Apache Druid

Deploy Apache Druid on Kubernetes — a high-performance real-time analytics database for fast slice-and-dice analysis on large datasets, commonly used as the backend for BI dashboards and real-time data exploration.

Component Architecture

Key Features

• Modular Druid topology — coordinator, broker, and router by default; ingestion and segment serving are opt-in
• Deep storage — local (dev) or S3/MinIO (production)
• Persistent task and segment storage — historical and middlemanager PVCs are created when those components are enabled
• ZooKeeper — bundled native StatefulSet or external connection string
• PostgreSQL metadata — bundled subchart or external PostgreSQL/MySQL
• Gateway API — optional native Kubernetes HTTPRoute for the router/web console
• Dual-stack Services — optional ipFamilyPolicy and ipFamilies for IPv4/IPv6 clusters
• External Secrets Operator — optional ExternalSecret resources for metadata and S3 credentials
• NetworkPolicy — optional ingress and egress controls for compatible CNIs

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install druid helmforge/druid -f values.yaml

OCI registry:

helm install druid oci://ghcr.io/helmforgedev/helm/druid -f values.yaml

Deployment Examples

# values.yaml — Druid development mode with local ingestion
# Local deep storage is for tests and single-node evaluation, not production.

overlord:
  enabled: true

historical:
  enabled: true
  persistence:
    size: 50Gi

middleManager:
  enabled: true
  persistence:
    size: 20Gi

postgresql:
  enabled: true
  auth:
    password: 'db-password'

zookeeper:
  enabled: true
  replicaCount: 1

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: druid.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Druid production mode with S3 deep storage (required for HA)
deepStorage:
  type: s3
  s3:
    bucket: druid-deep-storage
    baseKey: druid/segments
    region: us-east-1
    endpointUrl: '' # set for MinIO: https://minio.example.com
    existingSecret: druid-s3-credentials
    existingSecretAccessKeyKey: access-key
    existingSecretSecretKeyKey: secret-key

coordinator:
  javaOpts: '-Xms512m -Xmx1g'

overlord:
  enabled: true
  javaOpts: '-Xms512m -Xmx1g'

broker:
  javaOpts: '-Xms1g -Xmx2g'

historical:
  enabled: true
  javaOpts: '-Xms1g -Xmx2g'
  persistence:
    size: 100Gi # local segment cache only; segments also stored in S3

middleManager:
  enabled: true
  workerCapacity: 4
  persistence:
    size: 50Gi

postgresql:
  enabled: true
  auth:
    password: 'strong-db-password'

zookeeper:
  enabled: true
  replicaCount: 3
  persistence:
    size: 5Gi

ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: druid.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: druid-tls
      hosts:
        - druid.example.com

# values.yaml — Druid with external PostgreSQL and ZooKeeper
postgresql:
  enabled: false

zookeeper:
  enabled: false

metadata:
  mode: external
  external:
    type: postgresql
    host: postgres.database.svc.cluster.local
    port: 5432
    name: druid
    username: druid
    existingSecret: druid-db-credentials
    existingSecretPasswordKey: password

zookeeperConfig:
  mode: external
  external:
    hosts: 'zk-0.zookeeper:2181,zk-1.zookeeper:2181,zk-2.zookeeper:2181'

deepStorage:
  type: s3
  s3:
    bucket: druid-segments
    existingSecret: druid-s3-credentials

overlord:
  enabled: true

historical:
  enabled: true

middleManager:
  enabled: true

# values.yaml — Druid horizontally scaled (multiple brokers and historical nodes)
deepStorage:
  type: s3
  s3:
    bucket: druid-segments
    existingSecret: druid-s3-credentials

# Scale query layer
broker:
  replicaCount: 3
  javaOpts: '-Xms2g -Xmx4g'

# Enable ingestion coordination
overlord:
  enabled: true

# Scale storage layer (shared S3 enables multiple historical nodes)
historical:
  enabled: true
  replicaCount: 3
  javaOpts: '-Xms2g -Xmx4g'
  persistence:
    size: 200Gi

# Scale ingestion layer
middleManager:
  enabled: true
  replicaCount: 2
  workerCapacity: 8
  persistence:
    size: 100Gi

postgresql:
  enabled: true
  auth:
    password: 'strong-db-password'

zookeeper:
  enabled: true
  replicaCount: 3

Configuration Reference

Image

Components

Every component uses the same shape, but default enablement differs by role:

Historical and middlemanager also have:

Deep Storage

Metadata and ZooKeeper

Service and Ingress

Dual-stack fields are omitted by default so Services inherit the cluster defaults. Set them only when your cluster has IPv6 or dual-stack networking enabled:

service:
  ipFamilyPolicy: PreferDualStack
  ipFamilies:
    - IPv4
    - IPv6

Gateway API

The chart can render a native Kubernetes Gateway API HTTPRoute for the Druid router. It intentionally does not create a Gateway; reference the shared Gateway provided by your cluster platform.

gatewayAPI:
  enabled: true
  parentRefs:
    - name: shared-gateway
      namespace: gateway-system
      sectionName: https
  hostnames:
    - druid.example.com
  paths:
    - type: PathPrefix
      value: /

External Secrets

When External Secrets Operator is installed, the chart can render ExternalSecret resources for metadata and S3 credentials. Set the chart existingSecret values to the same Secret names ESO will create so workloads consume externally managed credentials.

metadata:
  mode: external
  external:
    existingSecret: druid-metadata

deepStorage:
  type: s3
  s3:
    bucket: druid-segments
    existingSecret: druid-s3

externalSecrets:
  enabled: true
  secretStoreRef:
    name: platform-secrets
    kind: ClusterSecretStore
  metadata:
    enabled: true
    data:
      - secretKey: password
        remoteRef:
          key: druid/metadata
          property: password
  deepStorage:
    enabled: true
    data:
      - secretKey: access-key
        remoteRef:
          key: druid/s3
          property: access-key
      - secretKey: secret-key
        remoteRef:
          key: druid/s3
          property: secret-key

Security Context

Druid workload containers run as UID/GID 1000 by default with privilege escalation disabled, all Linux capabilities dropped, and the runtime default seccomp profile. The prepare-dirs init container runs as root only to create and chown writable Druid directories.

NetworkPolicy

NetworkPolicy is opt-in because enforcement depends on the cluster CNI. When enabled, ingress defaults to same-namespace traffic on Druid component ports. Egress rules are optional and can allow DNS, same-namespace dependencies, HTTP, HTTPS, and extra peers:

networkPolicy:
  enabled: true
  ingress:
    allowSameNamespace: true
  egress:
    enabled: true
    allowDNS: true
    allowSameNamespace: true
    allowHTTPS: true

More Information

• Apache Druid Official Documentation
• Apache Druid GitHub Repository
• Kubernetes Gateway API
• Kubernetes IPv4/IPv6 dual-stack
• HelmForge Druid Chart Source