GLYPH Helm ChartRun GLYPH on your own Kubernetes cluster.

What the chart deploys, what your cluster must provide first, how it handles security, and where to get help.

Who this is for

• Kubernetes administrators who install, upgrade, and operate GLYPH. Start with Prerequisites, then Installation.
• Security officers who review the deployment before approving it. Start with Security.

If you want to use or administer a GLYPH workspace once it is running, see the Guides instead.

Early release

The chart is named glyph-app and is an early release. Value names, defaults, and install steps can change between releases. Confirm the current chart version with SENTRIQS before you plan an install.

Getting the chart

SENTRIQS provides the installer with pull credentials for its container registry. One set of credentials gives access to:

• The GLYPH Helm chart.
• The GLYPH container images (glyph-server, glyph-frontend, and glyph-mongodb).
• Your license.

Request the credentials from SENTRIQS before you start. Installation shows how to use them.

What the chart deploys

Component	Purpose	How it is deployed
Frontend	Serves the web app and proxies API and WebSocket traffic to the server.	Deployment, 2 replicas
Server	The GLYPH application server.	Deployment, 2 replicas
Periodic jobs	cleanup (daily, on by default), plus archiver, analytics, and dailyMetrics (off by default). They reuse the server image.	CronJobs
MongoDB	Primary database, run as an operator-managed replica set.	MongoDBCommunity resource, 1 member, 20Gi volume
RabbitMQ	Message broker, run as an operator-managed cluster.	RabbitmqCluster resource, 1 replica, 10Gi volume
Object storage	S3-compatible storage for files and archive material. The bucket is created with Object Lock and versioning.	SeaweedFS subchart (master, volume, filer, S3 gateway)
Routing and TLS	Host routing, TLS termination, and HTTP to HTTPS redirect.	Istio Gateway and VirtualService
Network policies	Default deny for inbound traffic to the namespace.	Three NetworkPolicy resources

Defaults are lean for a fast first install, and high availability is a values override. See Configuration.

What the chart does not deploy

You provide these first

Istio, cert-manager, the MongoDB Community Operator, the RabbitMQ Cluster Operator, the namespace, the TLS certificate for your hostname, and the application Secret. The chart creates resources that depend on every one of them. Prerequisites covers each in turn.

How traffic flows

1. Browsers connect to the Istio ingress gateway over HTTPS. TLS ends at the gateway, using a certificate Secret you provide.
2. From the gateway onward, traffic stays inside the Istio service mesh. With strict mTLS enforced, every hop is encrypted and mutually authenticated, so the gateway reaches the frontend over mTLS.
3. The frontend proxies API and WebSocket requests to the server over mTLS.
4. The server talks to MongoDB, RabbitMQ, and the S3 gateway in the same namespace, all over mTLS.
5. The server and jobs also make outbound HTTPS calls to a few external services, such as video and push notifications. See Security.

The chart does not create the mesh policy. Installation applies strict mTLS to the namespace, as in the reference setup.

GLYPH content is end-to-end encrypted by the clients, as described in the Security Model. This section covers the infrastructure around that, not the cryptography.

Where to go next

Prerequisites

What your cluster, registry, DNS, and secrets must provide before the first install.

Installation

The install sequence, plus upgrade and uninstall notes.

Configuration

The values that matter, their defaults, and sizing for availability.

Security

Workload hardening, permissions, network, secrets, and data.

Getting Support

What to collect, how to reach us, and where common install problems usually come from.