Install Graph Lakehouse with Helm

Outcome: One persistent database deployed with restricted internal service endpoints.

1. Before you begin

Confirm you have completed Prerequisites:

1. The target namespace graph-platform exists with pull secret graph-artifacts.
2. A default StorageClass is configured (kubectl get storageclass).
3. Your CSI license string is ready from your secret manager or licensing portal.
4. An approved internal CIDR range is identified for load balancer source filtering.

Verify the release chart is accessible:

helm show chart oci://artifacts.altair.com/graph-helmoci/anzograph --version 3.4.0

2. Configure

Download the production Helm values template:

• Values template: /examples/2026.1/graph-lakehouse-helm-values.yaml

Download or copy the values template. The template contains variables and placeholder fields; it is not directly runnable without replacement. Replace all required fields manually or use the approved automation contract before applying.

Credential Secret contract

Graph Lakehouse Helm expects a pre-existing generic Secret in the target namespace (graph-platform): graph-lakehouse-grpc. Provision this Secret using your organization's approved secret manager or Kubernetes process with the exact keys below:

Secret Name	Required Keys	Purpose / Defaults
graph-lakehouse-grpc	grpcAdminUser, grpcAdminPassword, grpcQueryUser, grpcQueryUserPassword	Database gRPC endpoint administrative and query credentials (e.g. grpcAdminUser=admin, grpcQueryUser=query, with strong random passwords).

For noninteractive pipeline generation and secure secret-manager rendering mechanics, see Template and secret contract.

Credential source

Obtain strong random passwords from your organization's secret manager. Do not reuse default passwords or embed cleartext credentials in values files.

Prepare your values.yaml file by supplying your deployment parameters:

csp: "<google|aws|azure>"
useExternalLB: false
internalLB:
  loadBalancerSourceRanges:
    - "<approved-cidr-range>"
replicas: 1
imagePullSecrets:
  - name: graph-artifacts
database:
  image:
    repository: artifacts.altair.com/graph-docker
    name: anzograph-db
    tag: "3.5.0"
    pullPolicy: IfNotPresent
  persistentVolumeClaimRetentionPolicy:
    whenDeleted: Retain
    whenScaled: Retain
  configStorageSize: 5Gi
  spillStorageSize: 32Gi
  persistentVolume:
    storageClass: default
    reclaimPolicy: Retain
    accessMode: ReadWriteOnce
    storage: 1Ti
grpcCredentialsSecret: graph-lakehouse-grpc
licensing:
  licenseType: CSI
  csi:
    legacyLicense: "<csi-license>"

Helm release licensing

The chart stores licensing fields in the Helm release Secret. Use a local values file with owner-only permissions (chmod 600), do not commit it, and delete it after applying. Verify that Secret encryption at rest is enabled on your cluster. For secure noninteractive mechanics and automated CI/CD pipelines, see Template and secret contract.

3. Install

Install Graph Lakehouse using Helm:

helm upgrade --install graph-lakehouse \
  oci://artifacts.altair.com/graph-helmoci/anzograph \
  --version 3.4.0 \
  --namespace graph-platform \
  --values values.yaml \
  --atomic --wait --timeout 20m

4. Verify

Check deployment and pod status:

helm status graph-lakehouse --namespace graph-platform
kubectl rollout status statefulset/anzograph-graph-lakehouse-db --namespace graph-platform --timeout=15m
kubectl get pods,pvc,service --namespace graph-platform

Expected result: Helm release status is deployed, the database StatefulSet pod is Running and Ready, PVCs are Bound, and internal services are active.

Execute a release-approved database query through the database endpoint to verify database responsiveness and active licensing status.

Rollback boundary

This chart does not support an ordinary in-place helm upgrade. Do not use helm rollback after data or cluster-shape changes. Follow the release-specific process in Upgrade and Uninstall to retain persistent volume claims.

5. Next steps

1. Store gRPC administrative passwords in your organization's secret manager.
2. Verify TLS certificate setup and ingress routing if external access is needed.
3. Review Upgrade and Uninstall runbooks. Standalone Graph Lakehouse Helm does not support ordinary in-place chart upgrades without specific migration procedures.