Prerequisites

Prepare these items before running an installation.

Required tools

• A supported Kubernetes or OpenShift cluster.
• kubectl configured for the target cluster.
• Helm 3.
• Permission to create namespaces, services, secrets, persistent volumes, and RBAC resources.
• Permission to install CRDs if you use operators.

Access the Graph artifact registry

Graph images and charts are distributed through the authenticated public registry at artifacts.altair.com. Sign in with your Siemens email address and create an access token before installing a chart or pulling an image.

Store the token in a secure password or secrets manager. Do not add it to a values file, a custom resource, shell history, or source control.

export ARTIFACTORY_USERNAME=<your-siemens-email>
read -r -s -p "Artifactory access token: " ARTIFACTORY_TOKEN
echo
export ARTIFACTORY_TOKEN

printf '%s' "${ARTIFACTORY_TOKEN}" | \
  docker login artifacts.altair.com \
  --username "${ARTIFACTORY_USERNAME}" \
  --password-stdin

printf '%s' "${ARTIFACTORY_TOKEN}" | \
  helm registry login artifacts.altair.com \
  --username "${ARTIFACTORY_USERNAME}" \
  --password-stdin

Create an image-pull secret in every namespace where Kubernetes will run Graph workloads. The secret must be in the same namespace as the Helm release or operator custom resource that uses it.

export NAMESPACE=<namespace>
export REGISTRY_SECRET=graph-artifacts

kubectl create namespace "${NAMESPACE}" --dry-run=client -o yaml | kubectl apply -f -

kubectl create secret docker-registry "${REGISTRY_SECRET}" \
  --namespace "${NAMESPACE}" \
  --docker-server=artifacts.altair.com \
  --docker-username="${ARTIFACTORY_USERNAME}" \
  --docker-password="${ARTIFACTORY_TOKEN}"

tip

The secret has type kubernetes.io/dockerconfigjson. Reference its name through the chart values or custom-resource pod template shown in the installation instructions; do not copy the token into those resources.

Required decisions

Decision	What to choose
Namespace	Where to install the operator, Helm release, or product custom resource.
Chart reference	A release-approved Graph OCI chart, for example oci://artifacts.altair.com/graph-helmoci/anzo.
Image tags	Release-approved image tags. Do not use latest in production.
Registry secret	A namespace-local Docker registry secret for artifacts.altair.com.
Storage	Storage class, volume sizes, retention policy, and whether NFS/shared storage is required.
Network access	Ingress, internal load balancer, external load balancer, and source-range restrictions.
TLS	Certificate secret names and trust requirements.
Credentials	Kubernetes secrets for administrator, UI, gRPC, keystore, and registry credentials.
Licensing	Altair One or release-approved license material.

Placeholders used in commands

Replace these before running commands:

export NAMESPACE=<namespace>
export RELEASE_NAME=<release-name>
export CHART_VERSION=<release-version>
export REGISTRY_SECRET=graph-artifacts
export TLS_SECRET=<tls-secret>
export STORAGE_CLASS=<storage-class>

Storage note

Graph Studio and Graph Lakehouse need persistent storage for production use. Siemens source documentation recommends NFS version 4 or later for shared platform storage and describes NFS as required for Kubernetes integration and dynamic deployments.

Elasticsearch note

If you use Distributed Unstructured or large text-search workloads, plan Elasticsearch. Confirm the release-specific Elasticsearch version matrix before deployment.