Private registries

Upstream registries

A standard install pulls images directly from these registries.

Registry	Used for
`registry.falkordb.cloud`	FalkorDB Enterprise images and Helm chart (credentials required)
`docker.io`	FalkorDB database and supporting images
`apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com`	KubeBlocks images
`registry.k8s.io`	Kubernetes ecosystem images (e.g. snapshot controller, ingress-nginx)
`ghcr.io`	FalkorDB Helm charts and addon images

Every image above — first-party and third-party — is also mirrored to registry.falkordb.cloud, so a cluster that can reach only that one host can still install the full stack. See Use the FalkorDB mirror.

Use the FalkorDB mirror

registry.falkordb.cloud mirrors every image the chart can pull under the falkordb namespace, preserving the upstream path: docker.io/apecloud/kubeblocks becomes registry.falkordb.cloud/falkordb/apecloud/kubeblocks. This turns five registries into one, which is useful when the cluster cannot reach docker.io, registry.k8s.io, ghcr.io, or apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com directly — only registry.falkordb.cloud. Install with the bundled overlay to retarget every subchart at once:

helm install falkordb-enterprise oci://registry.falkordb.cloud/falkordb/falkordb-enterprise \
  -f helm/falkordb-enterprise/examples/mirror-registry-values.yaml

Or through the installer script, which already defaults the chart reference and the Admin Server/UI images to registry.falkordb.cloud:

bash scripts/install.sh \
  --values helm/falkordb-enterprise/examples/mirror-registry-values.yaml \
  --registry-username '<username>' \
  --registry-password '<token>' \
  --yes

The same registry credentials used for Enterprise images authenticate pulls for the mirrored third-party images, since they share the same registry host.

To mirror into your own registry instead, copy helm/falkordb-enterprise/examples/mirror-registry-values.yaml and replace registry.falkordb.cloud/falkordb throughout with your registry path, then run scripts/mirror-images.sh against it (or your own image-sync tooling) before installing.

Installer-managed Secret

The installer can create or update a Docker registry Secret in the FalkorDB Enterprise namespace and wire it into the Admin Server and Admin UI deployments.

curl -fsSL https://raw.githubusercontent.com/FalkorDB/FalkorDB-Enterprise/refs/heads/main/scripts/install.sh | \
  GITEA_USERNAME='registry-username' \
  GITEA_TOKEN='registry-token' \
  bash -s -- \
    --namespace falkordb-system \
    --image-pull-secret falkordb-registry-pull-secret \
    --yes

Equivalent explicit flags, pointed at a different registry (for example GHCR):

bash scripts/install.sh \
  --namespace falkordb-system \
  --image-pull-secret ghcr-pull-secret \
  --registry-server ghcr.io \
  --registry-username 'github-user-or-service-account' \
  --registry-password 'github-token-with-read-packages' \
  --yes

If credentials are provided and --image-pull-secret is omitted, the installer uses falkordb-registry-pull-secret against registry.falkordb.cloud by default. GHCR_USERNAME/GHCR_TOKEN remain supported as aliases for GITEA_USERNAME/GITEA_TOKEN.

Existing Secret

If the Secret already exists, pass only its name:

bash scripts/install.sh \
  --namespace falkordb-system \
  --image-pull-secret existing-pull-secret \
  --yes

The installer will reference the existing Secret without recreating it.

Manual Helm values

If you install the chart manually, set image pull secrets for the Enterprise workloads:

adminServer:
  imagePullSecrets:
    - name: falkordb-registry-pull-secret

adminUi:
  imagePullSecrets:
    - name: falkordb-registry-pull-secret

# FalkorDB database pods run the private falkordb-enterprise image.
falkordb-addon:
  imagePullSecrets:
    - name: falkordb-registry-pull-secret

The Secret must exist in every namespace that hosts a FalkorDB cluster, not only the release namespace. The Browser subchart has its own image settings. Configure those through the corresponding dependency values if that image is also private.

Rotate credentials

Update the Secret in place:

kubectl -n falkordb-system create secret docker-registry falkordb-registry-pull-secret \
  --docker-server=registry.falkordb.cloud \
  --docker-username='registry-username' \
  --docker-password='new-registry-token' \
  --dry-run=client -o yaml | kubectl apply -f -

Restart workloads if the current pods need to pull images immediately:

kubectl -n falkordb-system rollout restart deployment -l app.kubernetes.io/component=admin-server
kubectl -n falkordb-system rollout restart deployment -l app.kubernetes.io/component=admin-ui

Get started

Install

Authentication

Deploy databases

Operations

Upgrade and uninstall

Troubleshooting

Upstream registries

Use the FalkorDB mirror

Installer-managed Secret

Existing Secret

Manual Helm values

Rotate credentials

​Upstream registries

​Use the FalkorDB mirror

​Installer-managed Secret

​Existing Secret

​Manual Helm values

​Rotate credentials

Upstream registries

Use the FalkorDB mirror

Installer-managed Secret

Existing Secret

Manual Helm values

Rotate credentials