Configuration reference
This table covers fields used by the installation runbooks. Inspect the release chart values and CRD before using fields not listed here.
Graph Studio operator
| Field | Required | Sensitive | Effect |
|---|---|---|---|
operator.image.* | Yes | No | Operator image/version |
operator.imagePullSecrets | Yes for Graph registry | Secret name | Operator Pod pull access |
relatedImages.anzo | Yes | No | Default workload image |
watchNamespace | Recommended | No | Empty watches all namespaces |
spec.nodeConfig.spec.selector | Yes | No | Must match template labels |
spec.nodeConfig.spec.template.spec.containers | Yes | No | Must include container anzo |
spec...imagePullSecrets | Yes for Graph registry | Secret name | Workload pull access |
spec.initJSON | Yes for usable product | Yes for licensing | Contains the stable serverId, licenseEncoded string, and bootstrap configuration |
spec.credentials | No | Secret name | Existing credential Secret; otherwise generated |
spec.volumes[] | Production | No | Data/log/shared storage |
spec.certificate / spec.tlsCerts | For external access | Secret/issuer names | Choose one server identity method |
spec.trustBundle | When private CAs are used | No | Outbound CA trust ConfigMap |
Graph Lakehouse operator
| Field | Required | Sensitive | Effect |
|---|---|---|---|
image.* / imagePullSecrets | Yes | Secret name | Operator image and pull access |
relatedImages.db | Yes | No | Database operand image |
relatedImages.operator | Yes | No | Operator image |
watchNamespaceOverride | Recommended | No | Empty uses the release namespace |
spec.db.nodeConfig.spec.selector | Yes | No | Must match DB template labels |
spec.db...containers | Yes | No | Must include container db |
DB imagePullSecrets | Yes for Graph registry | Secret name | Workload pull access |
spec.db.storage | Production | No | Data/config/spill size and retention |
spec.db.licensing | Yes | Yes | License activation (licenseType: CSI + csi.legacyLicense) |
spec.grpcCredentials | No | Secret name | Existing gRPC credentials; otherwise generated |
Standalone Helm
| Chart | Required production overrides |
|---|---|
anzo | Image, pull secret, all credential defaults, initJson (licenseEncoded), persistence, TLS, service exposure |
anzograph | Database image, pull secret, grpcCredentialsSecret, legacy CSI licensing, persistence/retention, cloud provider, and allowed CIDRs |
List authoritative values before editing:
helm show values <chart-reference> --version <chart-version> > values.reference.yaml
Never infer fields across products or releases. Unknown fields may render without taking
effect when a chart lacks a values schema. Machine-readable v2 schemas are maintained as
in-repository validation assets in schemas/anzo-v2.schema.json and
schemas/anzograph-v2.schema.json; provenance is tracked in
schemas/sources.yaml. For automated schema validation and CR verification tools, see Agentic reference.