Sisense Helm Chart Parameters

Host name that users use to reach Sisense, without a scheme or port (for example, sisense.example.com).

Used as the host of the Gateway API HTTPRoute (api-gateway.httpRoute.*) or of the legacy Ingress. Required when api-gateway.httpRoute.enabled is true; it must be a host name, not an IP address, otherwise the chart fails to render.

Set global.external_kube_apiserver_address as well.

Full URL that users use to reach Sisense, including the scheme and, if it is not the default port, the port (for example, https://sisense.example.com or http://10.0.0.5:30845). Sisense uses it as its system alias (the base URL of the application).

This parameter is not deprecated. Set both parameters: global.applicationDnsName is the host name only, and this parameter is the full URL.

Set to true when Sisense is exposed through an AWS Application Load Balancer (api-gateway.ingress.awsAlb is true) managed by the AWS Load Balancer Controller.

Optional. Exposes Sisense through a cloud load balancer: the api-gateway-external Service becomes type LoadBalancer on port 80 (HTTP).

This is one of several ways to expose Sisense and is not required on Amazon EKS, Azure AKS, or Google GKE. It has no effect when api-gateway.httpRoute.enabled is true. The load balancer serves HTTP only; for HTTPS, use the Gateway API HTTPRoute (api-gateway.httpRoute.*), or terminate TLS at an ingress controller or load balancer in front of Sisense.

When global.cloudLoadBalancer.enabled is true, creates an internal (private) load balancer instead of an internet-facing one by adding the internal load balancer annotation for the provider set in global.kubernetesCloudProvider (aws, azure, or gke).

The annotation is not added when global.ssl.enabled is true.

false (default): single-node model. Sisense data is written to hostPath directories under /opt/sisense/storage on the node, and with global.storageClass: manual, the chart creates hostPath PersistentVolumes for MongoDB, ZooKeeper, Dgraph, and Grafana. hostPath volumes are not allowed by the Kubernetes baseline and restricted Pod Security Standards, so the namespace must allow privileged pods. Use it only for single-node installations.

true: required on any multi-node or shared cluster (Amazon EKS, Azure AKS, Google GKE, OpenShift, or multi-node RKE2). Sisense services mount a shared ReadWriteMany PVC named storage, stateful services use volumes provisioned from StorageClasses, Sisense services get a required node affinity on node-<namespace>-Application=true, and services run with multiple replicas when global.highAvailability is true.

When you set true, also set global.storageType, global.storageClass, and mongodb.architecture: replicaset.

true: Sisense creates ClusterRoles for the build, bsm-executors, management, oxygen, and validator services so that it can read cluster-level information such as Kubernetes nodes.

Set to false to install Sisense with namespace-scoped permissions only (see Installing Sisense without ClusterVisibility). The chart then does not create these ClusterRoles, Sisense cannot read Kubernetes node information, and the Sisense Grafana dashboards are not deployed. Internal monitoring is not supported.

Grafana still creates cluster-scoped RBAC objects. With false, also set grafana.rbac.namespaced: true (or grafana.enabled: false).

The account that runs helm still needs permission to list nodes and get namespaces, because the chart looks up these objects while it renders.

Container-level securityContext applied to the containers and init containers of the Sisense services. When set, it takes precedence over the containerSecurityContext of the individual service.

It is not applied to the MongoDB, RabbitMQ, ZooKeeper, Grafana, mongot, or knowledgegraph pods, which have their own settings. When not set, the Sisense service containers have no container-level security context.

Can be small or large. If you have a small or medium deployment as per the minimum requirements, choose small; otherwise, choose large.

Determines the CPU and memory limits of the Sisense services.

You can override the values of a specific service with <service-name>.resources, for example:

ai-integration:
  resources:
    limits:
      cpu: 1300m
      memory: 2000Mi
    requests:
      cpu: 100m
      memory: 120Mi

Enables the delta approach for shared dashboards and widgets.

Exposes internal services as NodePorts, for example MongoDB (30017), ZooKeeper (32181), and RabbitMQ (30672 and 30673). Leave false unless you need to reach these services directly from outside the cluster.

Set to true to use an external RabbitMQ instead of the RabbitMQ that is bundled with the chart. This parameter does not remove the bundled RabbitMQ: also set rabbitmq.enabled: false.

Connection string of the external RabbitMQ, in the format amqp://username:password@host:port/vhost.

Management URL of the external RabbitMQ, in the format http://host:port (for example, http://rabbitmq.example.com:15672).

Name of an existing Secret in the Sisense namespace that contains the keys RABBITMQ_CONN_STRING and RABBITMQ_MGMT_URL. When set, the services read the RabbitMQ connection details from this Secret instead of connectionString and mgmtUrl, so the credentials are not stored in the values file.

Set to true to use an external ZooKeeper instead of the ZooKeeper that is bundled with the chart. This parameter does not remove the bundled ZooKeeper: also set zookeeper.enabled: false.

Connection string of the external ZooKeeper, in the format host1:port1,host2:port2,host3:port3.

NodePort of the api-gateway Service when Sisense is served over HTTP without a load balancer, HTTPRoute, or Ingress (http://<node-IP>:30845).

If you set it to 80 and api-gateway.httpRoute.enabled is false, the chart renders the legacy Ingress instead.

In cluster mode (global.clusterMode.enabled is true), runs the Sisense services with multiple replicas, and Sisense connects to a three-member MongoDB replica set. Set mongodb.replicaCount to 3 when this parameter is true, and to 1 when it is false.

Has no effect on single-node installations.

Creates HorizontalPodAutoscalers for the Sisense services that support autoscaling.

Names of image pull Secrets in the Sisense namespace, used to pull images from a private registry (see global.imageRegistry). Example:

global:
  imagePullSecrets:
    - my-registry-secret

Registry from which all Sisense images are pulled. Change it only if you mirror the images to your own registry. If the registry requires authentication, also set global.imagePullSecrets.

Set to true when Sisense runs on a managed Kubernetes service (Amazon EKS, Azure AKS, or Google GKE).

Set to true when installing on OpenShift. On OpenShift, set the ReadWriteMany StorageClass in sisense-utils.rwxScName.

Network (CNI) plugin of the cluster, for example calico or flannel.

If Sisense runs on a managed Kubernetes service, set to aws (Amazon EKS), azure (Azure AKS), or gke (Google GKE). Use gke, not gcp.

Used to select the internal load balancer annotation (global.cloudLoadBalancer.isInternal). With azure, it also selects the Azure Files StorageClass and the size of the shared storage PVC (see sisense-utils.azureCsi.enabled and sisense-utils.azureDefaultDiskSize).

Indicates that the MongoDB bundled with the chart is used. Keep it true together with mongodb.enabled.

On upgrade, the chart checks the version of the running MongoDB and stops the upgrade if it is older than 7.x. In that case, first upgrade to Sisense L2025.2.0.

Set to true if Sisense internal monitoring (Prometheus) is installed. See Installing/Updating Sisense Internal Monitoring.

To collect MongoDB, RabbitMQ, and ZooKeeper metrics, also set mongodb.metrics.enabled, rabbitmq.metrics.enabled, and zookeeper.metrics.enabled.

Hardened network isolation for shared clusters. When true, the network policy of api-gateway accepts traffic only from pods in the Sisense namespace and from the namespace set in global.networkIsolation.hardened.ingressNginxNamespace. Traffic from any other source, including direct NodePort or load balancer access, is not allowed by the policy.

Enable it only when users reach Sisense through a gateway or ingress controller that runs in that namespace.

Namespace of the gateway or ingress controller that is allowed to reach api-gateway when hardened network isolation is enabled.

If true, while the Sisense services are being deployed during an upgrade, the Sisense web page displays a maintenance page. Once deployment is complete, the regular Sisense page is displayed.

If false, the Sisense web pages are always displayed, although some services might be unavailable for a short time while they are deployed.

Set to true for offline (air-gapped) installations.

Pod-level security context of the Sisense service pods.

If you change the user or group, use the same values for the MongoDB, ZooKeeper, RabbitMQ, and Grafana security contexts (see mongodb.containerSecurityContext.runAsUser, zookeeper.containerSecurityContext.runAsUser, and grafana.securityContext.*).

Annotations added to the service account of every Sisense service, for example, an annotation that maps the service account to a cloud IAM role. To annotate only one service, use <service-name>.serviceAccount.annotations.

Indicates that Sisense is served over HTTPS. It does not configure TLS: TLS must be terminated by the gateway, ingress controller, or load balancer in front of Sisense.

When true and api-gateway.httpRoute.enabled is false, the chart renders the legacy Ingress, which has no TLS section, and the api-gateway Service is ClusterIP instead of NodePort.

For HTTPS, the recommended approach is the Gateway API HTTPRoute (api-gateway.httpRoute.*). See Manually Installing Sisense Helm Chart - with SSL.

ReadWriteOnce StorageClass for the stateful services.

manual (or empty): single-node model. The chart creates hostPath PersistentVolumes on the node for MongoDB, ZooKeeper, Dgraph, and Grafana.

In cluster mode, set it to an existing ReadWriteOnce StorageClass (for example, gp3 or ebs-sc on Amazon EKS, default on Azure AKS, or standard on Google GKE). MongoDB, ZooKeeper, Dgraph, mongot, and RabbitMQ (if its persistence is enabled) use it for their volumes. If you leave manual in cluster mode, their PVCs stay Pending.

Grafana does not use this parameter; see grafana.persistence.storageClassName.

Type of the shared ReadWriteMany storage: efs, fsx, nfs, azurefile, rook-ceph, or custom-rwx (any other ReadWriteMany StorageClass). Leave empty on single-node installations, where storage is hostPath.

Required in cluster mode. Several Sisense services (query, build, management, ae, build-ec-mgmt, and bsm-executors) read this value. If it is empty, they treat the storage as hostPath even though they mount the shared PVC.

Only fsx changes how the chart deploys: the chart creates a static PersistentVolume for Amazon FSx for Lustre from sisense-utils.fsxDnsName and sisense-utils.fsxMountName.

StorageClass of the shared PVC (named storage): sisense-utils.rwxScName, if set, is always used. Otherwise, efs uses aws-efs, fsx uses aws-fsx, nfs uses nfs-csi (or nfs-client if global.storageClass is nfs-client), and rook-ceph uses rook-cephfs-r3. On Azure (global.kubernetesCloudProvider is azure), sisense-azurefile-premium or sisense-azurefile-csi-premium is used (see sisense-utils.azureCsi.enabled). In all other cases, set sisense-utils.rwxScName; otherwise, the PVC uses the default StorageClass of the cluster, which must support ReadWriteMany.

See Storage Requirements for Self-Deployment.

Annotates ElastiCube pods for VPN awareness.

Creates a Gateway API HTTPRoute that routes traffic for global.applicationDnsName to Sisense. This is the recommended way to expose Sisense over HTTPS.

The chart does not create the Gateway. Create it beforehand (for example, with NGINX Gateway Fabric), with a listener that terminates TLS. Requires the Gateway API CRDs, and global.applicationDnsName must be set to a host name.

When true, the legacy Ingress and the cloud load balancer (global.cloudLoadBalancer.enabled) are not rendered.

Name of the existing Gateway that the HTTPRoute attaches to.

Namespace of the existing Gateway that the HTTPRoute attaches to.

NGINX Gateway Fabric ClientSettingsPolicy for the HTTPRoute. Rendered only when api-gateway.httpRoute.enabled is true, and requires the NGINX Gateway Fabric CRDs. If your Gateway is not NGINX Gateway Fabric, set enabled to false.

body.maxSize is the maximum size of a request body. It allows the import of large .sdata files; if you lower it, larger imports fail with HTTP 413.

NGINX Gateway Fabric UpstreamSettingsPolicy (keepalive settings for the connections to Sisense). Rendered only when api-gateway.httpRoute.enabled is true, and requires the NGINX Gateway Fabric CRDs. If your Gateway is not NGINX Gateway Fabric, set to false.

NGINX Gateway Fabric SnippetsFilter that sets proxy timeouts (300 seconds for read and send). Rendered only when api-gateway.httpRoute.enabled is true. Requires NGINX Gateway Fabric with SnippetsFilters enabled (nginxGateway.snippetsFilters.enable: true in its Helm values). Otherwise, set to false.

Renders the legacy Kubernetes Ingress (ingress class nginx) when api-gateway.httpRoute.enabled is false. The Ingress is also rendered when global.ssl.enabled or api-gateway.ingress.awsAlb is true, or global.gatewayPort is 80.

The Ingress has no TLS section: TLS must be terminated by the ingress controller or load balancer.

Uses an AWS Application Load Balancer for the Ingress (ingress class alb, internet-facing). Requires the AWS Load Balancer Controller. Also set global.albController.enabled: true.

Additional annotations for the Ingress.

ARN of the AWS Certificate Manager certificate for the load balancer when api-gateway.ingress.awsAlb is true.

Set to false to skip installing Grafana. The Grafana subchart does not define this parameter, so Grafana is installed unless you set it to false.

Grafana admin credentials. Sisense signs in to Grafana as user-<namespace> with the password passwd-<namespace>. If you install Sisense in a namespace other than sisense, set these values to match the namespace (for example, user-mynamespace and passwd-mynamespace).

Optional; cluster mode only. Do not set on single-node installations.

The chart does not set a node affinity for Grafana. To keep Grafana on the Sisense nodes, set a required node affinity on the label node-<namespace>-Application=true, where <namespace> is your Sisense namespace (for example, key node-mynamespace-Application, operator In, values "true").

Prometheus data source of Grafana. Keep these values.

Set only if Sisense internal monitoring is installed: http://sisense-prom-operator-kube-prometheus.<monitoring-namespace>.svc:9090, where <monitoring-namespace> is the namespace of Sisense internal monitoring (monitoring by default).

Because this entry is part of a list, include the whole datasources[0] entry (name, type, access, isDefault, and url) when you set it.

Runs an init container as root (user 0, with the CHOWN, DAC_OVERRIDE, and FOWNER capabilities) that sets the owner of the Grafana data volume.

Set to false if the namespace does not allow containers that run as root (for example, a namespace that enforces the restricted Pod Security Standard). The volume must then already be writable by grafana.securityContext.runAsUser.

StorageClass of the Grafana PVC. Grafana does not use global.storageClass.

Single node: set to manual (the chart creates a hostPath PersistentVolume for Grafana) and set grafana.persistence.selectorLabels.app.

Cluster mode: set to your ReadWriteOnce StorageClass (for example, gp3). If not set, the PVC uses the default StorageClass of the cluster.

Single node only: set to grafana-<namespace> (for example, grafana-sisense) so that the Grafana PVC binds to the hostPath PersistentVolume that the chart creates. Do not set in cluster mode.

false: Grafana creates a ClusterRole and ClusterRoleBinding, even when global.clusterVisibility is false.

Set to true for namespace-scoped installations (global.clusterVisibility: false) so that Grafana uses a Role and RoleBinding in the Sisense namespace instead. Alternatively, set grafana.enabled: false.

Pod security context of Grafana. The chart default is 472 (the Grafana image user). The sisense.sh installer sets these values to the global.securityContext values (1000 by default); set them yourself if you want Grafana to run with the same user as Sisense.

Namespace in which the Grafana sidecar looks for dashboard ConfigMaps. When not set, the sidecar uses the namespace that Grafana runs in (the Sisense namespace), which is correct for a standard installation.

Namespace in which the Grafana sidecar looks for data source ConfigMaps. When not set, the sidecar uses the namespace that Grafana runs in (the Sisense namespace).

Installs the MongoDB that is bundled with the chart. Keep true.

standalone (default): MongoDB runs as a single Deployment that uses the PVC data-mongodb-0, which the chart creates only on single-node installations.

Required in cluster mode: set to replicaset. If you leave standalone in cluster mode, the MongoDB pod stays Pending because the PVC data-mongodb-0 does not exist.

Number of MongoDB members when mongodb.architecture is replicaset. Set to 3 when global.highAvailability is true, and to 1 when it is false. Sisense connects to three members when high availability is enabled, and to one member when it is not.

User of the MongoDB container. The sisense.sh installer sets it to global.securityContext.runAsUser (1000 by default).

Creates a PodDisruptionBudget for MongoDB. Set to true in cluster mode.

Size of the volume of each MongoDB member in cluster mode.

File system group of the MongoDB pod. The sisense.sh installer sets it to global.securityContext.fsGroup (1000 by default).

Runs an init container as root (user 0) that sets the owner of the MongoDB data volume. Set to false if the namespace does not allow containers that run as root; the volume must then already be writable by mongodb.containerSecurityContext.runAsUser.

mongodb.metrics.enabled adds a Prometheus exporter to MongoDB. Set it to true only if Sisense internal monitoring is installed (and global.monitoring.internal is true).

The other mongodb.metrics.* values are already set by the chart. The ServiceMonitor is created only when mongodb.metrics.enabled is true, and it requires the Prometheus Operator CRDs.

If Sisense internal monitoring is installed in a namespace other than monitoring, set mongodb.metrics.serviceMonitor.namespace to that namespace.

Deploys MongoDB Search (mongot), which provides MongoDB search and vector search. This feature is in public preview.

Works in single-node and cluster mode; on single-node installations, MongoDB runs as a one-member replica set.

Password of the MongoDB user that mongot uses. The chart creates the user. We recommend that you set your own password.

Cluster mode only: stores the search indexes on a PVC. On single-node installations, or when set to false, mongot uses an emptyDir volume and rebuilds its indexes from MongoDB after a restart.

StorageClass of the mongot PVC. When empty, global.storageClass is used, so if global.storageClass is manual in cluster mode, the mongot PVC stays Pending.

Size of the mongot PVC.

Optional; cluster mode only. Do not set on single-node installations.

The chart does not set a node affinity for RabbitMQ; it only spreads the RabbitMQ pods across nodes when possible. To keep RabbitMQ on the Sisense nodes, set a required node affinity on the label node-<namespace>-Application=true, where <namespace> is your Sisense namespace (for example, key node-mynamespace-Application, operator In, values "true").

The second term (nodeSelectorTerms[1], label node-<namespace>-Build=true) is optional. With both terms, a pod can run on a node that has either label.

Number of RabbitMQ pods. Set to 3 for high availability in cluster mode.

Set to false when rabbitmq.replicaCount is 1 (the sisense.sh installer does this for single-node installations and when high availability is disabled).

Set to true only if Sisense internal monitoring is installed. The RabbitMQ ServiceMonitor is created only when this value is true, and it requires the Prometheus Operator CRDs.

Azure only (global.kubernetesCloudProvider is azure): true uses the StorageClass sisense-azurefile-csi-premium for the shared storage PVC; false uses sisense-azurefile-premium. The StorageClass must exist. sisense-utils.rwxScName, if set, takes precedence.

Azure only (global.kubernetesCloudProvider is azure): the shared storage PVC requests the larger of sisense-utils.sisenseDiskSize and this value, in Gi. With the defaults, the PVC requests 1200 Gi.

Amazon FSx for Lustre only (global.storageType is fsx): DNS name and mount name of the FSx file system. The chart creates a static PersistentVolume for the shared storage PVC from these values.

Set to true to store the Sisense logs on the file system. The sisense.sh installer sets it to true.

Namespace in which Sisense internal monitoring is installed (usually monitoring). If it is installed in a different namespace, set that namespace.

If set to true, creates a Kubernetes LimitRange and ResourceQuota in the Sisense namespace with default values.

You can override the limits as follows:

sisense-utils:
  resourceQuota:
    enabled: true
    limits_cpu: 82
    limits_memory: 87

(limits_memory is in Gi.)

Cluster mode only: name of the ReadWriteMany StorageClass of the shared storage PVC (named storage). When set, it is always used, regardless of global.storageType and the Azure settings.

Set it on OpenShift, for global.storageType: custom-rwx, and whenever your ReadWriteMany StorageClass is not named as the chart expects for your global.storageType (for example, nfs-csi).

Not used on single-node installations.

Size, in Gi, of the shared storage PVC in cluster mode. On Azure, see sisense-utils.azureDefaultDiskSize.

Time zone of the Sisense services.

Optional; cluster mode only. Do not set on single-node installations.

The chart does not set a node affinity for ZooKeeper. To keep ZooKeeper on the Sisense nodes, set a required node affinity on the label node-<namespace>-Application=true, where <namespace> is your Sisense namespace (for example, key node-mynamespace-Application, operator In, values "true").

The second term (nodeSelectorTerms[1], label node-<namespace>-Build=true) is optional. With both terms, a pod can run on a node that has either label.

Number of ZooKeeper servers. Set to 3 for high availability in cluster mode.

The ZooKeeper subchart generates the ensemble (the server.N lines) from this value and the Helm release name. Do not set zookeeper.configuration with your own server.N lines: the pod names come from the release name, not from the namespace, and a hand-written list breaks the quorum when they do not match.

Maximum number of concurrent connections from a single client IP address. We recommend 1000, the value that the sisense.sh installer uses.

Other ZooKeeper settings are also plain values, for example zookeeper.maxSessionTimeout, zookeeper.fourlwCommandsWhitelist, zookeeper.autopurge.snapRetainCount, and zookeeper.autopurge.purgeInterval.

User of the ZooKeeper container. The sisense.sh installer sets it to global.securityContext.runAsUser (1000 by default).

Set to true only if Sisense internal monitoring is installed. The ZooKeeper ServiceMonitor is created only when this value is true, and it requires the Prometheus Operator CRDs.

Maximum number of ZooKeeper pods that can be unavailable during voluntary disruptions, such as node drains. The subchart creates a PodDisruptionBudget by default and uses 1 when this value is not set. With three servers, 1 keeps a ZooKeeper quorum during a drain.

Single node only: set to data-zookeeper-0, the PVC that the chart creates on the node's hostPath volume. Do not set in cluster mode.

Size of the volume of each ZooKeeper server in cluster mode. The sisense.sh installer sets 5Gi.