Helm values - FalkorDB Docs

This page summarizes the high-impact Helm values for FalkorDB Enterprise.

The source of truth is the chart’s own values.yaml. Extract it with helm pull oci://registry.falkordb.cloud/falkordb/falkordb-enterprise --untar and verify against the chart version you are installing.

For every key the chart accepts, not just the ones below, see All Helm values. That page is generated from values.yaml, so its defaults are always the shipped ones.

Platform dependencies

Value	Default	Purpose
`kubeblocks.enabled`	`true`	Enables embedded KubeBlocks subchart for standalone Helm use. The installer sets this to `false` because it manages KubeBlocks as a separate release.
`snapshot-controller.enabled`	`false`	Snapshot Controller subchart. The installer manages Snapshot Controller separately.
`volumeSnapshotClass.enabled`	`true`	Creates a `VolumeSnapshotClass` for CSI-backed storage. The default driver is `hostpath.csi.k8s.io` for local development when `csi-hostpath-driver.enabled=true`; production installs should set this to the CSI driver used by their storage class.
`csi-hostpath-driver.enabled`	`false`	Optional CSI hostpath driver for local development clusters that need volume snapshot backups. Existing `local-path` PVCs are not migrated; recreate clusters on the CSI storage class before using volume snapshots.
`falkordb-addon.enabled`	`true`	Installs the FalkorDB KubeBlocks addon as part of the Enterprise chart.
`falkordb-browser.enabled`	`true`	Installs FalkorDB Browser.
`csi-s3.enabled`	`false`	Optional S3 CSI driver dependency.
`csi-nfs.enabled`	`false`	Optional NFS CSI driver dependency.

When using install.sh, the installer detects the default StorageClass provisioner and configures snapshot values automatically:

CSI-backed cloud StorageClasses, such as ebs.csi.aws.com, pd.csi.storage.gke.io, and disk.csi.azure.com, get a matching chart-managed VolumeSnapshotClass unless a default one already exists for that driver.
Local non-CSI StorageClasses, such as rancher.io/local-path, enable the optional csi-hostpath-driver and make csi-hostpath-sc the default for new PVCs. Existing PVCs are not migrated.
Unknown or non-CSI provisioners disable the chart-managed VolumeSnapshotClass; pass --set volumeSnapshotClass.driver=<csi-driver> when the storage platform supports snapshots but cannot be detected.

Explicit --set and --set-string values passed to the installer override the detected snapshot configuration. On upgrades, the installer reuses existing Helm release values before applying new detected values. This preserves deployment-specific image tags, image pull secrets, ingress hosts, TLS settings, and immutable PVC settings while still adding the correct snapshot configuration. FalkorDB Enterprise is intentionally limited to one installation per Kubernetes cluster. The chart renders a fixed cluster-scoped ClusterRole install lock and also checks for an existing Helm-owned ClusterDefinition/falkordb from older chart versions. Upgrades of the owning Helm release are allowed; installs from a different release or namespace fail during Helm rendering.

Registry credentials

registry.falkordb.cloud serves the FalkorDB images anonymously, so a default install needs no credentials. Configure this block only when pulling from a registry that requires authentication.

Value	Default	Purpose
`global.imageRegistry`	`registry.falkordb.cloud/falkordb`	Registry host and namespace prefixed to every chart-owned image. Overrides per-image `registry` values.
`global.imageCredentials.create`	`false`	When `true`, the chart creates the `dockerconfigjson` Secret from the fields below. When `false`, the Secret must already exist in the release namespace.
`global.imageCredentials.name`	`""`	Name of the pull Secret. Empty means no pull secret is referenced. Defaults to `falkordb-registry-pull-secret` when `create=true`.
`global.imageCredentials.registry`	`registry.falkordb.cloud`	Registry host the credentials authenticate against. Required when `create=true`.
`global.imageCredentials.username`	`""`	Registry username. Required when `create=true`.
`global.imageCredentials.password`	`""`	Registry password or token. Required when `create=true`.
`global.imagePullSecrets`	`[]`	Additional pull Secrets applied on top of `imageCredentials.name`. Entries may be plain names or `{name: ...}` objects.
`falkordb-addon.imagePullSecrets`	`[]`	Pull Secrets referenced by FalkorDB database pods and OpsDefinition jobs. Must match the names above; the addon subchart cannot read `global`.

Kubernetes has no cluster-scoped image pull Secret — imagePullSecrets always resolves in the pod’s own namespace. The Admin Server therefore copies the Secrets named in global.imageCredentials.name and global.imagePullSecrets from its own namespace into every namespace it provisions a database into, refreshing the copy on each cluster operation so a rotated credential propagates. Nothing outside this block needs to know the credentials, and operators do not have to seed namespaces by hand. install.sh creates the Secret from GITEA_USERNAME and GITEA_TOKEN (or --registry-username / --registry-password) and sets all of the values above for you.

Setting global.imageCredentials.create=true on an existing release hands ownership of the Secret to Helm. Helm refuses to adopt an object it does not own, so this fails with invalid ownership metadata unless the existing Secret carries the app.kubernetes.io/managed-by=Helm label and the meta.helm.sh/release-name and meta.helm.sh/release-namespace annotations. Secrets created by install.sh are stamped with them and are adoptable; hand-made ones must be labeled or deleted first.

API server address

Value	Default	Purpose
`global.kubernetesServiceHost`	`""`	Overrides `KUBERNETES_SERVICE_HOST` in every chart-owned container, and in database pods through `falkordb-addon`. Empty keeps the ClusterIP the kubelet injects.
`global.kubernetesServicePort`	`""`	Overrides `KUBERNETES_SERVICE_PORT` and `KUBERNETES_SERVICE_PORT_HTTPS` in the same places. Empty keeps the kubelet’s port.
`global.extraEnv`	`[]`	Extra environment variables appended to every chart-owned container. Unlike the two values above it stops there: database pods take `falkordb-addon.extraEnv` instead. Component-level `extraEnv` is applied after this and still wins.

The kubelet injects KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT into every container, pointing at the API server’s in-cluster ClusterIP. Every in-cluster client — the Admin Server’s Kubernetes client, kubectl in the hook Jobs, controller-runtime inside KubeBlocks — builds its API URL from those two variables. Leave both values empty unless the ClusterIP route does not work; nothing is rendered when they are unset. Set them when either failure mode applies:

The ClusterIP’s only endpoint is a managed or public API endpoint that requires SNI. A client connecting by IP sends no SNI, so the endpoint cannot select a certificate and TLS fails mid-handshake.
A firewall rejects traffic to the ClusterIP outright.

A container’s own environment entry takes precedence over the kubelet-injected one, so setting these moves every client onto a DNS name.

The host must be covered by a Subject Alternative Name on the API server’s serving certificate, or clients will fail certificate verification instead of connecting. kubernetes.default.svc.cluster.local is always covered and is the right first choice.

KubeBlocks does not read global. Use install.sh --kubernetes-service-host, which fans the value out to the standalone KubeBlocks release it installs, or examples/values-apiserver-dns.yaml, which sets kubeblocks.extraEnvs and kubeblocks.dataProtection.extraEnvs alongside the global keys. FalkorDB database pods need no extra configuration. The falkordb-addon subchart reads the same two values and emits them through ComponentDefinition.spec.vars, which KubeBlocks injects into every container of a database pod, including the kbagent sidecar it adds itself.

Gateway and public URLs

Value	Default	Purpose
`gateway.enabled`	`true`	Enables shared gateway routing templates.
`gateway.ingress.enabled`	`false`	Creates public ingress routing when enabled.
`gateway.ingress.hosts[0].host`	`""`	Public hostname used to derive Admin UI URL and CORS defaults.
`gateway.routes.ui.path`	`/`	Admin UI route path.
`gateway.routes.api.path`	`/api`	Admin Server API route path.
`gateway.routes.openapi.path`	`/swagger.json`	OpenAPI route path.

Admin Server

Value	Default	Purpose
`adminServer.enabled`	`true`	Deploys Admin Server.
`adminServer.image.repository`	`falkordb/falkordb-enterprise-server`	Admin Server image repository.
`adminServer.image.tag`	`latest`	Admin Server image tag. Pin this for production.
`adminServer.secret.jwtSecret`	`""`	Required by chart rendering when `adminServer.secret.create=true`. The installer generates or reuses one. Must be at least 32 characters.
`adminServer.license.value`	`""`	Optional signed FalkorDB Enterprise license string. When set, the chart creates a dedicated Secret and the admin server activates it on startup. Prefer an existing Secret for production.
`adminServer.license.existingSecret.name`	`""`	Existing Secret name containing the signed license. Mutually exclusive with `adminServer.license.value`.
`adminServer.license.existingSecret.key`	`license`	Secret key that contains the signed license.
`adminServer.license.statePath`	`/data/license-state.json`	Persisted license state path. Keep under the admin server persistence mount so activated licenses survive pod restarts.
`adminServer.env.corsOrigin`	`""`	Overrides the derived Admin UI public URL for CORS.
`adminServer.env.cookieSecure`	`null`	Uses server default when unset. Set `true` for TLS production, `false` only for HTTP testing.
`adminServer.env.enableSwagger`	`"false"`	Enables Swagger/OpenAPI serving when set to `"true"`.
`adminServer.persistence.enabled`	`true`	Persists Admin Server data such as audit DB.
`adminServer.persistence.size`	`8Gi`	Admin Server PVC size.

Admin Server license

Leave adminServer.license unset to start on a 14-day free trial with no configured limits — no license value or Secret is required. Activate or replace the license later from the Admin UI’s License page; the values below only matter if you want to provide a license at install time.

Set a license directly in values for development or one-off installs:

adminServer:
	license:
		value: "falkor.license.v1.<payload>.<signature>"

For production, store the signed license in an existing Secret in the release namespace and reference it from values:

kubectl -n falkordb-system create secret generic falkordb-enterprise-license \
	--from-literal=license='falkor.license.v1.<payload>.<signature>'

adminServer:
	license:
		existingSecret:
			name: falkordb-enterprise-license
			key: license

The admin server reads the Secret through FALKORDB_LICENSE, validates the signature, and persists the license state at adminServer.license.statePath. If the license expires, is invalid, or any configured limit is exceeded, the server and UI enter read-only mode until a valid license within limits is active. The signed license key payload includes a version field so future payload formats can be introduced explicitly. The current supported payload version is 1. To bind a license to one Kubernetes cluster, include k8sClusterId in the signed payload. By default the admin server compares this value to the UID of the kube-system namespace. You can retrieve it with:

kubectl get namespace kube-system -o jsonpath='{.metadata.uid}'

If your environment needs a different cluster identity source, set K8S_CLUSTER_ID on the admin server and issue licenses with the same value. Licenses without k8sClusterId remain unbound.

{
	"version": 1,
	"licenseId": "lic_...",
	"accountName": "Example Corp",
	"k8sClusterId": "00000000-0000-0000-0000-000000000000",
	"issuedAt": "2026-05-28T00:00:00.000Z",
	"expiresAt": "2027-05-28T00:00:00.000Z",
	"limits": {
		"cpuCores": "unlimited",
		"memoryGB": "unlimited",
		"deployments": "unlimited",
		"users": "unlimited"
	}
}

Bootstrap Admin resources

Value	Default	Purpose
`adminServer.bootstrap.adminUser.create`	`true`	Creates a Kubernetes Secret-backed local admin user.
`adminServer.bootstrap.adminUser.email`	`admin@falkordb.local`	Bootstrap admin email.
`adminServer.bootstrap.adminUser.password`	`Test123!@#`	Bootstrap admin password used only if no password hash and no existing user Secret exist. Change for production.
`adminServer.bootstrap.adminUser.mustChangePassword`	`false`	Forces password change after first sign-in when true.
`adminServer.bootstrap.rbacConfig.create`	`false`	Seeds RBAC ConfigMap. Existing config is preserved with Helm keep annotation.
`adminServer.bootstrap.settingsConfig.create`	`false`	Seeds settings ConfigMap. Existing config is preserved with Helm keep annotation.

Admin UI

Value	Default	Purpose
`adminUi.enabled`	`true`	Deploys Admin UI.
`adminUi.image.repository`	`falkordb/falkordb-enterprise-ui`	Admin UI image repository.
`adminUi.image.tag`	`latest`	Admin UI image tag. Pin this for production.
`adminUi.env.viteApiUrl`	`""`	Public API origin. Defaults to relative routing through gateway behavior.
`adminUi.env.viteBrowserUrl`	`""`	Browser URL override. Defaults to the Browser ingress URL when configured.
`adminUi.env.viteMockApi`	`"false"`	Enables mock API mode. Keep false outside local UI demos.

Browser encryption

Value	Default	Purpose
`falkordb-browser.browser.encryption.key`	`""`	Optional 64-character hexadecimal Browser encryption key.
`falkordb-browser.browser.encryption.existingSecret.name`	`""`	Use an existing Secret instead of chart-generated key management.
`browserEncryptionKey.enabled`	`true`	Runs a hook Job to ensure Browser encryption key Secret exists and restarts Browser.

Observability

Value	Default	Purpose
`podMonitor.enabled`	`false`	Creates PodMonitor for Admin Server.
`alertRules.enabled`	`false`	Creates PrometheusRule resources.
`grafanaDashboards.enabled`	`false`	Creates Grafana dashboard resources from configured dashboard values.

​Platform dependencies

​Registry credentials

​API server address

​Gateway and public URLs

​Admin Server

​Admin Server license

​Bootstrap Admin resources

​Admin UI

​Browser encryption

​Observability

Platform dependencies

Registry credentials

API server address

Gateway and public URLs

Admin Server

Admin Server license

Bootstrap Admin resources

Admin UI

Browser encryption

Observability