values.yaml, so the defaults here are the ones
you get. To read it directly, run helm pull oci://registry.falkordb.cloud/falkordb/falkordb-enterprise --untar.
Descriptions are the first paragraph of each key’s comment in
values.yaml. Many
keys carry longer rationale there — read the file itself before changing anything
whose description mentions a caveat.nameOverride
| Value | Default | Description |
|---|---|---|
nameOverride | "" | — |
fullnameOverride
| Value | Default | Description |
|---|---|---|
fullnameOverride | "" | — |
global
| Value | Default | Description |
|---|---|---|
global | — | Registry for the images this chart owns directly: the admin server, the admin UI, and the two kubectl hook jobs. When set it replaces the per-image registry below. Defaults to registry.falkordb.cloud, which carries every image the chart can pull under one host so a standard install only needs to reach that one registry. FalkorDB’s own images are published there directly by CI; third-party images are mirrored in under their upstream path. Set to "" to pull the chart-owned images from their original registries instead (registry.falkordb.cloud for the admin server/UI and the enterprise database image, docker.io for the hook jobs). |
global.imageRegistry | "registry.falkordb.cloud/falkordb" | — |
global.imageCredentials | — | Registry credentials for the private FalkorDB images. This is the single place credentials are configured; everything else in the chart derives from it. The default registry serves the FalkorDB images anonymously, so the whole block is off by default — set it only when pulling from a registry that requires authentication. |
global.imageCredentials.create | false | — |
global.imageCredentials.name | "" | — |
global.imageCredentials.registry | "registry.falkordb.cloud" | — |
global.imageCredentials.username | "" | — |
global.imageCredentials.password | "" | — |
global.imageCredentials.email | "" | — |
global.imagePullSecrets | [] | Extra pull secrets applied to every workload this chart owns, on top of imageCredentials.name. Entries may be plain names or objects with name. These are replicated into database namespaces alongside the credentials Secret above. |
global.kubernetesServiceHost | "" | Override the API server address that in-cluster clients derive from the KUBERNETES_SERVICE_HOST/KUBERNETES_SERVICE_PORT variables the kubelet injects into every container. Leave empty (the default) to keep the kubelet’s values, which point at the API server’s in-cluster ClusterIP — that is what almost every cluster wants and nothing is emitted. |
global.kubernetesServicePort | "" | — |
global.extraEnv | [] | Extra environment variables appended to every container this chart owns. Component-level extraEnv is applied after this, so a component can still override an entry of the same name. Unlike the two values above, this one is not shared with the subcharts and does NOT reach the database pods: set falkordb-addon.extraEnv for those. |
extraObjects
| Value | Default | Description |
|---|---|---|
extraObjects | [] | — |
preflight
| Value | Default | Description |
|---|---|---|
preflight | — | — |
preflight.cleanupStaleOpsDefinitions | — | — |
preflight.cleanupStaleOpsDefinitions.enabled | true | — |
preflight.cleanupStaleOpsDefinitions.image | — | alpine/kubectl rather than alpine/k8s: the hook only needs kubectl and a shell, while alpine/k8s also bundles aws, az, gcloud, helm and terraform. Measured with grype —only-fixed: alpine/k8s:1.33.1 carries 830 high and 126 critical fixable findings, alpine/kubectl:1.36.3 carries 4 high and 0 critical. |
preflight.cleanupStaleOpsDefinitions.image.registry | docker.io | — |
preflight.cleanupStaleOpsDefinitions.image.repository | alpine/kubectl | — |
preflight.cleanupStaleOpsDefinitions.image.tag | "1.36.3" | — |
preflight.cleanupStaleOpsDefinitions.image.pullPolicy | IfNotPresent | — |
preflight.cleanupStaleOpsDefinitions.serviceAccount | — | — |
preflight.cleanupStaleOpsDefinitions.serviceAccount.create | true | — |
preflight.cleanupStaleOpsDefinitions.serviceAccount.name | "" | — |
preflight.cleanupStaleOpsDefinitions.rbac | — | — |
preflight.cleanupStaleOpsDefinitions.rbac.create | true | — |
preflight.cleanupStaleOpsDefinitions.ttlSecondsAfterFinished | 300 | — |
preflight.cleanupStaleOpsDefinitions.podAnnotations | {} | — |
preflight.cleanupStaleOpsDefinitions.resources | {} | — |
preflight.cleanupStaleOpsDefinitions.podSecurityContext | — | — |
preflight.cleanupStaleOpsDefinitions.podSecurityContext.runAsNonRoot | true | — |
preflight.cleanupStaleOpsDefinitions.podSecurityContext.runAsUser | 1001 | — |
preflight.cleanupStaleOpsDefinitions.podSecurityContext.runAsGroup | 1001 | — |
preflight.cleanupStaleOpsDefinitions.podSecurityContext.seccompProfile | — | — |
preflight.cleanupStaleOpsDefinitions.podSecurityContext.seccompProfile.type | RuntimeDefault | — |
preflight.cleanupStaleOpsDefinitions.securityContext | — | — |
preflight.cleanupStaleOpsDefinitions.securityContext.allowPrivilegeEscalation | false | — |
preflight.cleanupStaleOpsDefinitions.securityContext.capabilities | — | — |
preflight.cleanupStaleOpsDefinitions.securityContext.capabilities.drop | see values.yaml | — |
kubeblocks
kubeblocks is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
|---|---|---|
kubeblocks | — | — |
kubeblocks.enabled | true | — |
kubeblocks.nameOverride | falkordb-enterprise | — |
kubeblocks.image | — | kubeblocks does not read .Values.global, so it needs its own registry override to land on the mirror by default. This one key is enough: dataProtection.image.registry and addonChartsImage.registry both fall back to it when unset, so kubeblocks, kubeblocks-tools, kubeblocks-dataprotection, datasafed and kubeblocks-charts all follow. |
kubeblocks.image.registry | registry.falkordb.cloud/falkordb | — |
kubeblocks.autoInstalledAddons | [] | — |
kubeblocks.rbac | — | — |
kubeblocks.rbac.additionalPolicyRules | see values.yaml | — |
snapshot-controller
snapshot-controller is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
|---|---|---|
snapshot-controller | — | — |
snapshot-controller.enabled | false | — |
snapshot-controller.installCRDs | true | — |
snapshot-controller.controller | — | — |
snapshot-controller.controller.image | — | — |
snapshot-controller.controller.image.tag | v8.6.0 | Chart 5.0.3 defaults the tag to its appVersion (v8.5.0), which grype reports as 9 critical / 36 high fixable. v8.6.0 rebases onto a current distroless base: 0 critical / 10 high. |
volumeSnapshotClass
| Value | Default | Description |
|---|---|---|
volumeSnapshotClass | — | — |
volumeSnapshotClass.enabled | true | — |
volumeSnapshotClass.name | falkordb-enterprise-csi-hostpath | — |
volumeSnapshotClass.driver | hostpath.csi.k8s.io | — |
volumeSnapshotClass.deletionPolicy | Delete | — |
volumeSnapshotClass.isDefault | true | — |
volumeSnapshotClass.annotations | {} | — |
volumeSnapshotClass.labels | {} | — |
csi-hostpath-driver
csi-hostpath-driver is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
|---|---|---|
csi-hostpath-driver | — | Chart 1.14.0 ships image tags from 2022 (csi-attacher v4.0.0, csi-provisioner v3.3.0, csi-snapshotter v6.1.0, …). Every one of them carries ~16 critical / ~126 high fixable findings, which made this single subchart the largest source of CVEs in the air-gap image manifest. The tags below are the current upstream sidecar releases; measured with grype --only-fixed, they drop the whole set to 0 critical for five of the eight images. csi-attacher and csi-external-health-monitor-controller still report 7 critical each - upstream has not rebased them - but that is down from 16 with roughly a tenth of the high findings. |
csi-hostpath-driver.enabled | false | — |
csi-hostpath-driver.image | — | — |
csi-hostpath-driver.image.registry | registry.k8s.io | — |
csi-hostpath-driver.image.repository | sig-storage/hostpathplugin | — |
csi-hostpath-driver.image.tag | v1.18.0 | Overrides the chart appVersion (v1.14.0): 14 critical / 83 high -> 0 / 7. |
csi-hostpath-driver.sidecars | — | — |
csi-hostpath-driver.sidecars.healthmonitor | — | — |
csi-hostpath-driver.sidecars.healthmonitor.image | — | — |
csi-hostpath-driver.sidecars.healthmonitor.image.repository | sig-storage/csi-external-health-monitor-controller | — |
csi-hostpath-driver.sidecars.healthmonitor.image.tag | v0.18.0 | — |
csi-hostpath-driver.sidecars.registrar | — | — |
csi-hostpath-driver.sidecars.registrar.image | — | — |
csi-hostpath-driver.sidecars.registrar.image.repository | sig-storage/csi-node-driver-registrar | — |
csi-hostpath-driver.sidecars.registrar.image.tag | v2.17.0 | — |
csi-hostpath-driver.sidecars.livenessprobe | — | — |
csi-hostpath-driver.sidecars.livenessprobe.image | — | — |
csi-hostpath-driver.sidecars.livenessprobe.image.repository | sig-storage/livenessprobe | — |
csi-hostpath-driver.sidecars.livenessprobe.image.tag | v2.19.0 | — |
csi-hostpath-driver.sidecars.attacher | — | — |
csi-hostpath-driver.sidecars.attacher.image | — | — |
csi-hostpath-driver.sidecars.attacher.image.repository | sig-storage/csi-attacher | — |
csi-hostpath-driver.sidecars.attacher.image.tag | v4.12.0 | — |
csi-hostpath-driver.sidecars.provisioner | — | — |
csi-hostpath-driver.sidecars.provisioner.image | — | — |
csi-hostpath-driver.sidecars.provisioner.image.repository | sig-storage/csi-provisioner | — |
csi-hostpath-driver.sidecars.provisioner.image.tag | v6.3.0 | — |
csi-hostpath-driver.sidecars.resizer | — | — |
csi-hostpath-driver.sidecars.resizer.image | — | — |
csi-hostpath-driver.sidecars.resizer.image.repository | sig-storage/csi-resizer | — |
csi-hostpath-driver.sidecars.resizer.image.tag | v2.2.1 | — |
csi-hostpath-driver.sidecars.snapshotter | — | — |
csi-hostpath-driver.sidecars.snapshotter.image | — | — |
csi-hostpath-driver.sidecars.snapshotter.image.repository | sig-storage/csi-snapshotter | — |
csi-hostpath-driver.sidecars.snapshotter.image.tag | v8.6.0 | — |
csi-hostpath-driver.storageClass | — | — |
csi-hostpath-driver.storageClass.create | true | — |
csi-hostpath-driver.storageClass.default | false | — |
falkordb-addon
falkordb-addon is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
|---|---|---|
falkordb-addon | — | — |
falkordb-addon.enabled | true | — |
falkordb-addon.image | — | FalkorDB Enterprise image: the FalkorDB core image plus the enterprise module (/var/lib/falkordb/bin/falkordb-enterprise.so). The image sets FALKORDB_EXTRA_MODULES_ARGS so the module is loaded next to the core one. Requires registry credentials. |
falkordb-addon.image.registry | registry.falkordb.cloud/falkordb | — |
falkordb-addon.image.repository | falkordb-enterprise-db | — |
falkordb-addon.imagePullSecrets | [] | Pull secrets for the private enterprise image, applied to the FalkorDB ComponentDefinition runtimes and OpsDefinition jobs (addon >= 1.6.4). Entries may be plain secret names or objects with a name field. |
falkordb-addon.falkordbVersions | see values.yaml | Replaces the upstream addon version list. Only FalkorDB releases with a published falkordb-enterprise-db image are offered. |
falkordb-addon.metrics | — | — |
falkordb-addon.metrics.image | — | — |
falkordb-addon.metrics.image.registry | docker.io | — |
falkordb-addon.apeDts | — | — |
falkordb-addon.apeDts.registry | docker.io | — |
falkordb-addon.apeDtsImage | — | — |
falkordb-addon.apeDtsImage.registry | docker.io | — |
falkordb-addon.dbctlImage | — | — |
falkordb-addon.dbctlImage.registry | docker.io | — |
falkordb-addon.busyboxImage | — | — |
falkordb-addon.busyboxImage.registry | docker.io | — |
falkordb-browser
falkordb-browser is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
|---|---|---|
falkordb-browser | — | — |
falkordb-browser.enabled | true | — |
falkordb-browser.browser | — | — |
falkordb-browser.browser.encryption | — | — |
falkordb-browser.browser.encryption.key | "" | Server-side encryption key for stored credentials and tokens. Must be 64 hexadecimal characters (32 bytes). If empty, the chart generates one and reuses the existing Secret value on upgrades. You can generate one with: openssl rand -hex 32 |
falkordb-browser.browser.encryption.existingSecret | — | Use an existing Secret in the release namespace for ENCRYPTION_KEY instead of setting encryption.key or generating a key in the chart Secret. |
falkordb-browser.browser.encryption.existingSecret.name | "" | — |
falkordb-browser.browser.encryption.existingSecret.key | "ENCRYPTION_KEY" | — |
falkordb-browser.ingress | — | No image override needed: since chart 2.4.0 falkordb-browser splits registry from repository and reads global.imageRegistry. |
falkordb-browser.ingress.enabled | false | — |
falkordb-browser.ingress.className | "" | — |
falkordb-browser.ingress.hosts | see values.yaml | — |
falkordb-browser.ingress.tls | [] | — |
falkordb-browser.env | — | — |
falkordb-browser.env.nextauthUrl | http://localhost:3000/ | — |
dm-sql-to-falkordb
dm-sql-to-falkordb is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
|---|---|---|
dm-sql-to-falkordb | — | — |
dm-sql-to-falkordb.enabled | false | — |
dm-sql-to-falkordb.ingress | — | — |
dm-sql-to-falkordb.ingress.enabled | false | — |
dm-sql-to-falkordb.ingress.className | "" | — |
dm-sql-to-falkordb.ingress.annotations | {} | — |
dm-sql-to-falkordb.ingress.hosts | see values.yaml | — |
dm-sql-to-falkordb.ingress.tls | [] | — |
browserEncryptionKey
| Value | Default | Description |
|---|---|---|
browserEncryptionKey | — | — |
browserEncryptionKey.enabled | true | — |
browserEncryptionKey.image | — | Ensures ENCRYPTION_KEY exists in the Browser chart Secret. The default Secret name is derived from the Browser release name, e.g. <release>-falkordb-browser. See the preflight hook above for why this is alpine/kubectl and not alpine/k8s. |
browserEncryptionKey.image.registry | docker.io | — |
browserEncryptionKey.image.repository | alpine/kubectl | — |
browserEncryptionKey.image.tag | "1.36.3" | — |
browserEncryptionKey.image.pullPolicy | IfNotPresent | — |
browserEncryptionKey.serviceAccount | — | — |
browserEncryptionKey.serviceAccount.create | true | — |
browserEncryptionKey.serviceAccount.name | "" | — |
browserEncryptionKey.rbac | — | — |
browserEncryptionKey.rbac.create | true | — |
browserEncryptionKey.ttlSecondsAfterFinished | 300 | — |
browserEncryptionKey.podAnnotations | {} | — |
browserEncryptionKey.resources | {} | — |
browserEncryptionKey.podSecurityContext | — | — |
browserEncryptionKey.podSecurityContext.runAsNonRoot | true | — |
browserEncryptionKey.podSecurityContext.runAsUser | 1001 | — |
browserEncryptionKey.podSecurityContext.runAsGroup | 1001 | — |
browserEncryptionKey.podSecurityContext.seccompProfile | — | — |
browserEncryptionKey.podSecurityContext.seccompProfile.type | RuntimeDefault | — |
browserEncryptionKey.securityContext | — | — |
browserEncryptionKey.securityContext.allowPrivilegeEscalation | false | — |
browserEncryptionKey.securityContext.capabilities | — | — |
browserEncryptionKey.securityContext.capabilities.drop | see values.yaml | — |
gateway
| Value | Default | Description |
|---|---|---|
gateway | — | — |
gateway.enabled | true | — |
gateway.ingress | — | — |
gateway.ingress.enabled | false | — |
gateway.ingress.className | "" | — |
gateway.ingress.annotations | {} | — |
gateway.ingress.hosts | see values.yaml | — |
gateway.ingress.tls | [] | — |
gateway.routes | — | — |
gateway.routes.ui | — | — |
gateway.routes.ui.path | / | — |
gateway.routes.ui.pathType | Prefix | — |
gateway.routes.api | — | — |
gateway.routes.api.path | /api | — |
gateway.routes.api.pathType | Prefix | — |
gateway.routes.openapi | — | — |
gateway.routes.openapi.enabled | true | — |
gateway.routes.openapi.path | /swagger.json | — |
gateway.routes.openapi.pathType | Exact | — |
csi-s3
csi-s3 is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
|---|---|---|
csi-s3 | — | — |
csi-s3.enabled | false | — |
csi-s3.images | — | The chart pins full references, tag included, and re-hosts two stock kubernetes-csi sidecars under cr.yandex. Point those two back at registry.k8s.io so they track upstream releases and dedupe with the tags the other CSI subcharts use; the mirror maps both to the same sig-storage/… path. The csi-s3-driver image itself has no upstream alternative and comes from the chart version (0.43.7: 24 critical / 93 high fixable, down from 34 / 172 at 0.43.4). |
csi-s3.images.provisioner | registry.k8s.io/sig-storage/csi-provisioner:v6.3.0 | — |
csi-s3.images.registrar | registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.17.0 | — |
csi-s3.storageClass | — | — |
csi-s3.storageClass.create | false | — |
csi-s3.secret | — | — |
csi-s3.secret.create | false | — |
csi-nfs
csi-nfs is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
|---|---|---|
csi-nfs | — | — |
csi-nfs.enabled | false | — |
csi-nfs.image | — | Chart 4.13.1 pins sidecars that are one to two releases behind; the newer tags below are all 0 critical, where the chart defaults range from 4 to 11. nfsplugin v4.13.4 is the current patch of the driver the chart ships (v4.13.1: 8 critical / 89 high -> 0 / 4). |
csi-nfs.image.nfs | — | — |
csi-nfs.image.nfs.repository | registry.k8s.io/sig-storage/nfsplugin | — |
csi-nfs.image.nfs.tag | v4.13.4 | — |
csi-nfs.image.csiProvisioner | — | — |
csi-nfs.image.csiProvisioner.tag | v6.3.0 | — |
csi-nfs.image.csiResizer | — | — |
csi-nfs.image.csiResizer.tag | v2.2.1 | — |
csi-nfs.image.csiSnapshotter | — | — |
csi-nfs.image.csiSnapshotter.tag | v8.6.0 | — |
csi-nfs.image.livenessProbe | — | — |
csi-nfs.image.livenessProbe.tag | v2.19.0 | — |
csi-nfs.image.nodeDriverRegistrar | — | — |
csi-nfs.image.nodeDriverRegistrar.tag | v2.17.0 | — |
csi-nfs.image.externalSnapshotter | — | — |
csi-nfs.image.externalSnapshotter.tag | v8.6.0 | — |
csi-nfs.storageClass | — | — |
csi-nfs.storageClass.create | false | — |
csi-nfs.externalSnapshotter | — | — |
csi-nfs.externalSnapshotter.enabled | false | — |
backupRepository
| Value | Default | Description |
|---|---|---|
backupRepository | — | — |
backupRepository.enabled | true | — |
backupRepository.name | falkordb-enterprise-pvc | — |
backupRepository.storageProviderRef | pvc | — |
backupRepository.isDefault | true | — |
backupRepository.pvReclaimPolicy | Delete | — |
backupRepository.volumeCapacity | 100Gi | — |
backupRepository.accessMethod | Mount | — |
backupRepository.pathPrefix | "" | — |
backupRepository.config | — | — |
backupRepository.config.storageClassName | "" | — |
backupRepository.config.accessMode | ReadWriteOnce | — |
backupRepository.config.volumeMode | Filesystem | — |
adminServer
| Value | Default | Description |
|---|---|---|
adminServer | — | — |
adminServer.enabled | true | — |
adminServer.image | — | — |
adminServer.image.registry | registry.falkordb.cloud/falkordb | — |
adminServer.image.repository | falkordb-enterprise-server | — |
adminServer.image.tag | "latest" | — |
adminServer.image.pullPolicy | IfNotPresent | — |
adminServer.replicaCount | 1 | — |
adminServer.deploymentStrategy | {} | Deployment update strategy. When empty and persistence is enabled, defaults to Recreate to avoid Multi-Attach errors on ReadWriteOnce volumes during image/tag changes. Set explicitly to override, e.g.: deploymentStrategy: type: RollingUpdate |
adminServer.serviceAccount | — | — |
adminServer.serviceAccount.create | true | — |
adminServer.serviceAccount.name | "" | — |
adminServer.serviceAccount.automountServiceAccountToken | true | — |
adminServer.serviceAccount.annotations | {} | — |
adminServer.rbac | — | — |
adminServer.rbac.create | true | — |
adminServer.service | — | — |
adminServer.service.type | ClusterIP | — |
adminServer.service.port | 3000 | — |
adminServer.service.protocol | http | — |
adminServer.service.host | "" | — |
adminServer.service.url | "" | — |
adminServer.service.apiBasePath | /api | — |
adminServer.service.loadBalancerClass | "" | — |
adminServer.service.loadBalancerIP | "" | — |
adminServer.service.externalTrafficPolicy | "" | — |
adminServer.service.loadBalancerSourceRanges | [] | — |
adminServer.serviceAnnotations | {} | — |
adminServer.resources | — | — |
adminServer.resources.requests | — | — |
adminServer.resources.requests.cpu | 250m | — |
adminServer.resources.requests.memory | 256Mi | — |
adminServer.resources.limits | — | — |
adminServer.resources.limits.cpu | "1" | — |
adminServer.resources.limits.memory | 1Gi | — |
adminServer.deploymentAnnotations | {} | — |
adminServer.podAnnotations | {} | — |
adminServer.podLabels | {} | — |
adminServer.imagePullSecrets | [] | — |
adminServer.podSecurityContext | — | — |
adminServer.podSecurityContext.runAsNonRoot | true | — |
adminServer.podSecurityContext.runAsUser | 1000 | — |
adminServer.podSecurityContext.runAsGroup | 1000 | — |
adminServer.podSecurityContext.fsGroup | 1000 | — |
adminServer.podSecurityContext.seccompProfile | — | — |
adminServer.podSecurityContext.seccompProfile.type | RuntimeDefault | — |
adminServer.securityContext | — | — |
adminServer.securityContext.allowPrivilegeEscalation | false | — |
adminServer.securityContext.capabilities | — | — |
adminServer.securityContext.capabilities.drop | see values.yaml | — |
adminServer.priorityClassName | "" | — |
adminServer.nodeSelector | {} | — |
adminServer.tolerations | [] | — |
adminServer.affinity | {} | — |
adminServer.command | [] | — |
adminServer.args | [] | — |
adminServer.persistence | — | — |
adminServer.persistence.enabled | true | — |
adminServer.persistence.mountPath | /data | — |
adminServer.persistence.accessModes | see values.yaml | — |
adminServer.persistence.size | 8Gi | — |
adminServer.persistence.storageClassName | "" | — |
adminServer.persistence.existingClaim | "" | — |
adminServer.secret | — | — |
adminServer.secret.create | true | — |
adminServer.secret.name | "" | — |
adminServer.secret.jwtSecret | "" | — |
adminServer.secret.googleClientId | "" | — |
adminServer.secret.googleClientSecret | "" | — |
adminServer.secret.azureClientId | "" | — |
adminServer.secret.azureClientSecret | "" | — |
adminServer.secret.googleWorkspaceServiceAccountKey | "" | — |
adminServer.license | — | — |
adminServer.license.value | "" | Signed FalkorDB Enterprise license string. If set, the chart creates a dedicated Secret and the admin server activates this license on startup. |
adminServer.license.existingSecret | — | Use an existing Secret in the release namespace instead of storing the license in Helm values. The Secret data should contain the signed license. |
adminServer.license.existingSecret.name | "" | — |
adminServer.license.existingSecret.key | "license" | — |
adminServer.license.statePath | /data/license-state.json | Persisted license state path. Keep this under adminServer.persistence.mountPath so API-activated licenses and Helm-provided licenses survive pod restarts. |
adminServer.env | — | — |
adminServer.env.nodeEnv | production | — |
adminServer.env.host | 0.0.0.0 | — |
adminServer.env.logLevel | info | — |
adminServer.env.logPretty | "false" | — |
adminServer.env.databasePath | /data/admin.db | — |
adminServer.env.jwtExpirySeconds | "3600" | — |
adminServer.env.k8sNamespace | "" | — |
adminServer.env.k8sInCluster | "true" | — |
adminServer.env.kubeconfig | "" | — |
adminServer.env.corsOrigin | "" | — |
adminServer.env.clusterExternalDomain | "" | Default DNS domain used to publish per-pod A records for new databases, e.g. “db.internal.example.com”. Requires ExternalDNS in the cluster and pod IPs that are routable from the consuming network. When set, each database gets a zone (<name>.<domain>, <name>-sent.<domain>) whose records point directly at pod IPs, so clients outside this cluster can reach replicas and shards without a kube-proxy hop. Leave empty to disable. |
adminServer.env.rateLimitWindowMs | "900000" | — |
adminServer.env.rateLimitMaxRequests | "100000" | — |
adminServer.env.enableSwagger | "false" | — |
adminServer.env.disableLocalAuth | "false" | — |
adminServer.env.cookieSecure | null | Set to null to use the server default: secure cookies in NODE_ENV=production. Set to false only for HTTP/no-TLS deployments. |
adminServer.env.cookieSameSite | lax | Auth cookie SameSite policy. Use none when Admin UI and Admin Server are on different public origins. |
adminServer.env.oauthProvider | "" | — |
adminServer.env.googleRedirectUri | "" | — |
adminServer.env.azureTenantId | "" | — |
adminServer.env.azureRedirectUri | "" | — |
adminServer.env.googleWorkspaceDomain | "" | — |
adminServer.env.googleWorkspaceAdminEmail | "" | — |
adminServer.env.googleWorkspacePrivateKeyPath | "" | — |
adminServer.bootstrap | — | — |
adminServer.bootstrap.adminUser | — | — |
adminServer.bootstrap.adminUser.create | true | — |
adminServer.bootstrap.adminUser.secretName | "" | — |
adminServer.bootstrap.adminUser.email | "admin@falkordb.local" | — |
adminServer.bootstrap.adminUser.name | "FalkorDB Admin" | — |
adminServer.bootstrap.adminUser.role | "admin" | — |
adminServer.bootstrap.adminUser.status | "active" | — |
adminServer.bootstrap.adminUser.source | "local" | — |
adminServer.bootstrap.adminUser.mustChangePassword | false | — |
adminServer.bootstrap.adminUser.password | "Test123!@#" | — |
adminServer.bootstrap.adminUser.passwordHash | "" | — |
adminServer.bootstrap.adminUser.labels | {} | — |
adminServer.bootstrap.adminUser.annotations | {} | — |
adminServer.bootstrap.rbacConfig | — | — |
adminServer.bootstrap.rbacConfig.create | false | — |
adminServer.bootstrap.rbacConfig.configMapName | "falkordb-rbac" | — |
adminServer.bootstrap.rbacConfig.labels | {} | — |
adminServer.bootstrap.rbacConfig.annotations | {} | — |
adminServer.bootstrap.rbacConfig.roles | see values.yaml | — |
adminServer.bootstrap.rbacConfig.groupMappings | [] | — |
adminServer.bootstrap.settingsConfig | — | — |
adminServer.bootstrap.settingsConfig.create | false | — |
adminServer.bootstrap.settingsConfig.configMapName | "falkordb-admin-settings" | — |
adminServer.bootstrap.settingsConfig.labels | {} | — |
adminServer.bootstrap.settingsConfig.annotations | {} | — |
adminServer.bootstrap.settingsConfig.settings | — | — |
adminServer.bootstrap.settingsConfig.settings.features | — | — |
adminServer.bootstrap.settingsConfig.settings.features.oauth2_enabled | true | — |
adminServer.bootstrap.settingsConfig.settings.features.local_users_enabled | true | — |
adminServer.bootstrap.settingsConfig.settings.features.self_service_onboarding | false | — |
adminServer.bootstrap.settingsConfig.settings.features.multi_cluster_mode | false | — |
adminServer.bootstrap.settingsConfig.settings.features.backup_auto_schedule | true | — |
adminServer.bootstrap.settingsConfig.settings.features.metrics_collection | true | — |
adminServer.bootstrap.settingsConfig.settings.features.api_docs_enabled | true | — |
adminServer.bootstrap.settingsConfig.settings.oauth | — | — |
adminServer.bootstrap.settingsConfig.settings.oauth.allowed_domains | [] | — |
adminServer.bootstrap.settingsConfig.settings.oauth.role_attribute_path | null | — |
adminServer.bootstrap.settingsConfig.settings.oauth.role_attribute_strict | false | — |
adminServer.bootstrap.settingsConfig.settings.google_workspace | — | — |
adminServer.bootstrap.settingsConfig.settings.google_workspace.domain | null | — |
adminServer.bootstrap.settingsConfig.settings.google_workspace.admin_email | null | — |
adminServer.bootstrap.settingsConfig.settings.google_workspace.private_key_secret_ref | null | — |
adminServer.bootstrap.settingsConfig.settings.retention | — | — |
adminServer.bootstrap.settingsConfig.settings.retention.audit_log_retention_days | 90 | — |
adminServer.bootstrap.settingsConfig.settings.retention.metrics_retention_days | 30 | — |
adminServer.bootstrap.settingsConfig.settings.metrics | — | — |
adminServer.bootstrap.settingsConfig.settings.metrics.prometheus_port | 9121 | — |
adminServer.extraEnv | [] | — |
adminServer.existingEnvSecrets | [] | — |
adminServer.existingEnvConfigMaps | [] | — |
adminServer.envFrom | [] | — |
adminServer.extraVolumes | [] | — |
adminServer.extraVolumeMounts | [] | — |
adminUi
| Value | Default | Description |
|---|---|---|
adminUi | — | — |
adminUi.enabled | true | — |
adminUi.image | — | — |
adminUi.image.registry | registry.falkordb.cloud/falkordb | — |
adminUi.image.repository | falkordb-enterprise-ui | — |
adminUi.image.tag | "latest" | — |
adminUi.image.pullPolicy | IfNotPresent | — |
adminUi.replicaCount | 1 | — |
adminUi.containerPort | 3000 | — |
adminUi.service | — | — |
adminUi.service.type | ClusterIP | — |
adminUi.service.port | 80 | — |
adminUi.service.protocol | http | — |
adminUi.service.host | "" | — |
adminUi.service.url | "" | — |
adminUi.service.loadBalancerClass | "" | — |
adminUi.service.loadBalancerIP | "" | — |
adminUi.service.externalTrafficPolicy | "" | — |
adminUi.service.loadBalancerSourceRanges | [] | — |
adminUi.resources | — | — |
adminUi.resources.requests | — | — |
adminUi.resources.requests.cpu | 100m | — |
adminUi.resources.requests.memory | 128Mi | — |
adminUi.resources.limits | — | — |
adminUi.resources.limits.cpu | 500m | — |
adminUi.resources.limits.memory | 512Mi | — |
adminUi.deploymentAnnotations | {} | — |
adminUi.podAnnotations | {} | — |
adminUi.podLabels | {} | — |
adminUi.imagePullSecrets | [] | — |
adminUi.podSecurityContext | — | — |
adminUi.podSecurityContext.runAsNonRoot | true | — |
adminUi.podSecurityContext.runAsUser | 101 | — |
adminUi.podSecurityContext.runAsGroup | 101 | — |
adminUi.podSecurityContext.fsGroup | 101 | — |
adminUi.podSecurityContext.seccompProfile | — | — |
adminUi.podSecurityContext.seccompProfile.type | RuntimeDefault | — |
adminUi.securityContext | — | — |
adminUi.securityContext.allowPrivilegeEscalation | false | — |
adminUi.securityContext.capabilities | — | — |
adminUi.securityContext.capabilities.drop | see values.yaml | — |
adminUi.priorityClassName | "" | — |
adminUi.nodeSelector | {} | — |
adminUi.tolerations | [] | — |
adminUi.affinity | {} | — |
adminUi.command | [] | — |
adminUi.args | [] | — |
adminUi.env | — | — |
adminUi.env.viteApiUrl | "" | — |
adminUi.env.viteApiBaseUrl | "" | — |
adminUi.env.viteWsBaseUrl | "" | — |
adminUi.env.viteSchemaUri | "" | — |
adminUi.env.viteBrowserUrl | "" | — |
adminUi.env.viteDmSqlUrl | "" | — |
adminUi.env.viteMockApi | "false" | — |
adminUi.extraEnv | [] | — |
adminUi.existingEnvSecrets | [] | — |
adminUi.existingEnvConfigMaps | [] | — |
adminUi.envFrom | [] | — |
adminUi.extraVolumes | [] | — |
adminUi.extraVolumeMounts | [] | — |
adminUi.serviceAnnotations | {} | — |
podMonitor
| Value | Default | Description |
|---|---|---|
podMonitor | — | — |
podMonitor.enabled | false | — |
podMonitor.interval | 30s | — |
podMonitor.scrapeTimeout | 10s | — |
podMonitor.additionalLabels | {} | — |
alertRules
| Value | Default | Description |
|---|---|---|
alertRules | — | — |
alertRules.enabled | false | — |
alertRules.additionalLabels | {} | — |
alertRules.additionalAnnotations | {} | — |
alertRules.defaultRules | — | — |
alertRules.defaultRules.enabled | true | — |
alertRules.defaultRules.for | 5m | — |
alertRules.additionalGroups | [] | — |
grafanaDashboards
| Value | Default | Description |
|---|---|---|
grafanaDashboards | — | — |
grafanaDashboards.enabled | false | — |
grafanaDashboards.additionalLabels | {} | — |
grafanaDashboards.dashboards | [] | — |