> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enterprise.falkordb.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Production install

> Install FalkorDB Enterprise with managed secrets, private images, ingress, TLS, and persistence.

## Prerequisites

* Access to run `kubectl` commands in the cluster's context.
* At least 3 worker nodes with 4 CPU and 16 GB of memory each.
* Outbound access from the cluster to pull images: `registry.falkordb.cloud` (Enterprise images, credentials required), `docker.io`, `apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com`, `registry.k8s.io`, and `ghcr.io` — or `registry.falkordb.cloud` alone, since every image is also mirrored there (see [Private registries](/deployment/private-images)).

## Recommended inputs

Prepare these values before installing:

* Kubernetes context name.
* FalkorDB Enterprise namespace.
* KubeBlocks namespace.
* A stable 32+ character JWT secret.
* Image pull credentials if Enterprise images are private.
* Public Admin UI hostname.
* TLS-enabled ingress configuration.
* Storage class for Admin Server persistence if the cluster default is not suitable.

Only one FalkorDB Enterprise installation is supported per Kubernetes cluster. The Helm chart creates a cluster-scoped install lock named `falkordb-enterprise-install-lock` and blocks installs from any other release or namespace in the same cluster. Re-running or upgrading the owning release is allowed.

Generate a JWT secret:

```bash theme={null}
openssl rand -hex 32
```

## Production values file

Create a values file for environment-specific settings:

```yaml theme={null}
gateway:
  enabled: true
  ingress:
    enabled: true
    className: nginx
    hosts:
      - host: admin.example.com
    tls:
      - secretName: falkordb-enterprise-admin-tls
        hosts:
          - admin.example.com

adminServer:
  env:
    nodeEnv: production
    corsOrigin: https://admin.example.com
    cookieSecure: true
    enableSwagger: "false"
  persistence:
    enabled: true
    size: 8Gi
    storageClassName: ""
  bootstrap:
    adminUser:
      email: admin@example.com
      password: replace-with-a-temporary-password
      mustChangePassword: true

adminUi:
  env:
    viteApiUrl: ""
```

When `gateway.ingress.enabled=true`, the chart derives the Admin UI public URL from the first gateway ingress host. The Admin Server CORS origin defaults to that Admin UI public URL unless `adminServer.env.corsOrigin` is set.

## Install with explicit context and Secrets

```bash theme={null}
curl -fsSL https://raw.githubusercontent.com/FalkorDB/FalkorDB-Enterprise/refs/heads/main/scripts/install.sh | \
  JWT_SECRET='replace-with-64-hex-characters' bash -s -- \
    --kube-context production-cluster \
    --release falkordb-enterprise \
    --namespace falkordb-system \
    --kubeblocks-namespace kb-system \
    --values production-values.yaml \
    --yes
```

You can also pass the secret as a script argument:

```bash theme={null}
bash scripts/install.sh \
  --kube-context production-cluster \
  --namespace falkordb-system \
  --kubeblocks-namespace kb-system \
  --values production-values.yaml \
  --jwt-secret 'replace-with-64-hex-characters' \
  --yes
```

## Private images

If Admin Server or Admin UI images are private, configure an image pull Secret. See [Private registries](/deployment/private-images) for the complete flow.

## Browser encryption key

FalkorDB Browser is enabled by default. The chart includes a post-install/post-upgrade hook that ensures a 64-character hexadecimal `ENCRYPTION_KEY` exists for the Browser deployment and restarts the Browser when needed.

To provide your own key:

```yaml theme={null}
falkordb-browser:
  browser:
    encryption:
      key: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
```

To use an existing Secret:

```yaml theme={null}
falkordb-browser:
  browser:
    encryption:
      existingSecret:
        name: browser-encryption
        key: ENCRYPTION_KEY
```

## Enterprise license

<Tip>
  Leaving `adminServer.license` empty is a valid choice, not just a placeholder state: the admin server starts a 14-day free trial with no configured limits as soon as it comes up unlicensed. You do not need to pass a license through Helm at all — sign in to the Admin UI and activate or replace the license from the **License** page at any time, including after install. Helm-provided licenses below are for automating unattended installs.
</Tip>

The admin server can receive a signed Enterprise license from Helm. For production, create a Secret in the Enterprise namespace and reference it from chart values:

```bash theme={null}
kubectl -n falkordb-system create secret generic falkordb-enterprise-license \
  --from-literal=license='falkor.license.v1.<payload>.<signature>'
```

```yaml theme={null}
adminServer:
  license:
    existingSecret:
      name: falkordb-enterprise-license
      key: license
```

For development installs, you can set the license directly in values:

```yaml theme={null}
adminServer:
  license:
    value: "falkor.license.v1.<payload>.<signature>"
```

The chart exposes the license to the admin server as `FALKORDB_LICENSE` and persists validated license state at `/data/license-state.json` by default. Keep admin server persistence enabled so API-activated licenses and Helm-provided licenses survive pod restarts. If the license is expired, invalid, or any resource limit is exceeded, authenticated write operations are locked and the Admin UI becomes read-only until a valid license within limits is active.

Generated license keys include a signed payload with `version: 1`. The admin server currently accepts payload version `1`; future license payload formats should increment this field.

To bind the license to this Kubernetes cluster, generate it with the cluster ID from the UID of the `kube-system` namespace:

```bash theme={null}
kubectl get namespace kube-system -o jsonpath='{.metadata.uid}'
```

The signed payload field is `k8sClusterId`. The admin server compares it to `K8S_CLUSTER_ID` when set, otherwise to the `kube-system` namespace UID. Omit `k8sClusterId` for an unbound license.

## Post-install validation

```bash theme={null}
helm status falkordb-enterprise -n falkordb-system
kubectl get pods -n falkordb-system
kubectl get ingress -n falkordb-system
kubectl get secret -n falkordb-system -l 'app.kubernetes.io/component=admin-server'
```

Open the Admin UI URL, sign in with the bootstrap admin user, and change the temporary password if `mustChangePassword=true`.

## Production notes

* Do not use the default bootstrap password in shared environments.
* Prefer a values file over long `--set` command lines.
* Do not rely on `helm --reuse-values` for upgrades unless image tags are set explicitly.
* Leave `cookieSecure` enabled behind TLS.
* Keep Admin Server persistence enabled unless audit logs and local state are intentionally disposable.