Helm-Based installation | Continuous Compliance 2026.5

Helm provides a packaged, repeatable installation model that mirrors the existing manifests but simplifies configuration and upgrades.

Overview

The Delphix Containerized Masking Helm chart packages the same components as the Direct Kubernetes Installation into a versioned, configurable release.

Prerequisites

To deploy Containerized Masking via Helm, the following components are required:

Requirement	Recommended Version	Comments
Kubernetes Cluster	1.25 or above	Any Certified Kubernetes platform
Helm	3.9.0 or above	Installation instructions: helm.sh/docs/intro/install/
kubectl	1.25.0 or above	Used to interact with the Kubernetes cluster

Additional requirements

Cluster permissions to create namespaces, StatefulSets, Services, and PersistentVolumeClaims
Access to container images (registry credentials or pre-loaded images)
Familiarity with Resource Requirements for Containerized Masking

Obtaining the Helm chart

Charts are available from the Containerized Masking S3 Helm repository. Download the chart tarball:

curl -XGET https://delphix-masking-helm.s3.amazonaws.com/delphix-containerized-masking-<version>.tgz \ 
  -o delphix-containerized-masking-<version>.tgz

Optional integrity check:

curl -XGET https://delphix-masking-helm.s3.amazonaws.com/index.yaml -o index.yaml 
shasum -a 256 delphix-containerized-masking-<version>.tgz

Verify the SHA-256 output matches the digest value for the same chart version in index.yaml.

Installation

Extract and Configure. Extract the chart and edit values-prod.yaml:
```
tar -xzf delphix-containerized-masking-<version>.tgz 
cd delphix-containerized-masking
```
The extracted chart has the following structure:
```
delphix-containerized-masking 
├── Chart.yaml 
├── README.md 
├── values.yaml 
├── values-prod.yaml 
├── values.schema.json 
└── templates 
  ├── NOTES.txt 
  ├── docker-registry-secret.yaml 
  ├── namespace.yaml 
  ├── persistentvolume-nfs.yaml 
  ├── persistentvolumeclaim-nfs.yaml 
  ├── service-masking.yaml 
  ├── service-masking-debugging.yaml 
  └── statefulset.yaml
```
Configure the following settings in values-prod.yaml:
- Registry credentials (imageCredentials.registry, imageCredentials.registryKey): Set the registry hostname and the name of a pre-created Kubernetes pull Secret. Create the Secret with kubectl create secret docker-registry.
- Storage size (storage.persistent.size): Use 50Gi minimum for production
- Storage class (storage.persistent.storageClassName): Set if your cluster requires it
- Image tags (images.database.tag, images.app.tag, images.proxy.tag): Release charts are pre-set to matching tags; change only when intentionally overriding images (for example, air-gapped or custom registry workflows)
- Init permissions (initPermissions.enabled): Enable when storage classes do not honor fsGroup. When containerSecurityContext.readOnlyRootFilesystem is true, the chart uses the initContainer that also seeds nginx scratch directories; when false, a permissions-only initContainer is used
- Remote file access (storage.nfs): Configure when NFS-based remote mounts are required
- Custom TLS certificates (proxyCerts): Configure to use custom proxy certificates
- Container resources (resources): Set CPU/memory per resource requirements
- Security context (podSecurityContext, containerSecurityContext): Both blocks have sensible defaults; the chart sets readOnlyRootFilesystem: true by default. Override containerSecurityContext.readOnlyRootFilesystem: false only to restore legacy behavior.

Install the Release

helm upgrade --install delphix-masking \ 
  delphix-containerized-masking-<version>.tgz \ 
  --namespace delphix-masking \ 
  --create-namespace \ 
  --values <directory path of the extracted chart>/values-prod.yaml

Verify Deployment
```
helm status delphix-masking --namespace delphix-masking 
kubectl get pods --namespace delphix-masking
```
Wait for pod delphix-masking-0 to reach Running status (it may take several minutes).

Key configuration options

Image sourcing

Registry-based (with credentials):

imageCredentials: 
  registry: "masking.download.delphix.com" 
  registryKey: "<pre-created-pull-secret-name>" 
imagePullPolicy: IfNotPresent

Air-gapped (pre-loaded images):

imageCredentials: 
  registry: "" 
imagePullPolicy: Never 
images: 
  database: 
    repository: "delphix-masking-database" 
  app: 
    repository: "delphix-masking-app"   
  proxy: 
    repository: "delphix-masking-proxy"

For image loading procedures, see Direct Kubernetes Installation.

Storage and resources

All storage and resource configuration follows the same requirements as Direct Kubernetes Installation. Key values-prod.yaml settings:

storage.persistent.size - PVC size (50Gi minimum)
storage.persistent.storageClassName - Storage class (leave empty for cluster default)
initPermissions.enabled - Enable for storage classes that don't honor fsGroup
resources.app, resources.database, resources.proxy - CPU/memory requests

For sizing guidance, see Resource Requirements.

Network access

Default service configuration

services: 
  masking: 
    type: NodePort 
    nodePorts: 
      http: 30080 
      https: 30443

Access the application at https://<node-ip>:30443/masking.

Change type: ClusterIP or type: NodePort as needed for your environment.

Read-only root filesystem

By default, containerSecurityContext.readOnlyRootFilesystem is set to true on the mds, app, and proxy containers. The chart creates and mounts the following emptyDir volumes so paths the engine writes to at runtime remain writable. emptyDir contents are ephemeral and do not persist across pod restarts.

Container	Paths
mds	/tmp, /var/tmp, /var/run/postgresql
app	/tmp, /var/tmp, /var/delphix/ssl, /var/delphix/sfdc/dxrt
Proxy	/tmp, /var/cache, /var/run, /etc/config

When enabled, the chart's initContainer also seeds the directories nginx expects to find pre-existing. When proxyConfig.enabled: true, the proxy /etc/config emptyDir is replaced by the ConfigMap mount (proxyCerts is unaffected).

To opt out, set containerSecurityContext.readOnlyRootFilesystem: false.

Upgrades and Rollbacks

Upgrading

Download new chart version
Update image tags in your values file (all three must match release version)

Run upgrade:

helm upgrade delphix-masking \ 
  path/to/delphix-containerized-masking-<new-version>.tgz \ 
  --namespace delphix-masking \ 
  --values path/to/delphix-containerized-masking/values-prod.yaml

PersistentVolumeClaims are preserved during upgrades, maintaining application state.

Rolling back

Rolling back is not recommended after upgrading.

Advanced configuration

Rendering manifests

helm template delphix-masking \ 
  path/to/delphix-containerized-masking-<version>.tgz \ 
  --namespace delphix-masking \ 
  --values path/to/delphix-containerized-masking/values-prod.yaml > my-manifest.yaml

Deploy with: kubectl apply -f my-manifest.yaml.

This bypasses Helm release management (no upgrade/rollback capability).

Custom TLS certificates and LDAP Truststore

Create secret with certificates

kubectl create secret generic proxy-certs \ 
  --namespace delphix-masking \ 
  --from-file=server.crt --from-file=server.key

Reference in values

proxyConfig: 
  enabled: false 
  configMapName: "" 
  mountPath: "/etc/config" 

proxyCerts: 
  enabled: true 
  secretName: "proxy-certs" 
  mountPath: "/etc/config/nginx/ssl" 

ldapSsl: 
  enabled: false 
  configMapName: "ldap-ssl-config" 
  fileName: ".masking_certs" 
  mountPath: "/var/delphix/ssl/.masking_certs"

When proxyConfig.enabled: true, the ConfigMap takes the place of the proxy /etc/config emptyDir created by the read-only root filesystem defaults; do not configure both.

Per-Container resources

Specify resource requests/limits in values.yaml.

resources: 
  database: 
    requests: 
      cpu: 4 
      memory: 32Gi 
  app: 
    requests: 
      cpu: 8 
      memory: 128Gi 
    limits: 
      memory: 128Gi  # Must equal request for app container 
  proxy: 
    requests: 
      cpu: 1 
      memory: 1Gi

Troubleshooting

Common diagnostics

kubectl get pods --namespace delphix-masking 
kubectl describe pod delphix-masking-0 --namespace delphix-masking 
kubectl logs delphix-masking-0 --namespace delphix-masking --container app

Helm-specific issues

Image pull errors: Verify imageCredentials.registry and imageCredentials.registryKey in your values file. Confirm the pull Secret named by registryKey exists in the namespace via kubectl get secret -n delphix-masking.
registryKey not set: registryKey defaults to empty in values-prod.yaml. When empty, the chart omits imagePullSecrets, and the pod attempts to pull without credentials. Set registryKey to the name of a pre-created docker-registry Secret containing your download.delphix.com credentials.
Repository name mismatch: The chart constructs image references as {imageCredentials.registry}/{images.*.repository}:{tag}. The default images.*.repository value is delphix-containerized-masking; it must match the provisioned repository name exactly. A mismatch returns "repository not found."
Permission errors: Set initPermissions.enabled: true for storage classes that don't honor fsGroup.
Chart validation errors: Run helm lint on the chart directory before installing.

For general Containerized Masking troubleshooting, see Direct Kubernetes Installation.

Uninstalling

helm uninstall delphix-masking --namespace delphix-masking

PVCs are retained. To delete all data:

kubectl delete pvc --namespace delphix-masking --all 
kubectl delete namespace delphix-masking

Additional resources

Direct Kubernetes Installation
Resource Requirements
Custom TLS certificates and LDAP Truststore

Last updated

Sep 29, 2026