Skip to main content

Install Graph Lakehouse with the operator

Outcome: One namespace-scoped operator, a persistent single-node database, and an internal ClusterIP database service.

1. Before you begin​

Confirm you have completed Prerequisites:

  1. The target namespace graph-platform exists with pull secret graph-artifacts.
  2. A default StorageClass is configured (kubectl get storageclass).
  3. Your CSI license string is ready from your secret manager or licensing portal.

Verify the release chart is accessible:

helm show chart oci://artifacts.altair.com/graph-helmoci/anzograph-operator --version 3.5.0

2. Configure​

Download the base operator values and custom resource templates:

Download or copy each template. The templates contain parameter placeholders (such as ${NAMESPACE} and ${CSI_LICENSE}); they are not directly runnable without replacement. Replace all required fields manually or use the approved automation contract before applying.

Prepare your operator-values.yaml:

image:
  repository: artifacts.altair.com/graph-docker/anzograph-operator
  tag: "3.5.0"
  pullPolicy: IfNotPresent
imagePullSecrets:
  - name: graph-artifacts
relatedImages:
  db: artifacts.altair.com/graph-docker/anzograph-db:3.5.0
  operator: artifacts.altair.com/graph-docker/anzograph-operator:3.5.0
watchNamespaceOverride: graph-platform

Prepare your graph-lakehouse.yaml custom resource. The base template graph-lakehouse.yaml uses legacyLicense: "${CSI_LICENSE}". Set the namespace and provide your legacy CSI license under spec.db.licensing.csi.legacyLicense:

  • metadata.namespace: Target namespace (graph-platform).
  • spec.db.licensing.csi.legacyLicense: Legacy CSI license string obtained from your secret manager (<csi-license>).

For supported licensing specifications, see Graph Lakehouse licensing.

Secret handling

Obtain the license string directly from your secret manager at deployment time. Store manual values in a local file with owner-only permissions (chmod 600), never commit it, and delete it immediately after applying. Restrict RBAC access to the AnzoGraph resource. For secure noninteractive mechanics and automated CI/CD injection, see Template and secret contract.

3. Install​

Install the operator with Helm:

helm upgrade --install graph-lakehouse-operator \
  oci://artifacts.altair.com/graph-helmoci/anzograph-operator \
  --version 3.5.0 \
  --namespace graph-platform \
  --values operator-values.yaml \
  --atomic --wait --timeout 10m

Verify that the operator CRD is established and controller rollout completes before applying the workload custom resource:

kubectl wait --for=condition=Established crd/anzographs.anzograph.clusters.cambridgesemantics.com --timeout=2m
kubectl rollout status deployment/graph-lakehouse-operator-anzograph-operator --namespace graph-platform --timeout=5m

Apply the configured Graph Lakehouse custom resource:

kubectl apply -f graph-lakehouse.yaml

4. Verify​

Check custom resource and database pod status:

kubectl wait --for=jsonpath='{.status.phase}'=Running anzograph/graph-lakehouse --namespace graph-platform --timeout=20m
kubectl wait --for=condition=Ready pod -l app.kubernetes.io/name=graph-lakehouse-db --namespace graph-platform --timeout=10m

Confirm service and volume status:

kubectl get anzograph,pvc,service --namespace graph-platform

Expected result: Custom resource phase is Running, database pod is Ready, PVCs are Bound, and internal service anzograph-graph-lakehouse-db-lb is active.

Administrative credentials transfer​

The operator generates administrative gRPC credentials in the named Secret anzograph-graph-lakehouse-grpc. Do not print or decode passwords in open terminal output or logs. Transfer the named Secret values into your organization's approved secret manager using an authorized, non-interactive process. For automated and non-interactive extraction workflows, see Template and secret contract.

Rollback boundary​

Before the custom resource is applied, uninstalling the operator release is safe. After the custom resource is applied and data is loaded, do not delete or reinitialize the database. Follow Uninstall and preserve all persistent volume claims deliberately.

5. Next steps​

  1. Transfer the generated admin credentials into your organization's secret manager.
  2. Configure approved ingress/load-balancer access with TLS termination before routing user traffic.
  3. Verify SPARQL/Cypher query execution and licensing status through a release-approved database query via the gRPC endpoint.
  4. For cross-component staging with Graph Studio (S3/Azure Blob or shared NFS), see Shared storage architecture.
  5. For custom database settings, logging sidecars, or NFS mounts, see Graph Lakehouse use cases.
  6. Review Upgrade and Uninstall runbooks before production rollout.