> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enterprise.falkordb.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Private registries

> Pull every image the chart uses from the FalkorDB mirror, or point the chart at your own private registry.

## Upstream registries

A standard install pulls images directly from these registries.

| Registry                                           | Used for                                                              |
| -------------------------------------------------- | --------------------------------------------------------------------- |
| `registry.falkordb.cloud`                          | FalkorDB Enterprise images and Helm chart (credentials required)      |
| `docker.io`                                        | FalkorDB database and supporting images                               |
| `apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com` | KubeBlocks images                                                     |
| `registry.k8s.io`                                  | Kubernetes ecosystem images (e.g. snapshot controller, ingress-nginx) |
| `ghcr.io`                                          | FalkorDB Helm charts and addon images                                 |

<Info>
  Every image above — first-party and third-party — is also mirrored to `registry.falkordb.cloud`, so a cluster that can reach only that one host can still install the full stack. See [Use the FalkorDB mirror](#use-the-falkordb-mirror).
</Info>

## Use the FalkorDB mirror

`registry.falkordb.cloud` mirrors every image the chart can pull under the `falkordb` namespace, preserving the upstream path: `docker.io/apecloud/kubeblocks` becomes `registry.falkordb.cloud/falkordb/apecloud/kubeblocks`. This turns five registries into one, which is useful when the cluster cannot reach `docker.io`, `registry.k8s.io`, `ghcr.io`, or `apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com` directly — only `registry.falkordb.cloud`.

Install with the bundled overlay to retarget every subchart at once:

```bash theme={null}
helm install falkordb-enterprise oci://registry.falkordb.cloud/falkordb/falkordb-enterprise \
  -f helm/falkordb-enterprise/examples/mirror-registry-values.yaml
```

Or through the installer script, which already defaults the chart reference and the Admin Server/UI images to `registry.falkordb.cloud`:

```bash theme={null}
bash scripts/install.sh \
  --values helm/falkordb-enterprise/examples/mirror-registry-values.yaml \
  --registry-username '<username>' \
  --registry-password '<token>' \
  --yes
```

<Note>
  The same registry credentials used for Enterprise images authenticate pulls for the mirrored third-party images, since they share the same registry host.
</Note>

To mirror into your own registry instead, copy `helm/falkordb-enterprise/examples/mirror-registry-values.yaml` and replace `registry.falkordb.cloud/falkordb` throughout with your registry path, then run `scripts/mirror-images.sh` against it (or your own image-sync tooling) before installing.

## Installer-managed Secret

The installer can create or update a Docker registry Secret in the FalkorDB Enterprise namespace and wire it into the Admin Server and Admin UI deployments.

```bash theme={null}
curl -fsSL https://raw.githubusercontent.com/FalkorDB/FalkorDB-Enterprise/refs/heads/main/scripts/install.sh | \
  GITEA_USERNAME='registry-username' \
  GITEA_TOKEN='registry-token' \
  bash -s -- \
    --namespace falkordb-system \
    --image-pull-secret falkordb-registry-pull-secret \
    --yes
```

Equivalent explicit flags, pointed at a different registry (for example GHCR):

```bash theme={null}
bash scripts/install.sh \
  --namespace falkordb-system \
  --image-pull-secret ghcr-pull-secret \
  --registry-server ghcr.io \
  --registry-username 'github-user-or-service-account' \
  --registry-password 'github-token-with-read-packages' \
  --yes
```

If credentials are provided and `--image-pull-secret` is omitted, the installer uses `falkordb-registry-pull-secret` against `registry.falkordb.cloud` by default. `GHCR_USERNAME`/`GHCR_TOKEN` remain supported as aliases for `GITEA_USERNAME`/`GITEA_TOKEN`.

## Existing Secret

If the Secret already exists, pass only its name:

```bash theme={null}
bash scripts/install.sh \
  --namespace falkordb-system \
  --image-pull-secret existing-pull-secret \
  --yes
```

The installer will reference the existing Secret without recreating it.

## Manual Helm values

If you install the chart manually, set image pull secrets for the Enterprise workloads:

```yaml theme={null}
adminServer:
  imagePullSecrets:
    - name: falkordb-registry-pull-secret

adminUi:
  imagePullSecrets:
    - name: falkordb-registry-pull-secret

# FalkorDB database pods run the private falkordb-enterprise image.
falkordb-addon:
  imagePullSecrets:
    - name: falkordb-registry-pull-secret
```

The Secret must exist in every namespace that hosts a FalkorDB cluster, not only the release namespace.

The Browser subchart has its own image settings. Configure those through the corresponding dependency values if that image is also private.

## Rotate credentials

Update the Secret in place:

```bash theme={null}
kubectl -n falkordb-system create secret docker-registry falkordb-registry-pull-secret \
  --docker-server=registry.falkordb.cloud \
  --docker-username='registry-username' \
  --docker-password='new-registry-token' \
  --dry-run=client -o yaml | kubectl apply -f -
```

Restart workloads if the current pods need to pull images immediately:

```bash theme={null}
kubectl -n falkordb-system rollout restart deployment -l app.kubernetes.io/component=admin-server
kubectl -n falkordb-system rollout restart deployment -l app.kubernetes.io/component=admin-ui
```