Kubernetes and OpenShift

The bundle's kubernetes/ folder deploys DataFactory with kubectl alone. It works on Amazon EKS, Azure AKS, Google GKE, Red Hat OpenShift, SUSE Rancher, k3s and other conformant clusters.

What you need

	Notes
Kubernetes	1.27 or later, x86_64 nodes
kubectl	Matching your cluster
Container registry	One your cluster can pull from (Harbor, Artifactory, Nexus, ECR, ACR, Artifact Registry, the OpenShift internal registry)
Storage	A storage class for the shared data volume; ReadWriteMany (EFS, Azure Files, Filestore, NFS, CephFS) when pods can run on different nodes
Ingress	An ingress controller, or OpenShift Routes
TLS certificate	For the host name users browse to
PostgreSQL 18 and Redis 7	Your own (for example RDS and ElastiCache), or the in-cluster ones in the manifests

The default replicas need about 2 vCPU and 12 GB of memory across the cluster, plus PostgreSQL and Redis.

1. Copy the images into your registry

From the extracted bundle, after signing in to your registry:

./push-images.sh registry.example.com/datafactory

2. Configure

cd kubernetes
cp secrets.env.template secrets.env

1. kustomization.yaml: set newName for each image to your registry path.

2. config.env: set PUBLIC_HOST. To use your own PostgreSQL and Redis, set POSTGRES_HOST, POSTGRES_SSLMODE and REDIS_URI, and remove the components/in-cluster-data line from kustomization.yaml.

3. secrets.env: fill in every value, including LICENCE. Generate the two keys with the image:

   docker run --rm --entrypoint python registry.example.com/datafactory/datashrink-be:<version> -c \
     "import secrets; from cryptography.fernet import Fernet; print(secrets.token_hex(32)); print(Fernet.generate_key().decode())"

   The first line is SECRET_KEY, the second CREDENTIALS_ENCRYPTION_KEY.

Keep a copy of secrets.env

Saved database passwords are encrypted with CREDENTIALS_ENCRYPTION_KEY. Without it they can't be read.

The namespace is datafactory. To use another, change namespace: in kustomization.yaml and the namespace in API_UPSTREAM in config.env.

3. Deploy

kubectl create namespace datafactory
kubectl -n datafactory create secret tls datafactory-tls --cert=tls.crt --key=tls.key
kubectl apply -k .
kubectl -n datafactory rollout status deploy

The first API pod creates the database and the first admin. Browse to https://<PUBLIC_HOST>, sign in as admin with ROOT_PASSWORD from secrets.env, and change the password.

OpenShift

In kustomization.yaml, enable components/openshift and remove components/in-cluster-data. Use your own PostgreSQL and Redis, because those images start as root.

The component replaces the Ingress with a Route and lets OpenShift assign user and group IDs; DataFactory runs under the default restricted-v2 policy. Skip the datafactory-tls secret: the Route uses the router's certificate unless you add your own to components/openshift/route.yaml.

Ingress timeouts

Prune progress streams over one long request. Set the ingress read or idle timeout to one hour, and turn off response buffering if your controller buffers by default.