Prerequisites

The chart deploys GLYPH's workloads and the custom resources for its databases. It does not install the platform pieces those depend on. Have everything on this page in place first, because several omissions only show up as confusing install failures.

Checklist

Requirement	Detail
Registry access	Pull credentials for the SENTRIQS container registry, provided by SENTRIQS. They cover the chart, the images, and your license.
Tooling	Helm 3 or later, kubectl, and openssl for generating secret values.
Cluster	Kubernetes with a default StorageClass and a CNI that enforces NetworkPolicy.
Istio	CRDs, istiod, and an ingress gateway labeled istio: ingress in istio-system.
cert-manager	Required by the RabbitMQ Cluster Operator.
Operators	MongoDB Community Operator 1.12.0 and RabbitMQ Cluster Operator 2.23.0.
Namespaces	The application namespace (default glyph), created before install.
DNS and TLS	A hostname that resolves to the ingress gateway, and a TLS Secret for it in istio-system.
Images	glyph-server, glyph-frontend, and glyph-mongodb available to your cluster, either mirrored into your own registry or pulled with the SENTRIQS credentials.
Application Secret	glyph-app-local-secrets, with all 23 keys, in the application namespace.
Email	A plan for outbound system email. See Email.

Kubernetes cluster

The chart does not declare a minimum Kubernetes version. It uses batch/v1 CronJobs, which means 1.21 or later, and the Istio and operator versions you choose may require newer. Reference environments are a local k3d cluster and Amazon EKS. Ask SENTRIQS to confirm other distributions before you commit to them.

• Rights. Installing the prerequisites creates CRDs, ClusterRoles, and admission webhooks, and the chart creates resources in istio-system. Use an account with cluster-admin or equivalent.
• Storage. The chart never sets a storageClassName, so the cluster default is used. All volumes are ReadWriteOnce filesystem volumes: MongoDB 20Gi, RabbitMQ 10Gi, SeaweedFS master 1Gi, volume 10Gi, and filer 10Gi.
• Node kernel. MongoDB 8.0 and later refuses to start on Linux kernel 6.19 and newer because of an upstream bug, unless the kernel is 7.0.14 or later. Check your node kernel version before the first install. There is no override flag.
• NetworkPolicy enforcement. The chart creates NetworkPolicy resources. If your CNI does not enforce them, they exist but do nothing.

Istio

Istio is required, not optional. The chart always renders an Istio Gateway and VirtualService, and there is no setting to use a different ingress controller.

• Install the Istio base CRDs and istiod.
• Run an ingress gateway in istio-system whose pods carry the label istio: ingress. The chart's Gateway selects that label and it is not configurable. Installing the Istio gateway chart with the release name istio-ingress produces it.
• The reference setup uses Istio ambient mode with strict mTLS, and the security description in these docs assumes it. The chart does not create the mesh policy, so you apply it (see Installation). Ask SENTRIQS before choosing a different mode.

cert-manager

cert-manager is needed for the RabbitMQ Cluster Operator's webhook certificates. The reference setup uses v1.21.2. You can also use it to issue the certificate for your hostname, but the chart does not create that certificate for you.

Operators

The chart creates a MongoDBCommunity and a RabbitmqCluster resource. Their operators must already be running. The manifests SENTRIQS tested against are in the chart's operators/ directory.

Operator	Version	Where it runs
MongoDB Community Operator	1.12.0	The same namespace as the database resource (mongo.namespace, default glyph)
RabbitMQ Cluster Operator	2.23.0	rabbitmq-system, watching the whole cluster

Operator placement

The MongoDB operator watches only its own namespace. The vendored manifest uses the namespace mongodb, so rewrite it to your application namespace when you apply it. The RabbitMQ operator registers admission webhooks that reject requests when unreachable, so wait until its webhook Service has endpoints before installing the chart.

The operators do the day-to-day database work: they create and configure the MongoDB replica set and the RabbitMQ cluster, roll out version and replica-count changes, and keep both reconciled with what the chart declares. Scaling or upgrading is a values change rather than a manual procedure.

Both operators install CRDs and cluster-scoped permissions. Review them with your security team using Security.

Namespaces

• Create the application namespace yourself. The chart does not.
• istio-system must exist, because the Gateway and the TLS Secret live there.
• The namespace passed to helm install --namespace, the namespace value, and mongo.namespace must all be the same.

DNS and TLS

• Choose the hostname users will type, for example glyph.example.com, and point DNS at the ingress gateway's load balancer.
• Create a TLS Secret (type kubernetes.io/tls) for that hostname in istio-system. The default name is glyph-app-tls, set with ingress.tls.secretName.
• HTTPS is mandatory. The web app relies on browser service workers, which browsers only expose in a secure context.
• The application matches the hostname exactly as the browser reports it, with no port. Serve it on the default HTTPS port (443).

Container images

SENTRIQS supplies three images from its container registry, using the pull credentials described in Installation. Ask for the tags that match the chart version you are installing. Mirror them into a registry your cluster can pull from, or pull them directly with pull secrets.

Image	Used for
glyph-server	The server and all periodic jobs
glyph-frontend	The frontend
glyph-mongodb	The mongod container, a minimal image built for this chart

The chart also pulls third-party images:

Image	Source
cgr.dev/chainguard/kubectl (pinned by digest)	The wait-for-mongo init container
chrislusf/seaweedfs	Object storage, from Docker Hub
Operator images and the images they start	quay.io and ghcr.io for the operators and MongoDB components, Docker Hub for RabbitMQ

For an air-gapped environment, mirror these and override the repositories. The operators choose some images at runtime, so list what is actually running after an install:

kubectl get pods -A -o jsonpath='{range .items[*]}{range .spec.containers[*]}{.image}{"\n"}{end}{range .spec.initContainers[*]}{.image}{"\n"}{end}{end}' | sort -u

Registry credentials

The chart has no imagePullSecrets setting, so mirroring the images into your own registry is the simpler route and keeps the SENTRIQS credentials off the cluster. If your own registry requires authentication, use node-level credentials (for example an EKS node role for ECR) or attach pull secrets to the service accounts in the namespace.

Application Secret

The chart contains no secret material. It references a Secret by name, glyph-app-local-secrets by default (server.secrets.localSecretName), which must exist in the application namespace before install.

Every key is required

All 23 keys are mandatory, even for features you do not use. A missing key leaves the server pod in CreateContainerConfigError. Some values are validated at startup, so a placeholder must still be well formed, for example a generated RSA private key in PEM format for the two private keys.

Key	Purpose
password	Password for the MongoDB application user
JWT_SECRET	Token signing secret
PWD_PEPPER, PWD_PEPPER1	Password hashing secrets
S3_ACCESS_KEY, S3_SECRET_KEY	Object storage credentials, used by SeaweedFS and the server
VAPID_PUB_KEY, VAPID_PRIV_KEY	Web push key pair
FIREBASE_PROJECT_ID, FIREBASE_CLIENT_EMAIL, FIREBASE_PRIV_KEY	Firebase service account for push notifications
SC_CLIENT_ID, SC_CLIENT_SECRET	Credentials for the GLYPH web client. The ID must be a 24-character hex string.
VONAGE_API_KEY, VONAGE_APP_ID, VONAGE_PRIVATE_KEY	Vonage Video API, used for meetings and huddles
SNOWFLAKE_ACCT, SNOWFLAKE_USER, SNOWFLAKE_ROLE, SNOWFLAKE_PASS, SNOWFLAKE_DB, SNOWFLAKE_SCHEMA, SNOWFLAKE_WH	Snowflake, used only by the analytics and dailyMetrics jobs

• Vonage. Video meetings need a real Vonage Video API application. With placeholder values the server starts, but video connections fail.
• Snowflake. Only the two analytics jobs use it, and both are off by default. Placeholders are fine until you enable them.
• Rotation. Treat the signing and hashing secrets as long-lived. Ask SENTRIQS before rotating them.
• Production handling. Create the Secret through your normal secrets workflow (External Secrets Operator, Sealed Secrets, or similar) rather than from a shell. The chart only needs the finished Secret to exist.

Email

The server sends system email, such as invitations and password resets, through Amazon SES. The chart does not configure email delivery. Agree an email arrangement with SENTRIQS before go-live, or invitations and password resets will not reach users.

Network access

The chart does not restrict outbound traffic. If your cluster does, allow:

• The SENTRIQS registry, your own image registries, and the third-party registries listed above.
• The Vonage Video API, for meetings.
• Firebase and web push endpoints, for push notifications.
• Amazon SES, for system email.
• Snowflake, only if you enable analytics or dailyMetrics.
• AWS Secrets Manager, only if you set server.skipAwsSecrets to false.

Once everything on this page is in place, continue to Installation.