Skip to main content

Install Graph Studio with the operator

Outcome: One namespace-scoped operator and one persistent Graph Studio instance exposed via a ClusterIP service.

1. Before you begin​

Confirm you have completed Prerequisites:

  1. The target namespace graph-platform exists with pull secret graph-artifacts.
  2. A supported StorageClass is available (kubectl get storageclass).
  3. cert-manager is installed (kubectl get crd certificates.cert-manager.io) with an Issuer or ClusterIssuer ready.
  4. Your CSI license string is available from your secret manager or licensing portal.

Verify the release chart is accessible:

helm show chart oci://artifacts.altair.com/graph-helmoci/anzo-operator --version 3.3.0

2. Configure​

Download the base operator values and custom resource templates:

Download or copy each template. The templates contain parameter placeholders (such as ${NAMESPACE}, ${GRAPH_HOSTNAME}, ${SERVER_ID}, ${CSI_LICENSE}, and ${STORAGE_CLASS}); they are not directly runnable without replacement. Replace all required fields manually or use the approved automation contract before applying.

Prepare your operator-values.yaml:

operator:
  image:
    repository: artifacts.altair.com/graph-docker/anzo-operator
    tag: "3.3.0"
    pullPolicy: IfNotPresent
  imagePullSecrets:
    - name: graph-artifacts
relatedImages:
  anzo: artifacts.altair.com/graph-docker/anzo:6.3.1
watchNamespace: graph-platform

Prepare your graph-studio.yaml custom resource. Set your production domain, issuer, stable server ID, storage class, and CSI license:

  • metadata.namespace: Target namespace (graph-platform).
  • certificate.spec.dnsNames: Your production DNS hostname (e.g. graph-studio.example.com).
  • certificate.spec.issuerRef: Your cert-manager issuer name and kind (Issuer or ClusterIssuer).
  • initJSON.serverId: A stable ID for this Graph Studio installation. Use the same ID for every restart, upgrade, or redeployment of this installation.
  • initJSON.licenseEncoded: Your encoded legacy CSI license string (<csi-license>).
  • volumes[*].pvc.storageClassName: Your cluster StorageClass.

The template explicitly mounts each PVC-only volume into the Graph Studio container. Retain these volumeMounts when adapting the template so that the data and log claims are used by the application.

Credential management

The operator automatically generates an internal Secret named anzo-graph-studio containing administrative credentials referenced via k8s://anzo-graph-studio/admin_user and admin_password. No cleartext passwords should be placed in the manifest. When handling any local manifest containing sensitive values, use a local file with owner-only permissions (chmod 600), do not commit it, and delete it after applying; see Template and secret contract for secure noninteractive mechanics.

3. Install​

Install the operator with Helm:

helm upgrade --install graph-studio-operator \
  oci://artifacts.altair.com/graph-helmoci/anzo-operator \
  --version 3.3.0 \
  --namespace graph-platform \
  --values operator-values.yaml \
  --atomic --wait --timeout 10m

Verify that the operator CRD is established and controller rollout completes before applying the workload custom resource:

kubectl wait --for=condition=Established crd/anzos.anzo.cambridgesemantics.com --timeout=2m
kubectl rollout status deployment/graph-studio-operator-anzo-operator --namespace graph-platform --timeout=5m

Apply the configured Graph Studio custom resource:

kubectl apply -f graph-studio.yaml

4. Verify​

Check the workload and certificate readiness:

kubectl wait --for=jsonpath='{.status.phase}'=Running anzo/graph-studio --namespace graph-platform --timeout=20m
kubectl wait --for=condition=Ready pod -l app.kubernetes.io/name=graph-studio --namespace graph-platform --timeout=10m
kubectl wait --for=condition=Ready certificate/graph-studio --namespace graph-platform --timeout=5m

Confirm service and volume status:

kubectl get anzo,pvc,service --namespace graph-platform

Expected result: Custom resource phase is Running, server pod is Ready, cert-manager Certificate graph-studio is Ready (populating TLS Secret graph-studio-tls), PVCs are Bound, and internal service anzo-graph-studio-lb is active.

Administrative credentials transfer​

The operator generates the administrative credentials in the named Secret anzo-graph-studio. Do not print or decode passwords in open terminal output or logs. Transfer the named Secret values into your organization's approved secret manager using an authorized, non-interactive process. For automated and non-interactive extraction workflows, see Template and secret contract.

Rollback boundary​

Before the custom resource is applied, uninstalling the operator release is safe. After the custom resource is created and data is loaded, follow Uninstall so persistent volume claims are retained deliberately.

5. Next steps​

  1. Configure an approved Ingress controller or API gateway with TLS termination.
  2. Transfer the generated admin credentials into your organization's secret manager.
  3. Log in using HTTPS and verify active licensing status in the administration settings.
  4. For cross-component staging with Graph Lakehouse (S3/Azure Blob or shared NFS), see Shared storage architecture.
  5. For custom settings, Keycloak SSO, or NFS mounts, see Graph Studio use cases.
  6. Review Upgrade and Uninstall runbooks before production rollout.