All Helm values - FalkorDB Docs

Every key the chart accepts, with the default it ships with. This page is generated from the chart’s own values.yaml, so the defaults here are the ones you get. To read it directly, run helm pull oci://registry.falkordb.cloud/falkordb/falkordb-enterprise --untar.

Descriptions are the first paragraph of each key’s comment in values.yaml. Many keys carry longer rationale there — read the file itself before changing anything whose description mentions a caveat.

For the values that matter most, and why, start with Helm values.

`nameOverride`

Value	Default	Description
`nameOverride`	`""`	—

`fullnameOverride`

Value	Default	Description
`fullnameOverride`	`""`	—

`global`

Value	Default	Description
`global`	—	Registry for the images this chart owns directly: the admin server, the admin UI, and the two kubectl hook jobs. When set it replaces the per-image registry below. Defaults to registry.falkordb.cloud, which carries every image the chart can pull under one host so a standard install only needs to reach that one registry. FalkorDB’s own images are published there directly by CI; third-party images are mirrored in under their upstream path. Set to "" to pull the chart-owned images from their original registries instead (registry.falkordb.cloud for the admin server/UI and the enterprise database image, docker.io for the hook jobs).
`global.imageRegistry`	`"registry.falkordb.cloud/falkordb"`	—
`global.imageCredentials`	—	Registry credentials for the private FalkorDB images. This is the single place credentials are configured; everything else in the chart derives from it. The default registry serves the FalkorDB images anonymously, so the whole block is off by default — set it only when pulling from a registry that requires authentication.
`global.imageCredentials.create`	`false`	—
`global.imageCredentials.name`	`""`	—
`global.imageCredentials.registry`	`"registry.falkordb.cloud"`	—
`global.imageCredentials.username`	`""`	—
`global.imageCredentials.password`	`""`	—
`global.imageCredentials.email`	`""`	—
`global.imagePullSecrets`	`[]`	Extra pull secrets applied to every workload this chart owns, on top of `imageCredentials.name`. Entries may be plain names or objects with `name`. These are replicated into database namespaces alongside the credentials Secret above.
`global.kubernetesServiceHost`	`""`	Override the API server address that in-cluster clients derive from the KUBERNETES_SERVICE_HOST/KUBERNETES_SERVICE_PORT variables the kubelet injects into every container. Leave empty (the default) to keep the kubelet’s values, which point at the API server’s in-cluster ClusterIP — that is what almost every cluster wants and nothing is emitted.
`global.kubernetesServicePort`	`""`	—
`global.extraEnv`	`[]`	Extra environment variables appended to every container this chart owns. Component-level `extraEnv` is applied after this, so a component can still override an entry of the same name. Unlike the two values above, this one is not shared with the subcharts and does NOT reach the database pods: set `falkordb-addon.extraEnv` for those.

`extraObjects`

Value	Default	Description
`extraObjects`	`[]`	—

`preflight`

Value	Default	Description
`preflight`	—	—
`preflight.cleanupStaleOpsDefinitions`	—	—
`preflight.cleanupStaleOpsDefinitions.enabled`	`true`	—
`preflight.cleanupStaleOpsDefinitions.image`	—	alpine/kubectl rather than alpine/k8s: the hook only needs kubectl and a shell, while alpine/k8s also bundles aws, az, gcloud, helm and terraform. Measured with grype —only-fixed: alpine/k8s:1.33.1 carries 830 high and 126 critical fixable findings, alpine/kubectl:1.36.3 carries 4 high and 0 critical.
`preflight.cleanupStaleOpsDefinitions.image.registry`	`docker.io`	—
`preflight.cleanupStaleOpsDefinitions.image.repository`	`alpine/kubectl`	—
`preflight.cleanupStaleOpsDefinitions.image.tag`	`"1.36.3"`	—
`preflight.cleanupStaleOpsDefinitions.image.pullPolicy`	`IfNotPresent`	—
`preflight.cleanupStaleOpsDefinitions.serviceAccount`	—	—
`preflight.cleanupStaleOpsDefinitions.serviceAccount.create`	`true`	—
`preflight.cleanupStaleOpsDefinitions.serviceAccount.name`	`""`	—
`preflight.cleanupStaleOpsDefinitions.rbac`	—	—
`preflight.cleanupStaleOpsDefinitions.rbac.create`	`true`	—
`preflight.cleanupStaleOpsDefinitions.ttlSecondsAfterFinished`	`300`	—
`preflight.cleanupStaleOpsDefinitions.podAnnotations`	`{}`	—
`preflight.cleanupStaleOpsDefinitions.resources`	`{}`	—
`preflight.cleanupStaleOpsDefinitions.podSecurityContext`	—	—
`preflight.cleanupStaleOpsDefinitions.podSecurityContext.runAsNonRoot`	`true`	—
`preflight.cleanupStaleOpsDefinitions.podSecurityContext.runAsUser`	`1001`	—
`preflight.cleanupStaleOpsDefinitions.podSecurityContext.runAsGroup`	`1001`	—
`preflight.cleanupStaleOpsDefinitions.podSecurityContext.seccompProfile`	—	—
`preflight.cleanupStaleOpsDefinitions.podSecurityContext.seccompProfile.type`	`RuntimeDefault`	—
`preflight.cleanupStaleOpsDefinitions.securityContext`	—	—
`preflight.cleanupStaleOpsDefinitions.securityContext.allowPrivilegeEscalation`	`false`	—
`preflight.cleanupStaleOpsDefinitions.securityContext.readOnlyRootFilesystem`	`true`	—
`preflight.cleanupStaleOpsDefinitions.securityContext.capabilities`	—	—
`preflight.cleanupStaleOpsDefinitions.securityContext.capabilities.drop`	see values.yaml	—

`kubeblocks`

kubeblocks is a vendored subchart. Only the keys this chart sets are listed; everything else it accepts is documented by the subchart itself.

Value	Default	Description
`kubeblocks`	—	—
`kubeblocks.enabled`	`true`	—
`kubeblocks.nameOverride`	`falkordb-enterprise`	—
`kubeblocks.image`	—	kubeblocks does not read .Values.global, so it needs its own registry override to land on the mirror by default. This one key is enough: dataProtection.image.registry and addonChartsImage.registry both fall back to it when unset, so kubeblocks, kubeblocks-tools, kubeblocks-dataprotection, datasafed and kubeblocks-charts all follow.
`kubeblocks.image.registry`	`registry.falkordb.cloud/falkordb`	—
`kubeblocks.autoInstalledAddons`	`[]`	—
`kubeblocks.rbac`	—	—
`kubeblocks.rbac.additionalPolicyRules`	see values.yaml	KubeBlocks generates a ClusterRole per cluster component and binds it to the component’s ServiceAccount, so its operator needs ClusterRole write access. This cannot be narrowed with `resourceNames`: that field has no effect on `create`, and the generated names are not known in advance.

`snapshot-controller`

snapshot-controller is a vendored subchart. Only the keys this chart sets are listed; everything else it accepts is documented by the subchart itself.

Value	Default	Description
`snapshot-controller`	—	—
`snapshot-controller.enabled`	`false`	—
`snapshot-controller.installCRDs`	`true`	—
`snapshot-controller.controller`	—	—
`snapshot-controller.controller.image`	—	—
`snapshot-controller.controller.image.tag`	`v8.6.0`	Chart 5.0.3 defaults the tag to its appVersion (v8.5.0), which grype reports as 9 critical / 36 high fixable. v8.6.0 rebases onto a current distroless base: 0 critical / 10 high.

`volumeSnapshotClass`

Value	Default	Description
`volumeSnapshotClass`	—	—
`volumeSnapshotClass.enabled`	`true`	—
`volumeSnapshotClass.name`	`falkordb-enterprise-csi-hostpath`	—
`volumeSnapshotClass.driver`	`hostpath.csi.k8s.io`	—
`volumeSnapshotClass.deletionPolicy`	`Delete`	—
`volumeSnapshotClass.isDefault`	`true`	—
`volumeSnapshotClass.annotations`	`{}`	—
`volumeSnapshotClass.labels`	`{}`	—

`csi-hostpath-driver`

csi-hostpath-driver is a vendored subchart. Only the keys this chart sets are listed; everything else it accepts is documented by the subchart itself.

Value	Default	Description
`csi-hostpath-driver`	—	Chart 1.14.0 ships image tags from 2022 (csi-attacher v4.0.0, csi-provisioner v3.3.0, csi-snapshotter v6.1.0, …). Every one of them carries ~16 critical / ~126 high fixable findings, which made this single subchart the largest source of CVEs in the air-gap image manifest. The tags below are the current upstream sidecar releases; measured with `grype --only-fixed`, they drop the whole set to 0 critical for five of the eight images. csi-attacher and csi-external-health-monitor-controller still report 7 critical each - upstream has not rebased them - but that is down from 16 with roughly a tenth of the high findings.
`csi-hostpath-driver.enabled`	`false`	—
`csi-hostpath-driver.image`	—	—
`csi-hostpath-driver.image.registry`	`registry.k8s.io`	—
`csi-hostpath-driver.image.repository`	`sig-storage/hostpathplugin`	—
`csi-hostpath-driver.image.tag`	`v1.18.0`	Overrides the chart appVersion (v1.14.0): 14 critical / 83 high -> 0 / 7.
`csi-hostpath-driver.sidecars`	—	—
`csi-hostpath-driver.sidecars.healthmonitor`	—	—
`csi-hostpath-driver.sidecars.healthmonitor.image`	—	—
`csi-hostpath-driver.sidecars.healthmonitor.image.repository`	`sig-storage/csi-external-health-monitor-controller`	—
`csi-hostpath-driver.sidecars.healthmonitor.image.tag`	`v0.18.0`	—
`csi-hostpath-driver.sidecars.registrar`	—	—
`csi-hostpath-driver.sidecars.registrar.image`	—	—
`csi-hostpath-driver.sidecars.registrar.image.repository`	`sig-storage/csi-node-driver-registrar`	—
`csi-hostpath-driver.sidecars.registrar.image.tag`	`v2.17.0`	—
`csi-hostpath-driver.sidecars.livenessprobe`	—	—
`csi-hostpath-driver.sidecars.livenessprobe.image`	—	—
`csi-hostpath-driver.sidecars.livenessprobe.image.repository`	`sig-storage/livenessprobe`	—
`csi-hostpath-driver.sidecars.livenessprobe.image.tag`	`v2.19.0`	—
`csi-hostpath-driver.sidecars.attacher`	—	—
`csi-hostpath-driver.sidecars.attacher.image`	—	—
`csi-hostpath-driver.sidecars.attacher.image.repository`	`sig-storage/csi-attacher`	—
`csi-hostpath-driver.sidecars.attacher.image.tag`	`v4.12.0`	—
`csi-hostpath-driver.sidecars.provisioner`	—	—
`csi-hostpath-driver.sidecars.provisioner.image`	—	—
`csi-hostpath-driver.sidecars.provisioner.image.repository`	`sig-storage/csi-provisioner`	—
`csi-hostpath-driver.sidecars.provisioner.image.tag`	`v6.3.0`	—
`csi-hostpath-driver.sidecars.resizer`	—	—
`csi-hostpath-driver.sidecars.resizer.image`	—	—
`csi-hostpath-driver.sidecars.resizer.image.repository`	`sig-storage/csi-resizer`	—
`csi-hostpath-driver.sidecars.resizer.image.tag`	`v2.2.1`	—
`csi-hostpath-driver.sidecars.snapshotter`	—	—
`csi-hostpath-driver.sidecars.snapshotter.image`	—	—
`csi-hostpath-driver.sidecars.snapshotter.image.repository`	`sig-storage/csi-snapshotter`	—
`csi-hostpath-driver.sidecars.snapshotter.image.tag`	`v8.6.0`	—
`csi-hostpath-driver.storageClass`	—	—
`csi-hostpath-driver.storageClass.create`	`true`	—
`csi-hostpath-driver.storageClass.default`	`false`	—

`falkordb-addon`

falkordb-addon is a vendored subchart. Only the keys this chart sets are listed; everything else it accepts is documented by the subchart itself.

Value	Default	Description
`falkordb-addon`	—	—
`falkordb-addon.enabled`	`true`	—
`falkordb-addon.image`	—	FalkorDB Enterprise image: the FalkorDB core image plus the enterprise module (/var/lib/falkordb/bin/falkordb-enterprise.so). The image sets FALKORDB_EXTRA_MODULES_ARGS so the module is loaded next to the core one. Requires registry credentials.
`falkordb-addon.image.registry`	`registry.falkordb.cloud/falkordb`	—
`falkordb-addon.image.repository`	`falkordb-enterprise-db`	—
`falkordb-addon.imagePullSecrets`	`[]`	Pull secrets for the private enterprise image, applied to the FalkorDB ComponentDefinition runtimes and OpsDefinition jobs (addon >= 1.6.4). Entries may be plain secret names or objects with a `name` field.
`falkordb-addon.falkordbVersions`	see values.yaml	Replaces the upstream addon version list. Only FalkorDB releases with a published falkordb-enterprise-db image are offered.
`falkordb-addon.metrics`	—	—
`falkordb-addon.metrics.image`	—	—
`falkordb-addon.metrics.image.registry`	`docker.io`	—
`falkordb-addon.apeDts`	—	—
`falkordb-addon.apeDts.registry`	`docker.io`	—
`falkordb-addon.apeDtsImage`	—	—
`falkordb-addon.apeDtsImage.registry`	`docker.io`	—
`falkordb-addon.dbctlImage`	—	—
`falkordb-addon.dbctlImage.registry`	`docker.io`	—
`falkordb-addon.busyboxImage`	—	—
`falkordb-addon.busyboxImage.registry`	`docker.io`	—

`falkordb-browser`

falkordb-browser is a vendored subchart. Only the keys this chart sets are listed; everything else it accepts is documented by the subchart itself.

Value	Default	Description
`falkordb-browser`	—	—
`falkordb-browser.enabled`	`true`	—
`falkordb-browser.browser`	—	—
`falkordb-browser.browser.encryption`	—	—
`falkordb-browser.browser.encryption.key`	`""`	Server-side encryption key for stored credentials and tokens. Must be 64 hexadecimal characters (32 bytes). If empty, the chart generates one and reuses the existing Secret value on upgrades. You can generate one with: openssl rand -hex 32
`falkordb-browser.browser.encryption.existingSecret`	—	Use an existing Secret in the release namespace for ENCRYPTION_KEY instead of setting encryption.key or generating a key in the chart Secret.
`falkordb-browser.browser.encryption.existingSecret.name`	`""`	—
`falkordb-browser.browser.encryption.existingSecret.key`	`"ENCRYPTION_KEY"`	—
`falkordb-browser.ingress`	—	No image override needed: since chart 2.4.0 falkordb-browser splits `registry` from `repository` and reads global.imageRegistry.
`falkordb-browser.ingress.enabled`	`false`	—
`falkordb-browser.ingress.className`	`""`	—
`falkordb-browser.ingress.hosts`	see values.yaml	—
`falkordb-browser.ingress.tls`	`[]`	—
`falkordb-browser.env`	—	—
`falkordb-browser.env.nextauthUrl`	`http://localhost:3000/`	—

`dm-sql-to-falkordb`

dm-sql-to-falkordb is a vendored subchart. Only the keys this chart sets are listed; everything else it accepts is documented by the subchart itself.

Value	Default	Description
`dm-sql-to-falkordb`	—	—
`dm-sql-to-falkordb.enabled`	`false`	—
`dm-sql-to-falkordb.ingress`	—	—
`dm-sql-to-falkordb.ingress.enabled`	`false`	—
`dm-sql-to-falkordb.ingress.className`	`""`	—
`dm-sql-to-falkordb.ingress.annotations`	`{}`	—
`dm-sql-to-falkordb.ingress.hosts`	see values.yaml	—
`dm-sql-to-falkordb.ingress.tls`	`[]`	—

`browserEncryptionKey`

Value	Default	Description
`browserEncryptionKey`	—	—
`browserEncryptionKey.enabled`	`true`	—
`browserEncryptionKey.image`	—	Ensures ENCRYPTION_KEY exists in the Browser chart Secret. The default Secret name is derived from the Browser release name, e.g. <release>-falkordb-browser. See the preflight hook above for why this is alpine/kubectl and not alpine/k8s.
`browserEncryptionKey.image.registry`	`docker.io`	—
`browserEncryptionKey.image.repository`	`alpine/kubectl`	—
`browserEncryptionKey.image.tag`	`"1.36.3"`	—
`browserEncryptionKey.image.pullPolicy`	`IfNotPresent`	—
`browserEncryptionKey.serviceAccount`	—	—
`browserEncryptionKey.serviceAccount.create`	`true`	—
`browserEncryptionKey.serviceAccount.name`	`""`	—
`browserEncryptionKey.rbac`	—	—
`browserEncryptionKey.rbac.create`	`true`	—
`browserEncryptionKey.ttlSecondsAfterFinished`	`300`	—
`browserEncryptionKey.podAnnotations`	`{}`	—
`browserEncryptionKey.resources`	`{}`	—
`browserEncryptionKey.podSecurityContext`	—	—
`browserEncryptionKey.podSecurityContext.runAsNonRoot`	`true`	—
`browserEncryptionKey.podSecurityContext.runAsUser`	`1001`	—
`browserEncryptionKey.podSecurityContext.runAsGroup`	`1001`	—
`browserEncryptionKey.podSecurityContext.seccompProfile`	—	—
`browserEncryptionKey.podSecurityContext.seccompProfile.type`	`RuntimeDefault`	—
`browserEncryptionKey.securityContext`	—	—
`browserEncryptionKey.securityContext.allowPrivilegeEscalation`	`false`	—
`browserEncryptionKey.securityContext.readOnlyRootFilesystem`	`true`	—
`browserEncryptionKey.securityContext.capabilities`	—	—
`browserEncryptionKey.securityContext.capabilities.drop`	see values.yaml	—

`gateway`

Value	Default	Description
`gateway`	—	—
`gateway.enabled`	`true`	—
`gateway.ingress`	—	—
`gateway.ingress.enabled`	`false`	—
`gateway.ingress.className`	`""`	—
`gateway.ingress.annotations`	`{}`	—
`gateway.ingress.hosts`	see values.yaml	—
`gateway.ingress.tls`	`[]`	—
`gateway.routes`	—	—
`gateway.routes.ui`	—	—
`gateway.routes.ui.path`	`/`	—
`gateway.routes.ui.pathType`	`Prefix`	—
`gateway.routes.api`	—	—
`gateway.routes.api.path`	`/api`	—
`gateway.routes.api.pathType`	`Prefix`	—
`gateway.routes.openapi`	—	—
`gateway.routes.openapi.enabled`	`true`	—
`gateway.routes.openapi.path`	`/swagger.json`	—
`gateway.routes.openapi.pathType`	`Exact`	—

`csi-s3`

csi-s3 is a vendored subchart. Only the keys this chart sets are listed; everything else it accepts is documented by the subchart itself.

Value	Default	Description
`csi-s3`	—	—
`csi-s3.enabled`	`false`	—
`csi-s3.images`	—	The chart pins full references, tag included, and re-hosts two stock kubernetes-csi sidecars under cr.yandex. Point those two back at registry.k8s.io so they track upstream releases and dedupe with the tags the other CSI subcharts use; the mirror maps both to the same sig-storage/… path. The csi-s3-driver image itself has no upstream alternative and comes from the chart version (0.43.7: 24 critical / 93 high fixable, down from 34 / 172 at 0.43.4).
`csi-s3.images.provisioner`	`registry.k8s.io/sig-storage/csi-provisioner:v6.3.0`	—
`csi-s3.images.registrar`	`registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.17.0`	—
`csi-s3.storageClass`	—	—
`csi-s3.storageClass.create`	`false`	—
`csi-s3.secret`	—	—
`csi-s3.secret.create`	`false`	—

`csi-nfs`

csi-nfs is a vendored subchart. Only the keys this chart sets are listed; everything else it accepts is documented by the subchart itself.

Value	Default	Description
`csi-nfs`	—	—
`csi-nfs.enabled`	`false`	—
`csi-nfs.image`	—	Chart 4.13.1 pins sidecars that are one to two releases behind; the newer tags below are all 0 critical, where the chart defaults range from 4 to 11. nfsplugin v4.13.4 is the current patch of the driver the chart ships (v4.13.1: 8 critical / 89 high -> 0 / 4).
`csi-nfs.image.nfs`	—	—
`csi-nfs.image.nfs.repository`	`registry.k8s.io/sig-storage/nfsplugin`	—
`csi-nfs.image.nfs.tag`	`v4.13.4`	—
`csi-nfs.image.csiProvisioner`	—	—
`csi-nfs.image.csiProvisioner.tag`	`v6.3.0`	—
`csi-nfs.image.csiResizer`	—	—
`csi-nfs.image.csiResizer.tag`	`v2.2.1`	—
`csi-nfs.image.csiSnapshotter`	—	—
`csi-nfs.image.csiSnapshotter.tag`	`v8.6.0`	—
`csi-nfs.image.livenessProbe`	—	—
`csi-nfs.image.livenessProbe.tag`	`v2.19.0`	—
`csi-nfs.image.nodeDriverRegistrar`	—	—
`csi-nfs.image.nodeDriverRegistrar.tag`	`v2.17.0`	—
`csi-nfs.image.externalSnapshotter`	—	—
`csi-nfs.image.externalSnapshotter.tag`	`v8.6.0`	—
`csi-nfs.storageClass`	—	—
`csi-nfs.storageClass.create`	`false`	—
`csi-nfs.externalSnapshotter`	—	—
`csi-nfs.externalSnapshotter.enabled`	`false`	—

`backupRepository`

Value	Default	Description
`backupRepository`	—	—
`backupRepository.enabled`	`true`	—
`backupRepository.name`	`falkordb-enterprise-pvc`	—
`backupRepository.storageProviderRef`	`pvc`	—
`backupRepository.isDefault`	`true`	—
`backupRepository.pvReclaimPolicy`	`Delete`	—
`backupRepository.volumeCapacity`	`100Gi`	—
`backupRepository.accessMethod`	`Mount`	—
`backupRepository.pathPrefix`	`""`	—
`backupRepository.config`	—	—
`backupRepository.config.storageClassName`	`""`	—
`backupRepository.config.accessMode`	`ReadWriteOnce`	—
`backupRepository.config.volumeMode`	`Filesystem`	—

`adminServer`

Value	Default	Description
`adminServer`	—	—
`adminServer.enabled`	`true`	—
`adminServer.image`	—	—
`adminServer.image.registry`	`registry.falkordb.cloud/falkordb`	—
`adminServer.image.repository`	`falkordb-enterprise-server`	—
`adminServer.image.tag`	`""`	Empty falls back to the chart’s appVersion, so a chart version always resolves to the same image. Set a tag only to override that.
`adminServer.image.digest`	`""`	Pin by content, for example “sha256:abc…”. Takes precedence over tag. A digest is the only reference a registry cannot silently repoint.
`adminServer.image.pullPolicy`	`IfNotPresent`	—
`adminServer.replicaCount`	`1`	—
`adminServer.deploymentStrategy`	`{}`	Deployment update strategy. When empty and persistence is enabled, defaults to Recreate to avoid Multi-Attach errors on ReadWriteOnce volumes during image/tag changes. Set explicitly to override, e.g.: deploymentStrategy: type: RollingUpdate
`adminServer.serviceAccount`	—	—
`adminServer.serviceAccount.create`	`true`	—
`adminServer.serviceAccount.name`	`""`	—
`adminServer.serviceAccount.automountServiceAccountToken`	`true`	—
`adminServer.serviceAccount.annotations`	`{}`	—
`adminServer.rbac`	—	—
`adminServer.rbac.create`	`true`	—
`adminServer.managedNamespaces`	—	Restricts which namespaces the admin server may provision databases into. The pattern is a regular expression matched against the namespace name. The server anchors it at both ends for you, so write the bare expression - a leading `^` or trailing `$` here is redundant. Example: “falkordb-.*” confines every database to a falkordb- prefix. The default empty string imposes no restriction.
`adminServer.managedNamespaces.pattern`	`""`	—
`adminServer.service`	—	—
`adminServer.service.type`	`ClusterIP`	—
`adminServer.service.port`	`3000`	—
`adminServer.service.protocol`	`http`	—
`adminServer.service.host`	`""`	—
`adminServer.service.url`	`""`	—
`adminServer.service.apiBasePath`	`/api`	—
`adminServer.service.loadBalancerClass`	`""`	—
`adminServer.service.loadBalancerIP`	`""`	—
`adminServer.service.externalTrafficPolicy`	`""`	—
`adminServer.service.loadBalancerSourceRanges`	`[]`	—
`adminServer.serviceAnnotations`	`{}`	—
`adminServer.resources`	—	—
`adminServer.resources.requests`	—	—
`adminServer.resources.requests.cpu`	`250m`	—
`adminServer.resources.requests.memory`	`256Mi`	—
`adminServer.resources.limits`	—	—
`adminServer.resources.limits.cpu`	`"1"`	—
`adminServer.resources.limits.memory`	`1Gi`	—
`adminServer.deploymentAnnotations`	`{}`	—
`adminServer.podAnnotations`	`{}`	—
`adminServer.podLabels`	`{}`	—
`adminServer.imagePullSecrets`	`[]`	—
`adminServer.podSecurityContext`	—	—
`adminServer.podSecurityContext.runAsNonRoot`	`true`	—
`adminServer.podSecurityContext.runAsUser`	`1000`	—
`adminServer.podSecurityContext.runAsGroup`	`1000`	—
`adminServer.podSecurityContext.fsGroup`	`1000`	—
`adminServer.podSecurityContext.seccompProfile`	—	—
`adminServer.podSecurityContext.seccompProfile.type`	`RuntimeDefault`	—
`adminServer.securityContext`	—	—
`adminServer.securityContext.allowPrivilegeEscalation`	`false`	—
`adminServer.securityContext.readOnlyRootFilesystem`	`true`	—
`adminServer.securityContext.capabilities`	—	—
`adminServer.securityContext.capabilities.drop`	see values.yaml	—
`adminServer.priorityClassName`	`""`	—
`adminServer.nodeSelector`	`{}`	—
`adminServer.tolerations`	`[]`	—
`adminServer.affinity`	`{}`	—
`adminServer.command`	`[]`	—
`adminServer.args`	`[]`	—
`adminServer.persistence`	—	—
`adminServer.persistence.enabled`	`true`	—
`adminServer.persistence.mountPath`	`/data`	—
`adminServer.persistence.accessModes`	see values.yaml	—
`adminServer.persistence.size`	`8Gi`	—
`adminServer.persistence.storageClassName`	`""`	—
`adminServer.persistence.existingClaim`	`""`	—
`adminServer.metrics`	—	The admin server exposes Prometheus metrics at /metrics on the API port, outside the authenticated /api prefix.
`adminServer.metrics.basicAuth`	—	HTTP Basic credentials for /metrics. Leave both empty to serve metrics unauthenticated to anything that can reach the pod. When set, the chart’s PodMonitor picks the same credentials up, so podMonitor.enabled keeps working; any other scraper must be configured by hand. username and password must be set together, and neither can be combined with existingSecret - the chart refuses to render otherwise, so a partial configuration cannot quietly leave the endpoint open.
`adminServer.metrics.basicAuth.username`	`""`	—
`adminServer.metrics.basicAuth.password`	`""`	—
`adminServer.metrics.basicAuth.existingSecret`	`""`	Take the credentials from a Secret that already exists in the release namespace instead of from Helm values. It must hold `username` and `password` keys.
`adminServer.secret`	—	—
`adminServer.secret.create`	`true`	—
`adminServer.secret.name`	`""`	—
`adminServer.secret.jwtSecret`	`""`	—
`adminServer.secret.jwtExistingSecret`	—	Read the JWT signing secret from a Secret that already exists in the release namespace instead of putting the value in Helm values, where it would be visible in `helm get values` and in the process table of whoever ran `--set`. install.sh uses this path. The remaining keys below are still taken from Helm values; only the JWT secret moves.
`adminServer.secret.jwtExistingSecret.name`	`""`	—
`adminServer.secret.jwtExistingSecret.key`	`jwt-secret`	—
`adminServer.secret.googleClientId`	`""`	—
`adminServer.secret.googleClientSecret`	`""`	—
`adminServer.secret.azureClientId`	`""`	—
`adminServer.secret.azureClientSecret`	`""`	—
`adminServer.secret.googleWorkspaceServiceAccountKey`	`""`	—
`adminServer.license`	—	—
`adminServer.license.value`	`""`	Signed FalkorDB Enterprise license string. If set, the chart creates a dedicated Secret and the admin server activates this license on startup.
`adminServer.license.existingSecret`	—	Use an existing Secret in the release namespace instead of storing the license in Helm values. The Secret data should contain the signed license.
`adminServer.license.existingSecret.name`	`""`	—
`adminServer.license.existingSecret.key`	`"license"`	—
`adminServer.license.statePath`	`/data/license-state.json`	Persisted license state path. Keep this under adminServer.persistence.mountPath so API-activated licenses and Helm-provided licenses survive pod restarts.
`adminServer.env`	—	—
`adminServer.env.nodeEnv`	`production`	—
`adminServer.env.host`	`0.0.0.0`	—
`adminServer.env.logLevel`	`info`	—
`adminServer.env.logPretty`	`"false"`	—
`adminServer.env.databasePath`	`/data/admin.db`	—
`adminServer.env.jwtExpirySeconds`	`"3600"`	—
`adminServer.env.k8sNamespace`	`""`	—
`adminServer.env.k8sInCluster`	`"true"`	—
`adminServer.env.kubeconfig`	`""`	—
`adminServer.env.corsOrigin`	`""`	—
`adminServer.env.clusterExternalDomain`	`""`	Default DNS domain used to publish per-pod A records for new databases, e.g. “db.internal.example.com”. Requires ExternalDNS in the cluster and pod IPs that are routable from the consuming network. When set, each database gets a zone (<name>.<domain>, <name>-sent.<domain>) whose records point directly at pod IPs, so clients outside this cluster can reach replicas and shards without a kube-proxy hop. Leave empty to disable.
`adminServer.env.rateLimitWindowMs`	`"900000"`	—
`adminServer.env.rateLimitMaxRequests`	`"100000"`	—
`adminServer.env.enableSwagger`	`"false"`	—
`adminServer.env.disableLocalAuth`	`"false"`	—
`adminServer.env.cookieSecure`	`null`	Set to null to use the server default: secure cookies in NODE_ENV=production. Set to false only for HTTP/no-TLS deployments.
`adminServer.env.cookieSameSite`	`lax`	Auth cookie SameSite policy. Use none when Admin UI and Admin Server are on different public origins.
`adminServer.env.oauthProvider`	`""`	—
`adminServer.env.googleRedirectUri`	`""`	—
`adminServer.env.azureTenantId`	`""`	—
`adminServer.env.azureRedirectUri`	`""`	—
`adminServer.env.googleWorkspaceDomain`	`""`	—
`adminServer.env.googleWorkspaceAdminEmail`	`""`	—
`adminServer.env.googleWorkspacePrivateKeyPath`	`""`	—
`adminServer.bootstrap`	—	—
`adminServer.bootstrap.adminUser`	—	—
`adminServer.bootstrap.adminUser.create`	`true`	—
`adminServer.bootstrap.adminUser.secretName`	`""`	—
`adminServer.bootstrap.adminUser.email`	`"admin@falkordb.local"`	—
`adminServer.bootstrap.adminUser.name`	`"FalkorDB Admin"`	—
`adminServer.bootstrap.adminUser.role`	`"admin"`	—
`adminServer.bootstrap.adminUser.status`	`"active"`	—
`adminServer.bootstrap.adminUser.source`	`"local"`	—
`adminServer.bootstrap.adminUser.mustChangePassword`	`false`	—
`adminServer.bootstrap.adminUser.password`	`"Test123!@#"`	—
`adminServer.bootstrap.adminUser.passwordHash`	`""`	—
`adminServer.bootstrap.adminUser.labels`	`{}`	—
`adminServer.bootstrap.adminUser.annotations`	`{}`	—
`adminServer.bootstrap.rbacConfig`	—	—
`adminServer.bootstrap.rbacConfig.create`	`false`	—
`adminServer.bootstrap.rbacConfig.configMapName`	`"falkordb-rbac"`	—
`adminServer.bootstrap.rbacConfig.labels`	`{}`	—
`adminServer.bootstrap.rbacConfig.annotations`	`{}`	—
`adminServer.bootstrap.rbacConfig.roles`	see values.yaml	—
`adminServer.bootstrap.rbacConfig.groupMappings`	`[]`	—
`adminServer.bootstrap.settingsConfig`	—	—
`adminServer.bootstrap.settingsConfig.create`	`false`	—
`adminServer.bootstrap.settingsConfig.configMapName`	`"falkordb-admin-settings"`	—
`adminServer.bootstrap.settingsConfig.labels`	`{}`	—
`adminServer.bootstrap.settingsConfig.annotations`	`{}`	—
`adminServer.bootstrap.settingsConfig.settings`	—	—
`adminServer.bootstrap.settingsConfig.settings.features`	—	—
`adminServer.bootstrap.settingsConfig.settings.features.oauth2_enabled`	`true`	—
`adminServer.bootstrap.settingsConfig.settings.features.local_users_enabled`	`true`	—
`adminServer.bootstrap.settingsConfig.settings.features.self_service_onboarding`	`false`	—
`adminServer.bootstrap.settingsConfig.settings.features.multi_cluster_mode`	`false`	—
`adminServer.bootstrap.settingsConfig.settings.features.backup_auto_schedule`	`true`	—
`adminServer.bootstrap.settingsConfig.settings.features.metrics_collection`	`true`	—
`adminServer.bootstrap.settingsConfig.settings.features.api_docs_enabled`	`true`	—
`adminServer.bootstrap.settingsConfig.settings.oauth`	—	—
`adminServer.bootstrap.settingsConfig.settings.oauth.allowed_domains`	`[]`	—
`adminServer.bootstrap.settingsConfig.settings.oauth.role_attribute_path`	`null`	—
`adminServer.bootstrap.settingsConfig.settings.oauth.role_attribute_strict`	`false`	—
`adminServer.bootstrap.settingsConfig.settings.google_workspace`	—	—
`adminServer.bootstrap.settingsConfig.settings.google_workspace.domain`	`null`	—
`adminServer.bootstrap.settingsConfig.settings.google_workspace.admin_email`	`null`	—
`adminServer.bootstrap.settingsConfig.settings.google_workspace.private_key_secret_ref`	`null`	—
`adminServer.bootstrap.settingsConfig.settings.retention`	—	—
`adminServer.bootstrap.settingsConfig.settings.retention.audit_log_retention_days`	`90`	—
`adminServer.bootstrap.settingsConfig.settings.retention.metrics_retention_days`	`30`	—
`adminServer.bootstrap.settingsConfig.settings.metrics`	—	—
`adminServer.bootstrap.settingsConfig.settings.metrics.prometheus_port`	`9121`	—
`adminServer.bootstrap.settingsConfig.settings.cost`	—	Estimated cost showback. FalkorDB Enterprise cannot know what the underlying infrastructure costs - it runs on any Kubernetes substrate, including on-prem and air-gapped - so the operator supplies the rates. With `enabled: false` the console still reports each database’s share of reserved capacity, just without a currency figure.
`adminServer.bootstrap.settingsConfig.settings.cost.enabled`	`false`	—
`adminServer.bootstrap.settingsConfig.settings.cost.provider`	`rate-card`	—
`adminServer.bootstrap.settingsConfig.settings.cost.currency`	`USD`	—
`adminServer.extraEnv`	`[]`	—
`adminServer.existingEnvSecrets`	`[]`	—
`adminServer.existingEnvConfigMaps`	`[]`	—
`adminServer.envFrom`	`[]`	—
`adminServer.extraVolumes`	`[]`	—
`adminServer.extraVolumeMounts`	`[]`	—

`adminUi`

Value	Default	Description
`adminUi`	—	—
`adminUi.enabled`	`true`	—
`adminUi.image`	—	—
`adminUi.image.registry`	`registry.falkordb.cloud/falkordb`	—
`adminUi.image.repository`	`falkordb-enterprise-ui`	—
`adminUi.image.tag`	`""`	Empty falls back to the chart’s appVersion, so a chart version always resolves to the same image. Set a tag only to override that.
`adminUi.image.digest`	`""`	Pin by content, for example “sha256:abc…”. Takes precedence over tag. A digest is the only reference a registry cannot silently repoint.
`adminUi.image.pullPolicy`	`IfNotPresent`	—
`adminUi.replicaCount`	`1`	—
`adminUi.containerPort`	`3000`	—
`adminUi.service`	—	—
`adminUi.service.type`	`ClusterIP`	—
`adminUi.service.port`	`80`	—
`adminUi.service.protocol`	`http`	—
`adminUi.service.host`	`""`	—
`adminUi.service.url`	`""`	—
`adminUi.service.loadBalancerClass`	`""`	—
`adminUi.service.loadBalancerIP`	`""`	—
`adminUi.service.externalTrafficPolicy`	`""`	—
`adminUi.service.loadBalancerSourceRanges`	`[]`	—
`adminUi.resources`	—	—
`adminUi.resources.requests`	—	—
`adminUi.resources.requests.cpu`	`100m`	—
`adminUi.resources.requests.memory`	`128Mi`	—
`adminUi.resources.limits`	—	—
`adminUi.resources.limits.cpu`	`500m`	—
`adminUi.resources.limits.memory`	`512Mi`	—
`adminUi.deploymentAnnotations`	`{}`	—
`adminUi.podAnnotations`	`{}`	—
`adminUi.podLabels`	`{}`	—
`adminUi.imagePullSecrets`	`[]`	—
`adminUi.podSecurityContext`	—	—
`adminUi.podSecurityContext.runAsNonRoot`	`true`	—
`adminUi.podSecurityContext.runAsUser`	`101`	—
`adminUi.podSecurityContext.runAsGroup`	`101`	—
`adminUi.podSecurityContext.fsGroup`	`101`	—
`adminUi.podSecurityContext.seccompProfile`	—	—
`adminUi.podSecurityContext.seccompProfile.type`	`RuntimeDefault`	—
`adminUi.securityContext`	—	—
`adminUi.securityContext.allowPrivilegeEscalation`	`false`	—
`adminUi.securityContext.readOnlyRootFilesystem`	`true`	—
`adminUi.securityContext.capabilities`	—	—
`adminUi.securityContext.capabilities.drop`	see values.yaml	—
`adminUi.priorityClassName`	`""`	—
`adminUi.nodeSelector`	`{}`	—
`adminUi.tolerations`	`[]`	—
`adminUi.affinity`	`{}`	—
`adminUi.command`	`[]`	—
`adminUi.args`	`[]`	—
`adminUi.env`	—	—
`adminUi.env.viteApiUrl`	`""`	—
`adminUi.env.viteApiBaseUrl`	`""`	—
`adminUi.env.viteWsBaseUrl`	`""`	—
`adminUi.env.viteSchemaUri`	`""`	—
`adminUi.env.viteBrowserUrl`	`""`	—
`adminUi.env.viteDmSqlUrl`	`""`	—
`adminUi.env.viteMockApi`	`"false"`	—
`adminUi.extraEnv`	`[]`	—
`adminUi.existingEnvSecrets`	`[]`	—
`adminUi.existingEnvConfigMaps`	`[]`	—
`adminUi.envFrom`	`[]`	—
`adminUi.extraVolumes`	`[]`	—
`adminUi.extraVolumeMounts`	`[]`	—
`adminUi.serviceAnnotations`	`{}`	—

`networkPolicy`

Value	Default	Description
`networkPolicy`	—	Opt-in NetworkPolicy for the Admin Server and Admin UI.
`networkPolicy.enabled`	`false`	Requires a CNI that enforces NetworkPolicy (Calico, Cilium, Antrea, or the controller built into k3s). A CNI that ignores NetworkPolicy accepts the objects and silently enforces nothing, so this is off by default rather than advertising isolation that may not exist. Recommended for production.
`networkPolicy.ingressControllerNamespace`	`ingress-nginx`	Namespaces allowed to reach the two components, matched on the kubernetes.io/metadata.name label that Kubernetes sets on every namespace. Where the ingress controller runs. Set to "" to drop the rule, which makes both components unreachable except through a port-forward.
`networkPolicy.monitoringNamespace`	`monitoring`	Where Prometheus runs. Only used when podMonitor.enabled is true.
`networkPolicy.dnsNamespace`	`kube-system`	Where CoreDNS/kube-dns runs. Set to "" only if DNS lives somewhere else and you supply the rule through extraEgress.
`networkPolicy.externalEgress`	—	Destinations outside the cluster that the Admin Server has to reach: the kube-apiserver, and the identity provider when adminServer.env.oauthProvider is set. NetworkPolicy matches on CIDR and never on hostname, so neither is expressible by name. The default is wide on purpose — the control plane endpoint is not knowable from inside the chart, and guessing it wrong locks the Admin Server out of the API server entirely. Narrow it to your control plane and identity provider ranges; see docs/reference/network-policy.mdx.
`networkPolicy.externalEgress.ports`	see values.yaml	—
`networkPolicy.externalEgress.cidrs`	see values.yaml	—
`networkPolicy.adminServer`	—	Appended verbatim to the generated policies, for anything the rules above do not cover. Each entry is a complete ingress or egress rule with its own from/to and ports, not a bare peer.
`networkPolicy.adminServer.extraIngress`	`[]`	—
`networkPolicy.adminServer.extraEgress`	`[]`	—
`networkPolicy.adminUi`	—	—
`networkPolicy.adminUi.extraIngress`	`[]`	—
`networkPolicy.adminUi.extraEgress`	`[]`	—

`podMonitor`

Value	Default	Description
`podMonitor`	—	—
`podMonitor.enabled`	`false`	—
`podMonitor.interval`	`30s`	—
`podMonitor.scrapeTimeout`	`10s`	—
`podMonitor.additionalLabels`	`{}`	—

`alertRules`

Value	Default	Description
`alertRules`	—	—
`alertRules.enabled`	`false`	—
`alertRules.additionalLabels`	`{}`	—
`alertRules.additionalAnnotations`	`{}`	—
`alertRules.defaultRules`	—	—
`alertRules.defaultRules.enabled`	`true`	—
`alertRules.defaultRules.for`	`5m`	—
`alertRules.additionalGroups`	`[]`	—

`grafanaDashboards`

Value	Default	Description
`grafanaDashboards`	—	—
`grafanaDashboards.enabled`	`false`	—
`grafanaDashboards.additionalLabels`	`{}`	—
`grafanaDashboards.dashboards`	`[]`	—

​nameOverride

​fullnameOverride

​global

​extraObjects

​preflight

​kubeblocks

​snapshot-controller

​volumeSnapshotClass

​csi-hostpath-driver

​falkordb-addon

​falkordb-browser

​dm-sql-to-falkordb

​browserEncryptionKey

​gateway

​csi-s3

​csi-nfs

​backupRepository

​adminServer

​adminUi

​networkPolicy

​podMonitor

​alertRules

​grafanaDashboards

`nameOverride`

`fullnameOverride`

`global`

`extraObjects`

`preflight`

`kubeblocks`

`snapshot-controller`

`volumeSnapshotClass`

`csi-hostpath-driver`

`falkordb-addon`

`falkordb-browser`

`dm-sql-to-falkordb`

`browserEncryptionKey`

`gateway`

`csi-s3`

`csi-nfs`

`backupRepository`

`adminServer`

`adminUi`

`networkPolicy`

`podMonitor`

`alertRules`

`grafanaDashboards`