Template and secret contract

This document defines the machine-readable template catalog, variable substitution contracts, pre-requisite Kubernetes Secret schemas, and secure automation patterns for executing headless installation and continuous delivery pipelines.

Templates are not directly runnable

Static manifests and values files hosted under /examples/ are parameterized templates. They contain variable markers (such as ${NAMESPACE}, ${SERVER_ID}, ${CSI_LICENSE}, ${STORAGE_CLASS}) and require pre-deployment substitution and pre-existing Kubernetes Secrets. Never execute kubectl apply or helm install against unrendered templates.

Downloadable template catalog

All authoritative templates for release 2026.1 are hosted in the static site distribution:

File Name	Template Classification	Target Component	Description
graph-studio.yaml	Complete Custom Resource	Graph Studio Operator	Full anzo.cambridgesemantics.com/v2 Anzo workload definition including cert-manager TLS spec, cluster IP service, stable server ID and CSI licensing via init JSON, and storage allocations.
graph-lakehouse.yaml	Complete Custom Resource	Graph Lakehouse Operator	Database-only anzograph.clusters.cambridgesemantics.com/v2 AnzoGraph workload definition with persistence and legacy CSI licensing.
graph-studio-operator-values.yaml	Helm Values Template	Graph Studio Operator Helm Chart	Values file for anzo-operator specifying pinned image references and target watch namespace.
graph-lakehouse-operator-values.yaml	Helm Values Template	Graph Lakehouse Operator Helm Chart	Values file for anzograph-operator specifying controller and operand image tags and namespace override.
graph-studio-helm-values.yaml	Helm Values Template	Standalone Graph Studio Helm Chart	Production values file for anzo standalone Helm chart with credential fields, TLS Secret binding, stable server ID and CSI licensing in init JSON, and persistence sizing.
graph-lakehouse-helm-values.yaml	Helm Values Template	Standalone Graph Lakehouse Helm Chart	Database-only production values file for anzograph standalone Helm chart with cloud provider type, internal CIDR filtering, gRPC credential secret reference, and legacy CSI licensing.

Template variable dictionary

Automated render pipelines must supply the following environment variables depending on the deployment target:

Variable	Target Template(s)	Description / Example	Sensitivity
NAMESPACE	Operator CR and operator values templates (graph-studio.yaml, graph-lakehouse.yaml, graph-studio-operator-values.yaml, graph-lakehouse-operator-values.yaml)	Target Kubernetes namespace (e.g. graph-platform).	Non-sensitive
STORAGE_CLASS	graph-studio.yaml, graph-studio-helm-values.yaml	Name of Kubernetes StorageClass supporting persistent storage.	Non-sensitive
GRAPH_HOSTNAME	graph-studio.yaml	Fully qualified domain name for Graph Studio TLS certificate (e.g. studio.example.com).	Non-sensitive
CERT_ISSUER	graph-studio.yaml	Name of cert-manager issuer resource.	Non-sensitive
CERT_ISSUER_KIND	graph-studio.yaml	Kind of cert-manager issuer (Issuer or ClusterIssuer).	Non-sensitive
SERVER_ID	graph-studio.yaml, graph-studio-helm-values.yaml	Stable Graph Studio server ID for one Kubernetes installation. Reuse this exact value for restarts, upgrades, and redeployments of that installation.	Sensitive
CSI_LICENSE	graph-studio.yaml, graph-studio-helm-values.yaml, graph-lakehouse.yaml, graph-lakehouse-helm-values.yaml	Base64-encoded legacy CSI license string.	Sensitive
CSP	graph-lakehouse-helm-values.yaml	Target cloud service provider (google, aws, or azure).	Non-sensitive
ALLOWED_CIDR	graph-lakehouse-helm-values.yaml	CIDR block authorized for internal load balancer access (e.g. <management-cidr-block>).	Non-sensitive
RELEASE_NAME	graph-studio-helm-values.yaml	Helm release identifier (defaults to graph-studio).	Non-sensitive
TLS_SECRET	graph-studio-helm-values.yaml	Pre-existing Kubernetes Secret name containing PKCS12 keystore and CA certificate.	Non-sensitive
GS_ADMIN_PASSWORD	graph-studio-helm-values.yaml	Sysadmin password for initial Graph Studio administration.	Sensitive
GS_JMS_PASSWORD	graph-studio-helm-values.yaml	JMS broker service password.	Sensitive
GS_KEYSTORE_PASSWORD	graph-studio-helm-values.yaml	Passphrase protecting Java keystores and truststores.	Sensitive
GS_LDAP_PASSWORD	graph-studio-helm-values.yaml	Internal LDAP server administrator password.	Sensitive
GS_SSL_PASSWORD	graph-studio-helm-values.yaml	Password for the PKCS12 server TLS bundle in TLS_SECRET.	Sensitive

Kubernetes Secret contracts

Automated provisioning must ensure prerequisite Secrets exist prior to workload deployment.

1. Registry pull Secret: graph-artifacts

Required in all namespaces where operator or product pods run.

• Name: graph-artifacts

• Type: kubernetes.io/dockerconfigjson

• Data key: .dockerconfigjson

• Automation provisioning pattern:

  The approved secret manager or CI integration materializes a complete .dockerconfigjson file with 0600 permissions inside a private temporary directory (0700). Automation validates that this file exists, supplies the payload using --from-file, and ensures immediate cleanup without expanding credentials as command-line arguments:

  # Ephemeral private working directory
  PULL_SECRETS_DIR="$(mktemp -d)"
  chmod 700 "${PULL_SECRETS_DIR}"
  trap 'rm -rf "${PULL_SECRETS_DIR}"' EXIT
  
  DOCKER_CONFIG_PATH="${PULL_SECRETS_DIR}/.dockerconfigjson"
  
  # Approved secret manager or CI integration materializes .dockerconfigjson with 0600 mode:
  # (e.g. vault kv get, aws secretsmanager, or CI credential file provider)
  test -s "${DOCKER_CONFIG_PATH}" || {
    echo "ERROR: Docker config file missing or empty at ${DOCKER_CONFIG_PATH}" >&2
    exit 1
  }
  
  kubectl create secret generic graph-artifacts \
    --namespace "${NAMESPACE}" \
    --type=kubernetes.io/dockerconfigjson \
    --from-file=.dockerconfigjson="${DOCKER_CONFIG_PATH}" \
    --dry-run=client -o yaml | kubectl apply -f -
  
  rm -rf "${PULL_SECRETS_DIR}"
  trap - EXIT

2. Graph Lakehouse Helm credentials: graph-lakehouse-grpc

Required in the Graph Lakehouse Helm release namespace (graph-platform).

• Secret: graph-lakehouse-grpc
  • grpcAdminUser: gRPC admin user (typically admin).
  • grpcAdminPassword: gRPC admin password.
  • grpcQueryUser: gRPC query user (typically query).
  • grpcQueryUserPassword: gRPC query user password.

3. Operator-generated credentials

When installing via operators, credentials are automatically generated by the controllers into named Kubernetes Secrets:

Operator	Generated Secret Name	Internal Secret Keys
Graph Studio Operator	anzo-graph-studio	admin_user, admin_password
Graph Lakehouse Operator	anzograph-graph-lakehouse-grpc	grpcAdminUser, grpcAdminPassword, grpcQueryUser, grpcQueryUserPassword

Automated pipelines must not print these credentials to stdout/console logs. Instead, fetch and sync them noninteractively directly into an external secret store (such as HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault) using standard stdin streaming or secured temporary files, avoiding command-line argument exposure.

Secure automation execution mechanics

Automation runners and CI/CD pipelines must follow safe ephemeral rendering patterns to avoid leaking credentials to disk or build logs:

1. Restricted temporary directory: Create a temporary workspace with permissions 0700 (mktemp -d).
2. Trap handlers: Register Bash EXIT traps to wipe the temporary workspace and unset sensitive environment variables.
3. Explicit variable projection: Avoid unrestricted substitution (envsubst without argument lists). Explicitly list valid variables to prevent unintended environmental bleed.
4. Server-side dry-run validation: Validate rendered manifests against the Kubernetes API (kubectl apply --server-side --dry-run=server) before committing state.
5. Atomic Helm operations: Use --atomic --wait with generous timeouts to allow stateful workloads to reach steady state or roll back cleanly on failure.

Complete automated render-apply script pattern

#!/usr/bin/env bash
set -euo pipefail

# 1. Fail-fast nonempty checks for all substituted variables
: "${NAMESPACE:?Variable NAMESPACE must be set and non-empty}"
: "${CSI_LICENSE:?Variable CSI_LICENSE must be set and non-empty}"

# 2. Allocate ephemeral working directory with restricted permissions
WORKDIR="$(mktemp -d)"
chmod 700 "${WORKDIR}"

cleanup() {
  rm -rf "${WORKDIR}"
  unset CSI_LICENSE
}
trap cleanup EXIT

# 3. Fetch authoritative template
DOCS_ORIGIN="https://graph-ops-docs-f07260.gitlab.io"
curl -fsSLo "${WORKDIR}/template.yaml" "${DOCS_ORIGIN}/examples/2026.1/graph-lakehouse.yaml"

# 4. Perform scoped parameter substitution
envsubst '${NAMESPACE} ${CSI_LICENSE}' \
  < "${WORKDIR}/template.yaml" > "${WORKDIR}/rendered.yaml"

# 5. Dry-run validation against live API
kubectl apply --server-side --dry-run=server -f "${WORKDIR}/rendered.yaml"

# 6. Apply manifest
kubectl apply -f "${WORKDIR}/rendered.yaml"

# 7. Bounded readiness wait
kubectl wait --for=jsonpath='{.status.phase}'=Running anzograph/graph-lakehouse \
  --namespace "${NAMESPACE}" --timeout=20m

# 8. Non-interactive secret export to external secret store (example using file/stdin streaming)
# STREAM_FILE="${WORKDIR}/grpc_pass.txt"
# touch "${STREAM_FILE}" && chmod 600 "${STREAM_FILE}"
# kubectl get secret anzograph-graph-lakehouse-grpc \
#   --namespace "${NAMESPACE}" -o jsonpath='{.data.grpcAdminPassword}' | base64 -d > "${STREAM_FILE}"
# External secret managers can ingest "${STREAM_FILE}" or read directly via stdin without CLI argument exposure.

Related links

• Release contract and lifecycle gates
• Validation commands and CI controls
• Graph Studio Operator guide
• Graph Lakehouse Operator guide