Helm values - FalkorDB Enterprise

This page summarizes the high-impact Helm values for FalkorDB Enterprise.

The source of truth is helm/falkordb-enterprise/values.yaml. Verify against the chart version you are installing.

Platform dependencies

Value	Default	Purpose
`kubeblocks.enabled`	`true`	Enables embedded KubeBlocks subchart for standalone Helm use. The installer sets this to `false` because it manages KubeBlocks as a separate release.
`snapshot-controller.enabled`	`false`	Snapshot Controller subchart. The installer manages Snapshot Controller separately.
`volumeSnapshotClass.enabled`	`true`	Creates a `VolumeSnapshotClass` for CSI-backed storage. The default driver is `hostpath.csi.k8s.io` for local development when `csi-hostpath-driver.enabled=true`; production installs should set this to the CSI driver used by their storage class.
`csi-hostpath-driver.enabled`	`false`	Optional CSI hostpath driver for local development clusters that need volume snapshot backups. Existing `local-path` PVCs are not migrated; recreate clusters on the CSI storage class before using volume snapshots.
`falkordb-addon.enabled`	`true`	Installs the FalkorDB KubeBlocks addon as part of the Enterprise chart.
`falkordb-browser.enabled`	`true`	Installs FalkorDB Browser.
`csi-s3.enabled`	`false`	Optional S3 CSI driver dependency.
`csi-nfs.enabled`	`false`	Optional NFS CSI driver dependency.

When using scripts/install.sh, the installer detects the default StorageClass provisioner and configures snapshot values automatically:

CSI-backed cloud StorageClasses, such as ebs.csi.aws.com, pd.csi.storage.gke.io, and disk.csi.azure.com, get a matching chart-managed VolumeSnapshotClass unless a default one already exists for that driver.
Local non-CSI StorageClasses, such as rancher.io/local-path, enable the optional csi-hostpath-driver and make csi-hostpath-sc the default for new PVCs. Existing PVCs are not migrated.
Unknown or non-CSI provisioners disable the chart-managed VolumeSnapshotClass; pass --set volumeSnapshotClass.driver=<csi-driver> when the storage platform supports snapshots but cannot be detected.

Explicit --set and --set-string values passed to the installer override the detected snapshot configuration. On upgrades, the installer reuses existing Helm release values before applying new detected values. This preserves deployment-specific image tags, image pull secrets, ingress hosts, TLS settings, and immutable PVC settings while still adding the correct snapshot configuration. FalkorDB Enterprise is intentionally limited to one installation per Kubernetes cluster. The chart renders a fixed cluster-scoped ClusterRole install lock and also checks for an existing Helm-owned ClusterDefinition/falkordb from older chart versions. Upgrades of the owning Helm release are allowed; installs from a different release or namespace fail during Helm rendering.

Gateway and public URLs

Value	Default	Purpose
`gateway.enabled`	`true`	Enables shared gateway routing templates.
`gateway.ingress.enabled`	`false`	Creates public ingress routing when enabled.
`gateway.ingress.hosts[0].host`	`""`	Public hostname used to derive Admin UI URL and CORS defaults.
`gateway.routes.ui.path`	`/`	Admin UI route path.
`gateway.routes.api.path`	`/api`	Admin Server API route path.
`gateway.routes.openapi.path`	`/swagger.json`	OpenAPI route path.

Admin Server

Value	Default	Purpose
`adminServer.enabled`	`true`	Deploys Admin Server.
`adminServer.image.repository`	`falkordb/falkordb-enterprise-server`	Admin Server image repository.
`adminServer.image.tag`	`latest`	Admin Server image tag. Pin this for production.
`adminServer.secret.jwtSecret`	`""`	Required by chart rendering when `adminServer.secret.create=true`. The installer generates or reuses one. Must be at least 32 characters.
`adminServer.license.value`	`""`	Optional signed FalkorDB Enterprise license string. When set, the chart creates a dedicated Secret and the admin server activates it on startup. Prefer an existing Secret for production.
`adminServer.license.existingSecret.name`	`""`	Existing Secret name containing the signed license. Mutually exclusive with `adminServer.license.value`.
`adminServer.license.existingSecret.key`	`license`	Secret key that contains the signed license.
`adminServer.license.statePath`	`/data/license-state.json`	Persisted license state path. Keep under the admin server persistence mount so activated licenses survive pod restarts.
`adminServer.env.corsOrigin`	`""`	Overrides the derived Admin UI public URL for CORS.
`adminServer.env.cookieSecure`	`null`	Uses server default when unset. Set `true` for TLS production, `false` only for HTTP testing.
`adminServer.env.enableSwagger`	`"false"`	Enables Swagger/OpenAPI serving when set to `"true"`.
`adminServer.persistence.enabled`	`true`	Persists Admin Server data such as audit DB.
`adminServer.persistence.size`	`8Gi`	Admin Server PVC size.

Admin Server license

Leave adminServer.license unset to start on a 14-day free trial with no configured limits — no license value or Secret is required. Activate or replace the license later from the Admin UI’s License page; the values below only matter if you want to provide a license at install time.

Set a license directly in values for development or one-off installs:

adminServer:
	license:
		value: "falkor.license.v1.<payload>.<signature>"

For production, store the signed license in an existing Secret in the release namespace and reference it from values:

kubectl -n falkordb-system create secret generic falkordb-enterprise-license \
	--from-literal=license='falkor.license.v1.<payload>.<signature>'

adminServer:
	license:
		existingSecret:
			name: falkordb-enterprise-license
			key: license

The admin server reads the Secret through FALKORDB_LICENSE, validates the signature, and persists the license state at adminServer.license.statePath. If the license expires, is invalid, or any configured limit is exceeded, the server and UI enter read-only mode until a valid license within limits is active. The signed license key payload includes a version field so future payload formats can be introduced explicitly. The current supported payload version is 1. To bind a license to one Kubernetes cluster, include k8sClusterId in the signed payload. By default the admin server compares this value to the UID of the kube-system namespace. You can retrieve it with:

kubectl get namespace kube-system -o jsonpath='{.metadata.uid}'

If your environment needs a different cluster identity source, set K8S_CLUSTER_ID on the admin server and issue licenses with the same value. Licenses without k8sClusterId remain unbound.

{
	"version": 1,
	"licenseId": "lic_...",
	"accountName": "Example Corp",
	"k8sClusterId": "00000000-0000-0000-0000-000000000000",
	"issuedAt": "2026-05-28T00:00:00.000Z",
	"expiresAt": "2027-05-28T00:00:00.000Z",
	"limits": {
		"cpuCores": "unlimited",
		"memoryGB": "unlimited",
		"deployments": "unlimited",
		"users": "unlimited"
	}
}

Bootstrap Admin resources

Value	Default	Purpose
`adminServer.bootstrap.adminUser.create`	`true`	Creates a Kubernetes Secret-backed local admin user.
`adminServer.bootstrap.adminUser.email`	`admin@falkordb.local`	Bootstrap admin email.
`adminServer.bootstrap.adminUser.password`	`Test123!@#`	Bootstrap admin password used only if no password hash and no existing user Secret exist. Change for production.
`adminServer.bootstrap.adminUser.mustChangePassword`	`false`	Forces password change after first sign-in when true.
`adminServer.bootstrap.rbacConfig.create`	`false`	Seeds RBAC ConfigMap. Existing config is preserved with Helm keep annotation.
`adminServer.bootstrap.settingsConfig.create`	`false`	Seeds settings ConfigMap. Existing config is preserved with Helm keep annotation.

Admin UI

Value	Default	Purpose
`adminUi.enabled`	`true`	Deploys Admin UI.
`adminUi.image.repository`	`falkordb/falkordb-enterprise-ui`	Admin UI image repository.
`adminUi.image.tag`	`latest`	Admin UI image tag. Pin this for production.
`adminUi.env.viteApiUrl`	`""`	Public API origin. Defaults to relative routing through gateway behavior.
`adminUi.env.viteBrowserUrl`	`""`	Browser URL override. Defaults to the Browser ingress URL when configured.
`adminUi.env.viteMockApi`	`"false"`	Enables mock API mode. Keep false outside local UI demos.

Browser encryption

Value	Default	Purpose
`falkordb-browser.browser.encryption.key`	`""`	Optional 64-character hexadecimal Browser encryption key.
`falkordb-browser.browser.encryption.existingSecret.name`	`""`	Use an existing Secret instead of chart-generated key management.
`browserEncryptionKey.enabled`	`true`	Runs a hook Job to ensure Browser encryption key Secret exists and restarts Browser.

Observability

Value	Default	Purpose
`podMonitor.enabled`	`false`	Creates PodMonitor for Admin Server.
`alertRules.enabled`	`false`	Creates PrometheusRule resources.
`grafanaDashboards.enabled`	`false`	Creates Grafana dashboard resources from configured dashboard values.

​Platform dependencies

​Gateway and public URLs

​Admin Server

​Admin Server license

​Bootstrap Admin resources

​Admin UI

​Browser encryption

​Observability

Platform dependencies

Gateway and public URLs

Admin Server

Admin Server license

Bootstrap Admin resources

Admin UI

Browser encryption

Observability