K3s
Lightweight Kubernetes ..
K3s
K3s is a lightweight, certified Kubernetes distribution designed for resource-constrained environments, edge computing, IoT devices, and development scenarios. Created by Rancher Labs (now part of SUSE), it packages everything needed to run Kubernetes into a single binary under 100MB.
This makes K3s significantly lighter than standard Kubernetes while maintaining full compatibility with Kubernetes APIs and features. It requires minimal memory (512MB minimum) and offers simplified operations with reduced dependencies.
K3s comes with built-in components like the Traefik ingress controller, local storage provisioner, and service load balancer. It's perfect for development, CI/CD, edge deployments, and ARM devices, yet remains production-ready with high availability capabilities.

K3s Core Components
Control Plane Components
The control plane includes the API Server (Kubernetes API endpoint for cluster management), Controller Manager (manages core control loops for replication, endpoints, and namespaces), and Scheduler (assigns pods to nodes based on resource availability).
K3s can use either etcd or lightweight SQLite as the datastore for cluster state, making it more flexible than standard Kubernetes.
Node Components
Each node runs the Kubelet agent which manages pod lifecycle. Containerd is built-in as the container runtime for running containers.
Kube-proxy manages network proxying and service networking across the cluster.
Built-in Add-ons
K3s includes Traefik Ingress Controller for routing external HTTP/HTTPS traffic to services. The Local Path Provisioner enables dynamic persistent volume provisioning using local storage.
CoreDNS provides cluster DNS for service discovery. The Service Load Balancer manages LoadBalancer-type services without requiring external cloud provider integrations.
Networking
Flannel serves as the default CNI (Container Network Interface) plugin for pod networking. Network Policies control traffic flow between pods and services for enhanced security.

Pentaho Server Pod
Runs Tomcat application server with Pentaho Server 11
Built on Debian Trixie Slim with OpenJDK 21 JRE
Multi-stage Docker build for optimized image size
Exposed internally on port 8080
Includes readiness and liveness probes for health monitoring
Resource limits configured for CPU and memory stability



Pentaho Server requires three separate databases, each serving a distinct purpose:
jackrabbit
jcr_user
Java Content Repository (JCR) - Stores all Pentaho content including reports, dashboards, data sources, analysis schemas, and user files. This is the primary content storage for the Pentaho repository.
quartz
pentaho_user
Quartz Scheduler - Manages all scheduled jobs, triggers, and calendars. Contains tables for job definitions (QRTZ6_JOB_DETAILS), triggers (QRTZ6_TRIGGERS), execution history, and cluster coordination locks.
hibernate
hibuser
Hibernate Repository - Hosts security configuration, audit logging, user session data, and contains two additional schemas: pentaho_dilogs (ETL execution logging) and pentaho_operations_mart (analytics data mart).
Netwoking
Internal Communication:
Both pods run within the
pentahonamespaceClusterIP services provide stable internal DNS names
PostgreSQL accessible at
postgresql.pentaho.svc.cluster.local:5432Pentaho Server accessible at
pentaho-server.pentaho.svc.cluster.local:8080
External Access:
Traefik Ingress Controller routes external traffic to Pentaho Server
Configurable hostname and path-based routing
Optional TLS/SSL termination support
Tomcat manages connection pools defined in context.xml. Each pool serves a specific purpose:
jdbc/Hibernate
repository:5432/hibernate
Security, Users, Roles
jdbc/Quartz
repository:5432/quartz
Job Scheduling
jdbc/jackrabbit
repository:5432/jackrabbit
Content Repository
jdbc/Audit
repository:5432/hibernate
Audit Logging
jdbc/live_logging_info
repository:5432/hibernate
ETL Runtime Logs
jdbc/PDI_Operations_Mart
repository:5432/hibernate
Operations Analytics
Storage
PersistentVolumeClaims (PVCs):
postgres-pvc: PostgreSQL data directory (/var/lib/postgresql/data)pentaho-pvc: Pentaho solutions and data directories
Storage Class:
Uses K3s's built-in
local-pathstorage provisionerProvisions volumes on node's local filesystem
Automatic volume creation and binding
ConfigMaps:
Database initialization scripts (5 SQL files)
Pentaho configuration settings (JVM parameters, Tomcat settings)
Secrets:
PostgreSQL credentials (postgres_password, pentaho_user, pentaho_password)
JDBC connection strings
Base64-encoded for security
Before you begin the K3s deployment, ensure you have completed the Setup: Pentaho Containers
Run through the following steps to deploy Pentaho Server on a single-node K3s with PostgreSQL 15 repository.
Prepare Environment
The "Prepare Environment" section outlines the initial setup steps required before deploying Pentaho Server 11 on K3s:
copying the deployment assets to your home directory,
staging the Pentaho Server Enterprise Edition ZIP file, verifying the file is in place,
confirming K3s is properly installed and running
Ensure you have downloaded: pentaho-server-ee-11.0.0.0-237.zip
Create directory & copy over assets.
Copy over the pentaho-server-ee-11.0.0.0-237.zip /docker/stagedArtefacts directory.
Verify that the file.
Verify the K3s installation.

Pentaho Server requires a valid license. The
.envfile contains a LICENSE_URL pointing to the Flexera license server. Ensure your license entitlements are active before deployment.
Without a valid license, Pentaho Server will start but many features will be disabled. Verify your license status before proceeding with production deployments.
Key Differences
Orchestration
Docker Compose
Kubernetes (K3s)
Configuration
.env file + docker-compose.yml
Kubernetes manifests (YAML)
Secrets
Docker secrets or Vault
Kubernetes Secrets
Networking
Docker bridge network
K3s cluster network + Traefik Ingress
Storage
Docker volumes
PersistentVolumeClaims (PVCs)
Scaling
Manual (docker compose up --scale)
Declarative (replicas in deployment)
Health Checks
Docker HEALTHCHECK
Kubernetes readiness/liveness probes
Init Scripts
Volume mount to /docker-entrypoint-initdb.d
ConfigMap mounted to PostgreSQL pod
Pre-flight Taks
The Pre-flight Tasks section outlines the essential preparation steps needed before deploying Pentaho Server 11 in K3s containers.
Configure Environment Variables
Edit the .env.example file within the docker-build/ directory with your deployment-specific settings. This includes Pentaho version identifier and Docker image name/tag.
Configure PostgreSQL database credentials and connection parameters. Set JVM memory allocation with minimum heap (default 4GB) and maximum heap (default 8GB).
Add your Enterprise Edition license server URL if applicable. Configure build options including image edition (EE/CE), plugin detection, and registry push settings.
Once configured, copy this template to .env for use by the build process.
softwareOverride Directory
The softwareOverride/ directory within docker-build/ provides a mechanism for customizing Pentaho configurations. These customizations get baked into the Docker image during the build process.
Files are organized in numbered directories and processed in alphabetical order.
The 1_drivers/ directory contains the PostgreSQL JDBC driver (included by default), and you can place additional JDBC drivers here.
The 2_repository/ directory holds database connection configurations for Jackrabbit (JCR), Quartz (scheduler), and Hibernate repositories. The 3_security/ directory is empty in this K3s deployment since there's no Vault integration.
The 4_others/ directory contains modified Tomcat scripts (startup.sh, setenv.sh), server.xml, and other application-level configurations.
You can optionally upgrade the PostgreSQL JDBC driver by downloading from Maven Central or copying from the workshop's database drivers collection. Place the updated driver in softwareOverride/1_drivers/tomcat/lib/.
Configure .env
Edit the .env.template
Enter the following details:
PENTAHO_VERSION
11.0.0.0-237
Pentaho Server version
EDITION
ee
Enterprise version
INCLUDE_DEMO
1
Include demo data
IMAGE_TAG
pentaho/pentaho-server:11.0.0.0-237
Docker image tag
PENTAHO_MIN_MEMORY
4096m
JVM minimum heap size
PENTAHO_MAX_MEMORY
8192m
JVM maximum heap size
PENTAHO_DI_JAVA_OPTIONS
"-Dfile.encoding=utf8 -Djava.awt.headless=true"
PENTAHO_IMAGE_NAME
pentaho/pentaho-server
Docker image name
TZ
America/NY
Time Zone of server
DB_TYPE
postgres
DB_HOST
postgres
DB_PORT
5432
PostgreSQL HTTP port
PUSH_TO REGISTRY
false
Pushes direct to K3s Regsitry
LOAD_INTO_K3S
true
Loads directly to K3s
RUN TESTS
true
LICENSE_URL
(empty)
EE license server URL
Save:
Create .env
softwareOverride
The PostgreSQL JDBC driver is included in the Pentaho distribution. If you need to upgrade:
Download from Maven Central
Place in
softwareOverride/1_drivers/tomcat/lib/
Or
Copy from Workshop--Installation/'Database Drivers'/
Build & Push Pentaho Image
The build.sh script is an automated build wrapper that:
Validates prerequisites - Checks Docker is installed
Checks for required files - Verifies Pentaho ZIP exists in stagedArtifacts/
Detects plugins automatically - Finds PAZ, PIR, PDD plugins
Confirms build - Shows what will be built and asks for confirmation
Runs docker build - Executes the build with proper arguments
Shows image info - Displays image size and details after build
Optional: Tests image - Runs basic container test (you can skip this)
Optional: Pushes to registry - Pushes to Docker registry (only with -p flag)
This is the recommended approach for building Pentaho Docker images. It uses a single .env file to configure everything - similar to the Docker Compose deployment.
You can modify the build with the following options:
-v
--version VERSION
Pentaho version (default: 11.0.0.0-237)
-t
--tag TAG
Docker image tag (default: pentaho/pentaho-server:VERSION)
-e
--edition EDITION
ee or ce (default: ee)
-d
--demo
Include demo content (default: no)
-p
--push
Push to registry after build
-h
--help
Push to registry after build
Build & Push the Pentaho Server Image directly into K3s Registry.

Helm Charts
Helm is the package manager for Kubernetes, often referred to as "apt/yum for Kubernetes." It simplifies the deployment and management of Kubernetes applications by:
Packaging: Bundling related Kubernetes resources together
Templating: Parameterizing manifests for reusability across environments
Versioning: Managing application versions and upgrades
Release Management: Tracking deployments and enabling rollbacks

Chart.yaml
values.yaml
templates
namespace.yaml
Creates an isolated Kubernetes namespace to contain all Pentaho resources
secret.yaml
Stores sensitive database credentials (passwords) encrypted in Kubernetes
config-*.yaml
Configures Pentaho environment variables (JVM memory, database settings, paths, timezone) Contains SQL scripts to initialize PostgreSQL databases (jackrabbit, quartz, hibernate) on first startup
pvc.yaml
Requests persistent storage volumes for PostgreSQL data and optional Pentaho data/solutions
*-deployment.yaml
Deploys Pentaho Business Analytics Server with init container, health probes, and resource limits. Deploys PostgreSQL 15 database server with automatic initialization and persistent storage
*-service.yaml
Routes external HTTP/HTTPS traffic to Pentaho Server via Traefik ingress controller. Exposes PostgreSQL port 5432 as a stable DNS endpoint for Pentaho to connect to.
ingress.yaml
Routes external HTTP/HTTPS traffic to Pentaho Server via Traefik ingress controller
Deploy
The architecture consists of two main pods running within a dedicated Pentaho namespace:
a Pentaho Server pod (Tomcat on Debian with OpenJDK 21) and
a PostgreSQL pod hosting three essential databases - Jackrabbit for content storage, Quartz for job scheduling, and Hibernate for security and audit logging.
Before you proceed, ensure you have completed Steps 1 - 3. You should have a Pentaho Server image + PostgreSQL 15 repository images pushed to the K3s repository.
Quick check.
Check The Pentaho Image is available.

Default Deployment
The deployment workflow progresses through four stages:
preparing the environment by staging the Pentaho Enterprise Edition package and verifying K3s.
configuring environment variables and software overrides during pre-flight tasks.
building and pushing a custom Docker image into the K3s container runtime.
finally deploying the full stack using either Helm charts or an automated
deploy.shscript that orchestrates namespace creation, secrets, ConfigMaps, persistent storage, and Traefik ingress routing.
Also covers the Helm chart structure, a suite of helper scripts for backup, health checks, resource monitoring, and deployment validation, along with multiple access methods including port-forwarding, hostname-based ingress, and direct node IP.
Install using Helm charts.

Helper Scripts
The K3s Pentaho deployment includes a collection of helper scripts in the scripts/ directory for day-to-day operations and maintenance:
backup-postgres.sh: Creates timestamped, compressed dumps of all Pentaho databases (Jackrabbit, Quartz, Hibernate) using
pg_dumpexecuted inside the PostgreSQL pod.restore-postgres.sh: Restores Pentaho databases from backup files, useful for disaster recovery, environment cloning, or migrating data between clusters.
health-check.sh: Performs a quick runtime health check covering pod readiness, service availability, database connectivity, and a live HTTP test against the Pentaho login page.
validate-deployment.sh: Runs a comprehensive audit across six categories: namespace, pods, services, PersistentVolumeClaims, ConfigMaps, and ingress configuration.
monitor-resources.sh: Tracks CPU and memory usage across all Pentaho pods using
kubectl topto help identify resource constraints or optimization opportunities.monitor-postgres.sh: Monitors PostgreSQL-specific metrics including connection counts, active queries, table sizes, and overall database health.
verify-k3s.sh: Validates the underlying K3s infrastructure (node status, storage classes, Traefik ingress, and core components) before attempting a Pentaho deployment.
Makefile: Provides convenience commands such as
make health,make status,make logs,make port-forward, andmake destroyfor streamlined cluster management.
Directory Layout
This K3s deployment configuration provides several important capabilities:
Completely self-contained Kubernetes deployment on lightweight K3s
Automated database initialization with PostgreSQL SQL scripts
Kubernetes-native health checks and startup ordering
Persistent volume claims for database and Pentaho content
Docker image build process with multi-stage optimization
Resource limits (CPU/memory) for stability
Production-ready Kubernetes manifest templates
PostgreSQL JDBC driver included
Easy backup and restore procedures via utility scripts
Ingress configuration for Traefik routing
Root Directory Files
docker-build
db_init_postgres
manifests
scripts
Key Differences: K3s vs Docker
Orchestration
Docker Compose
Kubernetes (K3s)
Configuration
.env file + docker-compose.yml
Kubernetes manifests (YAML)
Secrets
Docker secrets or Vault
Kubernetes Secrets
Networking
Docker bridge network
K3s cluster network + Traefik Ingress
Storage
Docker volumes
PersistentVolumeClaims (PVCs)
Scaling
Manual (docker compose up --scale)
Declarative (replicas in deployment)
Health Checks
Docker HEALTHCHECK
Kubernetes readiness/liveness probes
Init Scripts
Volume mount to /docker-entrypoint-initdb.d
ConfigMap mounted to PostgreSQL pod
Deployment execution
The deploy.sh script automates the entire workflow:
Verifies K3s is running
Creates namespace
Applies all manifests in correct order
Monitors pod startup
Validates service readiness
Provides deployment summary with access URLs
1. Namespace Creation:
Creates isolated logical environment for all Pentaho resources.
2. Secret Generation:
Stores PostgreSQL credentials and JDBC connection strings as Kubernetes Secrets.
3. Storage Provisioning:
Creates PersistentVolumeClaims for PostgreSQL data and Pentaho content.
4. ConfigMap Creation:
Mounts PostgreSQL initialization scripts and Pentaho configuration.
5. PostgreSQL Deployment:
Deploys PostgreSQL pod with:
Mounted init scripts (automatic database creation on first startup)
Persistent volume for data
Health checks and resource limits
ClusterIP service for internal connectivity
6. Pentaho Server Deployment:
Deploys Pentaho pod with:
Custom Docker image
Environment variables from ConfigMap and Secrets
Volume mounts for solutions/data
Readiness/liveness probes
ClusterIP service
7. Ingress Configuration:
Configures Traefik routing for external access.
Run the deploy.sh

Quick Commands with Makefile
There's also bunch of scripts that will help validate the deployment:
Run the following
validate-deployment.shscript.

Health Check
Quick health check script for running Pentaho deployment - faster and lighter than full validation, focused on runtime health status.
Namespace
Verifies pentaho namespace exists
Exits immediately if namespace missing (critical)
Pod Readiness
PostgreSQL pod is ready (not just running)
Pentaho Server pod is ready
Checks
containerStatuses[0].ready status
Services
PostgreSQL service exists
Pentaho Server service exists
Database Connectivity
PostgreSQL is responding to queries
All 3 databases exist:
* jackrabbit
* quartz
* hibernate
Uses
psql -lqtto list databases
Web Application Health
Live HTTP test to Pentaho login page
Uses port-forward to access service
Expects HTTP 200 response
Tests: http://localhost:8080/pentaho/Login
Resource Usage
Shows CPU/memory usage via
kubectl top podsGracefully handles missing metrics-server

Port Forward (Recommended for Testing/Development)
The simplest method using kubectl to forward a local port to the Pentaho service:
Access URL: http://localhost:8080/pentaho
You can also use an alternate port if 8080 is busy:
Ingress with Hostname (pentaho.local)
Uses K3s's built-in Traefik ingress controller with DNS-style access:
Setup:
(Replace 10.0.0.1 with your actual node IP)
Access URL: http://pentaho.local/pentaho
Ingress via Direct Node IP (No DNS Required)
Access directly through any cluster node's IP address without configuring /etc/hosts:
Access URL: http://<node-ip>/pentaho
This works because the ingress includes a path-based rule that doesn't require a hostname.
Makefile Convenience Command
The project includes a Makefile shortcut:
This automatically sets up port forwarding to localhost:8080.
Default Credentials
admin
password
⚠️ Change these for production deployments!
Quick Reference
Port Forward
Development/Testing
http://localhost:8080/pentaho
Ingress (hostname)
Production with DNS
http://pentaho.local/pentaho
Ingress (direct IP)
Testing without DNS
http://<node-ip>/pentaho
Last updated
Was this helpful?

