feat(DMVP-10317): add analytics component charts

README.md

@@ -7,6 +7,14 @@ helm repo add dasmeta https://dasmeta.github.io/helm
 
 ### The available charts and the docs how to configure them can be found in [./charts](./charts) folder. Chart-specific docs and example values live in each chart's README and in [examples/<chart-name>/](./examples/) (e.g. [examples/base/](./examples/base/)).
 
+### Analytics charts
+
+| Chart | Purpose | Documentation | Minimal values |
+| --- | --- | --- | --- |
+| `metabase` | Default analytics visualisation service | [README](./charts/metabase/README.md) | [example](./examples/metabase/minimal.yaml) |
+| `postgrest` | Read-only REST API over the analytics database | [README](./charts/postgrest/README.md) | [example](./examples/postgrest/minimal.yaml) |
+| `redash` | Optional visualisation provider | [README](./charts/redash/README.md) | [example](./examples/redash/minimal.yaml) |
+
 
 ## For developers
 1. enable local git pre-commit hooks by running the following command in your terminal

charts/metabase/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: base
+  repository: https://dasmeta.github.io/helm
+  version: 0.3.31
+digest: sha256:2c20b28ea353c938243258cbebb3fffda752688bbb7686c49ec0f7f990a62681
+generated: "2026-07-29T15:13:41.755884+04:00"

charts/metabase/Chart.yaml

@@ -0,0 +1,11 @@
+apiVersion: v2
+name: metabase
+description: Metabase deployment built on the DasMeta base chart
+type: application
+version: 0.1.0
+appVersion: "0.63.1"
+
+dependencies:
+  - name: base
+    version: 0.3.31
+    repository: https://dasmeta.github.io/helm

charts/metabase/README.md

@@ -0,0 +1,40 @@
+# Metabase
+
+Metabase is the default visualisation provider for the data-analytics platform. This chart is a thin wrapper around the published `dasmeta/base` chart; it deploys Metabase only and does not create its application database, users, grants, DNS, ingress controller, or secrets.
+
+## Prerequisites
+
+- A PostgreSQL application database and an application user, provisioned outside this chart.
+- A Kubernetes Secret containing Metabase runtime configuration. At minimum it must contain `MB_DB_TYPE=postgres` and `MB_DB_CONNECTION_URI`.
+- An ingress controller and DNS record if public access is enabled.
+
+## Install
+
+```bash
+helm repo add dasmeta https://dasmeta.github.io/helm
+helm upgrade --install metabase dasmeta/metabase \
+  --namespace analytics --create-namespace \
+  --version 0.1.0 \
+  -f examples/metabase/minimal.yaml
+```
+
+The example references `example-metabase-runtime`; create it through the platform secret-management flow before installing. Do not place credentials in Helm values.
+
+## Key values
+
+All application values are nested under `base` because this chart depends on `dasmeta/base`.
+
+| Key | Purpose |
+| --- | --- |
+| `base.envFrom` | References the Secret containing `MB_*` runtime settings. |
+| `base.ingress` | Enables and configures external access. |
+| `base.resources` | Configures Metabase resource requests and limits. |
+| `base.fullnameOverride` | Provides a stable service name. |
+
+## Validate locally
+
+From the repository root:
+
+```bash
+helm template metabase charts/metabase -f examples/metabase/minimal.yaml
+```

charts/metabase/values.yaml

@@ -0,0 +1,15 @@
+base:
+  appVersion: 0.63.1
+  replicaCount: 1
+  image:
+    repository: metabase/metabase
+    tag: v0.63.1.12
+    pullPolicy: Always
+  containerPort: 3000
+  service:
+    type: ClusterIP
+    port: 3000
+  serviceAccount:
+    create: false
+  ingress:
+    enabled: false

charts/postgrest/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: base
+  repository: https://dasmeta.github.io/helm
+  version: 0.3.31
+digest: sha256:2c20b28ea353c938243258cbebb3fffda752688bbb7686c49ec0f7f990a62681
+generated: "2026-07-29T15:13:41.755884+04:00"

charts/postgrest/Chart.yaml

@@ -0,0 +1,11 @@
+apiVersion: v2
+name: postgrest
+description: PostgREST deployment built on the DasMeta base chart
+type: application
+version: 0.1.0
+appVersion: "13.0.8"
+
+dependencies:
+  - name: base
+    version: 0.3.31
+    repository: https://dasmeta.github.io/helm

charts/postgrest/README.md

@@ -0,0 +1,40 @@
+# PostgREST
+
+PostgREST exposes the governed analytics schema through a REST API. This chart deploys PostgREST only; it does not provision PostgreSQL, roles, grants, schema migrations, DNS, ingress controller, or runtime secrets.
+
+## Prerequisites
+
+- A PostgreSQL analytics database with a dedicated API role and least-privilege grants.
+- A Kubernetes Secret with PostgREST configuration, including `PGRST_DB_URI`, `PGRST_DB_SCHEMAS`, `PGRST_DB_ANON_ROLE`, and `PGRST_JWT_SECRET` when JWT authentication is enabled.
+- An ingress controller and DNS record if the API is exposed externally.
+
+## Install
+
+```bash
+helm repo add dasmeta https://dasmeta.github.io/helm
+helm upgrade --install postgrest dasmeta/postgrest \
+  --namespace analytics --create-namespace \
+  --version 0.1.0 \
+  -f examples/postgrest/minimal.yaml
+```
+
+The referenced Secret is created by the platform secret-management flow. Keep database credentials and JWT keys out of Helm values.
+
+## Key values
+
+All application values are nested under `base` because this chart depends on `dasmeta/base`.
+
+| Key | Purpose |
+| --- | --- |
+| `base.envFrom` | References the Secret containing `PGRST_*` runtime settings. |
+| `base.ingress` | Enables and configures API exposure. |
+| `base.resources` | Configures PostgREST resource requests and limits. |
+| `base.fullnameOverride` | Provides a stable internal service name. |
+
+## Validate locally
+
+From the repository root:
+
+```bash
+helm template postgrest charts/postgrest -f examples/postgrest/minimal.yaml
+```

charts/postgrest/values.yaml

@@ -0,0 +1,14 @@
+base:
+  appVersion: 13.0.8
+  image:
+    repository: postgrest/postgrest
+    tag: v13.0.8
+    pullPolicy: Always
+  containerPort: 3000
+  service:
+    type: ClusterIP
+    port: 3000
+  serviceAccount:
+    create: false
+  ingress:
+    enabled: false

charts/redash/Chart.lock

@@ -0,0 +1,18 @@
+dependencies:
+- name: base
+  repository: https://dasmeta.github.io/helm
+  version: 0.3.31
+- name: base
+  repository: https://dasmeta.github.io/helm
+  version: 0.3.31
+- name: base
+  repository: https://dasmeta.github.io/helm
+  version: 0.3.31
+- name: base
+  repository: https://dasmeta.github.io/helm
+  version: 0.3.31
+- name: base
+  repository: https://dasmeta.github.io/helm
+  version: 0.3.31
+digest: sha256:e7a0e6502f1d21e6ecb8f43a2e2448e18cadbe63583e3c96efefec72961d7cd3
+generated: "2026-07-29T15:13:45.905818+04:00"

charts/redash/Chart.yaml

@@ -0,0 +1,28 @@
+apiVersion: v2
+name: redash
+description: Redash topology built on DasMeta base chart dependencies
+type: application
+version: 0.1.0
+appVersion: "26.3.0"
+
+dependencies:
+  - name: base
+    alias: server
+    version: 0.3.31
+    repository: https://dasmeta.github.io/helm
+  - name: base
+    alias: scheduler
+    version: 0.3.31
+    repository: https://dasmeta.github.io/helm
+  - name: base
+    alias: scheduledWorker
+    version: 0.3.31
+    repository: https://dasmeta.github.io/helm
+  - name: base
+    alias: adhocWorker
+    version: 0.3.31
+    repository: https://dasmeta.github.io/helm
+  - name: base
+    alias: defaultWorker
+    version: 0.3.31
+    repository: https://dasmeta.github.io/helm

charts/redash/README.md

@@ -0,0 +1,43 @@
+# Redash
+
+Redash is an optional visualisation provider for the data-analytics platform. The chart deploys the native Redash server, scheduler, and worker topology through aliases of the published `dasmeta/base` chart. It does not provision PostgreSQL, Redis, users, grants, DNS, ingress controller, or runtime secrets.
+
+## Prerequisites
+
+- A PostgreSQL application database and a Redis endpoint, provisioned outside this chart.
+- A Kubernetes Secret containing `REDASH_DATABASE_URL`, `REDASH_REDIS_URL`, `REDASH_COOKIE_SECRET`, and `REDASH_SECRET_KEY`.
+- An ingress controller and DNS record if public access is enabled.
+
+The first deployment must run Redash's native `create_db` command. The minimal example does this as a server init container before the web server starts. The command uses the same externally managed runtime Secret as the Redash services.
+
+## Install
+
+```bash
+helm repo add dasmeta https://dasmeta.github.io/helm
+helm upgrade --install redash dasmeta/redash \
+  --namespace analytics --create-namespace \
+  --version 0.1.0 \
+  -f examples/redash/minimal.yaml
+```
+
+The referenced Secret is created by the platform secret-management flow. Do not place Redash database, Redis, or cryptographic keys in Helm values.
+
+## Components and key values
+
+| Component | Values key | Native command | Default queues |
+| --- | --- | --- | --- |
+| Web server | `server` | `server` | — |
+| Scheduler | `scheduler` | `scheduler` | — |
+| Scheduled worker | `scheduledWorker` | `worker` | `scheduled_queries,schemas` |
+| Ad-hoc worker | `adhocWorker` | `worker` | `queries` |
+| Default worker | `defaultWorker` | `worker` | `periodic,emails,default` |
+
+Each component has its own `envFrom`, `resources`, `replicaCount`, and scheduling values. Only `server.ingress` exposes a Service by default. The Redash image entrypoint receives the native command through the component's `args` value. Resource names include the Helm release name, so separate releases do not collide in one namespace.
+
+## Validate locally
+
+From the repository root:
+
+```bash
+helm template redash charts/redash -f examples/redash/minimal.yaml
+```

charts/redash/values.yaml

@@ -0,0 +1,85 @@
+server:
+  # Inherited base-chart naming: keep fullnameOverride empty so the release name
+  # remains in resource names; the unique nameOverride scopes this component.
+  nameOverride: redash-server
+  appVersion: 26.3.0
+  image:
+    repository: redash/redash
+    tag: 26.3.0
+    pullPolicy: Always
+  replicaCount: 1
+  containerPort: 5000
+  service:
+    type: ClusterIP
+    port: 5000
+  serviceAccount:
+    create: false
+  ingress:
+    enabled: false
+  args:
+    - server
+
+scheduler:
+  nameOverride: redash-scheduler
+  appVersion: 26.3.0
+  image:
+    repository: redash/redash
+    tag: 26.3.0
+    pullPolicy: Always
+  service:
+    enabled: false
+  serviceAccount:
+    create: false
+  args:
+    - scheduler
+
+scheduledWorker:
+  nameOverride: redash-scheduled-worker
+  appVersion: 26.3.0
+  image:
+    repository: redash/redash
+    tag: 26.3.0
+    pullPolicy: Always
+  service:
+    enabled: false
+  serviceAccount:
+    create: false
+  args:
+    - worker
+  extraEnv:
+    QUEUES: scheduled_queries,schemas
+    WORKERS_COUNT: "1"
+
+adhocWorker:
+  nameOverride: redash-adhoc-worker
+  appVersion: 26.3.0
+  image:
+    repository: redash/redash
+    tag: 26.3.0
+    pullPolicy: Always
+  service:
+    enabled: false
+  serviceAccount:
+    create: false
+  args:
+    - worker
+  extraEnv:
+    QUEUES: queries
+    WORKERS_COUNT: "2"
+
+defaultWorker:
+  nameOverride: redash-default-worker
+  appVersion: 26.3.0
+  image:
+    repository: redash/redash
+    tag: 26.3.0
+    pullPolicy: Always
+  service:
+    enabled: false
+  serviceAccount:
+    create: false
+  args:
+    - worker
+  extraEnv:
+    QUEUES: periodic,emails,default
+    WORKERS_COUNT: "1"

examples/metabase/minimal.yaml

@@ -0,0 +1,11 @@
+# Runtime credentials are supplied by the platform secret-management flow.
+base:
+  fullnameOverride: example-metabase
+  envFrom:
+    secret: example-metabase-runtime
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      memory: 1Gi

examples/postgrest/minimal.yaml

@@ -0,0 +1,11 @@
+# Runtime credentials and JWT keys are supplied by the platform secret-management flow.
+base:
+  fullnameOverride: example-postgrest
+  envFrom:
+    secret: example-postgrest-runtime
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      memory: 256Mi