values.yaml, so the defaults here are the ones
you get. To read it directly, log in with helm registry login registry.falkordb.cloud --username '<username>' (it prompts for your access token), then run helm pull oci://registry.falkordb.cloud/falkordb/falkordb-enterprise --untar.
Descriptions are the first paragraph of each key’s comment in
values.yaml. Many
keys carry longer rationale there — read the file itself before changing anything
whose description mentions a caveat.nameOverride
| Value | Default | Description |
|---|---|---|
nameOverride | "" | — |
fullnameOverride
| Value | Default | Description |
|---|---|---|
fullnameOverride | "" | — |
global
| Value | Default | Description |
|---|---|---|
global | — | Registry for the images this chart owns directly: the admin server, the admin UI, and the two kubectl hook jobs. When set it replaces the per-image registry below. Defaults to registry.falkordb.cloud, which carries every image the chart can pull under one host so a standard install only needs to reach that one registry. FalkorDB’s own images are published there directly by CI; third-party images are mirrored in under their upstream path. Set to "" to pull the chart-owned images from their original registries instead (registry.falkordb.cloud for the admin server/UI and the enterprise database image, docker.io for the hook jobs). |
global.imageRegistry | "registry.falkordb.cloud/falkordb" | — |
global.imageCredentials | — | Registry credentials for the private FalkorDB images. This is the single place credentials are configured; everything else in the chart derives from it. The default registry requires authentication for every image, hooks included, so an install from it needs a Secret here; scripts/install.sh creates one and sets name for you. The block is only off by default because the chart cannot ship credentials. |
global.imageCredentials.create | false | — |
global.imageCredentials.name | "" | — |
global.imageCredentials.registry | "registry.falkordb.cloud" | — |
global.imageCredentials.username | "" | — |
global.imageCredentials.password | "" | — |
global.imageCredentials.email | "" | — |
global.imagePullSecrets | [] | Extra pull secrets applied to every workload this chart owns, on top of imageCredentials.name. Entries may be plain names or objects with name. These are replicated into database namespaces alongside the credentials Secret above. |
global.kubernetesServiceHost | "" | Override the API server address that in-cluster clients derive from the KUBERNETES_SERVICE_HOST/KUBERNETES_SERVICE_PORT variables the kubelet injects into every container. Leave empty (the default) to keep the kubelet’s values, which point at the API server’s in-cluster ClusterIP — that is what almost every cluster wants and nothing is emitted. |
global.kubernetesServicePort | "" | — |
global.extraEnv | [] | Extra environment variables appended to every container this chart owns. Component-level extraEnv is applied after this, so a component can still override an entry of the same name. Unlike the two values above, this one is not shared with the subcharts and does NOT reach the database pods: set falkordb-addon.extraEnv for those. |
extraObjects
| Value | Default | Description |
|---|---|---|
extraObjects | [] | — |
preflight
| Value | Default | Description |
|---|---|---|
preflight | — | — |
preflight.cleanupStaleOpsDefinitions | — | — |
preflight.cleanupStaleOpsDefinitions.enabled | true | — |
preflight.cleanupStaleOpsDefinitions.image | — | alpine/kubectl rather than alpine/k8s: the hook only needs kubectl and a shell, while alpine/k8s also bundles aws, az, gcloud, helm and terraform. Measured with grype —only-fixed: alpine/k8s:1.33.1 carries 830 high and 126 critical fixable findings, alpine/kubectl:1.36.3 carries 4 high and 0 critical. |
preflight.cleanupStaleOpsDefinitions.image.registry | docker.io | — |
preflight.cleanupStaleOpsDefinitions.image.repository | alpine/kubectl | — |
preflight.cleanupStaleOpsDefinitions.image.tag | "1.36.3" | — |
preflight.cleanupStaleOpsDefinitions.image.pullPolicy | IfNotPresent | — |
preflight.cleanupStaleOpsDefinitions.serviceAccount | — | — |
preflight.cleanupStaleOpsDefinitions.serviceAccount.create | true | — |
preflight.cleanupStaleOpsDefinitions.serviceAccount.name | "" | — |
preflight.cleanupStaleOpsDefinitions.rbac | — | — |
preflight.cleanupStaleOpsDefinitions.rbac.create | true | — |
preflight.cleanupStaleOpsDefinitions.ttlSecondsAfterFinished | 300 | — |
preflight.cleanupStaleOpsDefinitions.podAnnotations | {} | — |
preflight.cleanupStaleOpsDefinitions.imagePullSecrets | [] | Extra pull secrets for the hook pod, on top of global.imageCredentials.name and global.imagePullSecrets, which it already references. Entries may be plain names or objects with name. Needed when image points at a private mirror. The Secret must exist before helm install: this pod runs as a pre-install hook, ahead of the chart-created Secret that global.imageCredentials.create: true renders. |
preflight.cleanupStaleOpsDefinitions.resources | {} | — |
preflight.cleanupStaleOpsDefinitions.podSecurityContext | — | — |
preflight.cleanupStaleOpsDefinitions.podSecurityContext.runAsNonRoot | true | — |
preflight.cleanupStaleOpsDefinitions.podSecurityContext.runAsUser | 1001 | — |
preflight.cleanupStaleOpsDefinitions.podSecurityContext.runAsGroup | 1001 | — |
preflight.cleanupStaleOpsDefinitions.podSecurityContext.seccompProfile | — | — |
preflight.cleanupStaleOpsDefinitions.podSecurityContext.seccompProfile.type | RuntimeDefault | — |
preflight.cleanupStaleOpsDefinitions.securityContext | — | — |
preflight.cleanupStaleOpsDefinitions.securityContext.allowPrivilegeEscalation | false | — |
preflight.cleanupStaleOpsDefinitions.securityContext.readOnlyRootFilesystem | true | — |
preflight.cleanupStaleOpsDefinitions.securityContext.capabilities | — | — |
preflight.cleanupStaleOpsDefinitions.securityContext.capabilities.drop | see values.yaml | — |
kubeblocks
kubeblocks is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
|---|---|---|
kubeblocks | — | — |
kubeblocks.enabled | true | — |
kubeblocks.nameOverride | falkordb-enterprise | — |
kubeblocks.image | — | kubeblocks does not read .Values.global, so it needs its own registry override to land on the mirror by default. This one key is enough: dataProtection.image.registry and addonChartsImage.registry both fall back to it when unset, so kubeblocks, kubeblocks-tools, kubeblocks-dataprotection, datasafed and kubeblocks-charts all follow. |
kubeblocks.image.registry | registry.falkordb.cloud/falkordb | — |
kubeblocks.autoInstalledAddons | [] | — |
kubeblocks.rbac | — | — |
kubeblocks.rbac.additionalPolicyRules | see values.yaml | KubeBlocks generates a ClusterRole per cluster component and binds it to the component’s ServiceAccount, so its operator needs ClusterRole write access. This cannot be narrowed with resourceNames: that field has no effect on create, and the generated names are not known in advance. |
snapshot-controller
snapshot-controller is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
|---|---|---|
snapshot-controller | — | — |
snapshot-controller.enabled | false | — |
snapshot-controller.installCRDs | true | — |
snapshot-controller.controller | — | — |
snapshot-controller.controller.image | — | — |
snapshot-controller.controller.image.tag | v8.6.0 | Chart 5.0.3 defaults the tag to its appVersion (v8.5.0), which grype reports as 9 critical / 36 high fixable. v8.6.0 rebases onto a current distroless base: 0 critical / 10 high. |
volumeSnapshotClass
| Value | Default | Description |
|---|---|---|
volumeSnapshotClass | — | — |
volumeSnapshotClass.enabled | true | — |
volumeSnapshotClass.name | falkordb-enterprise-csi-hostpath | — |
volumeSnapshotClass.driver | hostpath.csi.k8s.io | — |
volumeSnapshotClass.deletionPolicy | Delete | — |
volumeSnapshotClass.isDefault | true | — |
volumeSnapshotClass.parameters | {} | Driver-specific snapshot parameters. The installer sets type: snap for Longhorn (driver.longhorn.io), which otherwise takes a Longhorn backup that fails unless a Longhorn backup target is configured. |
volumeSnapshotClass.annotations | {} | — |
volumeSnapshotClass.labels | {} | — |
csi-hostpath-driver
csi-hostpath-driver is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
|---|---|---|
csi-hostpath-driver | — | Chart 1.14.0 ships image tags from 2022 (csi-attacher v4.0.0, csi-provisioner v3.3.0, csi-snapshotter v6.1.0, …). Every one of them carries ~16 critical / ~126 high fixable findings, which made this single subchart the largest source of CVEs in the air-gap image manifest. The tags below are the current upstream sidecar releases; measured with grype --only-fixed, they drop the whole set to 0 critical for five of the eight images. csi-attacher and csi-external-health-monitor-controller still report 7 critical each - upstream has not rebased them - but that is down from 16 with roughly a tenth of the high findings. |
csi-hostpath-driver.enabled | false | — |
csi-hostpath-driver.image | — | — |
csi-hostpath-driver.image.registry | registry.k8s.io | — |
csi-hostpath-driver.image.repository | sig-storage/hostpathplugin | — |
csi-hostpath-driver.image.tag | v1.18.0 | Overrides the chart appVersion (v1.14.0): 14 critical / 83 high -> 0 / 7. |
csi-hostpath-driver.sidecars | — | — |
csi-hostpath-driver.sidecars.healthmonitor | — | — |
csi-hostpath-driver.sidecars.healthmonitor.image | — | — |
csi-hostpath-driver.sidecars.healthmonitor.image.repository | sig-storage/csi-external-health-monitor-controller | — |
csi-hostpath-driver.sidecars.healthmonitor.image.tag | v0.18.0 | — |
csi-hostpath-driver.sidecars.registrar | — | — |
csi-hostpath-driver.sidecars.registrar.image | — | — |
csi-hostpath-driver.sidecars.registrar.image.repository | sig-storage/csi-node-driver-registrar | — |
csi-hostpath-driver.sidecars.registrar.image.tag | v2.17.0 | — |
csi-hostpath-driver.sidecars.livenessprobe | — | — |
csi-hostpath-driver.sidecars.livenessprobe.image | — | — |
csi-hostpath-driver.sidecars.livenessprobe.image.repository | sig-storage/livenessprobe | — |
csi-hostpath-driver.sidecars.livenessprobe.image.tag | v2.19.0 | — |
csi-hostpath-driver.sidecars.attacher | — | — |
csi-hostpath-driver.sidecars.attacher.image | — | — |
csi-hostpath-driver.sidecars.attacher.image.repository | sig-storage/csi-attacher | — |
csi-hostpath-driver.sidecars.attacher.image.tag | v4.12.0 | — |
csi-hostpath-driver.sidecars.provisioner | — | — |
csi-hostpath-driver.sidecars.provisioner.image | — | — |
csi-hostpath-driver.sidecars.provisioner.image.repository | sig-storage/csi-provisioner | — |
csi-hostpath-driver.sidecars.provisioner.image.tag | v6.3.0 | — |
csi-hostpath-driver.sidecars.resizer | — | — |
csi-hostpath-driver.sidecars.resizer.image | — | — |
csi-hostpath-driver.sidecars.resizer.image.repository | sig-storage/csi-resizer | — |
csi-hostpath-driver.sidecars.resizer.image.tag | v2.2.1 | — |
csi-hostpath-driver.sidecars.snapshotter | — | — |
csi-hostpath-driver.sidecars.snapshotter.image | — | — |
csi-hostpath-driver.sidecars.snapshotter.image.repository | sig-storage/csi-snapshotter | — |
csi-hostpath-driver.sidecars.snapshotter.image.tag | v8.6.0 | — |
csi-hostpath-driver.storageClass | — | — |
csi-hostpath-driver.storageClass.create | true | — |
csi-hostpath-driver.storageClass.default | false | — |
falkordb-addon
falkordb-addon is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
|---|---|---|
falkordb-addon | — | — |
falkordb-addon.enabled | true | — |
falkordb-addon.image | — | FalkorDB Enterprise image: the FalkorDB core image plus the enterprise module (/var/lib/falkordb/bin/falkordb-enterprise.so). The image sets FALKORDB_EXTRA_MODULES_ARGS so the module is loaded next to the core one. Requires registry credentials. |
falkordb-addon.image.registry | registry.falkordb.cloud/falkordb | — |
falkordb-addon.image.repository | falkordb-enterprise-db | — |
falkordb-addon.imagePullSecrets | [] | Pull secrets for the private enterprise image, applied to the FalkorDB ComponentDefinition runtimes and OpsDefinition jobs (addon >= 1.6.4). Entries may be plain secret names or objects with a name field. |
falkordb-addon.falkordbVersions | see values.yaml | Replaces the upstream addon version list. Only FalkorDB releases with a published falkordb-enterprise-db image are offered. |
falkordb-addon.metrics | — | — |
falkordb-addon.metrics.image | — | — |
falkordb-addon.metrics.image.registry | docker.io | — |
falkordb-addon.apeDtsImage | — | — |
falkordb-addon.apeDtsImage.registry | docker.io | — |
falkordb-addon.dbctlImage | — | — |
falkordb-addon.dbctlImage.registry | docker.io | — |
falkordb-addon.busyboxImage | — | — |
falkordb-addon.busyboxImage.registry | docker.io | — |
falkordb-browser
falkordb-browser is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
|---|---|---|
falkordb-browser | — | — |
falkordb-browser.enabled | true | — |
falkordb-browser.browser | — | — |
falkordb-browser.browser.encryption | — | — |
falkordb-browser.browser.encryption.key | "" | Server-side encryption key for stored credentials and tokens. Must be 64 hexadecimal characters (32 bytes). If empty, the chart generates one and reuses the existing Secret value on upgrades. You can generate one with: openssl rand -hex 32 |
falkordb-browser.browser.encryption.existingSecret | — | Use an existing Secret in the release namespace for ENCRYPTION_KEY instead of setting encryption.key or generating a key in the chart Secret. |
falkordb-browser.browser.encryption.existingSecret.name | "" | — |
falkordb-browser.browser.encryption.existingSecret.key | "ENCRYPTION_KEY" | — |
falkordb-browser.imagePullSecrets | [] | Pull secrets for the Browser pod. Required with the default private registry: the subchart reads global.imageRegistry but not global.imageCredentials, so repeat the name set there, as an object with name. scripts/install.sh writes this for you. |
falkordb-browser.ingress | — | — |
falkordb-browser.ingress.enabled | false | — |
falkordb-browser.ingress.className | "" | — |
falkordb-browser.ingress.hosts | see values.yaml | — |
falkordb-browser.ingress.tls | [] | — |
falkordb-browser.env | — | — |
falkordb-browser.env.nextauthUrl | http://localhost:3000/ | — |
dm-sql-to-falkordb
dm-sql-to-falkordb is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
|---|---|---|
dm-sql-to-falkordb | — | — |
dm-sql-to-falkordb.enabled | false | — |
dm-sql-to-falkordb.ingress | — | — |
dm-sql-to-falkordb.ingress.enabled | false | — |
dm-sql-to-falkordb.ingress.className | "" | — |
dm-sql-to-falkordb.ingress.annotations | {} | — |
dm-sql-to-falkordb.ingress.hosts | see values.yaml | — |
dm-sql-to-falkordb.ingress.tls | [] | — |
browserEncryptionKey
| Value | Default | Description |
|---|---|---|
browserEncryptionKey | — | — |
browserEncryptionKey.enabled | true | — |
browserEncryptionKey.image | — | Ensures ENCRYPTION_KEY exists in the Browser chart Secret. The default Secret name is derived from the Browser release name, e.g. <release>-falkordb-browser. See the preflight hook above for why this is alpine/kubectl and not alpine/k8s. |
browserEncryptionKey.image.registry | docker.io | — |
browserEncryptionKey.image.repository | alpine/kubectl | — |
browserEncryptionKey.image.tag | "1.36.3" | — |
browserEncryptionKey.image.pullPolicy | IfNotPresent | — |
browserEncryptionKey.serviceAccount | — | — |
browserEncryptionKey.serviceAccount.create | true | — |
browserEncryptionKey.serviceAccount.name | "" | — |
browserEncryptionKey.rbac | — | — |
browserEncryptionKey.rbac.create | true | — |
browserEncryptionKey.ttlSecondsAfterFinished | 300 | — |
browserEncryptionKey.podAnnotations | {} | — |
browserEncryptionKey.imagePullSecrets | [] | Extra pull secrets for the hook pod, on top of global.imageCredentials.name and global.imagePullSecrets, which it already references. Entries may be plain names or objects with name. |
browserEncryptionKey.resources | {} | — |
browserEncryptionKey.podSecurityContext | — | — |
browserEncryptionKey.podSecurityContext.runAsNonRoot | true | — |
browserEncryptionKey.podSecurityContext.runAsUser | 1001 | — |
browserEncryptionKey.podSecurityContext.runAsGroup | 1001 | — |
browserEncryptionKey.podSecurityContext.seccompProfile | — | — |
browserEncryptionKey.podSecurityContext.seccompProfile.type | RuntimeDefault | — |
browserEncryptionKey.securityContext | — | — |
browserEncryptionKey.securityContext.allowPrivilegeEscalation | false | — |
browserEncryptionKey.securityContext.readOnlyRootFilesystem | true | — |
browserEncryptionKey.securityContext.capabilities | — | — |
browserEncryptionKey.securityContext.capabilities.drop | see values.yaml | — |
gateway
| Value | Default | Description |
|---|---|---|
gateway | — | — |
gateway.enabled | true | — |
gateway.ingress | — | — |
gateway.ingress.enabled | false | — |
gateway.ingress.className | "" | — |
gateway.ingress.annotations | {} | — |
gateway.ingress.hosts | see values.yaml | — |
gateway.ingress.tls | [] | — |
gateway.routes | — | — |
gateway.routes.ui | — | — |
gateway.routes.ui.path | / | — |
gateway.routes.ui.pathType | Prefix | — |
gateway.routes.api | — | — |
gateway.routes.api.path | /api | — |
gateway.routes.api.pathType | Prefix | — |
gateway.routes.openapi | — | — |
gateway.routes.openapi.enabled | true | — |
gateway.routes.openapi.path | /swagger.json | — |
gateway.routes.openapi.pathType | Exact | — |
csi-s3
csi-s3 is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
|---|---|---|
csi-s3 | — | — |
csi-s3.enabled | false | — |
csi-s3.images | — | The chart pins full references, tag included, and re-hosts two stock kubernetes-csi sidecars under cr.yandex. Point those two back at registry.k8s.io so they track upstream releases and dedupe with the tags the other CSI subcharts use; the mirror maps both to the same sig-storage/… path. The csi-s3-driver image itself has no upstream alternative and comes from the chart version (0.43.7: 24 critical / 93 high fixable, down from 34 / 172 at 0.43.4). |
csi-s3.images.provisioner | registry.k8s.io/sig-storage/csi-provisioner:v6.3.0 | — |
csi-s3.images.registrar | registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.17.0 | — |
csi-s3.storageClass | — | — |
csi-s3.storageClass.create | false | — |
csi-s3.secret | — | — |
csi-s3.secret.create | false | — |
csi-nfs
csi-nfs is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
|---|---|---|
csi-nfs | — | — |
csi-nfs.enabled | false | — |
csi-nfs.image | — | Chart 4.13.1 pins sidecars that are one to two releases behind; the newer tags below are all 0 critical, where the chart defaults range from 4 to 11. nfsplugin v4.13.4 is the current patch of the driver the chart ships (v4.13.1: 8 critical / 89 high -> 0 / 4). |
csi-nfs.image.nfs | — | — |
csi-nfs.image.nfs.repository | registry.k8s.io/sig-storage/nfsplugin | — |
csi-nfs.image.nfs.tag | v4.13.4 | — |
csi-nfs.image.csiProvisioner | — | — |
csi-nfs.image.csiProvisioner.tag | v6.3.0 | — |
csi-nfs.image.csiResizer | — | — |
csi-nfs.image.csiResizer.tag | v2.2.1 | — |
csi-nfs.image.csiSnapshotter | — | — |
csi-nfs.image.csiSnapshotter.tag | v8.6.0 | — |
csi-nfs.image.livenessProbe | — | — |
csi-nfs.image.livenessProbe.tag | v2.19.0 | — |
csi-nfs.image.nodeDriverRegistrar | — | — |
csi-nfs.image.nodeDriverRegistrar.tag | v2.17.0 | — |
csi-nfs.image.externalSnapshotter | — | — |
csi-nfs.image.externalSnapshotter.tag | v8.6.0 | — |
csi-nfs.storageClass | — | — |
csi-nfs.storageClass.create | false | — |
csi-nfs.externalSnapshotter | — | — |
csi-nfs.externalSnapshotter.enabled | false | — |
backupRepository
| Value | Default | Description |
|---|---|---|
backupRepository | — | The default repository is a volume in this Kubernetes cluster, so backups share the databases’ failure domain. For production, point the default repository at object storage (S3, GCS, Azure Blob or MinIO); see docs/operations/backups.mdx. |
backupRepository.enabled | true | — |
backupRepository.name | falkordb-enterprise-pvc | — |
backupRepository.storageProviderRef | pvc | — |
backupRepository.isDefault | true | — |
backupRepository.pvReclaimPolicy | Retain | Keep backup volumes when the repository is deleted. Changing this does not affect volumes that already exist. |
backupRepository.keep | true | Keep the BackupRepo when the release is uninstalled, so helm uninstall cannot take the backups with it. Reinstalling under the same release name and namespace adopts it again. |
backupRepository.volumeCapacity | 100Gi | — |
backupRepository.accessMethod | Mount | — |
backupRepository.pathPrefix | "" | — |
backupRepository.config | — | — |
backupRepository.config.storageClassName | "" | — |
backupRepository.config.accessMode | ReadWriteOnce | — |
backupRepository.config.volumeMode | Filesystem | — |
adminServer
| Value | Default | Description |
|---|---|---|
adminServer | — | — |
adminServer.enabled | true | — |
adminServer.image | — | — |
adminServer.image.registry | registry.falkordb.cloud/falkordb | — |
adminServer.image.repository | falkordb-enterprise-server | — |
adminServer.image.tag | "" | Empty falls back to the chart’s appVersion, so a chart version always resolves to the same image. Set a tag only to override that. |
adminServer.image.digest | "" | Pin by content, for example “sha256:abc…”. Takes precedence over tag. A digest is the only reference a registry cannot silently repoint. |
adminServer.image.pullPolicy | IfNotPresent | — |
adminServer.rdbTransfer | — | RDB export and import. The admin server runs FalkorDB’s redis-rdb-cli in Jobs (and CronJobs, for scheduled exports) in the database namespaces. |
adminServer.rdbTransfer.image | — | — |
adminServer.rdbTransfer.image.registry | us-central1-docker.pkg.dev | The path is kept when mirroring, so global.imageRegistry retargets it. |
adminServer.rdbTransfer.image.repository | falkordb-public/public/redis-rdb-cli | — |
adminServer.rdbTransfer.image.tag | "v0.9.11" | — |
adminServer.rdbTransfer.image.digest | "" | Pin by content, for example “sha256:abc…”. Takes precedence over tag. |
adminServer.replicaCount | 1 | — |
adminServer.deploymentStrategy | {} | Deployment update strategy. When empty and persistence is enabled, defaults to Recreate to avoid Multi-Attach errors on ReadWriteOnce volumes during image/tag changes. Set explicitly to override, e.g.: deploymentStrategy: type: RollingUpdate |
adminServer.serviceAccount | — | — |
adminServer.serviceAccount.create | true | — |
adminServer.serviceAccount.name | "" | — |
adminServer.serviceAccount.automountServiceAccountToken | true | — |
adminServer.serviceAccount.annotations | {} | — |
adminServer.rbac | — | — |
adminServer.rbac.create | true | — |
adminServer.rbac.admissionPolicy | — | A ValidatingAdmissionPolicy that holds the Admin Server to what it actually does, beyond what RBAC can express. Its RBAC lets it bind its namespace-scoped role into any namespace and create Jobs and KubeBlocks objects there, and every one of those can name the ServiceAccount its pods run as. The policy denies its requests that would run a pod with a ServiceAccount token or a ServiceAccount KubeBlocks didn’t generate, bind it into kube-* or managedNamespaces.denied, or define an OpsDefinition other than the two TLS ones. Rendered only where the API server serves admissionregistration.k8s.io/v1 ValidatingAdmissionPolicy (Kubernetes 1.30 and later); older clusters install without it. |
adminServer.rbac.admissionPolicy.enabled | true | — |
adminServer.rbac.admissionPolicy.validationActions | [Warn, Audit] | What a violation does. This release warns and records an audit event rather than refusing the request, so a violation nobody anticipated can’t break a running install; the next release switches to [Deny]. Watch for violations in the API server’s audit log, or in its apiserver_validating_admission_policy_check_total metric with enforcement_action=“warn” and this policy’s name. Set [Deny] to enforce now. Kubernetes accepts Deny, Warn and Audit, but not Deny together with Warn. |
adminServer.managedNamespaces | — | Restricts which namespaces the admin server may provision databases into. The pattern is a regular expression matched against the namespace name. The server anchors it at both ends for you, so write the bare expression - a leading ^ or trailing $ here is redundant. Example: “falkordb-.*” confines every database to a falkordb- prefix. The default empty string imposes no restriction. |
adminServer.managedNamespaces.pattern | "" | — |
adminServer.managedNamespaces.denied | see values.yaml | — |
adminServer.service | — | — |
adminServer.service.type | ClusterIP | — |
adminServer.service.port | 3000 | — |
adminServer.service.protocol | http | — |
adminServer.service.host | "" | — |
adminServer.service.url | "" | — |
adminServer.service.apiBasePath | /api | — |
adminServer.service.loadBalancerClass | "" | — |
adminServer.service.loadBalancerIP | "" | — |
adminServer.service.externalTrafficPolicy | "" | — |
adminServer.service.loadBalancerSourceRanges | [] | — |
adminServer.serviceAnnotations | {} | — |
adminServer.resources | — | — |
adminServer.resources.requests | — | — |
adminServer.resources.requests.cpu | 250m | — |
adminServer.resources.requests.memory | 256Mi | — |
adminServer.resources.limits | — | — |
adminServer.resources.limits.cpu | "1" | — |
adminServer.resources.limits.memory | 1Gi | — |
adminServer.deploymentAnnotations | {} | — |
adminServer.podAnnotations | {} | — |
adminServer.podLabels | {} | — |
adminServer.imagePullSecrets | [] | — |
adminServer.podSecurityContext | — | — |
adminServer.podSecurityContext.runAsNonRoot | true | — |
adminServer.podSecurityContext.runAsUser | 1000 | — |
adminServer.podSecurityContext.runAsGroup | 1000 | — |
adminServer.podSecurityContext.fsGroup | 1000 | — |
adminServer.podSecurityContext.seccompProfile | — | — |
adminServer.podSecurityContext.seccompProfile.type | RuntimeDefault | — |
adminServer.securityContext | — | — |
adminServer.securityContext.allowPrivilegeEscalation | false | — |
adminServer.securityContext.readOnlyRootFilesystem | true | — |
adminServer.securityContext.capabilities | — | — |
adminServer.securityContext.capabilities.drop | see values.yaml | — |
adminServer.priorityClassName | "" | — |
adminServer.nodeSelector | {} | — |
adminServer.tolerations | [] | — |
adminServer.affinity | {} | — |
adminServer.command | [] | — |
adminServer.args | [] | — |
adminServer.persistence | — | — |
adminServer.persistence.enabled | true | — |
adminServer.persistence.mountPath | /data | — |
adminServer.persistence.accessModes | see values.yaml | — |
adminServer.persistence.size | 8Gi | — |
adminServer.persistence.storageClassName | "" | — |
adminServer.persistence.existingClaim | "" | — |
adminServer.metrics | — | The admin server exposes Prometheus metrics at /metrics on the API port, outside the authenticated /api prefix. |
adminServer.metrics.basicAuth | — | HTTP Basic credentials for /metrics. Leave both empty to serve metrics unauthenticated to anything that can reach the pod. When set, the chart’s PodMonitor picks the same credentials up, so podMonitor.enabled keeps working; any other scraper must be configured by hand. username and password must be set together, and neither can be combined with existingSecret - the chart refuses to render otherwise, so a partial configuration cannot quietly leave the endpoint open. |
adminServer.metrics.basicAuth.username | "" | — |
adminServer.metrics.basicAuth.password | "" | — |
adminServer.metrics.basicAuth.existingSecret | "" | Take the credentials from a Secret that already exists in the release namespace instead of from Helm values. It must hold username and password keys. |
adminServer.secret | — | — |
adminServer.secret.create | true | — |
adminServer.secret.name | "" | — |
adminServer.secret.jwtSecret | "" | — |
adminServer.secret.jwtExistingSecret | — | Read the JWT signing secret from a Secret that already exists in the release namespace instead of putting the value in Helm values, where it would be visible in helm get values and in the process table of whoever ran --set. install.sh uses this path. The remaining keys below are still taken from Helm values; only the JWT secret moves. |
adminServer.secret.jwtExistingSecret.name | "" | — |
adminServer.secret.jwtExistingSecret.key | jwt-secret | — |
adminServer.secret.googleClientId | "" | — |
adminServer.secret.googleClientSecret | "" | — |
adminServer.secret.azureClientId | "" | — |
adminServer.secret.azureClientSecret | "" | — |
adminServer.secret.googleWorkspaceServiceAccountKey | "" | — |
adminServer.license | — | — |
adminServer.license.value | "" | Signed FalkorDB Enterprise license string. If set, the chart creates a dedicated Secret and the admin server activates this license on startup. |
adminServer.license.existingSecret | — | Use an existing Secret in the release namespace instead of storing the license in Helm values. The Secret data should contain the signed license. |
adminServer.license.existingSecret.name | "" | — |
adminServer.license.existingSecret.key | "license" | — |
adminServer.license.statePath | /data/license-state.json | Persisted license state path. Keep this under adminServer.persistence.mountPath so API-activated licenses and Helm-provided licenses survive pod restarts. |
adminServer.license.verificationGracePeriodHours | 24 | Hours a license bound to a Kubernetes cluster ID stays valid while the admin server cannot read the cluster ID (API server outage, missing RBAC), counted from the last successful check. A cluster ID that is read and does not match invalidates the license immediately. 0 disables the grace period. |
adminServer.env | — | — |
adminServer.env.nodeEnv | production | — |
adminServer.env.host | 0.0.0.0 | — |
adminServer.env.logLevel | info | — |
adminServer.env.logPretty | "false" | — |
adminServer.env.databasePath | /data/admin.db | — |
adminServer.env.jwtExpirySeconds | "3600" | — |
adminServer.env.k8sNamespace | "" | — |
adminServer.env.k8sInCluster | "true" | — |
adminServer.env.kubeconfig | "" | — |
adminServer.env.corsOrigin | "" | — |
adminServer.env.clusterExternalDomain | "" | Default DNS domain used to publish per-pod A records for new databases, e.g. “db.internal.example.com”. Requires ExternalDNS in the cluster and pod IPs that are routable from the consuming network. When set, each database gets a zone (<name>.<domain>, <name>-sent.<domain>) whose records point directly at pod IPs, so clients outside this cluster can reach replicas and shards without a kube-proxy hop. Leave empty to disable. |
adminServer.env.rateLimitWindowMs | "900000" | — |
adminServer.env.rateLimitMaxRequests | "100000" | — |
adminServer.env.enableSwagger | "false" | — |
adminServer.env.disableLocalAuth | "false" | — |
adminServer.env.cookieSecure | null | Set to null to use the server default: secure cookies in NODE_ENV=production. Set to false only for HTTP/no-TLS deployments. |
adminServer.env.cookieSameSite | lax | Auth cookie SameSite policy. Use none when Admin UI and Admin Server are on different public origins. |
adminServer.env.oauthProvider | "" | — |
adminServer.env.googleRedirectUri | "" | — |
adminServer.env.azureTenantId | "" | — |
adminServer.env.azureRedirectUri | "" | — |
adminServer.env.googleWorkspaceDomain | "" | — |
adminServer.env.googleWorkspaceAdminEmail | "" | — |
adminServer.env.googleWorkspacePrivateKeyPath | "" | — |
adminServer.bootstrap | — | — |
adminServer.bootstrap.adminUser | — | — |
adminServer.bootstrap.adminUser.create | true | — |
adminServer.bootstrap.adminUser.secretName | "" | — |
adminServer.bootstrap.adminUser.email | "admin@falkordb.local" | — |
adminServer.bootstrap.adminUser.name | "FalkorDB Admin" | — |
adminServer.bootstrap.adminUser.role | "admin" | — |
adminServer.bootstrap.adminUser.status | "active" | — |
adminServer.bootstrap.adminUser.source | "local" | — |
adminServer.bootstrap.adminUser.mustChangePassword | true | The bootstrap admin must pick a new password on first sign-in. |
adminServer.bootstrap.adminUser.password | null | Bootstrap admin password, hashed with bcrypt at render time. Leave it null and passwordHash empty to have the chart generate a random password on first install, stored in the Secret <release>-initial-admin-password (key: password); delete that Secret once you have signed in and changed the password. |
adminServer.bootstrap.adminUser.passwordHash | "" | — |
adminServer.bootstrap.adminUser.labels | {} | — |
adminServer.bootstrap.adminUser.annotations | {} | — |
adminServer.bootstrap.rbacConfig | — | — |
adminServer.bootstrap.rbacConfig.create | false | — |
adminServer.bootstrap.rbacConfig.configMapName | "falkordb-rbac" | — |
adminServer.bootstrap.rbacConfig.labels | {} | — |
adminServer.bootstrap.rbacConfig.annotations | {} | — |
adminServer.bootstrap.rbacConfig.roles | see values.yaml | — |
adminServer.bootstrap.rbacConfig.groupMappings | [] | — |
adminServer.bootstrap.settingsConfig | — | — |
adminServer.bootstrap.settingsConfig.create | false | — |
adminServer.bootstrap.settingsConfig.configMapName | "falkordb-admin-settings" | — |
adminServer.bootstrap.settingsConfig.labels | {} | — |
adminServer.bootstrap.settingsConfig.annotations | {} | — |
adminServer.bootstrap.settingsConfig.settings | — | — |
adminServer.bootstrap.settingsConfig.settings.features | — | — |
adminServer.bootstrap.settingsConfig.settings.features.oauth2_enabled | true | — |
adminServer.bootstrap.settingsConfig.settings.features.local_users_enabled | true | — |
adminServer.bootstrap.settingsConfig.settings.features.self_service_onboarding | false | — |
adminServer.bootstrap.settingsConfig.settings.features.multi_cluster_mode | false | — |
adminServer.bootstrap.settingsConfig.settings.features.backup_auto_schedule | true | — |
adminServer.bootstrap.settingsConfig.settings.features.metrics_collection | true | — |
adminServer.bootstrap.settingsConfig.settings.features.api_docs_enabled | true | — |
adminServer.bootstrap.settingsConfig.settings.oauth | — | — |
adminServer.bootstrap.settingsConfig.settings.oauth.allowed_domains | [] | — |
adminServer.bootstrap.settingsConfig.settings.oauth.role_attribute_path | null | — |
adminServer.bootstrap.settingsConfig.settings.oauth.role_attribute_strict | false | — |
adminServer.bootstrap.settingsConfig.settings.google_workspace | — | — |
adminServer.bootstrap.settingsConfig.settings.google_workspace.domain | null | — |
adminServer.bootstrap.settingsConfig.settings.google_workspace.admin_email | null | — |
adminServer.bootstrap.settingsConfig.settings.google_workspace.private_key_secret_ref | null | — |
adminServer.bootstrap.settingsConfig.settings.retention | — | — |
adminServer.bootstrap.settingsConfig.settings.retention.audit_log_retention_days | 90 | — |
adminServer.bootstrap.settingsConfig.settings.retention.metrics_retention_days | 30 | — |
adminServer.bootstrap.settingsConfig.settings.retention.rdb_import_retention_days | 14 | Finished RDB imports and rollbacks (and failed exports) are deleted, with their pre-import snapshots, this many days after they finish. |
adminServer.bootstrap.settingsConfig.settings.retention.rdb_export_retention_days | 0 | Successful manual RDB exports are deleted, with their files, this many days after they finish. 0 keeps them; scheduled exports follow their schedule’s retention. |
adminServer.bootstrap.settingsConfig.settings.metrics | — | — |
adminServer.bootstrap.settingsConfig.settings.metrics.prometheus_port | 9121 | — |
adminServer.bootstrap.settingsConfig.settings.cost | — | Estimated cost showback. FalkorDB Enterprise cannot know what the underlying infrastructure costs - it runs on any Kubernetes substrate, including on-prem and air-gapped - so the operator supplies the rates. With enabled: false the console still reports each database’s share of reserved capacity, just without a currency figure. |
adminServer.bootstrap.settingsConfig.settings.cost.enabled | false | — |
adminServer.bootstrap.settingsConfig.settings.cost.provider | rate-card | — |
adminServer.bootstrap.settingsConfig.settings.cost.currency | USD | — |
adminServer.extraEnv | [] | — |
adminServer.existingEnvSecrets | [] | — |
adminServer.existingEnvConfigMaps | [] | — |
adminServer.envFrom | [] | — |
adminServer.extraVolumes | [] | — |
adminServer.extraVolumeMounts | [] | — |
adminUi
| Value | Default | Description |
|---|---|---|
adminUi | — | — |
adminUi.enabled | true | — |
adminUi.image | — | — |
adminUi.image.registry | registry.falkordb.cloud/falkordb | — |
adminUi.image.repository | falkordb-enterprise-ui | — |
adminUi.image.tag | "" | Empty falls back to the chart’s appVersion, so a chart version always resolves to the same image. Set a tag only to override that. |
adminUi.image.digest | "" | Pin by content, for example “sha256:abc…”. Takes precedence over tag. A digest is the only reference a registry cannot silently repoint. |
adminUi.image.pullPolicy | IfNotPresent | — |
adminUi.replicaCount | 1 | — |
adminUi.containerPort | 3000 | — |
adminUi.apiProxy | — | Forward requests under adminServer.service.apiBasePath to the Admin Server from the Admin UI pod, so the UI works on one origin without an Ingress, for example through kubectl port-forward svc/<release>-admin-ui 8080:80. |
adminUi.apiProxy.enabled | true | — |
adminUi.service | — | — |
adminUi.service.type | ClusterIP | — |
adminUi.service.port | 80 | — |
adminUi.service.protocol | http | — |
adminUi.service.host | "" | — |
adminUi.service.url | "" | — |
adminUi.service.loadBalancerClass | "" | — |
adminUi.service.loadBalancerIP | "" | — |
adminUi.service.externalTrafficPolicy | "" | — |
adminUi.service.loadBalancerSourceRanges | [] | — |
adminUi.resources | — | — |
adminUi.resources.requests | — | — |
adminUi.resources.requests.cpu | 100m | — |
adminUi.resources.requests.memory | 128Mi | — |
adminUi.resources.limits | — | — |
adminUi.resources.limits.cpu | 500m | — |
adminUi.resources.limits.memory | 512Mi | — |
adminUi.deploymentAnnotations | {} | — |
adminUi.podAnnotations | {} | — |
adminUi.podLabels | {} | — |
adminUi.imagePullSecrets | [] | — |
adminUi.podSecurityContext | — | — |
adminUi.podSecurityContext.runAsNonRoot | true | — |
adminUi.podSecurityContext.runAsUser | 101 | — |
adminUi.podSecurityContext.runAsGroup | 101 | — |
adminUi.podSecurityContext.fsGroup | 101 | — |
adminUi.podSecurityContext.seccompProfile | — | — |
adminUi.podSecurityContext.seccompProfile.type | RuntimeDefault | — |
adminUi.securityContext | — | — |
adminUi.securityContext.allowPrivilegeEscalation | false | — |
adminUi.securityContext.readOnlyRootFilesystem | true | — |
adminUi.securityContext.capabilities | — | — |
adminUi.securityContext.capabilities.drop | see values.yaml | — |
adminUi.priorityClassName | "" | — |
adminUi.nodeSelector | {} | — |
adminUi.tolerations | [] | — |
adminUi.affinity | {} | — |
adminUi.command | [] | — |
adminUi.args | [] | — |
adminUi.env | — | — |
adminUi.env.viteApiUrl | "" | — |
adminUi.env.viteApiBaseUrl | "" | — |
adminUi.env.viteWsBaseUrl | "" | — |
adminUi.env.viteSchemaUri | "" | — |
adminUi.env.viteBrowserUrl | "" | — |
adminUi.env.viteDmSqlUrl | "" | — |
adminUi.env.viteMockApi | "false" | — |
adminUi.extraEnv | [] | — |
adminUi.existingEnvSecrets | [] | — |
adminUi.existingEnvConfigMaps | [] | — |
adminUi.envFrom | [] | — |
adminUi.extraVolumes | [] | — |
adminUi.extraVolumeMounts | [] | — |
adminUi.serviceAnnotations | {} | — |
networkPolicy
| Value | Default | Description |
|---|---|---|
networkPolicy | — | Opt-in NetworkPolicy for the Admin Server and Admin UI. |
networkPolicy.enabled | false | Requires a CNI that enforces NetworkPolicy (Calico, Cilium, Antrea, or the controller built into k3s). A CNI that ignores NetworkPolicy accepts the objects and silently enforces nothing, so this is off by default rather than advertising isolation that may not exist. Recommended for production. |
networkPolicy.ingressControllerNamespace | ingress-nginx | Namespaces allowed to reach the two components, matched on the kubernetes.io/metadata.name label that Kubernetes sets on every namespace. Where the ingress controller runs. Set to "" to drop the rule, which makes both components unreachable except through a port-forward. |
networkPolicy.monitoringNamespace | monitoring | Where Prometheus runs. Only used when podMonitor.enabled is true. |
networkPolicy.dnsNamespace | kube-system | Where CoreDNS/kube-dns runs. Set to "" only if DNS lives somewhere else and you supply the rule through extraEgress. |
networkPolicy.externalEgress | — | Destinations outside the cluster that the Admin Server has to reach: the kube-apiserver, and the identity provider when adminServer.env.oauthProvider is set. NetworkPolicy matches on CIDR and never on hostname, so neither is expressible by name. The default is wide on purpose — the control plane endpoint is not knowable from inside the chart, and guessing it wrong locks the Admin Server out of the API server entirely. Narrow it to your control plane and identity provider ranges; see docs/reference/network-policy.mdx. |
networkPolicy.externalEgress.ports | see values.yaml | — |
networkPolicy.externalEgress.cidrs | see values.yaml | — |
networkPolicy.adminServer | — | Appended verbatim to the generated policies, for anything the rules above do not cover. Each entry is a complete ingress or egress rule with its own from/to and ports, not a bare peer. |
networkPolicy.adminServer.extraIngress | [] | — |
networkPolicy.adminServer.extraEgress | [] | — |
networkPolicy.adminUi | — | — |
networkPolicy.adminUi.extraIngress | [] | — |
networkPolicy.adminUi.extraEgress | [] | — |
podMonitor
| Value | Default | Description |
|---|---|---|
podMonitor | — | — |
podMonitor.enabled | false | — |
podMonitor.interval | 30s | — |
podMonitor.scrapeTimeout | 10s | — |
podMonitor.additionalLabels | {} | — |
alertRules
| Value | Default | Description |
|---|---|---|
alertRules | — | — |
alertRules.enabled | false | — |
alertRules.additionalLabels | {} | — |
alertRules.additionalAnnotations | {} | — |
alertRules.defaultRules | — | — |
alertRules.defaultRules.enabled | true | — |
alertRules.defaultRules.for | 5m | — |
alertRules.databaseRules | — | Database health alerts: node and cluster state, replication, memory against maxmemory, data volume usage and failed backups. The redis_* alerts need podMonitor.enabled; the volume and backup alerts need the kubelet and kube-state-metrics series that kube-prometheus-stack collects by default. |
alertRules.databaseRules.enabled | true | — |
alertRules.databaseRules.for | 5m | — |
alertRules.databaseRules.memoryUsedRatio | 0.9 | Alert when used memory exceeds this share of maxmemory. |
alertRules.databaseRules.volumeFreeRatio | 0.15 | Alert when a data volume has less than this share free. |
alertRules.databaseRules.dataVolumeClaimRegex | "data-.+" | PVCs KubeBlocks creates for FalkorDB data, named data-<deployment>-<component>-<n>. |
alertRules.additionalGroups | [] | — |
grafanaDashboards
| Value | Default | Description |
|---|---|---|
grafanaDashboards | — | — |
grafanaDashboards.enabled | false | — |
grafanaDashboards.additionalLabels | {} | — |
grafanaDashboards.dashboards | [] | — |