Production planning

Record these decisions in change control before installation.

Area	Required decision	Acceptance evidence
Release	One row from the release matrix	Chart and image versions/digests recorded
Capacity	CPU, memory, replicas, and growth margin	Product sizing review
Storage	Class, size, access mode, topology, reclaim policy	PVC binding plus backup/restore test
Shared files	Whether object storage File Connections (S3/Azure Blob) or NFS is required by the workflow	Bucket access/IAM or NFS v4+ connectivity and permissions test (see Shared storage architecture)
Network	ClusterIP, ingress, or load balancer; allowed CIDRs	Endpoint reachable only from approved sources
TLS	Issuer/Secret, DNS names, CA chain, rotation owner	Trusted HTTPS connection
Credentials	Generation, storage, access, rotation	No default or committed credentials
Licensing	CSI legacy licensing method	Product reports active license
Security	Service accounts, RBAC, Pod Security/SCC, network policy	Security review and policy admission pass
Recovery	Backup scope, frequency, restore target, RTO/RPO	Successful restore test

Storage rules

• Use persistent volumes for product data and required logs.
• Treat StatefulSet PVC retention and StorageClass/PV reclaim policy as separate controls.
• Use ReadWriteMany only when a supported shared workflow requires concurrent mounts.
• For shared staging storage between Graph Studio and Graph Lakehouse, prefer S3 or Azure Blob File Connections. When NFS is required, use NFS v4 or later, verify ownership/group permissions across pods, and see Shared storage architecture.
• Do not reuse retained Graph Lakehouse data across incompatible versions or cluster shapes.

Network and TLS rules

• Start with ClusterIP unless external exposure is required.
• Restrict load balancer source ranges; never retain 0.0.0.0/0 by default.
• Use organization-approved certificates and CA bundles.
• Test certificate renewal and trust updates before production.

Release gate

Do not approve production use until the release owner records public artifact availability and disposable-cluster validation in data/releases.yaml. Kubernetes 1.35 is the recorded documentation baseline; other compatibility targets require release-specific evidence. For validation gates and release contracts, see Agentic reference.

Distributed Unstructured and Elasticsearch are outside the current installation scope. Add them only with a product-approved architecture and version matrix.