Install Graph Studio with Helm

Outcome: One persistent Graph Studio StatefulSet exposed via a ClusterIP service.

1. Before you begin

Confirm you have completed Prerequisites:

1. The target namespace graph-platform exists with pull secret graph-artifacts.
2. A supported StorageClass is available (kubectl get storageclass).
3. A TLS Secret containing keystore.p12 and ca.crt is created in graph-platform.
4. Your CSI license string is available from your secret manager or licensing portal.

Verify the release chart is accessible:

helm show chart oci://artifacts.altair.com/graph-helmoci/anzo --version 2.1.0

2. Configure

Download the authoritative production Helm values template:

• Values template: /examples/2026.1/graph-studio-helm-values.yaml

Download or copy the values template. The template contains parameter placeholders; it is not directly runnable without replacement. Treat the downloaded template as the single authoritative configuration file and replace the following fields manually (or via the approved automation contract) before applying:

Section / Key	Configuration Decision	Guidance
anzo.credentials	Passwords (adminPassword, jmsPassword, keystoreClientKeyPassword, ldapServerPassword, sslPassword, sskKeyPassword)	Retrieve strong random secrets from your approved secret manager.
anzo.initJson.serverId	Stable Graph Studio server ID	Set once for this Kubernetes installation and reuse it for every restart, upgrade, and redeployment.
anzo.initJson.licenseEncoded	Encoded legacy CSI license	Specify your base64-encoded CSI license string.
anzo.certsSecret	TLS Secret name	Reference the pre-created Secret containing keystore.p12 and ca.crt.
anzo.persistence.*.storageClass	Cluster StorageClass	Set to a valid, supported PersistentVolume StorageClass.

Secret handling

All credential and licensing fields (adminPassword, jmsPassword, sslPassword, licenseEncoded, etc.) must be retrieved from an authorized secret manager at deployment time. Never commit plain-text credentials or license keys. Use a local file with owner-only permissions (chmod 600), do not commit it, and delete it after applying. Helm stores values in release Secret objects; verify that your Kubernetes cluster enforces encryption at rest. For secure noninteractive mechanics and automated pipelines, see Template and secret contract.

Chart compatibility

The 2.1.0 chart retains the legacy key anzo.credentials.sskKeyPassword. Keep this key aligned with sslPassword in your values file so the TLS key password does not fall back to a default.

3. Install

Install Graph Studio using Helm:

helm upgrade --install graph-studio \
  oci://artifacts.altair.com/graph-helmoci/anzo \
  --version 2.1.0 \
  --namespace graph-platform \
  --values values.yaml \
  --atomic --wait --timeout 20m

4. Verify

Check deployment and pod status:

helm status graph-studio --namespace graph-platform
kubectl rollout status statefulset/anzo-graph-studio --namespace graph-platform --timeout=15m
kubectl get pods,pvc,service --namespace graph-platform

Expected result: Helm release status is deployed, the StatefulSet pod is Running and Ready, data and log PVCs are Bound, and only internal services are exposed.

Verify admin login through the internal endpoint and confirm active licensing status in the management console.

Rollback boundary

Before data is loaded, helm rollback or helm uninstall is safe. After data is loaded, follow Upgrade or Uninstall and verify PVC/PV retention before taking destructive action.

5. Next steps

1. Configure an approved Ingress controller or API gateway with TLS termination.
2. Store all generated credentials securely in your secret manager.
3. Review Upgrade and Uninstall runbooks before production rollout.