Helm / Kubernetes

Deploy Marmot to your Kubernetes cluster using our official Helm chart.

Quick Start

1. 1

   Add the Helm repository

   helm repo add marmotdata https://marmotdata.github.io/charts
   helm repo update

2. 2

   Install Marmot

   helm install marmot marmotdata/marmot

3. 3

   Access the UI

   Port-forward to access the dashboard:

   kubectl port-forward svc/marmot 8080:8080

   Open http://localhost:8080 in your browser.

Default Credentials

The default username and password is admin:admin. Change this after your first login.

---

Database Configuration

Marmot requires PostgreSQL. Choose one of the following options:

Connect Marmot to your existing PostgreSQL database:

config:
  database:
    host: postgres.example.com
    port: 5432
    user: marmot
    passwordSecretRef:
      name: marmot-db-secret
      key: password
    name: marmot
    sslmode: require

For development and testing, enable the embedded PostgreSQL:

helm install marmot marmotdata/marmot \
  --set postgresql.enabled=true

The chart generates a PostgreSQL password Secret named <release>-postgresql with a password key and reuses it on upgrades. To use an existing Secret:

postgresql:
  auth:
    existingSecret: marmot-postgres-credentials
    passwordKey: password

For production Kubernetes deployments, CloudNativePG provides a robust PostgreSQL operator with automatic failover, read replicas and connection pooling.

1. 1

   Install the CloudNativePG operator

   Follow the CloudNativePG installation guide to install the operator. The quickest method:

   kubectl apply --server-side -f \
     https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/releases/cnpg-1.25.1.yaml

2. 2

   Configure and install Marmot with CNPG

   # values.yaml
   cnpg:
     enabled: true
     instances: 3  # 1 primary + 2 read replicas
     password: "your-secure-password"
   
     parameters:
       shared_buffers: "256MB"
       work_mem: "64MB"
       effective_cache_size: "1GB"
   
     persistence:
       size: "10Gi"
   
     pooler:
       enabled: true
       instances: 2
       poolMode: "transaction"

   helm install marmot marmotdata/marmot -f values.yaml

3. 3

   Verify the cluster is ready

   kubectl get clusters
   kubectl get pods -l cnpg.io/cluster=marmot-cnpg

   All pods should show Running status with the primary indicated by the -1 suffix.

---

Encryption Key

Marmot encrypts sensitive pipeline credentials at rest. You must configure an encryption key.

The Helm chart can auto-generate an encryption key for you (enabled by default):

config:
  server:
    autoGenerateEncryptionKey: true

Back Up Your Key

If the generated secret is deleted, you'll lose access to encrypted credentials. Back it up immediately after installation.

Retrieve the auto-generated key:

kubectl get secret <release-name>-marmot-encryption-key \
  -o jsonpath='{.data.encryption-key}' | base64 -d

1. 1

   Generate an encryption key

   marmot generate-encryption-key
   # or
   openssl rand -base64 32

2. 2

   Create a Kubernetes secret

   kubectl create secret generic marmot-encryption \
     --from-literal=encryption-key="your-generated-key"

3. 3

   Configure the Helm chart

   config:
     server:
       autoGenerateEncryptionKey: false
       encryptionKeySecretRef:
         name: marmot-encryption
         key: encryption-key

For local development only, you can disable encryption entirely:

config:
  server:
    autoGenerateEncryptionKey: false
    allowUnencrypted: true

Security Risk

This stores all credentials in plaintext. Never use this in production.

---

Reference

For all available configuration options, view the chart's defaults:

helm show values marmotdata/marmot

Or browse the values.yaml on GitHub.

Next Steps

• Add Data with PluginsAutomatically discover assets from your data sources
• Configure AuthenticationSet up SSO with GitHub, Google, Okta and more