefix to the entry.

    Note:

    You can only define this parameter when installing or upgrading Sisense. After defining this value, you can view this value under General Settings in the Sisense Admin page.

    linux_user: ""

    Enter the name of the Linux user that runs sisense.sh on the installation machine.

    Use a regular (non-root) user that can run sudo without a password (NOPASSWD) for the duration of the installation; you can remove the NOPASSWD rule afterwards. This is needed only on the installation machine. No privileges are required on the EKS nodes: the installer does not connect to or run anything on them. The same user needs kubectl access to the cluster with cluster-admin rights.

    ssh_key: ""

    SSH is not used when you install on an existing EKS cluster. However, if ssh_key is empty, the installer still prompts for the password of the Linux user defined in linux_user.

    To skip the prompt (for example, for an unattended installation with -y), set ssh_key to the path of any existing key file. The installer checks only that the file exists and sets its permissions to 400.

    storage_type: ""
    		Enter fsx for Amazon EKS for using Amazon FSx cluster. You must also enter values for fsx_dns_name and fsx_mount_name.
    fsx_dns_name: ""

    This is relevant for FSx implementations

    If your system uses AWS FSx services, enter the associated DNS name.

    fsx_mount_name: ""

    This is relevant for FSx implementations

    If your system uses AWS FSx services, enter the mount name for the file system.

    If you are using Scratch 1, enter fsx.

    To share one FSx file system between several Sisense namespaces, end the value with a slash (/). See Storage on Amazon EKS.

    mongodb_disk_size: 20

    Enter the amount of disk space allocated for the Sisense application database.

    This value should be multiplied by the number of nodes used in your deployment.

    It is recommended to leave the default of 20GB. If only metadata is stored in the MongoDB, there is no need to increase the size.

    zookeeper_disk_size: 2

    Enter the amount of disk space allocated for the ZooKeeper service.

    This value should be multiplied by the number of nodes in your deployment.

    It is recommended to leave the default of 2GB. If only metadata is stored in the Zookeeper service, there is no need to increase the size.

    timezone: "UTC"

    data-pm-slice='1 1 ["table",null,"tableRow",null,"tableCell",null]'>Enter the system time zone.
    Applicable to the time zone of the relative date-time filters.
    Format: TZ database name (i.e., UTC, US/Central, Asia Tokyo, Etc/GMC+6). 

    namespace_name: sisense

    Enter the name of the Kubernetes namespace. By default, the namespace is Sisense.

    If you have multiple deployments, you should have a unique namespace for each deployment. For example, there might be a development and production environment.

    Additionally for multiple deployments:

    • Each environment must have a unique gateway_port value.
    • Each deployment after the first, the value of the update should be set to true.

    Note:

    Kubernetes ports should be released (Non-listening mode).

    gateway_port: 30845

    Enter the port of the API gateway for your deployment. Do not set this port to 443 if setting up SSL.

    If you are not implementing SSL, this is the port used to connect to Sisense.

    is_ssl: false

    Enter true for secure connections to Sisense.

    Enter false if you have not implemented SSL.

    SSL is terminated by NGINX Gateway Fabric, which requires Kubernetes 1.32 or later.

    If you enter true, see Setting Up SSL for Sisense on Linux.

    ssl_key_path: ""

    If you connect to your server securely, enter the SSL keypath.

    When the SSL is defined, the Sisense API Gateway Port will be 443 and not the value defined in the gateway_port parameter.

    ssl_cer_path: ""

    If you connect to your server securely, enter the SSL certificate path (.cer file). 

    internal_monitoring: true

    Enter false to disable a Prometheus supported Grafana dashboard from monitoring your deployment. See Monitoring Sisense on Linux.

    uninstall_sisense: false

    Enter true to uninstall Sisense services, but leave your Kubernetes infrastructure unchanged, in case it's needed in the future.

    remove_user_data: false

    Enter true to delete all user data.This deletes your ElastiCube models, application database, message broker, and add-ons.

    signature_validation: false

    Enter true to enable Image Signature Validation.

  7. Run the configuration script.
    ./sisense.sh cloud_config.yaml

    Your configuration settings are displayed with a message to confirm that you want to deploy Sisense with these settings.

  8. Enter Yes to confirm that you want to deploy Sisense or enter No to abort the deployment.

    If you entered Yes, the script deploys Sisense. The installer writes its log to sisense-installer.log in the directory you ran ./sisense.sh from. If there are any issues, check this file.

  9. To access Sisense, enter the address that the installer displays at the end of the installation into your browser.

    You can also find the address in the sisense-installer.log file. If you set cloud_load_balancer: true, you can display the external address of the load balancer with kubectl get svc api-gateway-external -n <namespace>.

    The installer does not install the Kubernetes Dashboard. To use it, install it separately; see Deploy the Kubernetes Dashboard (web UI).