> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enterprise.falkordb.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Helm values

> High-impact Helm values for the FalkorDB Enterprise chart, verified against the chart defaults.

This page summarizes the high-impact Helm values for FalkorDB Enterprise.

<Info>
  The source of truth is [helm/falkordb-enterprise/values.yaml](https://github.com/FalkorDB/FalkorDB-Enterprise/blob/main/helm/falkordb-enterprise/values.yaml). Verify against the chart version you are installing.
</Info>

## Platform dependencies

| Value                         | Default | Purpose                                                                                                                                                                                                                                               |
| ----------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `kubeblocks.enabled`          | `true`  | Enables embedded KubeBlocks subchart for standalone Helm use. The installer sets this to `false` because it manages KubeBlocks as a separate release.                                                                                                 |
| `snapshot-controller.enabled` | `false` | Snapshot Controller subchart. The installer manages Snapshot Controller separately.                                                                                                                                                                   |
| `volumeSnapshotClass.enabled` | `true`  | Creates a `VolumeSnapshotClass` for CSI-backed storage. The default driver is `hostpath.csi.k8s.io` for local development when `csi-hostpath-driver.enabled=true`; production installs should set this to the CSI driver used by their storage class. |
| `csi-hostpath-driver.enabled` | `false` | Optional CSI hostpath driver for local development clusters that need volume snapshot backups. Existing `local-path` PVCs are not migrated; recreate clusters on the CSI storage class before using volume snapshots.                                 |
| `falkordb-addon.enabled`      | `true`  | Installs the FalkorDB KubeBlocks addon as part of the Enterprise chart.                                                                                                                                                                               |
| `falkordb-browser.enabled`    | `true`  | Installs FalkorDB Browser.                                                                                                                                                                                                                            |
| `csi-s3.enabled`              | `false` | Optional S3 CSI driver dependency.                                                                                                                                                                                                                    |
| `csi-nfs.enabled`             | `false` | Optional NFS CSI driver dependency.                                                                                                                                                                                                                   |

When using `scripts/install.sh`, the installer detects the default StorageClass provisioner and configures snapshot values automatically:

* CSI-backed cloud StorageClasses, such as `ebs.csi.aws.com`, `pd.csi.storage.gke.io`, and `disk.csi.azure.com`, get a matching chart-managed `VolumeSnapshotClass` unless a default one already exists for that driver.
* Local non-CSI StorageClasses, such as `rancher.io/local-path`, enable the optional `csi-hostpath-driver` and make `csi-hostpath-sc` the default for new PVCs. Existing PVCs are not migrated.
* Unknown or non-CSI provisioners disable the chart-managed `VolumeSnapshotClass`; pass `--set volumeSnapshotClass.driver=<csi-driver>` when the storage platform supports snapshots but cannot be detected.

Explicit `--set` and `--set-string` values passed to the installer override the detected snapshot configuration.

On upgrades, the installer reuses existing Helm release values before applying new detected values. This preserves deployment-specific image tags, image pull secrets, ingress hosts, TLS settings, and immutable PVC settings while still adding the correct snapshot configuration.

FalkorDB Enterprise is intentionally limited to one installation per Kubernetes cluster. The chart renders a fixed cluster-scoped ClusterRole install lock and also checks for an existing Helm-owned `ClusterDefinition/falkordb` from older chart versions. Upgrades of the owning Helm release are allowed; installs from a different release or namespace fail during Helm rendering.

## Gateway and public URLs

| Value                           | Default         | Purpose                                                        |
| ------------------------------- | --------------- | -------------------------------------------------------------- |
| `gateway.enabled`               | `true`          | Enables shared gateway routing templates.                      |
| `gateway.ingress.enabled`       | `false`         | Creates public ingress routing when enabled.                   |
| `gateway.ingress.hosts[0].host` | `""`            | Public hostname used to derive Admin UI URL and CORS defaults. |
| `gateway.routes.ui.path`        | `/`             | Admin UI route path.                                           |
| `gateway.routes.api.path`       | `/api`          | Admin Server API route path.                                   |
| `gateway.routes.openapi.path`   | `/swagger.json` | OpenAPI route path.                                            |

## Admin Server

| Value                                     | Default                               | Purpose                                                                                                                                                                                    |
| ----------------------------------------- | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `adminServer.enabled`                     | `true`                                | Deploys Admin Server.                                                                                                                                                                      |
| `adminServer.image.repository`            | `falkordb/falkordb-enterprise-server` | Admin Server image repository.                                                                                                                                                             |
| `adminServer.image.tag`                   | `latest`                              | Admin Server image tag. Pin this for production.                                                                                                                                           |
| `adminServer.secret.jwtSecret`            | `""`                                  | Required by chart rendering when `adminServer.secret.create=true`. The installer generates or reuses one. Must be at least 32 characters.                                                  |
| `adminServer.license.value`               | `""`                                  | Optional signed FalkorDB Enterprise license string. When set, the chart creates a dedicated Secret and the admin server activates it on startup. Prefer an existing Secret for production. |
| `adminServer.license.existingSecret.name` | `""`                                  | Existing Secret name containing the signed license. Mutually exclusive with `adminServer.license.value`.                                                                                   |
| `adminServer.license.existingSecret.key`  | `license`                             | Secret key that contains the signed license.                                                                                                                                               |
| `adminServer.license.statePath`           | `/data/license-state.json`            | Persisted license state path. Keep under the admin server persistence mount so activated licenses survive pod restarts.                                                                    |
| `adminServer.env.corsOrigin`              | `""`                                  | Overrides the derived Admin UI public URL for CORS.                                                                                                                                        |
| `adminServer.env.cookieSecure`            | `null`                                | Uses server default when unset. Set `true` for TLS production, `false` only for HTTP testing.                                                                                              |
| `adminServer.env.enableSwagger`           | `"false"`                             | Enables Swagger/OpenAPI serving when set to `"true"`.                                                                                                                                      |
| `adminServer.persistence.enabled`         | `true`                                | Persists Admin Server data such as audit DB.                                                                                                                                               |
| `adminServer.persistence.size`            | `8Gi`                                 | Admin Server PVC size.                                                                                                                                                                     |

### Admin Server license

<Tip>
  Leave `adminServer.license` unset to start on a 14-day free trial with no configured limits — no license value or Secret is required. Activate or replace the license later from the Admin UI's **License** page; the values below only matter if you want to provide a license at install time.
</Tip>

Set a license directly in values for development or one-off installs:

```yaml theme={null}
adminServer:
	license:
		value: "falkor.license.v1.<payload>.<signature>"
```

For production, store the signed license in an existing Secret in the release namespace and reference it from values:

```bash theme={null}
kubectl -n falkordb-system create secret generic falkordb-enterprise-license \
	--from-literal=license='falkor.license.v1.<payload>.<signature>'
```

```yaml theme={null}
adminServer:
	license:
		existingSecret:
			name: falkordb-enterprise-license
			key: license
```

The admin server reads the Secret through `FALKORDB_LICENSE`, validates the signature, and persists the license state at `adminServer.license.statePath`. If the license expires, is invalid, or any configured limit is exceeded, the server and UI enter read-only mode until a valid license within limits is active.

The signed license key payload includes a `version` field so future payload formats can be introduced explicitly. The current supported payload version is `1`.

To bind a license to one Kubernetes cluster, include `k8sClusterId` in the signed payload. By default the admin server compares this value to the UID of the `kube-system` namespace. You can retrieve it with:

```bash theme={null}
kubectl get namespace kube-system -o jsonpath='{.metadata.uid}'
```

If your environment needs a different cluster identity source, set `K8S_CLUSTER_ID` on the admin server and issue licenses with the same value. Licenses without `k8sClusterId` remain unbound.

```json theme={null}
{
	"version": 1,
	"licenseId": "lic_...",
	"accountName": "Example Corp",
	"k8sClusterId": "00000000-0000-0000-0000-000000000000",
	"issuedAt": "2026-05-28T00:00:00.000Z",
	"expiresAt": "2027-05-28T00:00:00.000Z",
	"limits": {
		"cpuCores": "unlimited",
		"memoryGB": "unlimited",
		"deployments": "unlimited",
		"users": "unlimited"
	}
}
```

## Bootstrap Admin resources

| Value                                                | Default                | Purpose                                                                                                          |
| ---------------------------------------------------- | ---------------------- | ---------------------------------------------------------------------------------------------------------------- |
| `adminServer.bootstrap.adminUser.create`             | `true`                 | Creates a Kubernetes Secret-backed local admin user.                                                             |
| `adminServer.bootstrap.adminUser.email`              | `admin@falkordb.local` | Bootstrap admin email.                                                                                           |
| `adminServer.bootstrap.adminUser.password`           | `Test123!@#`           | Bootstrap admin password used only if no password hash and no existing user Secret exist. Change for production. |
| `adminServer.bootstrap.adminUser.mustChangePassword` | `false`                | Forces password change after first sign-in when true.                                                            |
| `adminServer.bootstrap.rbacConfig.create`            | `false`                | Seeds RBAC ConfigMap. Existing config is preserved with Helm keep annotation.                                    |
| `adminServer.bootstrap.settingsConfig.create`        | `false`                | Seeds settings ConfigMap. Existing config is preserved with Helm keep annotation.                                |

## Admin UI

| Value                        | Default                           | Purpose                                                                    |
| ---------------------------- | --------------------------------- | -------------------------------------------------------------------------- |
| `adminUi.enabled`            | `true`                            | Deploys Admin UI.                                                          |
| `adminUi.image.repository`   | `falkordb/falkordb-enterprise-ui` | Admin UI image repository.                                                 |
| `adminUi.image.tag`          | `latest`                          | Admin UI image tag. Pin this for production.                               |
| `adminUi.env.viteApiUrl`     | `""`                              | Public API origin. Defaults to relative routing through gateway behavior.  |
| `adminUi.env.viteBrowserUrl` | `""`                              | Browser URL override. Defaults to the Browser ingress URL when configured. |
| `adminUi.env.viteMockApi`    | `"false"`                         | Enables mock API mode. Keep false outside local UI demos.                  |

## Browser encryption

| Value                                                     | Default | Purpose                                                                              |
| --------------------------------------------------------- | ------- | ------------------------------------------------------------------------------------ |
| `falkordb-browser.browser.encryption.key`                 | `""`    | Optional 64-character hexadecimal Browser encryption key.                            |
| `falkordb-browser.browser.encryption.existingSecret.name` | `""`    | Use an existing Secret instead of chart-generated key management.                    |
| `browserEncryptionKey.enabled`                            | `true`  | Runs a hook Job to ensure Browser encryption key Secret exists and restarts Browser. |

## Observability

| Value                       | Default | Purpose                                                               |
| --------------------------- | ------- | --------------------------------------------------------------------- |
| `podMonitor.enabled`        | `false` | Creates PodMonitor for Admin Server.                                  |
| `alertRules.enabled`        | `false` | Creates PrometheusRule resources.                                     |
| `grafanaDashboards.enabled` | `false` | Creates Grafana dashboard resources from configured dashboard values. |