Changelog

​

Breaking changes

• Upgrading from 0.3.x requires moving image pulls from ghcr.io to registry.falkordb.cloud, a change first made in 0.4.0. See Migrate from 0.3 to 1.0, which folds in everything 0.4 required so 0.3.x installs can upgrade in one step.

​

Added

• global.kubernetesServiceHost and global.kubernetesServicePort override the API server address every in-cluster client derives from the KUBERNETES_SERVICE_* variables the kubelet injects, for clusters where the API server’s ClusterIP is unusable — a public endpoint that requires SNI, or a firewall that rejects it. install.sh --kubernetes-service-host sets them and fans the value out to the KubeBlocks release; examples/values-apiserver-dns.yaml does the same for a plain helm install. Both default to empty and render nothing when unset. FalkorDB addon 1.7.5 reads the same two values, so the database pods are covered without any extra configuration.
• global.extraEnv appends environment variables to every container the chart owns. It stops at the chart boundary: database pods take falkordb-addon.extraEnv.
• docs/reference/helm-values-reference.mdx lists every value the chart accepts with its real default. It is generated from values.yaml by node scripts/generate-values-docs.mjs, and CI fails if it is stale, so the published defaults can no longer drift from the chart. The hand-written reference/helm-values page stays the curated tour of the values that matter.
• global.imageCredentials is the single place private registry credentials are configured. With create: true the chart owns the pull Secret; otherwise it expects one to already exist in the release namespace. global.imagePullSecrets adds further secrets to every workload the chart owns.
• The admin server replicates the registry pull Secrets from its own namespace into every namespace it provisions a database into, so no namespace has to be seeded by hand before a database is created in it.
• install.sh --version VERSION selects the FalkorDB Enterprise chart version to install, and accepts a leading v. --chart-version remains as an alias. Re-running the installer with a different value upgrades or downgrades the release.
• The installer reports the chart version it resolved, and the plan shows the version transition for an existing release.
• A published changelog and compatibility matrix, generated from this file and the release tags, plus migration guides under docs/upgrades/migrations/.
• install.sh --channel beta installs the latest beta release. Beta releases are published as prerelease versions, so a default install never picks one up.
• The installed chart version and release channel are reported on the Diagnostics page, and recorded in the support package manifest and its viewer, so a bundle identifies the build it came from without being unpacked.
• The chart prints post-install notes naming the release, the pull Secret in use and whether the chart owns it, and warns when falkordb-addon.imagePullSecrets omits that Secret, which would leave database pods pulling anonymously.
• networkPolicy.enabled creates NetworkPolicies for the Admin Server and Admin UI. Both set policyTypes: [Ingress, Egress], so anything not named is denied. networkPolicy.ingressControllerNamespace, .monitoringNamespace and .dnsNamespace say where those callers run, and networkPolicy.externalEgress.ports/.cidrs cover the kube-apiserver and the identity provider, which NetworkPolicy can only express as address ranges. networkPolicy.adminServer.extraIngress/.extraEgress and the adminUi equivalents append whole rules for anything else. Off by default: a CNI that does not implement NetworkPolicy accepts the objects and silently enforces nothing.
• adminServer.metrics.basicAuth.username/.password, or .existingSecret, put HTTP Basic auth on /metrics. The chart’s own PodMonitor picks the same credentials up. Setting only one of the pair fails the render rather than quietly leaving the endpoint open.
• adminServer.image.digest and adminUi.image.digest pin images by content. A digest takes precedence over the tag and is the only reference a registry cannot silently repoint.
• adminServer.managedNamespaces.pattern restricts which namespaces may hold databases. It is an anchored regular expression matched against the namespace name, enforced on the server, so it also covers API clients and restores.
• install.sh --pod-security-enforce, --pod-security-audit and --pod-security-warn set the Pod Security Admission labels the installer applies to the namespaces it creates.
• A security reference describing the whole posture in one place — every RBAC grant and why it exists, which controls are enforced by Kubernetes rather than by the product, and where the limits are — plus Pod security, Network policy and Supply chain for the detail. CI re-checks the claims against the rendered chart on every change, so removing a control from the chart fails the build.

​

Changed

• The FalkorDB addon subchart moves from 1.7.2 to 1.7.5.
• The Admin Server’s Secret and ConfigMap access is no longer granted cluster-wide. It lives in a ClusterRole that is only ever bound per namespace: into the release namespace by the chart, and into each database namespace by the Admin Server as it provisions one. The server has no access to those objects in any namespace it has not been bound into. Existing installs are reconciled on startup, so an upgrade needs no manual step.
• The Admin Server no longer holds namespaces: list. The namespace picker in the console therefore lists only namespaces that already hold a database, plus the release namespace; type a name into the field to deploy into a new one.

​

Security

• Every workload the chart owns — Admin Server, Admin UI and both hook Jobs — runs as a non-root user with readOnlyRootFilesystem, allowPrivilegeEscalation: false, all capabilities dropped and a RuntimeDefault seccomp profile, and so satisfies the restricted Pod Security Standard. The Admin UI no longer mounts a ServiceAccount token it has no use for.
• The installer labels the namespaces it creates for Pod Security Admission, and raises the release namespace to privileged only when it auto-enables the bundled CSI hostpath driver, whose pods require it.
• The Admin Server’s rolebindings: create grant is bounded by bind restricted with resourceNames to the single namespace-scoped ClusterRole, so it cannot be used to grant itself any other role. No role the chart owns uses a wildcard.
• The session signing key is no longer passed through Helm values. The installer creates the Secret out of band and hands the chart only its name, so the key does not appear in the process table, in the Helm release Secret, or in helm get values.
• Container images and the Helm chart are signed with cosign, and images carry a CycloneDX bill of materials as an attestation. scripts/mirror-images.sh copies the signatures alongside the images, so a mirrored registry stays verifiable. Verification is not enforced at admission time; see Supply chain for the commands and for how to make it a boundary.
• A release name long enough to fill the 63-character budget no longer collapses the Admin Server’s namespace-scoped ClusterRole onto the name of its cluster-wide one. The suffix was appended before truncation, so it could be cut off entirely, leaving two objects sharing a name and the cluster-wide ClusterRoleBinding pointing at whichever applied last — the role carrying Secret access. CI now renders the chart under a maximum-length release name and fails if any two objects collide.

​

Fixed

• Requesting a chart version while running the installer from a repository checkout no longer silently installs the working-tree chart. The published chart is used instead.
• The installer no longer leaves the bundled CSI hostpath driver unschedulable on clusters whose default StorageClass is not CSI-capable. Pod Security Admission labels were applied before the driver was enabled, so its privileged pods were refused admission and the install timed out waiting for a StatefulSet that never got a pod.
• Re-running the installer against an existing release no longer tears down the bundled CSI hostpath driver it had previously enabled.
• Setting adminServer.rbac.create=false while letting the chart create the ServiceAccount no longer breaks database creation. The Admin Server was still pointed at a namespace-scoped ClusterRole the chart had not created, so it tried to bind a role it held no bind permission on and every attempt failed with an opaque 403.
• Listing namespaces no longer reports a namespace as absent when the API server refuses the request. Only “not found” and “gone” are treated as a namespace that has disappeared; a lost permission or an unreachable API server is surfaced instead of silently shortening the list.

​

Added

• Scheduling policy support for deployments. Node selectors and tolerations can be set per component for FalkorDB, Sentinel, and shards, from the deployment wizard and from the Admin Server API.
• Administrators can reset a user’s password.

​

Changed

• The falkordb-browser subchart moves from 2.0.9 to 2.4.0. It now reads global.imageRegistry, so the umbrella chart no longer overrides falkordb-browser.image.repository. Mirrored registries need falkordb-browser:v2.4.0 before upgrading.
• The csi-s3 subchart moves from 0.43.4 to 0.43.7.

​

Fixed

• csi-s3 and csi-driver-nfs images updated to clear reported vulnerabilities.

​

Breaking changes

• First-party images and the Helm chart are published to registry.falkordb.cloud instead of ghcr.io. Existing image pull secrets, mirror configurations, and any pinned ghcr.io image references have to be updated. See Migrate from 0.3 to 0.4.
• The chart no longer injects a default image registry through the installer. The registry comes from the chart’s own global.imageRegistry value, so a registry supplied through -f values.yaml is no longer outranked.

​

Added

• Publish summary scripts for the enterprise database image.

​

Fixed

• Helm upgrades read the release revision correctly and wait for addon definitions to reconcile before continuing.
• Admin UI: max uptime renders as a readable duration, memory metrics agree between tabs, and small non-zero CPU and memory percentages are no longer rounded away.

​

Added

• Scripts to collect, mirror, and verify the third-party images the chart pulls, for air-gapped and mirrored-registry installations.

​

Changed

• The FalkorDB addon subchart moves from 1.7.1 to 1.7.2.
• The dm-sql-to-falkordb subchart moves from 1.1.2 to 1.1.6.

​

Added

• External DNS support, including per-pod DNS records and configuration from the standalone and sharded deployment wizards.
• A confirmation dialog for starting and stopping a deployment.

​

Changed

• The FalkorDB addon subchart moves to 1.7.1.
• User-facing terminology changed from “cluster” to “deployment”.

​

Fixed

• Deployments stuck in Pending can be updated, so a failed create no longer strands them.