> ## Documentation Index
> Fetch the complete documentation index at: https://docs.falkordb.com/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> FalkorDB is a graph database that speaks the Redis protocol. Queries are issued as OpenCypher through the GRAPH.QUERY and GRAPH.RO_QUERY commands, not over Bolt or a SQL connection.
> FalkorDB implements a subset of OpenCypher with proprietary extensions. Do not assume Neo4j-only syntax or procedures are available — check /cypher/cypher-support and /cypher/known-limitations before using a clause.
> FalkorDB is the successor to RedisGraph, but they are separate products. Do not present RedisGraph commands, versions, or limitations as current FalkorDB behavior.
> Use the official clients listed in /getting-started/clients rather than generic Redis or Neo4j drivers, and prefer the language the user is already working in.
> Configuration parameters are set with GRAPH.CONFIG SET or at startup; cite the exact parameter name from /getting-started/configuration rather than inventing one.
> This site covers four products: FalkorDB (core), FalkorDB Cloud, FalkorDB Enterprise, and the GraphRAG SDK. Name which one an answer applies to, since setup and operations differ.
# Helm values
> High-impact Helm values for the FalkorDB Enterprise chart, verified against the chart defaults.
This page summarizes the high-impact Helm values for FalkorDB Enterprise.
The source of truth is the chart's own `values.yaml`. Extract it with `helm pull oci://registry.falkordb.cloud/falkordb/falkordb-enterprise --untar` and verify against the chart version you are installing.
For every key the chart accepts, not just the ones below, see
[All Helm values](/enterprise/reference/helm-values-reference). That page is generated from
`values.yaml`, so its defaults are always the shipped ones.
## Platform dependencies
| Value | Default | Purpose |
| ----------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `kubeblocks.enabled` | `true` | Enables embedded KubeBlocks subchart for standalone Helm use. The installer sets this to `false` because it manages KubeBlocks as a separate release. |
| `snapshot-controller.enabled` | `false` | Snapshot Controller subchart. The installer manages Snapshot Controller separately. |
| `volumeSnapshotClass.enabled` | `true` | Creates a `VolumeSnapshotClass` for CSI-backed storage. The default driver is `hostpath.csi.k8s.io` for local development when `csi-hostpath-driver.enabled=true`; production installs should set this to the CSI driver used by their storage class. |
| `csi-hostpath-driver.enabled` | `false` | Optional CSI hostpath driver for local development clusters that need volume snapshot backups. Existing `local-path` PVCs are not migrated; recreate clusters on the CSI storage class before using volume snapshots. |
| `falkordb-addon.enabled` | `true` | Installs the FalkorDB KubeBlocks addon as part of the Enterprise chart. |
| `falkordb-browser.enabled` | `true` | Installs FalkorDB Browser. |
| `csi-s3.enabled` | `false` | Optional S3 CSI driver dependency. |
| `csi-nfs.enabled` | `false` | Optional NFS CSI driver dependency. |
When using `install.sh`, the installer detects the default StorageClass provisioner and configures snapshot values automatically:
* CSI-backed cloud StorageClasses, such as `ebs.csi.aws.com`, `pd.csi.storage.gke.io`, and `disk.csi.azure.com`, get a matching chart-managed `VolumeSnapshotClass` unless a default one already exists for that driver.
* Local non-CSI StorageClasses, such as `rancher.io/local-path`, enable the optional `csi-hostpath-driver` and make `csi-hostpath-sc` the default for new PVCs. Existing PVCs are not migrated.
* Unknown or non-CSI provisioners disable the chart-managed `VolumeSnapshotClass`; pass `--set volumeSnapshotClass.driver=` when the storage platform supports snapshots but cannot be detected.
Explicit `--set` and `--set-string` values passed to the installer override the detected snapshot configuration.
On upgrades, the installer reuses existing Helm release values before applying new detected values. This preserves deployment-specific image tags, image pull secrets, ingress hosts, TLS settings, and immutable PVC settings while still adding the correct snapshot configuration.
FalkorDB Enterprise is intentionally limited to one installation per Kubernetes cluster. The chart renders a fixed cluster-scoped ClusterRole install lock and also checks for an existing Helm-owned `ClusterDefinition/falkordb` from older chart versions. Upgrades of the owning Helm release are allowed; installs from a different release or namespace fail during Helm rendering.
## Registry credentials
`registry.falkordb.cloud` serves the FalkorDB images anonymously, so a default install needs no credentials. Configure this block only when pulling from a registry that requires authentication.
| Value | Default | Purpose |
| ---------------------------------- | ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `global.imageRegistry` | `registry.falkordb.cloud/falkordb` | Registry host and namespace prefixed to every chart-owned image. Overrides per-image `registry` values. |
| `global.imageCredentials.create` | `false` | When `true`, the chart creates the `dockerconfigjson` Secret from the fields below. When `false`, the Secret must already exist in the release namespace. |
| `global.imageCredentials.name` | `""` | Name of the pull Secret. Empty means no pull secret is referenced. Defaults to `falkordb-registry-pull-secret` when `create=true`. |
| `global.imageCredentials.registry` | `registry.falkordb.cloud` | Registry host the credentials authenticate against. Required when `create=true`. |
| `global.imageCredentials.username` | `""` | Registry username. Required when `create=true`. |
| `global.imageCredentials.password` | `""` | Registry password or token. Required when `create=true`. |
| `global.imagePullSecrets` | `[]` | Additional pull Secrets applied on top of `imageCredentials.name`. Entries may be plain names or `{name: ...}` objects. |
| `falkordb-addon.imagePullSecrets` | `[]` | Pull Secrets referenced by FalkorDB database pods and OpsDefinition jobs. Must match the names above; the addon subchart cannot read `global`. |
Kubernetes has no cluster-scoped image pull Secret — `imagePullSecrets` always resolves in the pod's own namespace. The Admin Server therefore copies the Secrets named in `global.imageCredentials.name` and `global.imagePullSecrets` from its own namespace into every namespace it provisions a database into, refreshing the copy on each cluster operation so a rotated credential propagates. Nothing outside this block needs to know the credentials, and operators do not have to seed namespaces by hand.
`install.sh` creates the Secret from `GITEA_USERNAME` and `GITEA_TOKEN` (or `--registry-username` / `--registry-password`) and sets all of the values above for you.
Setting `global.imageCredentials.create=true` on an existing release hands ownership of the Secret to Helm. Helm refuses to adopt an object it does not own, so this fails with `invalid ownership metadata` unless the existing Secret carries the `app.kubernetes.io/managed-by=Helm` label and the `meta.helm.sh/release-name` and `meta.helm.sh/release-namespace` annotations. Secrets created by `install.sh` are stamped with them and are adoptable; hand-made ones must be labeled or deleted first.
## API server address
| Value | Default | Purpose |
| ------------------------------ | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `global.kubernetesServiceHost` | `""` | Overrides `KUBERNETES_SERVICE_HOST` in every chart-owned container, and in database pods through `falkordb-addon`. Empty keeps the ClusterIP the kubelet injects. |
| `global.kubernetesServicePort` | `""` | Overrides `KUBERNETES_SERVICE_PORT` and `KUBERNETES_SERVICE_PORT_HTTPS` in the same places. Empty keeps the kubelet's port. |
| `global.extraEnv` | `[]` | Extra environment variables appended to every chart-owned container. Unlike the two values above it stops there: database pods take `falkordb-addon.extraEnv` instead. Component-level `extraEnv` is applied after this and still wins. |
The kubelet injects `KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT` into every container, pointing at the API server's in-cluster ClusterIP. Every in-cluster client — the Admin Server's Kubernetes client, `kubectl` in the hook Jobs, controller-runtime inside KubeBlocks — builds its API URL from those two variables. Leave both values empty unless the ClusterIP route does not work; nothing is rendered when they are unset.
Set them when either failure mode applies:
* The ClusterIP's only endpoint is a managed or public API endpoint that requires SNI. A client connecting by IP sends no SNI, so the endpoint cannot select a certificate and TLS fails mid-handshake.
* A firewall rejects traffic to the ClusterIP outright.
A container's own environment entry takes precedence over the kubelet-injected one, so setting these moves every client onto a DNS name.
The host must be covered by a Subject Alternative Name on the API server's serving certificate, or clients will fail certificate verification instead of connecting. `kubernetes.default.svc.cluster.local` is always covered and is the right first choice.
KubeBlocks does not read `global`. Use `install.sh --kubernetes-service-host`, which fans the value out to the standalone KubeBlocks release it installs, or `examples/values-apiserver-dns.yaml`, which sets `kubeblocks.extraEnvs` and `kubeblocks.dataProtection.extraEnvs` alongside the global keys.
FalkorDB database pods need no extra configuration. The `falkordb-addon` subchart reads the same two values and emits them through `ComponentDefinition.spec.vars`, which KubeBlocks injects into every container of a database pod, including the `kbagent` sidecar it adds itself.
## Gateway and public URLs
| Value | Default | Purpose |
| ------------------------------- | --------------- | -------------------------------------------------------------- |
| `gateway.enabled` | `true` | Enables shared gateway routing templates. |
| `gateway.ingress.enabled` | `false` | Creates public ingress routing when enabled. |
| `gateway.ingress.hosts[0].host` | `""` | Public hostname used to derive Admin UI URL and CORS defaults. |
| `gateway.routes.ui.path` | `/` | Admin UI route path. |
| `gateway.routes.api.path` | `/api` | Admin Server API route path. |
| `gateway.routes.openapi.path` | `/swagger.json` | OpenAPI route path. |
## Admin Server
| Value | Default | Purpose |
| ----------------------------------------- | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `adminServer.enabled` | `true` | Deploys Admin Server. |
| `adminServer.image.repository` | `falkordb/falkordb-enterprise-server` | Admin Server image repository. |
| `adminServer.image.tag` | `latest` | Admin Server image tag. Pin this for production. |
| `adminServer.secret.jwtSecret` | `""` | Required by chart rendering when `adminServer.secret.create=true`. The installer generates or reuses one. Must be at least 32 characters. |
| `adminServer.license.value` | `""` | Optional signed FalkorDB Enterprise license string. When set, the chart creates a dedicated Secret and the admin server activates it on startup. Prefer an existing Secret for production. |
| `adminServer.license.existingSecret.name` | `""` | Existing Secret name containing the signed license. Mutually exclusive with `adminServer.license.value`. |
| `adminServer.license.existingSecret.key` | `license` | Secret key that contains the signed license. |
| `adminServer.license.statePath` | `/data/license-state.json` | Persisted license state path. Keep under the admin server persistence mount so activated licenses survive pod restarts. |
| `adminServer.env.corsOrigin` | `""` | Overrides the derived Admin UI public URL for CORS. |
| `adminServer.env.cookieSecure` | `null` | Uses server default when unset. Set `true` for TLS production, `false` only for HTTP testing. |
| `adminServer.env.enableSwagger` | `"false"` | Enables Swagger/OpenAPI serving when set to `"true"`. |
| `adminServer.persistence.enabled` | `true` | Persists Admin Server data such as audit DB. |
| `adminServer.persistence.size` | `8Gi` | Admin Server PVC size. |
### Admin Server license
Leave `adminServer.license` unset to start on a 14-day free trial with no configured limits — no license value or Secret is required. Activate or replace the license later from the Admin UI's **License** page; the values below only matter if you want to provide a license at install time.
Set a license directly in values for development or one-off installs:
```yaml theme={null}
adminServer:
license:
value: "falkor.license.v1.."
```
For production, store the signed license in an existing Secret in the release namespace and reference it from values:
```bash theme={null}
kubectl -n falkordb-system create secret generic falkordb-enterprise-license \
--from-literal=license='falkor.license.v1..'
```
```yaml theme={null}
adminServer:
license:
existingSecret:
name: falkordb-enterprise-license
key: license
```
The admin server reads the Secret through `FALKORDB_LICENSE`, validates the signature, and persists the license state at `adminServer.license.statePath`. If the license expires, is invalid, or any configured limit is exceeded, the server and UI enter read-only mode until a valid license within limits is active.
The signed license key payload includes a `version` field so future payload formats can be introduced explicitly. The current supported payload version is `1`.
To bind a license to one Kubernetes cluster, include `k8sClusterId` in the signed payload. By default the admin server compares this value to the UID of the `kube-system` namespace. You can retrieve it with:
```bash theme={null}
kubectl get namespace kube-system -o jsonpath='{.metadata.uid}'
```
If your environment needs a different cluster identity source, set `K8S_CLUSTER_ID` on the admin server and issue licenses with the same value. Licenses without `k8sClusterId` remain unbound.
```json theme={null}
{
"version": 1,
"licenseId": "lic_...",
"accountName": "Example Corp",
"k8sClusterId": "00000000-0000-0000-0000-000000000000",
"issuedAt": "2026-05-28T00:00:00.000Z",
"expiresAt": "2027-05-28T00:00:00.000Z",
"limits": {
"cpuCores": "unlimited",
"memoryGB": "unlimited",
"deployments": "unlimited",
"users": "unlimited"
}
}
```
## Bootstrap Admin resources
| Value | Default | Purpose |
| ---------------------------------------------------- | ---------------------- | ---------------------------------------------------------------------------------------------------------------- |
| `adminServer.bootstrap.adminUser.create` | `true` | Creates a Kubernetes Secret-backed local admin user. |
| `adminServer.bootstrap.adminUser.email` | `admin@falkordb.local` | Bootstrap admin email. |
| `adminServer.bootstrap.adminUser.password` | `Test123!@#` | Bootstrap admin password used only if no password hash and no existing user Secret exist. Change for production. |
| `adminServer.bootstrap.adminUser.mustChangePassword` | `false` | Forces password change after first sign-in when true. |
| `adminServer.bootstrap.rbacConfig.create` | `false` | Seeds RBAC ConfigMap. Existing config is preserved with Helm keep annotation. |
| `adminServer.bootstrap.settingsConfig.create` | `false` | Seeds settings ConfigMap. Existing config is preserved with Helm keep annotation. |
## Admin UI
| Value | Default | Purpose |
| ---------------------------- | --------------------------------- | -------------------------------------------------------------------------- |
| `adminUi.enabled` | `true` | Deploys Admin UI. |
| `adminUi.image.repository` | `falkordb/falkordb-enterprise-ui` | Admin UI image repository. |
| `adminUi.image.tag` | `latest` | Admin UI image tag. Pin this for production. |
| `adminUi.env.viteApiUrl` | `""` | Public API origin. Defaults to relative routing through gateway behavior. |
| `adminUi.env.viteBrowserUrl` | `""` | Browser URL override. Defaults to the Browser ingress URL when configured. |
| `adminUi.env.viteMockApi` | `"false"` | Enables mock API mode. Keep false outside local UI demos. |
## Browser encryption
| Value | Default | Purpose |
| --------------------------------------------------------- | ------- | ------------------------------------------------------------------------------------ |
| `falkordb-browser.browser.encryption.key` | `""` | Optional 64-character hexadecimal Browser encryption key. |
| `falkordb-browser.browser.encryption.existingSecret.name` | `""` | Use an existing Secret instead of chart-generated key management. |
| `browserEncryptionKey.enabled` | `true` | Runs a hook Job to ensure Browser encryption key Secret exists and restarts Browser. |
## Observability
| Value | Default | Purpose |
| --------------------------- | ------- | --------------------------------------------------------------------- |
| `podMonitor.enabled` | `false` | Creates PodMonitor for Admin Server. |
| `alertRules.enabled` | `false` | Creates PrometheusRule resources. |
| `grafanaDashboards.enabled` | `false` | Creates Grafana dashboard resources from configured dashboard values. |