> ## Documentation Index
> Fetch the complete documentation index at: https://docs.falkordb.com/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> FalkorDB is a graph database that speaks the Redis protocol. Queries are issued as OpenCypher through the GRAPH.QUERY and GRAPH.RO_QUERY commands, not over Bolt or a SQL connection.
> FalkorDB implements a subset of OpenCypher with proprietary extensions. Do not assume Neo4j-only syntax or procedures are available — check /cypher/cypher-support and /cypher/known-limitations before using a clause.
> FalkorDB is the successor to RedisGraph, but they are separate products. Do not present RedisGraph commands, versions, or limitations as current FalkorDB behavior.
> Use the official clients listed in /getting-started/clients rather than generic Redis or Neo4j drivers, and prefer the language the user is already working in.
> Configuration parameters are set with GRAPH.CONFIG SET or at startup; cite the exact parameter name from /getting-started/configuration rather than inventing one.
> This site covers four products: FalkorDB (core), FalkorDB Cloud, FalkorDB Enterprise, and the GraphRAG SDK. Name which one an answer applies to, since setup and operations differ.
# All Helm values
> Every value the FalkorDB Enterprise chart accepts, with its default, generated from values.yaml.
Every key the chart accepts, with the default it ships with. This page is
generated from the chart's own `values.yaml`, so the defaults here are the ones
you get. To read it directly, run `helm pull oci://registry.falkordb.cloud/falkordb/falkordb-enterprise --untar`.
Descriptions are the first paragraph of each key's comment in `values.yaml`. Many
keys carry longer rationale there — read the file itself before changing anything
whose description mentions a caveat.
For the values that matter most, and why, start with
[Helm values](/enterprise/reference/helm-values).
## `nameOverride`
| Value | Default | Description |
| -------------- | ------- | ----------- |
| `nameOverride` | `""` | — |
## `fullnameOverride`
| Value | Default | Description |
| ------------------ | ------- | ----------- |
| `fullnameOverride` | `""` | — |
## `global`
| Value | Default | Description |
| ---------------------------------- | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `global` | — | Registry for the images this chart owns directly: the admin server, the admin UI, and the two kubectl hook jobs. When set it replaces the per-image registry below. Defaults to registry.falkordb.cloud, which carries every image the chart can pull under one host so a standard install only needs to reach that one registry. FalkorDB's own images are published there directly by CI; third-party images are mirrored in under their upstream path. Set to "" to pull the chart-owned images from their original registries instead (registry.falkordb.cloud for the admin server/UI and the enterprise database image, docker.io for the hook jobs). |
| `global.imageRegistry` | `"registry.falkordb.cloud/falkordb"` | — |
| `global.imageCredentials` | — | Registry credentials for the private FalkorDB images. This is the single place credentials are configured; everything else in the chart derives from it. The default registry serves the FalkorDB images anonymously, so the whole block is off by default -- set it only when pulling from a registry that requires authentication. |
| `global.imageCredentials.create` | `false` | — |
| `global.imageCredentials.name` | `""` | — |
| `global.imageCredentials.registry` | `"registry.falkordb.cloud"` | — |
| `global.imageCredentials.username` | `""` | — |
| `global.imageCredentials.password` | `""` | — |
| `global.imageCredentials.email` | `""` | — |
| `global.imagePullSecrets` | `[]` | Extra pull secrets applied to every workload this chart owns, on top of `imageCredentials.name`. Entries may be plain names or objects with `name`. These are replicated into database namespaces alongside the credentials Secret above. |
| `global.kubernetesServiceHost` | `""` | Override the API server address that in-cluster clients derive from the KUBERNETES\_SERVICE\_HOST/KUBERNETES\_SERVICE\_PORT variables the kubelet injects into every container. Leave empty (the default) to keep the kubelet's values, which point at the API server's in-cluster ClusterIP -- that is what almost every cluster wants and nothing is emitted. |
| `global.kubernetesServicePort` | `""` | — |
| `global.extraEnv` | `[]` | Extra environment variables appended to every container this chart owns. Component-level `extraEnv` is applied after this, so a component can still override an entry of the same name. Unlike the two values above, this one is not shared with the subcharts and does NOT reach the database pods: set `falkordb-addon.extraEnv` for those. |
## `extraObjects`
| Value | Default | Description |
| -------------- | ------- | ----------- |
| `extraObjects` | `[]` | — |
## `preflight`
| Value | Default | Description |
| ------------------------------------------------------------------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `preflight` | — | — |
| `preflight.cleanupStaleOpsDefinitions` | — | — |
| `preflight.cleanupStaleOpsDefinitions.enabled` | `true` | — |
| `preflight.cleanupStaleOpsDefinitions.image` | — | alpine/kubectl rather than alpine/k8s: the hook only needs kubectl and a shell, while alpine/k8s also bundles aws, az, gcloud, helm and terraform. Measured with grype --only-fixed: alpine/k8s:1.33.1 carries 830 high and 126 critical fixable findings, alpine/kubectl:1.36.3 carries 4 high and 0 critical. |
| `preflight.cleanupStaleOpsDefinitions.image.registry` | `docker.io` | — |
| `preflight.cleanupStaleOpsDefinitions.image.repository` | `alpine/kubectl` | — |
| `preflight.cleanupStaleOpsDefinitions.image.tag` | `"1.36.3"` | — |
| `preflight.cleanupStaleOpsDefinitions.image.pullPolicy` | `IfNotPresent` | — |
| `preflight.cleanupStaleOpsDefinitions.serviceAccount` | — | — |
| `preflight.cleanupStaleOpsDefinitions.serviceAccount.create` | `true` | — |
| `preflight.cleanupStaleOpsDefinitions.serviceAccount.name` | `""` | — |
| `preflight.cleanupStaleOpsDefinitions.rbac` | — | — |
| `preflight.cleanupStaleOpsDefinitions.rbac.create` | `true` | — |
| `preflight.cleanupStaleOpsDefinitions.ttlSecondsAfterFinished` | `300` | — |
| `preflight.cleanupStaleOpsDefinitions.podAnnotations` | `{}` | — |
| `preflight.cleanupStaleOpsDefinitions.resources` | `{}` | — |
| `preflight.cleanupStaleOpsDefinitions.podSecurityContext` | — | — |
| `preflight.cleanupStaleOpsDefinitions.podSecurityContext.runAsNonRoot` | `true` | — |
| `preflight.cleanupStaleOpsDefinitions.podSecurityContext.runAsUser` | `1001` | — |
| `preflight.cleanupStaleOpsDefinitions.podSecurityContext.runAsGroup` | `1001` | — |
| `preflight.cleanupStaleOpsDefinitions.podSecurityContext.seccompProfile` | — | — |
| `preflight.cleanupStaleOpsDefinitions.podSecurityContext.seccompProfile.type` | `RuntimeDefault` | — |
| `preflight.cleanupStaleOpsDefinitions.securityContext` | — | — |
| `preflight.cleanupStaleOpsDefinitions.securityContext.allowPrivilegeEscalation` | `false` | — |
| `preflight.cleanupStaleOpsDefinitions.securityContext.capabilities` | — | — |
| `preflight.cleanupStaleOpsDefinitions.securityContext.capabilities.drop` | see values.yaml | — |
## `kubeblocks`
`kubeblocks` is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
| --------------------------------------- | ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `kubeblocks` | — | — |
| `kubeblocks.enabled` | `true` | — |
| `kubeblocks.nameOverride` | `falkordb-enterprise` | — |
| `kubeblocks.image` | — | kubeblocks does not read .Values.global, so it needs its own registry override to land on the mirror by default. This one key is enough: dataProtection.image.registry and addonChartsImage.registry both fall back to it when unset, so kubeblocks, kubeblocks-tools, kubeblocks-dataprotection, datasafed and kubeblocks-charts all follow. |
| `kubeblocks.image.registry` | `registry.falkordb.cloud/falkordb` | — |
| `kubeblocks.autoInstalledAddons` | `[]` | — |
| `kubeblocks.rbac` | — | — |
| `kubeblocks.rbac.additionalPolicyRules` | see values.yaml | — |
## `snapshot-controller`
`snapshot-controller` is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
| ------------------------------------------ | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `snapshot-controller` | — | — |
| `snapshot-controller.enabled` | `false` | — |
| `snapshot-controller.installCRDs` | `true` | — |
| `snapshot-controller.controller` | — | — |
| `snapshot-controller.controller.image` | — | — |
| `snapshot-controller.controller.image.tag` | `v8.6.0` | Chart 5.0.3 defaults the tag to its appVersion (v8.5.0), which grype reports as 9 critical / 36 high fixable. v8.6.0 rebases onto a current distroless base: 0 critical / 10 high. |
## `volumeSnapshotClass`
| Value | Default | Description |
| ------------------------------------ | ---------------------------------- | ----------- |
| `volumeSnapshotClass` | — | — |
| `volumeSnapshotClass.enabled` | `true` | — |
| `volumeSnapshotClass.name` | `falkordb-enterprise-csi-hostpath` | — |
| `volumeSnapshotClass.driver` | `hostpath.csi.k8s.io` | — |
| `volumeSnapshotClass.deletionPolicy` | `Delete` | — |
| `volumeSnapshotClass.isDefault` | `true` | — |
| `volumeSnapshotClass.annotations` | `{}` | — |
| `volumeSnapshotClass.labels` | `{}` | — |
## `csi-hostpath-driver`
`csi-hostpath-driver` is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
| ------------------------------------------------------------- | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `csi-hostpath-driver` | — | Chart 1.14.0 ships image tags from 2022 (csi-attacher v4.0.0, csi-provisioner v3.3.0, csi-snapshotter v6.1.0, ...). Every one of them carries \~16 critical / \~126 high fixable findings, which made this single subchart the largest source of CVEs in the air-gap image manifest. The tags below are the current upstream sidecar releases; measured with `grype --only-fixed`, they drop the whole set to 0 critical for five of the eight images. csi-attacher and csi-external-health-monitor-controller still report 7 critical each - upstream has not rebased them - but that is down from 16 with roughly a tenth of the high findings. |
| `csi-hostpath-driver.enabled` | `false` | — |
| `csi-hostpath-driver.image` | — | — |
| `csi-hostpath-driver.image.registry` | `registry.k8s.io` | — |
| `csi-hostpath-driver.image.repository` | `sig-storage/hostpathplugin` | — |
| `csi-hostpath-driver.image.tag` | `v1.18.0` | Overrides the chart appVersion (v1.14.0): 14 critical / 83 high -> 0 / 7. |
| `csi-hostpath-driver.sidecars` | — | — |
| `csi-hostpath-driver.sidecars.healthmonitor` | — | — |
| `csi-hostpath-driver.sidecars.healthmonitor.image` | — | — |
| `csi-hostpath-driver.sidecars.healthmonitor.image.repository` | `sig-storage/csi-external-health-monitor-controller` | — |
| `csi-hostpath-driver.sidecars.healthmonitor.image.tag` | `v0.18.0` | — |
| `csi-hostpath-driver.sidecars.registrar` | — | — |
| `csi-hostpath-driver.sidecars.registrar.image` | — | — |
| `csi-hostpath-driver.sidecars.registrar.image.repository` | `sig-storage/csi-node-driver-registrar` | — |
| `csi-hostpath-driver.sidecars.registrar.image.tag` | `v2.17.0` | — |
| `csi-hostpath-driver.sidecars.livenessprobe` | — | — |
| `csi-hostpath-driver.sidecars.livenessprobe.image` | — | — |
| `csi-hostpath-driver.sidecars.livenessprobe.image.repository` | `sig-storage/livenessprobe` | — |
| `csi-hostpath-driver.sidecars.livenessprobe.image.tag` | `v2.19.0` | — |
| `csi-hostpath-driver.sidecars.attacher` | — | — |
| `csi-hostpath-driver.sidecars.attacher.image` | — | — |
| `csi-hostpath-driver.sidecars.attacher.image.repository` | `sig-storage/csi-attacher` | — |
| `csi-hostpath-driver.sidecars.attacher.image.tag` | `v4.12.0` | — |
| `csi-hostpath-driver.sidecars.provisioner` | — | — |
| `csi-hostpath-driver.sidecars.provisioner.image` | — | — |
| `csi-hostpath-driver.sidecars.provisioner.image.repository` | `sig-storage/csi-provisioner` | — |
| `csi-hostpath-driver.sidecars.provisioner.image.tag` | `v6.3.0` | — |
| `csi-hostpath-driver.sidecars.resizer` | — | — |
| `csi-hostpath-driver.sidecars.resizer.image` | — | — |
| `csi-hostpath-driver.sidecars.resizer.image.repository` | `sig-storage/csi-resizer` | — |
| `csi-hostpath-driver.sidecars.resizer.image.tag` | `v2.2.1` | — |
| `csi-hostpath-driver.sidecars.snapshotter` | — | — |
| `csi-hostpath-driver.sidecars.snapshotter.image` | — | — |
| `csi-hostpath-driver.sidecars.snapshotter.image.repository` | `sig-storage/csi-snapshotter` | — |
| `csi-hostpath-driver.sidecars.snapshotter.image.tag` | `v8.6.0` | — |
| `csi-hostpath-driver.storageClass` | — | — |
| `csi-hostpath-driver.storageClass.create` | `true` | — |
| `csi-hostpath-driver.storageClass.default` | `false` | — |
## `falkordb-addon`
`falkordb-addon` is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
| --------------------------------------- | ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `falkordb-addon` | — | — |
| `falkordb-addon.enabled` | `true` | — |
| `falkordb-addon.image` | — | FalkorDB Enterprise image: the FalkorDB core image plus the enterprise module (/var/lib/falkordb/bin/falkordb-enterprise.so). The image sets FALKORDB\_EXTRA\_MODULES\_ARGS so the module is loaded next to the core one. Requires registry credentials. |
| `falkordb-addon.image.registry` | `registry.falkordb.cloud/falkordb` | — |
| `falkordb-addon.image.repository` | `falkordb-enterprise-db` | — |
| `falkordb-addon.imagePullSecrets` | `[]` | Pull secrets for the private enterprise image, applied to the FalkorDB ComponentDefinition runtimes and OpsDefinition jobs (addon >= 1.6.4). Entries may be plain secret names or objects with a `name` field. |
| `falkordb-addon.falkordbVersions` | see values.yaml | Replaces the upstream addon version list. Only FalkorDB releases with a published falkordb-enterprise-db image are offered. |
| `falkordb-addon.metrics` | — | — |
| `falkordb-addon.metrics.image` | — | — |
| `falkordb-addon.metrics.image.registry` | `docker.io` | — |
| `falkordb-addon.apeDts` | — | — |
| `falkordb-addon.apeDts.registry` | `docker.io` | — |
| `falkordb-addon.apeDtsImage` | — | — |
| `falkordb-addon.apeDtsImage.registry` | `docker.io` | — |
| `falkordb-addon.dbctlImage` | — | — |
| `falkordb-addon.dbctlImage.registry` | `docker.io` | — |
| `falkordb-addon.busyboxImage` | — | — |
| `falkordb-addon.busyboxImage.registry` | `docker.io` | — |
## `falkordb-browser`
`falkordb-browser` is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
| --------------------------------------------------------- | ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `falkordb-browser` | — | — |
| `falkordb-browser.enabled` | `true` | — |
| `falkordb-browser.browser` | — | — |
| `falkordb-browser.browser.encryption` | — | — |
| `falkordb-browser.browser.encryption.key` | `""` | Server-side encryption key for stored credentials and tokens. Must be 64 hexadecimal characters (32 bytes). If empty, the chart generates one and reuses the existing Secret value on upgrades. You can generate one with: openssl rand -hex 32 |
| `falkordb-browser.browser.encryption.existingSecret` | — | Use an existing Secret in the release namespace for ENCRYPTION\_KEY instead of setting encryption.key or generating a key in the chart Secret. |
| `falkordb-browser.browser.encryption.existingSecret.name` | `""` | — |
| `falkordb-browser.browser.encryption.existingSecret.key` | `"ENCRYPTION_KEY"` | — |
| `falkordb-browser.ingress` | — | No image override needed: since chart 2.4.0 falkordb-browser splits `registry` from `repository` and reads global.imageRegistry. |
| `falkordb-browser.ingress.enabled` | `false` | — |
| `falkordb-browser.ingress.className` | `""` | — |
| `falkordb-browser.ingress.hosts` | see values.yaml | — |
| `falkordb-browser.ingress.tls` | `[]` | — |
| `falkordb-browser.env` | — | — |
| `falkordb-browser.env.nextauthUrl` | `http://localhost:3000/` | — |
## `dm-sql-to-falkordb`
`dm-sql-to-falkordb` is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
| ---------------------------------------- | --------------- | ----------- |
| `dm-sql-to-falkordb` | — | — |
| `dm-sql-to-falkordb.enabled` | `false` | — |
| `dm-sql-to-falkordb.ingress` | — | — |
| `dm-sql-to-falkordb.ingress.enabled` | `false` | — |
| `dm-sql-to-falkordb.ingress.className` | `""` | — |
| `dm-sql-to-falkordb.ingress.annotations` | `{}` | — |
| `dm-sql-to-falkordb.ingress.hosts` | see values.yaml | — |
| `dm-sql-to-falkordb.ingress.tls` | `[]` | — |
## `browserEncryptionKey`
| Value | Default | Description |
| --------------------------------------------------------------- | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `browserEncryptionKey` | — | — |
| `browserEncryptionKey.enabled` | `true` | — |
| `browserEncryptionKey.image` | — | Ensures ENCRYPTION\_KEY exists in the Browser chart Secret. The default Secret name is derived from the Browser release name, e.g. \-falkordb-browser. See the preflight hook above for why this is alpine/kubectl and not alpine/k8s. |
| `browserEncryptionKey.image.registry` | `docker.io` | — |
| `browserEncryptionKey.image.repository` | `alpine/kubectl` | — |
| `browserEncryptionKey.image.tag` | `"1.36.3"` | — |
| `browserEncryptionKey.image.pullPolicy` | `IfNotPresent` | — |
| `browserEncryptionKey.serviceAccount` | — | — |
| `browserEncryptionKey.serviceAccount.create` | `true` | — |
| `browserEncryptionKey.serviceAccount.name` | `""` | — |
| `browserEncryptionKey.rbac` | — | — |
| `browserEncryptionKey.rbac.create` | `true` | — |
| `browserEncryptionKey.ttlSecondsAfterFinished` | `300` | — |
| `browserEncryptionKey.podAnnotations` | `{}` | — |
| `browserEncryptionKey.resources` | `{}` | — |
| `browserEncryptionKey.podSecurityContext` | — | — |
| `browserEncryptionKey.podSecurityContext.runAsNonRoot` | `true` | — |
| `browserEncryptionKey.podSecurityContext.runAsUser` | `1001` | — |
| `browserEncryptionKey.podSecurityContext.runAsGroup` | `1001` | — |
| `browserEncryptionKey.podSecurityContext.seccompProfile` | — | — |
| `browserEncryptionKey.podSecurityContext.seccompProfile.type` | `RuntimeDefault` | — |
| `browserEncryptionKey.securityContext` | — | — |
| `browserEncryptionKey.securityContext.allowPrivilegeEscalation` | `false` | — |
| `browserEncryptionKey.securityContext.capabilities` | — | — |
| `browserEncryptionKey.securityContext.capabilities.drop` | see values.yaml | — |
## `gateway`
| Value | Default | Description |
| --------------------------------- | --------------- | ----------- |
| `gateway` | — | — |
| `gateway.enabled` | `true` | — |
| `gateway.ingress` | — | — |
| `gateway.ingress.enabled` | `false` | — |
| `gateway.ingress.className` | `""` | — |
| `gateway.ingress.annotations` | `{}` | — |
| `gateway.ingress.hosts` | see values.yaml | — |
| `gateway.ingress.tls` | `[]` | — |
| `gateway.routes` | — | — |
| `gateway.routes.ui` | — | — |
| `gateway.routes.ui.path` | `/` | — |
| `gateway.routes.ui.pathType` | `Prefix` | — |
| `gateway.routes.api` | — | — |
| `gateway.routes.api.path` | `/api` | — |
| `gateway.routes.api.pathType` | `Prefix` | — |
| `gateway.routes.openapi` | — | — |
| `gateway.routes.openapi.enabled` | `true` | — |
| `gateway.routes.openapi.path` | `/swagger.json` | — |
| `gateway.routes.openapi.pathType` | `Exact` | — |
## `csi-s3`
`csi-s3` is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
| ---------------------------- | --------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `csi-s3` | — | — |
| `csi-s3.enabled` | `false` | — |
| `csi-s3.images` | — | The chart pins full references, tag included, and re-hosts two stock kubernetes-csi sidecars under cr.yandex. Point those two back at registry.k8s.io so they track upstream releases and dedupe with the tags the other CSI subcharts use; the mirror maps both to the same sig-storage/... path. The csi-s3-driver image itself has no upstream alternative and comes from the chart version (0.43.7: 24 critical / 93 high fixable, down from 34 / 172 at 0.43.4). |
| `csi-s3.images.provisioner` | `registry.k8s.io/sig-storage/csi-provisioner:v6.3.0` | — |
| `csi-s3.images.registrar` | `registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.17.0` | — |
| `csi-s3.storageClass` | — | — |
| `csi-s3.storageClass.create` | `false` | — |
| `csi-s3.secret` | — | — |
| `csi-s3.secret.create` | `false` | — |
## `csi-nfs`
`csi-nfs` is a vendored subchart. Only the keys this chart sets are listed;
everything else it accepts is documented by the subchart itself.
| Value | Default | Description |
| --------------------------------------- | --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `csi-nfs` | — | — |
| `csi-nfs.enabled` | `false` | — |
| `csi-nfs.image` | — | Chart 4.13.1 pins sidecars that are one to two releases behind; the newer tags below are all 0 critical, where the chart defaults range from 4 to 11. nfsplugin v4.13.4 is the current patch of the driver the chart ships (v4.13.1: 8 critical / 89 high -> 0 / 4). |
| `csi-nfs.image.nfs` | — | — |
| `csi-nfs.image.nfs.repository` | `registry.k8s.io/sig-storage/nfsplugin` | — |
| `csi-nfs.image.nfs.tag` | `v4.13.4` | — |
| `csi-nfs.image.csiProvisioner` | — | — |
| `csi-nfs.image.csiProvisioner.tag` | `v6.3.0` | — |
| `csi-nfs.image.csiResizer` | — | — |
| `csi-nfs.image.csiResizer.tag` | `v2.2.1` | — |
| `csi-nfs.image.csiSnapshotter` | — | — |
| `csi-nfs.image.csiSnapshotter.tag` | `v8.6.0` | — |
| `csi-nfs.image.livenessProbe` | — | — |
| `csi-nfs.image.livenessProbe.tag` | `v2.19.0` | — |
| `csi-nfs.image.nodeDriverRegistrar` | — | — |
| `csi-nfs.image.nodeDriverRegistrar.tag` | `v2.17.0` | — |
| `csi-nfs.image.externalSnapshotter` | — | — |
| `csi-nfs.image.externalSnapshotter.tag` | `v8.6.0` | — |
| `csi-nfs.storageClass` | — | — |
| `csi-nfs.storageClass.create` | `false` | — |
| `csi-nfs.externalSnapshotter` | — | — |
| `csi-nfs.externalSnapshotter.enabled` | `false` | — |
## `backupRepository`
| Value | Default | Description |
| ------------------------------------------ | ------------------------- | ----------- |
| `backupRepository` | — | — |
| `backupRepository.enabled` | `true` | — |
| `backupRepository.name` | `falkordb-enterprise-pvc` | — |
| `backupRepository.storageProviderRef` | `pvc` | — |
| `backupRepository.isDefault` | `true` | — |
| `backupRepository.pvReclaimPolicy` | `Delete` | — |
| `backupRepository.volumeCapacity` | `100Gi` | — |
| `backupRepository.accessMethod` | `Mount` | — |
| `backupRepository.pathPrefix` | `""` | — |
| `backupRepository.config` | — | — |
| `backupRepository.config.storageClassName` | `""` | — |
| `backupRepository.config.accessMode` | `ReadWriteOnce` | — |
| `backupRepository.config.volumeMode` | `Filesystem` | — |
## `adminServer`
| Value | Default | Description |
| --------------------------------------------------------------------------------------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `adminServer` | — | — |
| `adminServer.enabled` | `true` | — |
| `adminServer.image` | — | — |
| `adminServer.image.registry` | `registry.falkordb.cloud/falkordb` | — |
| `adminServer.image.repository` | `falkordb-enterprise-server` | — |
| `adminServer.image.tag` | `"latest"` | — |
| `adminServer.image.pullPolicy` | `IfNotPresent` | — |
| `adminServer.replicaCount` | `1` | — |
| `adminServer.deploymentStrategy` | `{}` | Deployment update strategy. When empty and persistence is enabled, defaults to Recreate to avoid Multi-Attach errors on ReadWriteOnce volumes during image/tag changes. Set explicitly to override, e.g.: deploymentStrategy: type: RollingUpdate |
| `adminServer.serviceAccount` | — | — |
| `adminServer.serviceAccount.create` | `true` | — |
| `adminServer.serviceAccount.name` | `""` | — |
| `adminServer.serviceAccount.automountServiceAccountToken` | `true` | — |
| `adminServer.serviceAccount.annotations` | `{}` | — |
| `adminServer.rbac` | — | — |
| `adminServer.rbac.create` | `true` | — |
| `adminServer.service` | — | — |
| `adminServer.service.type` | `ClusterIP` | — |
| `adminServer.service.port` | `3000` | — |
| `adminServer.service.protocol` | `http` | — |
| `adminServer.service.host` | `""` | — |
| `adminServer.service.url` | `""` | — |
| `adminServer.service.apiBasePath` | `/api` | — |
| `adminServer.service.loadBalancerClass` | `""` | — |
| `adminServer.service.loadBalancerIP` | `""` | — |
| `adminServer.service.externalTrafficPolicy` | `""` | — |
| `adminServer.service.loadBalancerSourceRanges` | `[]` | — |
| `adminServer.serviceAnnotations` | `{}` | — |
| `adminServer.resources` | — | — |
| `adminServer.resources.requests` | — | — |
| `adminServer.resources.requests.cpu` | `250m` | — |
| `adminServer.resources.requests.memory` | `256Mi` | — |
| `adminServer.resources.limits` | — | — |
| `adminServer.resources.limits.cpu` | `"1"` | — |
| `adminServer.resources.limits.memory` | `1Gi` | — |
| `adminServer.deploymentAnnotations` | `{}` | — |
| `adminServer.podAnnotations` | `{}` | — |
| `adminServer.podLabels` | `{}` | — |
| `adminServer.imagePullSecrets` | `[]` | — |
| `adminServer.podSecurityContext` | — | — |
| `adminServer.podSecurityContext.runAsNonRoot` | `true` | — |
| `adminServer.podSecurityContext.runAsUser` | `1000` | — |
| `adminServer.podSecurityContext.runAsGroup` | `1000` | — |
| `adminServer.podSecurityContext.fsGroup` | `1000` | — |
| `adminServer.podSecurityContext.seccompProfile` | — | — |
| `adminServer.podSecurityContext.seccompProfile.type` | `RuntimeDefault` | — |
| `adminServer.securityContext` | — | — |
| `adminServer.securityContext.allowPrivilegeEscalation` | `false` | — |
| `adminServer.securityContext.capabilities` | — | — |
| `adminServer.securityContext.capabilities.drop` | see values.yaml | — |
| `adminServer.priorityClassName` | `""` | — |
| `adminServer.nodeSelector` | `{}` | — |
| `adminServer.tolerations` | `[]` | — |
| `adminServer.affinity` | `{}` | — |
| `adminServer.command` | `[]` | — |
| `adminServer.args` | `[]` | — |
| `adminServer.persistence` | — | — |
| `adminServer.persistence.enabled` | `true` | — |
| `adminServer.persistence.mountPath` | `/data` | — |
| `adminServer.persistence.accessModes` | see values.yaml | — |
| `adminServer.persistence.size` | `8Gi` | — |
| `adminServer.persistence.storageClassName` | `""` | — |
| `adminServer.persistence.existingClaim` | `""` | — |
| `adminServer.secret` | — | — |
| `adminServer.secret.create` | `true` | — |
| `adminServer.secret.name` | `""` | — |
| `adminServer.secret.jwtSecret` | `""` | — |
| `adminServer.secret.googleClientId` | `""` | — |
| `adminServer.secret.googleClientSecret` | `""` | — |
| `adminServer.secret.azureClientId` | `""` | — |
| `adminServer.secret.azureClientSecret` | `""` | — |
| `adminServer.secret.googleWorkspaceServiceAccountKey` | `""` | — |
| `adminServer.license` | — | — |
| `adminServer.license.value` | `""` | Signed FalkorDB Enterprise license string. If set, the chart creates a dedicated Secret and the admin server activates this license on startup. |
| `adminServer.license.existingSecret` | — | Use an existing Secret in the release namespace instead of storing the license in Helm values. The Secret data should contain the signed license. |
| `adminServer.license.existingSecret.name` | `""` | — |
| `adminServer.license.existingSecret.key` | `"license"` | — |
| `adminServer.license.statePath` | `/data/license-state.json` | Persisted license state path. Keep this under adminServer.persistence.mountPath so API-activated licenses and Helm-provided licenses survive pod restarts. |
| `adminServer.env` | — | — |
| `adminServer.env.nodeEnv` | `production` | — |
| `adminServer.env.host` | `0.0.0.0` | — |
| `adminServer.env.logLevel` | `info` | — |
| `adminServer.env.logPretty` | `"false"` | — |
| `adminServer.env.databasePath` | `/data/admin.db` | — |
| `adminServer.env.jwtExpirySeconds` | `"3600"` | — |
| `adminServer.env.k8sNamespace` | `""` | — |
| `adminServer.env.k8sInCluster` | `"true"` | — |
| `adminServer.env.kubeconfig` | `""` | — |
| `adminServer.env.corsOrigin` | `""` | — |
| `adminServer.env.clusterExternalDomain` | `""` | Default DNS domain used to publish per-pod A records for new databases, e.g. "db.internal.example.com". Requires ExternalDNS in the cluster and pod IPs that are routable from the consuming network. When set, each database gets a zone (\.\, \-sent.\) whose records point directly at pod IPs, so clients outside this cluster can reach replicas and shards without a kube-proxy hop. Leave empty to disable. |
| `adminServer.env.rateLimitWindowMs` | `"900000"` | — |
| `adminServer.env.rateLimitMaxRequests` | `"100000"` | — |
| `adminServer.env.enableSwagger` | `"false"` | — |
| `adminServer.env.disableLocalAuth` | `"false"` | — |
| `adminServer.env.cookieSecure` | `null` | Set to null to use the server default: secure cookies in NODE\_ENV=production. Set to false only for HTTP/no-TLS deployments. |
| `adminServer.env.cookieSameSite` | `lax` | Auth cookie SameSite policy. Use none when Admin UI and Admin Server are on different public origins. |
| `adminServer.env.oauthProvider` | `""` | — |
| `adminServer.env.googleRedirectUri` | `""` | — |
| `adminServer.env.azureTenantId` | `""` | — |
| `adminServer.env.azureRedirectUri` | `""` | — |
| `adminServer.env.googleWorkspaceDomain` | `""` | — |
| `adminServer.env.googleWorkspaceAdminEmail` | `""` | — |
| `adminServer.env.googleWorkspacePrivateKeyPath` | `""` | — |
| `adminServer.bootstrap` | — | — |
| `adminServer.bootstrap.adminUser` | — | — |
| `adminServer.bootstrap.adminUser.create` | `true` | — |
| `adminServer.bootstrap.adminUser.secretName` | `""` | — |
| `adminServer.bootstrap.adminUser.email` | `"admin@falkordb.local"` | — |
| `adminServer.bootstrap.adminUser.name` | `"FalkorDB Admin"` | — |
| `adminServer.bootstrap.adminUser.role` | `"admin"` | — |
| `adminServer.bootstrap.adminUser.status` | `"active"` | — |
| `adminServer.bootstrap.adminUser.source` | `"local"` | — |
| `adminServer.bootstrap.adminUser.mustChangePassword` | `false` | — |
| `adminServer.bootstrap.adminUser.password` | `"Test123!@#"` | — |
| `adminServer.bootstrap.adminUser.passwordHash` | `""` | — |
| `adminServer.bootstrap.adminUser.labels` | `{}` | — |
| `adminServer.bootstrap.adminUser.annotations` | `{}` | — |
| `adminServer.bootstrap.rbacConfig` | — | — |
| `adminServer.bootstrap.rbacConfig.create` | `false` | — |
| `adminServer.bootstrap.rbacConfig.configMapName` | `"falkordb-rbac"` | — |
| `adminServer.bootstrap.rbacConfig.labels` | `{}` | — |
| `adminServer.bootstrap.rbacConfig.annotations` | `{}` | — |
| `adminServer.bootstrap.rbacConfig.roles` | see values.yaml | — |
| `adminServer.bootstrap.rbacConfig.groupMappings` | `[]` | — |
| `adminServer.bootstrap.settingsConfig` | — | — |
| `adminServer.bootstrap.settingsConfig.create` | `false` | — |
| `adminServer.bootstrap.settingsConfig.configMapName` | `"falkordb-admin-settings"` | — |
| `adminServer.bootstrap.settingsConfig.labels` | `{}` | — |
| `adminServer.bootstrap.settingsConfig.annotations` | `{}` | — |
| `adminServer.bootstrap.settingsConfig.settings` | — | — |
| `adminServer.bootstrap.settingsConfig.settings.features` | — | — |
| `adminServer.bootstrap.settingsConfig.settings.features.oauth2_enabled` | `true` | — |
| `adminServer.bootstrap.settingsConfig.settings.features.local_users_enabled` | `true` | — |
| `adminServer.bootstrap.settingsConfig.settings.features.self_service_onboarding` | `false` | — |
| `adminServer.bootstrap.settingsConfig.settings.features.multi_cluster_mode` | `false` | — |
| `adminServer.bootstrap.settingsConfig.settings.features.backup_auto_schedule` | `true` | — |
| `adminServer.bootstrap.settingsConfig.settings.features.metrics_collection` | `true` | — |
| `adminServer.bootstrap.settingsConfig.settings.features.api_docs_enabled` | `true` | — |
| `adminServer.bootstrap.settingsConfig.settings.oauth` | — | — |
| `adminServer.bootstrap.settingsConfig.settings.oauth.allowed_domains` | `[]` | — |
| `adminServer.bootstrap.settingsConfig.settings.oauth.role_attribute_path` | `null` | — |
| `adminServer.bootstrap.settingsConfig.settings.oauth.role_attribute_strict` | `false` | — |
| `adminServer.bootstrap.settingsConfig.settings.google_workspace` | — | — |
| `adminServer.bootstrap.settingsConfig.settings.google_workspace.domain` | `null` | — |
| `adminServer.bootstrap.settingsConfig.settings.google_workspace.admin_email` | `null` | — |
| `adminServer.bootstrap.settingsConfig.settings.google_workspace.private_key_secret_ref` | `null` | — |
| `adminServer.bootstrap.settingsConfig.settings.retention` | — | — |
| `adminServer.bootstrap.settingsConfig.settings.retention.audit_log_retention_days` | `90` | — |
| `adminServer.bootstrap.settingsConfig.settings.retention.metrics_retention_days` | `30` | — |
| `adminServer.bootstrap.settingsConfig.settings.metrics` | — | — |
| `adminServer.bootstrap.settingsConfig.settings.metrics.prometheus_port` | `9121` | — |
| `adminServer.extraEnv` | `[]` | — |
| `adminServer.existingEnvSecrets` | `[]` | — |
| `adminServer.existingEnvConfigMaps` | `[]` | — |
| `adminServer.envFrom` | `[]` | — |
| `adminServer.extraVolumes` | `[]` | — |
| `adminServer.extraVolumeMounts` | `[]` | — |
## `adminUi`
| Value | Default | Description |
| -------------------------------------------------- | ---------------------------------- | ----------- |
| `adminUi` | — | — |
| `adminUi.enabled` | `true` | — |
| `adminUi.image` | — | — |
| `adminUi.image.registry` | `registry.falkordb.cloud/falkordb` | — |
| `adminUi.image.repository` | `falkordb-enterprise-ui` | — |
| `adminUi.image.tag` | `"latest"` | — |
| `adminUi.image.pullPolicy` | `IfNotPresent` | — |
| `adminUi.replicaCount` | `1` | — |
| `adminUi.containerPort` | `3000` | — |
| `adminUi.service` | — | — |
| `adminUi.service.type` | `ClusterIP` | — |
| `adminUi.service.port` | `80` | — |
| `adminUi.service.protocol` | `http` | — |
| `adminUi.service.host` | `""` | — |
| `adminUi.service.url` | `""` | — |
| `adminUi.service.loadBalancerClass` | `""` | — |
| `adminUi.service.loadBalancerIP` | `""` | — |
| `adminUi.service.externalTrafficPolicy` | `""` | — |
| `adminUi.service.loadBalancerSourceRanges` | `[]` | — |
| `adminUi.resources` | — | — |
| `adminUi.resources.requests` | — | — |
| `adminUi.resources.requests.cpu` | `100m` | — |
| `adminUi.resources.requests.memory` | `128Mi` | — |
| `adminUi.resources.limits` | — | — |
| `adminUi.resources.limits.cpu` | `500m` | — |
| `adminUi.resources.limits.memory` | `512Mi` | — |
| `adminUi.deploymentAnnotations` | `{}` | — |
| `adminUi.podAnnotations` | `{}` | — |
| `adminUi.podLabels` | `{}` | — |
| `adminUi.imagePullSecrets` | `[]` | — |
| `adminUi.podSecurityContext` | — | — |
| `adminUi.podSecurityContext.runAsNonRoot` | `true` | — |
| `adminUi.podSecurityContext.runAsUser` | `101` | — |
| `adminUi.podSecurityContext.runAsGroup` | `101` | — |
| `adminUi.podSecurityContext.fsGroup` | `101` | — |
| `adminUi.podSecurityContext.seccompProfile` | — | — |
| `adminUi.podSecurityContext.seccompProfile.type` | `RuntimeDefault` | — |
| `adminUi.securityContext` | — | — |
| `adminUi.securityContext.allowPrivilegeEscalation` | `false` | — |
| `adminUi.securityContext.capabilities` | — | — |
| `adminUi.securityContext.capabilities.drop` | see values.yaml | — |
| `adminUi.priorityClassName` | `""` | — |
| `adminUi.nodeSelector` | `{}` | — |
| `adminUi.tolerations` | `[]` | — |
| `adminUi.affinity` | `{}` | — |
| `adminUi.command` | `[]` | — |
| `adminUi.args` | `[]` | — |
| `adminUi.env` | — | — |
| `adminUi.env.viteApiUrl` | `""` | — |
| `adminUi.env.viteApiBaseUrl` | `""` | — |
| `adminUi.env.viteWsBaseUrl` | `""` | — |
| `adminUi.env.viteSchemaUri` | `""` | — |
| `adminUi.env.viteBrowserUrl` | `""` | — |
| `adminUi.env.viteDmSqlUrl` | `""` | — |
| `adminUi.env.viteMockApi` | `"false"` | — |
| `adminUi.extraEnv` | `[]` | — |
| `adminUi.existingEnvSecrets` | `[]` | — |
| `adminUi.existingEnvConfigMaps` | `[]` | — |
| `adminUi.envFrom` | `[]` | — |
| `adminUi.extraVolumes` | `[]` | — |
| `adminUi.extraVolumeMounts` | `[]` | — |
| `adminUi.serviceAnnotations` | `{}` | — |
## `podMonitor`
| Value | Default | Description |
| ----------------------------- | ------- | ----------- |
| `podMonitor` | — | — |
| `podMonitor.enabled` | `false` | — |
| `podMonitor.interval` | `30s` | — |
| `podMonitor.scrapeTimeout` | `10s` | — |
| `podMonitor.additionalLabels` | `{}` | — |
## `alertRules`
| Value | Default | Description |
| ---------------------------------- | ------- | ----------- |
| `alertRules` | — | — |
| `alertRules.enabled` | `false` | — |
| `alertRules.additionalLabels` | `{}` | — |
| `alertRules.additionalAnnotations` | `{}` | — |
| `alertRules.defaultRules` | — | — |
| `alertRules.defaultRules.enabled` | `true` | — |
| `alertRules.defaultRules.for` | `5m` | — |
| `alertRules.additionalGroups` | `[]` | — |
## `grafanaDashboards`
| Value | Default | Description |
| ------------------------------------ | ------- | ----------- |
| `grafanaDashboards` | — | — |
| `grafanaDashboards.enabled` | `false` | — |
| `grafanaDashboards.additionalLabels` | `{}` | — |
| `grafanaDashboards.dashboards` | `[]` | — |