Installation

This page walks through a full install in the order that works. Commands assume the application namespace is glyph, the Helm release is named glyph-app, and you are in the root of the chart directory you pull below. Read Prerequisites first.

Keep the release name

Name the release glyph-app. The object storage endpoint and its credential reference in values.yaml are written for that name. If you use another name, override storage.endpoint and seaweedfs.s3.credentials.admin.existingSecret to match.

Get the chart and images

SENTRIQS provides the installer with pull credentials for its container registry. They give access to the Helm chart, the GLYPH container images, and your license. SENTRIQS also gives you the registry hostname and repository paths. Treat the credentials like any other secret.

Log in and pull the chart. Passing the password on standard input keeps it out of your shell history:

helm registry login <sentriqs-registry> --username <username> --password-stdin
helm pull oci://<sentriqs-registry>/<repository>/glyph-app --version <version> --untar
cd glyph-app

Then bring the three images to a registry your cluster can pull from. Mirroring them into your own registry is the simplest route, because the chart has no imagePullSecrets setting:

docker login <sentriqs-registry>
docker pull <sentriqs-registry>/<repository>/<image>:<tag>
docker tag <sentriqs-registry>/<repository>/<image>:<tag> registry.example.com/glyph/<image>:<tag>
docker push registry.example.com/glyph/<image>:<tag>

Repeat for glyph-server, glyph-frontend, and glyph-mongodb, using the tags SENTRIQS gives you for your chart version. A direct registry-to-registry copy with skopeo or crane works equally well.

STEP 1Install cert-manager and Istio

Skip anything your cluster already has. This is the reference setup, with Istio in ambient mode:

helm install cert-manager oci://quay.io/jetstack/charts/cert-manager \
  --version v1.21.2 --namespace cert-manager --create-namespace \
  --set crds.enabled=true

helm repo add istio https://blob.istio.io/istio-release/charts
helm repo update
helm install istio-base istio/base -n istio-system --create-namespace
helm install istiod istio/istiod -n istio-system --set profile=ambient
helm install istio-cni istio/cni -n istio-system --set profile=ambient
helm install ztunnel istio/ztunnel -n istio-system
helm install istio-ingress istio/gateway -n istio-system

The Istio CNI plugin has distribution-specific paths on some platforms (k3s, for example). Check the Istio documentation for your platform. If you already run Istio, confirm only that an ingress gateway with the label istio: ingress exists in istio-system.

STEP 2Create the namespace and enforce mTLS

kubectl create namespace glyph
kubectl label namespace glyph istio.io/dataplane-mode=ambient

The label enrolls the namespace in the ambient mesh from the first pod onward. Then enforce strict mTLS so every hop inside the namespace is encrypted and mutually authenticated, and plaintext connections are rejected. The chart does not create this policy, so apply a PeerAuthentication yourself.

kubectl apply -f - <<EOF
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: default
  namespace: glyph
spec:
  mtls:
    mode: STRICT
EOF

STEP 3Install the operators

kubectl apply -f operators/mongodb-crds.yml
sed "s/namespace: mongodb$/namespace: glyph/" operators/mongodb-operator.yml \
  | kubectl apply -f -
kubectl rollout status deployment/mongodb-kubernetes-operator \
  -n glyph --timeout=120s

kubectl apply -f operators/rabbitmq-cluster-operator.yml
kubectl rollout status deployment/rabbitmq-cluster-operator \
  -n rabbitmq-system --timeout=120s

A ready Deployment does not guarantee the RabbitMQ webhook is routable yet. Wait until this prints an address, or the chart install fails with no endpoints available for service "cluster-operator-webhook-service":

kubectl get endpoints cluster-operator-webhook-service -n rabbitmq-system \
  -o jsonpath='{.subsets[0].addresses[0].ip}'

STEP 4Add the TLS certificate

Create the Secret for your hostname in istio-system, from a certificate issued by your CA or by cert-manager:

kubectl create secret tls glyph-app-tls -n istio-system \
  --cert=tls.crt --key=tls.key

STEP 5Create the application Secret

Create glyph-app-local-secrets in the application namespace with all 23 keys listed in Prerequisites. Hex values avoid characters that need URL encoding in database connection strings.

kubectl create secret generic glyph-app-local-secrets -n glyph \
  --from-literal=password="$(openssl rand -hex 24)" \
  --from-literal=JWT_SECRET="$(openssl rand -hex 32)" \
  --from-literal=PWD_PEPPER="$(openssl rand -hex 32)" \
  --from-literal=PWD_PEPPER1="$(openssl rand -hex 32)" \
  --from-literal=S3_ACCESS_KEY="$(openssl rand -hex 10)" \
  --from-literal=S3_SECRET_KEY="$(openssl rand -hex 20)" \
  --from-literal=SC_CLIENT_ID="$(openssl rand -hex 12)" \
  --from-literal=SC_CLIENT_SECRET="$(openssl rand -hex 32)" \
  --from-literal=VAPID_PUB_KEY="$VAPID_PUB_KEY" \
  --from-literal=VAPID_PRIV_KEY="$VAPID_PRIV_KEY" \
  --from-literal=FIREBASE_PROJECT_ID="$FIREBASE_PROJECT_ID" \
  --from-literal=FIREBASE_CLIENT_EMAIL="$FIREBASE_CLIENT_EMAIL" \
  --from-file=FIREBASE_PRIV_KEY=firebase-private-key.pem \
  --from-literal=VONAGE_API_KEY="$VONAGE_API_KEY" \
  --from-literal=VONAGE_APP_ID="$VONAGE_APP_ID" \
  --from-file=VONAGE_PRIVATE_KEY=vonage-private-key.pem \
  --from-literal=SNOWFLAKE_ACCT="$SNOWFLAKE_ACCT" \
  --from-literal=SNOWFLAKE_USER="$SNOWFLAKE_USER" \
  --from-literal=SNOWFLAKE_ROLE="$SNOWFLAKE_ROLE" \
  --from-literal=SNOWFLAKE_PASS="$SNOWFLAKE_PASS" \
  --from-literal=SNOWFLAKE_DB="$SNOWFLAKE_DB" \
  --from-literal=SNOWFLAKE_SCHEMA="$SNOWFLAKE_SCHEMA" \
  --from-literal=SNOWFLAKE_WH="$SNOWFLAKE_WH"

Generate the VAPID pair with npx web-push generate-vapid-keys. For features you do not use, supply well-formed placeholders. In production, prefer your secrets workflow over a shell command so the values do not land in shell history.

STEP 6Write a values file and install

Create my-values.yaml with your hostname and image locations:

namespace: glyph
global:
  domain: example.com
  subdomain: glyph
server:
  image:
    repository: registry.example.com/glyph/glyph-server
frontend:
  image:
    repository: registry.example.com/glyph/glyph-frontend
mongo:
  image:
    repository: registry.example.com/glyph/glyph-mongodb

This serves GLYPH at glyph.example.com. Add tag under each image if SENTRIQS gave you tags that differ from the defaults. See Configuration for everything else.

Fetch the SeaweedFS subchart if charts/ does not already contain it (this needs access to the SeaweedFS Helm repository), then install:

helm dependency update .
helm install glyph-app . --namespace glyph -f my-values.yaml

STEP 7Verify the install

kubectl wait --for=jsonpath='{.status.phase}'=Running \
  mongodbcommunity/glyph-mongodb -n glyph --timeout=300s
kubectl rollout status statefulset/glyph-rabbitmq-server -n glyph --timeout=180s
kubectl rollout status deployment/glyph-app-server -n glyph --timeout=180s
kubectl rollout status deployment/glyph-app-frontend -n glyph --timeout=180s
kubectl get pods -n glyph

Allow several minutes on a first install for image pulls and MongoDB to bootstrap. The server waits for MongoDB in an init container and retries, so a few early restarts are normal.

Once the pods are healthy, contact SENTRIQS to complete the initial setup of your deployment.

Upgrading

helm dependency update .
helm upgrade glyph-app . --namespace glyph -f my-values.yaml

• Review the diff first. Compare the new chart version's values.yaml and notes from SENTRIQS against your values file. The chart is pre-1.0, so names and defaults can change.
• MongoDB versions. Change mongo.version and mongo.featureCompatibilityVersion together, one major version at a time, and confirm the database is healthy between steps. A larger jump can leave the MongoDB operator unable to reconcile, and recovery is manual. Talk to SENTRIQS before any major MongoDB upgrade.
• Operators. The operators are not part of the release. Upgrade them separately, using the versions SENTRIQS lists for your chart version.

Uninstalling

helm uninstall glyph-app --namespace glyph

Uninstalling removes the release, not everything around it:

• Data volumes. Volumes created by the operators and by the SeaweedFS StatefulSets can remain, and so can your data. Check with kubectl get pvc -n glyph and delete them deliberately.
• Object storage credentials. The SeaweedFS S3 identity Secret is kept on purpose (helm.sh/resource-policy: keep).
• Prerequisites. The namespace, the application Secret, the TLS Secret, the operators and their CRDs, cert-manager, and Istio are all left in place. Remove the operators only after the release is gone.