Skip to main content

​
Prerequisites

  • Access to run kubectl commands in the cluster’s context (kubectl can reach the target cluster).
  • helm is installed.
  • Your Kubernetes user can create namespaces, CRDs, RBAC resources, and workloads.
  • At least 3 worker nodes with 4 CPU and 16 GB of memory each.
  • Access to the FalkorDB Enterprise Portal, with the cluster registered so you have its registry credentials. Request access from your FalkorDB account manager.
  • The commands on this page do not apply a license, so the installation starts a 14-day trial. Activate the cluster’s license afterward, or run the install command from the cluster’s install guide in the portal, which applies the license Secret for you.
  • No ingress controller is needed: by default you reach the Admin UI with kubectl port-forward. A permanent address needs one; see Ingress controller.
  • Outbound access from the cluster to registry.falkordb.cloud (credentials required). The installer also contacts upstream hosts from both your machine and the cluster: the installer script, CRDs, the KubeBlocks and snapshot controller charts and images, and ingress-nginx when --quick-access installs one. See Network access for the full list.
Verify the active context before installing:

​
Install

Install with the default release and namespaces:
The chart and the Enterprise images are in the private registry.falkordb.cloud registry, so every install command needs --registry-username and --registry-password. The installer uses them to log Helm in to the registry before pulling the chart, and to create the image pull Secret the cluster pulls images with. Without them the install fails at the chart pull. Your username and access token are on the cluster’s install guide in the FalkorDB Enterprise Portal, which also generates the full command for you.
By default, the installer:
  • Installs or updates KubeBlocks in kb-system.
  • Installs or updates Snapshot Controller in kb-system.
  • Installs FalkorDB Enterprise in falkordb-system.
  • Keeps the Admin UI inside the Kubernetes cluster. It prints the kubectl port-forward command to reach it. To publish it on a public address over plain HTTP for an evaluation, pass --quick-access (see Quick access).
  • When the default StorageClass is local non-CSI storage such as local-path, keeps it on a multi-node cluster and warns that it is not suitable for production. On a single-node cluster it enables a bundled hostpath CSI driver in its place, so volume-snapshot backups work. That driver also keeps every volume on the one node and isn’t replicated storage, so it is for evaluation only. CSI storage is used as it is. See --local-csi-hostpath in the installer reference.
  • Disables the embedded KubeBlocks and snapshot-controller subcharts in the Enterprise release because those platform components are managed as separate releases.
  • Labels the FalkorDB namespace for Pod Security Admission: enforce=baseline, plus audit and warn at restricted. Override with --pod-security-enforce, --pod-security-audit, and --pod-security-warn, or pass an empty value to leave a label unset.
  • Generates or reuses the Admin Server JWT signing secret and stores it in a dedicated Secret named <release>-admin-server-jwt, then points the chart at it with adminServer.secret.jwtExistingSecret.name. The value is never passed through Helm values, so it does not appear in helm get values or in the process table.
  • Creates the bootstrap local admin user admin@falkordb.local with a random password, unless disabled with Helm values. The password is stored in the Secret <release>-initial-admin-password and must be changed at first sign-in.
The script prints an install plan and asks for confirmation. Use --yes for non-interactive installs:

​
Install into specific namespaces

​
Dry run

Render the chart without changing the cluster:
In dry-run mode, the script skips CRD apply, KubeBlocks install, Snapshot Controller install, image pull Secret creation, and stale definition cleanup. It still renders the Enterprise chart with helm template.

​
Validate the install

Check the Helm releases:
Check pods:

​
Open the Admin UI

The Admin UI is not exposed outside the Kubernetes cluster by default. Forward a local port to it:
Then open http://localhost:8080. The Admin UI forwards API calls to the Admin Server, so this one port-forward is all you need. Sign in as admin@falkordb.local. Read the generated password with:
You must choose a new password at first sign-in. Delete the falkordb-enterprise-initial-admin-password Secret afterwards. For a permanent address, configure the gateway Ingress with TLS, as described in the production install.

​
Quick access

For an evaluation, --quick-access publishes the Admin UI and the Admin Server API on one public origin through the chart’s gateway Ingress. The installer uses the cluster’s default IngressClass when one exists, and otherwise installs ingress-nginx into the ingress-nginx namespace. It then prints the URL.
Quick access serves the Admin UI over plain HTTP, usually on a public load balancer, so passwords and session cookies cross the network without encryption. Don’t use it for shared or production environments.
Quick access sets adminServer.env.cookieSecure=false. Because the UI and API share one origin, the auth cookie keeps the default SameSite=Lax policy. Use --no-ingress to fall back to two LoadBalancer services on separate origins, which additionally sets adminServer.env.cookieSameSite=none. Quick access applies only to a first install without custom values, ingress, service host or service URL settings.

​
Local chart development

From a checked-out repository, use the local chart:
A local chart needs no Helm login, but the images are still private, so the installer needs the credentials to create the image pull Secret.