FalkorDB Enterprise install and uninstall script reference

install.sh installs or updates FalkorDB Enterprise on any Kubernetes cluster reachable by kubectl. It prints an install plan and asks for confirmation before changing the cluster. Both scripts are published at https://falkordb.github.io/FalkorDB-Enterprise/, so no repository checkout is needed.

curl -fsSL https://falkordb.github.io/FalkorDB-Enterprise/install.sh | \
  bash -s -- \
    --registry-username '<username>' \
    --registry-password '<token>'

Confirmation prompts are read from /dev/tty, so the piped form above stays interactive.

Terminal output

When its output goes to a terminal, the installer runs as a guided, step-by-step UI:

It asks only for what the flags left out: the kube context when several are configured, the registry username and token on a first install that has no pull credentials (it checks them against the registry before going on), and on a first install how to reach the Admin UI (port-forward or quick access). Every question has a flag, and --yes turns all of them off.
It shows each phase as a step, with a spinner and the step’s latest progress while it runs, then a check mark and how long it took.
It ends with a summary: the Admin UI address or the kubectl port-forward command, the bootstrap admin user, and how to read its generated password.

Helm’s and kubectl’s own output goes to a log file, named in the summary. When a step fails, the installer shows the error, the last lines of that log, and its path. Anywhere else, such as CI, a redirected run, --dry-run or --debug, the installer prints plain [falkordb-enterprise] log lines instead. --plain does the same on a terminal. NO_COLOR keeps the layout and drops the colors.

Every long option has an environment variable equivalent in uppercase with underscores. For example, --kube-context maps to KUBE_CONTEXT and --namespace maps to NAMESPACE. The registry credentials are the exception: --registry-server, --registry-username and --registry-password map to IMAGE_PULL_SECRET_SERVER, IMAGE_PULL_SECRET_USERNAME and IMAGE_PULL_SECRET_PASSWORD.

Release and namespace options

Option	Default	Description
`--release NAME`	`falkordb-enterprise`	Helm release name.
`--namespace NAME`	`falkordb-system`	FalkorDB Enterprise namespace.
`--pod-security-enforce LEVEL`	the namespace’s current level, else `baseline`	Pod Security Admission enforce level for the FalkorDB namespace. One of `privileged`, `baseline`, `restricted`. Without this flag, the installer raises the level to `privileged` when a bundled CSI driver is enabled. Pass an empty value to leave the label unset.
`--pod-security-audit LEVEL`	`restricted`	Pod Security Admission audit level.
`--pod-security-warn LEVEL`	`restricted`	Pod Security Admission warn level.
`--kube-context NAME`	current context	kubeconfig context to target.
`--kubeblocks-namespace NAME`	`kb-system`	KubeBlocks namespace.
`--kubeblocks-release NAME`	`kubeblocks`	KubeBlocks Helm release name.
`--kubeblocks-chart REF`	`kubeblocks/kubeblocks`	KubeBlocks Helm chart reference.

Chart options

Option	Default	Description
`--chart REF`	local checkout, otherwise `oci://registry.falkordb.cloud/falkordb/falkordb-enterprise`	Helm chart path or reference.
`--version VERSION`	latest published	FalkorDB Enterprise chart version, for example `0.4.1`. A leading `v` is accepted. Re-running the installer with a different value upgrades or downgrades the release. Overrides a local checkout chart.
`--chart-version VERSION`	latest published	Alias for `--version`.
`--channel CHANNEL`	`stable`	Release channel to resolve the latest version from: `stable` or `beta`. Beta releases are published as prerelease versions, so a stable install never picks one up. Ignored when `--version` is given.
`--kubeblocks-version VERSION`	auto-detected	KubeBlocks CRD version. Detected from the chart when omitted.
`--snapshotter-version VERSION`	`v8.5.0`	External snapshotter CRD version.
`-f`, `--values FILE`	—	Helm values file. Repeatable.
`--set KEY=VALUE`	—	Helm `--set` override. Repeatable.
`--set-string KEY=VALUE`	—	Helm `--set-string` override. Repeatable.
`--unset-value KEY`	—	Remove a stored value, given as a dotted path such as `gateway.ingress.className`, so the chart default applies again. Escape a dot inside a key with a backslash, as with `--set`: `'gateway.ingress.annotations.cert-manager\.io/cluster-issuer'`. Repeatable.
`--replace-values`	off	Replace the stored values with this run’s `--values`/`--set`/`--set-string` values instead of merging them in.
`--show-values`	—	Print the release’s stored values as YAML and exit. Before the first upgrade that stores them, prints what that upgrade would migrate.
`--helm-arg VALUE`	—	Raw argument appended to the Enterprise `helm install`/`upgrade` command. Repeatable. Values passed this way are not stored.

Values passed with --values, --set and --set-string are stored in the Secret <release>-installer-values and reapplied on later runs; everything else comes from the new chart’s defaults. falkordb-addon.falkordbVersions and image tags are never stored. See How the installer keeps your values.

Secrets and registry options

Option	Default	Description
`--jwt-secret VALUE`	generated	Admin Server JWT secret. Generated on first install when omitted.
`--image-pull-secret NAME`	`falkordb-registry-pull-secret`	Image pull Secret to create or reuse.
`--registry-server URL`	`registry.falkordb.cloud`	Registry server for the Helm login and the image pull Secret.
`--registry-username NAME`	—	Registry username. Required unless you have already run `helm registry login` and created the pull Secret yourself: the installer uses it to pull the chart from the private registry.
`--registry-password VALUE`	—	Registry password or access token. Required with `--registry-username`.
`--image-registry PREFIX`	unset	Registry prefix, including the namespace, for the images this chart templates and the FalkorDB addon. Sets `global.imageRegistry`. Vendored subcharts (KubeBlocks, CSI drivers, the browser) do not read it — retarget those with `examples/mirror-registry-values.yaml`. Left unset, the chart’s own default (`registry.falkordb.cloud/falkordb`) applies.

A credential typed on the command line, as a flag or as a VAR=value prefix, lands in your shell history. To keep it out, read it at a prompt and export it, then run the installer without the password flag: read -rsp 'Registry token: ' IMAGE_PULL_SECRET_PASSWORD && export IMAGE_PULL_SECRET_PASSWORD, then ... | bash -s -- --registry-username '<username>' --yes. The same works for JWT_SECRET.

Platform dependency options

Option	Description
`--skip-crds`	Do not apply KubeBlocks CRDs.
`--install-snapshot-crds`	Pre-apply VolumeSnapshot and VolumeGroupSnapshot CRDs and disable chart CRD ownership.
`--skip-kubeblocks`	Do not install or upgrade the KubeBlocks Helm release.
`--skip-snapshot-controller`	Do not install or upgrade the Snapshot Controller Helm release.
`--skip-dependency-update`	Do not run `helm dependency update` for local chart directories.
`--local-csi-hostpath MODE`	What to do when the default `StorageClass` is local non-CSI storage (`local-path`, minikube or microk8s hostpath). `auto` (default) enables the bundled single-replica csi-hostpath driver, makes `csi-hostpath-sc` the default `StorageClass` and raises the namespace to `privileged` only on a single-node cluster. On a multi-node cluster, `auto` keeps the local `StorageClass` and warns that it is not suitable for production; volume-snapshot backups are then unavailable. `enable` turns the driver on for any cluster; `disable` never does. The driver keeps every volume on one node, so with `enable` on a multi-node cluster, losing that node loses all database data: it is not replicated storage.
`--allow-zonal-backup-repo`	Install even though the nodes span several zones and the default backup repository is a volume on zonal block storage (EBS, Persistent Disk, Azure Disk). That volume stays in the zone it is created in, so backups of databases in other zones never start. Without this flag, a new install on such a cluster stops (or, in the terminal UI, asks) and points you to object storage or a `ReadWriteMany` `StorageClass` instead. Upgrades and `--dry-run` only warn. See Backups.

Networking options

Option	Description
`--quick-access`	On a first install, publish the Admin UI and the Admin Server API on a public address over plain HTTP through the chart’s gateway Ingress, installing ingress-nginx when no `IngressClass` exists. Also sets `adminServer.env.cookieSecure=false`. Off by default. Use it for evaluation only: traffic, including passwords, is unencrypted.
`--no-ingress`	Quick access through two `LoadBalancer` services instead of a single gateway Ingress. Implies `--quick-access`. Also sets `adminServer.env.cookieSameSite=none`.
`--kubernetes-service-host HOST`	Point every in-cluster Kubernetes client at this API server address instead of the ClusterIP the kubelet injects. Sets `global.kubernetesServiceHost` and the equivalent `extraEnvs` on the KubeBlocks release.
`--kubernetes-service-port PORT`	Port to pair with `--kubernetes-service-host`. Omit to keep the kubelet’s port.

Leave the last two unset on a normal cluster. They are only needed where the ClusterIP route fails — a managed or public API endpoint that requires SNI (connecting by IP sends no SNI, so TLS fails mid-handshake), or a firewall that rejects the ClusterIP. Use a DNS name covered by a SAN on the API server’s certificate, such as kubernetes.default.svc.cluster.local; an uncovered name fails certificate verification instead. See Helm values for the underlying keys.

Execution options

Option	Default	Description
`--timeout DURATION`	`15m`	Helm and `kubectl wait` timeout.
`--skip-auth-check`	`false`	Do not verify Kubernetes RBAC permissions before installing.
`--no-wait`	—	Do not wait for Helm resources.
`--no-enterprise-wait`	—	Do not wait for the FalkorDB Enterprise Helm release.
`--dry-run`	`false`	Render and validate Helm output without changing cluster resources.
`-y`, `--yes`	`false`	Skip confirmation prompts.
`--debug`	`false`	Enable shell tracing and Helm debug output. Implies plain output.
`--plain`	`false`	Print plain log lines instead of the terminal UI. See Terminal output.
`-h`, `--help`	—	Show the built-in help text.

Examples

curl -fsSL https://falkordb.github.io/FalkorDB-Enterprise/install.sh | \
  bash -s -- \
    --registry-username '<username>' \
    --registry-password '<token>' \
    --yes

curl -fsSL https://falkordb.github.io/FalkorDB-Enterprise/install.sh | \
  bash -s -- \
    --registry-username '<username>' \
    --registry-password '<token>' \
    --kube-context my-cluster \
    --namespace falkordb-system \
    --kubeblocks-namespace kb-system

curl -fsSL https://falkordb.github.io/FalkorDB-Enterprise/install.sh | \
  JWT_SECRET="$(openssl rand -hex 32)" bash -s -- \
    --registry-username '<username>' \
    --registry-password '<token>' \
    --kube-context production-cluster \
    --values production-values.yaml \
    --yes

curl -fsSL https://falkordb.github.io/FalkorDB-Enterprise/install.sh | \
  bash -s -- \
    --registry-username '<username>' \
    --registry-password '<token>' \
    --dry-run

Uninstall

uninstall.sh removes the Enterprise release and, optionally, the platform components the installer added. It refuses to run while FalkorDB deployments exist unless you pass --force, keeps the backup repository and, unless --delete-namespaces deletes its namespace, the bootstrap admin user, and makes the StorageClass the installer demoted the cluster default again. See the uninstall playbook for the full procedure and data-retention considerations.

Source of truth

The installer help text is authoritative. Run it to see the exact options for your version:

curl -fsSL https://falkordb.github.io/FalkorDB-Enterprise/install.sh | \
  bash -s -- --help

​Terminal output

​Release and namespace options

​Chart options

​Secrets and registry options

​Platform dependency options

​Networking options

​Execution options

​Examples

​Uninstall

​Source of truth

Terminal output

Release and namespace options

Chart options

Secrets and registry options

Platform dependency options

Networking options

Execution options

Examples

Uninstall

Source of truth