Production install

Prerequisites

Access to run kubectl commands in the cluster’s context.
At least 3 worker nodes with 4 CPU and 16 GB of memory each.
Outbound access from the cluster to pull images: registry.falkordb.cloud (Enterprise images, credentials required), docker.io, apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com, registry.k8s.io, and ghcr.io — or registry.falkordb.cloud alone, since every image is also mirrored there (see Private registries).

Recommended inputs

Prepare these values before installing:

Kubernetes context name.
FalkorDB Enterprise namespace.
KubeBlocks namespace.
A stable 32+ character JWT secret.
Image pull credentials if Enterprise images are private.
Public Admin UI hostname.
TLS-enabled ingress configuration.
Storage class for Admin Server persistence if the cluster default is not suitable.

Only one FalkorDB Enterprise installation is supported per Kubernetes cluster. The Helm chart creates a cluster-scoped install lock named falkordb-enterprise-install-lock and blocks installs from any other release or namespace in the same cluster. Re-running or upgrading the owning release is allowed. Generate a JWT secret:

openssl rand -hex 32

Production values file

Create a values file for environment-specific settings:

gateway:
  enabled: true
  ingress:
    enabled: true
    className: nginx
    hosts:
      - host: admin.example.com
    tls:
      - secretName: falkordb-enterprise-admin-tls
        hosts:
          - admin.example.com

adminServer:
  env:
    nodeEnv: production
    corsOrigin: https://admin.example.com
    cookieSecure: true
    enableSwagger: "false"
  persistence:
    enabled: true
    size: 8Gi
    storageClassName: ""
  bootstrap:
    adminUser:
      email: admin@example.com
      password: replace-with-a-temporary-password
      mustChangePassword: true

adminUi:
  env:
    viteApiUrl: ""

When gateway.ingress.enabled=true, the chart derives the Admin UI public URL from the first gateway ingress host. The Admin Server CORS origin defaults to that Admin UI public URL unless adminServer.env.corsOrigin is set.

Install with explicit context and Secrets

curl -fsSL https://raw.githubusercontent.com/FalkorDB/FalkorDB-Enterprise/refs/heads/main/scripts/install.sh | \
  JWT_SECRET='replace-with-64-hex-characters' bash -s -- \
    --kube-context production-cluster \
    --release falkordb-enterprise \
    --namespace falkordb-system \
    --kubeblocks-namespace kb-system \
    --values production-values.yaml \
    --yes

You can also pass the secret as a script argument:

bash scripts/install.sh \
  --kube-context production-cluster \
  --namespace falkordb-system \
  --kubeblocks-namespace kb-system \
  --values production-values.yaml \
  --jwt-secret 'replace-with-64-hex-characters' \
  --yes

Private images

If Admin Server or Admin UI images are private, configure an image pull Secret. See Private registries for the complete flow.

Browser encryption key

FalkorDB Browser is enabled by default. The chart includes a post-install/post-upgrade hook that ensures a 64-character hexadecimal ENCRYPTION_KEY exists for the Browser deployment and restarts the Browser when needed. To provide your own key:

falkordb-browser:
  browser:
    encryption:
      key: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"

To use an existing Secret:

falkordb-browser:
  browser:
    encryption:
      existingSecret:
        name: browser-encryption
        key: ENCRYPTION_KEY

Enterprise license

Leaving adminServer.license empty is a valid choice, not just a placeholder state: the admin server starts a 14-day free trial with no configured limits as soon as it comes up unlicensed. You do not need to pass a license through Helm at all — sign in to the Admin UI and activate or replace the license from the License page at any time, including after install. Helm-provided licenses below are for automating unattended installs.

The admin server can receive a signed Enterprise license from Helm. For production, create a Secret in the Enterprise namespace and reference it from chart values:

kubectl -n falkordb-system create secret generic falkordb-enterprise-license \
  --from-literal=license='falkor.license.v1.<payload>.<signature>'

adminServer:
  license:
    existingSecret:
      name: falkordb-enterprise-license
      key: license

For development installs, you can set the license directly in values:

adminServer:
  license:
    value: "falkor.license.v1.<payload>.<signature>"

The chart exposes the license to the admin server as FALKORDB_LICENSE and persists validated license state at /data/license-state.json by default. Keep admin server persistence enabled so API-activated licenses and Helm-provided licenses survive pod restarts. If the license is expired, invalid, or any resource limit is exceeded, authenticated write operations are locked and the Admin UI becomes read-only until a valid license within limits is active. Generated license keys include a signed payload with version: 1. The admin server currently accepts payload version 1; future license payload formats should increment this field. To bind the license to this Kubernetes cluster, generate it with the cluster ID from the UID of the kube-system namespace:

kubectl get namespace kube-system -o jsonpath='{.metadata.uid}'

The signed payload field is k8sClusterId. The admin server compares it to K8S_CLUSTER_ID when set, otherwise to the kube-system namespace UID. Omit k8sClusterId for an unbound license.

Post-install validation

helm status falkordb-enterprise -n falkordb-system
kubectl get pods -n falkordb-system
kubectl get ingress -n falkordb-system
kubectl get secret -n falkordb-system -l 'app.kubernetes.io/component=admin-server'

Open the Admin UI URL, sign in with the bootstrap admin user, and change the temporary password if mustChangePassword=true.

Production notes

Do not use the default bootstrap password in shared environments.
Prefer a values file over long --set command lines.
Do not rely on helm --reuse-values for upgrades unless image tags are set explicitly.
Leave cookieSecure enabled behind TLS.
Keep Admin Server persistence enabled unless audit logs and local state are intentionally disposable.

Get started

Install

Authentication

Deploy databases

Operations

Upgrade and uninstall

Troubleshooting

Prerequisites

Recommended inputs

Production values file

Install with explicit context and Secrets

Private images

Browser encryption key

Enterprise license

Post-install validation

Production notes

​Prerequisites

​Recommended inputs

​Production values file

​Install with explicit context and Secrets

​Private images

​Browser encryption key

​Enterprise license

​Post-install validation

​Production notes

Prerequisites

Recommended inputs

Production values file

Install with explicit context and Secrets

Private images

Browser encryption key

Enterprise license

Post-install validation

Production notes