Deploy FalkorDB Enterprise on Amazon Elastic Kubernetes Service (EKS)

Prerequisites

AWS CLI (aws) v2, configured with credentials that can create VPCs, EKS clusters, node groups, and IAM roles (aws configure or SSO).
eksctl 0.180 or later.
kubectl, helm, and base64 on the machine that runs the installer.
At least 3 worker nodes with 4 CPU and 16 GB of memory each.
Outbound access from the cluster to pull images: registry.falkordb.cloud (Enterprise images, credentials required), docker.io, apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com, registry.k8s.io, and ghcr.io — or registry.falkordb.cloud alone, since every image is also mirrored there (see Private registries).

Confirm the CLI is authenticated against the right account:

aws sts get-caller-identity

Required infrastructure

A production EKS install needs:

Resource	Purpose
VPC and subnets	Network for the EKS control plane and nodes (created by `eksctl`).
EKS cluster	Kubernetes control plane and a small system node group.
Managed node group	Dedicated capacity for FalkorDB database workloads.
Amazon EBS CSI driver	Persistent volumes and snapshot-based backups (not enabled by default — installed below).
Load balancer or ingress with public DNS	External access to the Admin UI and Admin Server.

Set common variables used by the commands below:

export AWS_REGION=us-east-1
export CLUSTER_NAME=falkordb-enterprise
export K8S_VERSION=1.34

1. Create the EKS cluster

Create a cluster with a small system node group and an IAM OIDC provider (required for the EBS CSI driver in the next step). eksctl creates the VPC and subnets automatically:

eksctl create cluster \
  --name "$CLUSTER_NAME" \
  --region "$AWS_REGION" \
  --version "$K8S_VERSION" \
  --nodegroup-name system \
  --node-type m6i.xlarge \
  --nodes 2 \
  --nodes-min 2 \
  --nodes-max 3 \
  --with-oidc \
  --managed

Add --zones us-east-1a,us-east-1b,us-east-1c to pin the cluster to specific availability zones if needed.

2. Create a managed node group for databases

Size this pool for your FalkorDB memory footprint. Memory-optimized r6i instances are a good fit for graph workloads.

eksctl create nodegroup \
  --cluster "$CLUSTER_NAME" \
  --region "$AWS_REGION" \
  --name falkordb \
  --node-type r6i.2xlarge \
  --nodes 3 \
  --nodes-min 3 \
  --nodes-max 10 \
  --node-labels "workload=falkordb" \
  --managed

3. Get cluster credentials

aws eks update-kubeconfig \
  --region "$AWS_REGION" \
  --name "$CLUSTER_NAME"

kubectl config current-context
kubectl get nodes

4. Install the Amazon EBS CSI driver

EKS does not provision persistent volumes out of the box — the Amazon EBS CSI driver add-on must be installed explicitly, with an IAM role scoped to it:

export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)

eksctl create iamserviceaccount \
  --cluster "$CLUSTER_NAME" \
  --region "$AWS_REGION" \
  --namespace kube-system \
  --name ebs-csi-controller-sa \
  --role-name "AmazonEKS_EBS_CSI_DriverRole_${CLUSTER_NAME}" \
  --attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy \
  --role-only \
  --approve

eksctl create addon \
  --cluster "$CLUSTER_NAME" \
  --region "$AWS_REGION" \
  --name aws-ebs-csi-driver \
  --service-account-role-arn "arn:aws:iam::${AWS_ACCOUNT_ID}:role/AmazonEKS_EBS_CSI_DriverRole_${CLUSTER_NAME}" \
  --force

5. Verify storage and snapshot support

FalkorDB Enterprise uses persistent volumes for databases and the Admin Server, and volume snapshots for backups. Create a gp3 storage class and mark it default:

cat <<'EOF' | kubectl apply -f -
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: gp3
  annotations:
    storageclass.kubernetes.io/is-default-class: "true"
provisioner: ebs.csi.aws.com
parameters:
  type: gp3
volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: true
EOF

kubectl get storageclass
kubectl get crd volumesnapshots.snapshot.storage.k8s.io

EKS does not ship the VolumeSnapshot CRDs or a snapshot controller by default, so leave the installer’s bundled Snapshot Controller enabled (this is the default — no extra flag needed).

Install FalkorDB Enterprise

Quick install

With the EKS context active, run the installer:

curl -fsSL https://falkordb.github.io/FalkorDB-Enterprise/install.sh | \
  bash -s -- \
    --registry-username '<username>' \
    --registry-password '<token>' \
    --yes

The installer keeps the Admin UI inside the Kubernetes cluster and prints the kubectl port-forward command to reach it, along with how to read the generated admin password. For an evaluation, --quick-access on a first install instead exposes the Admin UI and Admin Server API on the ingress controller’s address over plain HTTP. It uses the cluster’s default IngressClass, an IngressClass named nginx, or the only IngressClass in the cluster, in that order, and installs ingress-nginx only when none of these exists. The installer does not manage an ingress controller it did not install. The address is public only if that controller provides a public external address; an internal controller gives an internal one. The ingress-nginx controller Service provisions a Classic Load Balancer by default. See Quickstart for what the installer does and how to validate it.

Production install

For production, prepare a values file with TLS ingress, a stable JWT secret, and a bootstrap admin user as described in Production install. A ready-to-edit EKS example ships inside the chart at examples/values-eks.yaml — extract it with helm registry login registry.falkordb.cloud --username '<username>' (it prompts for your access token), then helm pull oci://registry.falkordb.cloud/falkordb/falkordb-enterprise --untar. Example EKS-specific values:

gateway:
  enabled: true
  ingress:
    enabled: true
    className: nginx
    hosts:
      - host: admin.example.com
    tls:
      - secretName: falkordb-enterprise-admin-tls
        hosts:
          - admin.example.com

adminServer:
  env:
    nodeEnv: production
    corsOrigin: https://admin.example.com
    cookieSecure: true
  persistence:
    enabled: true
    size: 8Gi
    storageClassName: gp3

These values use className: nginx, so the cluster needs the ingress-nginx controller. The installer installs it only for --quick-access, so install it yourself first:

helm upgrade --install ingress-nginx ingress-nginx \
  --repo https://kubernetes.github.io/ingress-nginx \
  --namespace ingress-nginx --create-namespace

To use a Network Load Balancer instead of the default Classic Load Balancer, annotate the ingress-nginx controller Service after install:

kubectl annotate service ingress-nginx-controller -n ingress-nginx \
  service.beta.kubernetes.io/aws-load-balancer-type=nlb

Then install:

curl -fsSL https://falkordb.github.io/FalkorDB-Enterprise/install.sh | \
  JWT_SECRET="$(openssl rand -hex 32)" bash -s -- \
    --registry-username '<username>' \
    --registry-password '<token>' \
    --kube-context "$(kubectl config current-context)" \
    --namespace falkordb-system \
    --kubeblocks-namespace kb-system \
    --values production-values.yaml \
    --yes

DNS

Point your Admin UI hostname at the ingress load balancer:

kubectl get ingress -n falkordb-system

Create a Route 53 record for admin.example.com pointing at the ADDRESS (hostname) shown:

aws route53 change-resource-record-sets \
  --hosted-zone-id "<hosted-zone-id>" \
  --change-batch '{
    "Changes": [{
      "Action": "UPSERT",
      "ResourceRecordSet": {
        "Name": "admin.example.com",
        "Type": "CNAME",
        "TTL": 300,
        "ResourceRecords": [{"Value": "<ingress-hostname>"}]
      }
    }]
  }'

Validate the install

helm status kubeblocks -n kb-system
helm status falkordb-enterprise -n falkordb-system
kubectl get pods -n kb-system
kubectl get pods -n falkordb-system
kubectl get ingress -n falkordb-system

With the production values file, open the Admin UI hostname. After a default install there is no Ingress: use the kubectl port-forward command the installer printed. Sign in with the bootstrap admin user; Open the Admin UI shows how to read its generated password.

Pod security admission

The installer labels falkordb-system with enforce=baseline. baseline is also enough for kb-system and for database namespaces. See Pod Security Admission levels for the measured level of each namespace and the workloads that cap it.

Clean up

Delete the Enterprise release first (see uninstall), then remove the AWS resources:

eksctl delete nodegroup --cluster "$CLUSTER_NAME" --region "$AWS_REGION" --name falkordb
eksctl delete cluster --name "$CLUSTER_NAME" --region "$AWS_REGION"

Deleting the cluster removes the VPC, subnets, node groups, and load balancers eksctl created for it.

Get started

Install

Authentication

Deploy databases

Operations

Licensing

Security

Releases

Upgrade and uninstall

Troubleshooting

Deploy FalkorDB Enterprise on Amazon Elastic Kubernetes Service (EKS)

Prerequisites

Required infrastructure

1. Create the EKS cluster

2. Create a managed node group for databases

3. Get cluster credentials

4. Install the Amazon EBS CSI driver

5. Verify storage and snapshot support

Install FalkorDB Enterprise

Quick install

Production install

DNS

Validate the install

Pod security admission

Clean up

​Prerequisites

​Required infrastructure

​1. Create the EKS cluster

​2. Create a managed node group for databases

​3. Get cluster credentials

​4. Install the Amazon EBS CSI driver

​5. Verify storage and snapshot support

​Install FalkorDB Enterprise

​Quick install

​Production install

​DNS

​Validate the install

​Pod security admission

​Clean up

Prerequisites

Required infrastructure

1. Create the EKS cluster

2. Create a managed node group for databases

3. Get cluster credentials

4. Install the Amazon EBS CSI driver

5. Verify storage and snapshot support

Install FalkorDB Enterprise

Quick install

Production install

DNS

Validate the install

Pod security admission

Clean up