Security on Docs

Integrate cert-manager with Redis for Kubernetes

Mon, 01 Jan 0001 00:00:00 +0000

cert-manager is a Kubernetes add-on that automates the management and issuance of TLS certificates. The Redis operator integrates with cert-manager, so you can use automatically managed certificates for:

Redis Enterprise cluster (REC) components (API, CM, proxy, syncer, and others)
Database replication with TLS
LDAP client authentication
SSO/SAML certificates

Benefits of using cert-manager include:

Automatic certificate renewal: cert-manager handles certificate rotation before expiration.
Standardized management: Use the same certificate management approach across your Kubernetes infrastructure.
Multiple certificate authorities: Support for Let's Encrypt, private CAs, Vault, and more.
Automatic propagation: For Active-Active databases, certificate changes automatically sync across all participating clusters.

Warning:

The cert-manager integration uses Kubernetes secrets. It is not compatible with Vault-based secret management (when clusterCredentialSecretType: vault). See HashiCorp Vault integration for details.

Prerequisites

Kubernetes cluster with Redis Enterprise operator installed
cert-manager v1.19.0 or later installed

If cert-manager is not already installed, see the cert-manager installation documentation.

Manage Redis Enterprise cluster (REC) credentials

Mon, 01 Jan 0001 00:00:00 +0000

Redis Enterprise for Kubernetes uses a custom resource called RedisEnterpriseCluster to create a Redis Enterprise cluster (REC). During creation, it generates random credentials for the operator to use. The credentials are saved in a Kubernetes (K8s) secret. The secret name defaults to the cluster name and is specified by the clusterCredentialSecretName field in the REC specification.

Note:

This procedure is only supported for operator versions 6.0.20-12 and above.

Retrieve the current username and password

The credentials can be used to access the Redis Enterprise admin console or the API. Connectivity must be configured to the REC pods using an appropriate service (or port forwarding).

Enable SSO authentication

Mon, 01 Jan 0001 00:00:00 +0000

Redis Enterprise Software supports SAML 2.0 single sign-on (SSO) for the Cluster Manager UI with both IdP-initiated and SP-initiated authentication. User accounts are automatically created on first sign-in using just-in-time (JIT) provisioning.

IdP requirements

Your identity provider must support:

Manage Redis Enterprise cluster (REC) certificates

Mon, 01 Jan 0001 00:00:00 +0000

Redis Software for Kubernetes generates self-signed TLS certificates for each new cluster. You can replace any of those certificates with your own.

You can manage REC certificates in two ways:

Method 1: Manage certificates with the REC custom resource (recommended). Store each certificate in a Kubernetes secret and reference the secret from the REC custom resource. The operator applies the certificate and keeps the cluster in sync with the secret. Use this method whenever the certificate type is exposed in spec.certificates.
Method 2: Manage certificates with the Redis Software REST API. Call the cluster's REST API directly, bypassing the operator. Use this method only when you need to follow the Redis Software procedure for a cluster that does not define the certificate in spec.certificates. The operator overwrites changes made this way if the same certificate is also defined in the REC custom resource.

For the list of certificates and what each one encrypts, see the certificates table.

Add client certificates

Mon, 01 Jan 0001 00:00:00 +0000

For each client certificate you want to use with your database, you need to create a Kubernetes secret to hold it. You can then reference that secret in your Redis Enterprise database (REDB) custom resource spec.

Create a secret to hold the new certificate

Create the secret config file with the required fields shown below.

Enable LDAP authentication

Mon, 01 Jan 0001 00:00:00 +0000

LDAP support for Redis Enterprise Software

Redis Enterprise Software supports LDAP authentication and authorization through role-based access controls (RBAC). You can map LDAP groups to Redis Enterprise roles to control access to your database and the Cluster Manager UI. For more details on how LDAP works with Redis Enterprise, see LDAP authentication.

Store configuration in Kubernetes Secrets

Mon, 01 Jan 0001 00:00:00 +0000

You can store Redis Enterprise configuration items in Kubernetes Secrets for automatic updates and secure management. When you update these Secrets, the operator immediately reads the changes and propagates them to the Redis Enterprise Cluster (REC).

License configuration

Redis Enterprise clusters require a valid license. You can apply licenses using Kubernetes Secrets (recommended) or embed them directly in the cluster specification.

Integrate HashiCorp Vault with Redis Enterprise for Kubernetes

Mon, 01 Jan 0001 00:00:00 +0000

You can configure HashiCorp Vault as the centralized secret management system for the Redis Enterprise Kubernetes operator, replacing the default Kubernetes secrets. This integration provides enhanced security, centralized secret management, and advanced features like secret rotation and audit logging.

What secrets are managed by Vault?

When Vault integration is enabled, all secrets referenced in Redis Enterprise custom resources are retrieved from Vault instead of Kubernetes secrets, including:

Allow automatic resource adjustment

Mon, 01 Jan 0001 00:00:00 +0000

Redis Enterprise for Kubernetes 7.22.0-6 introduces the ability to run with automatic resource adjustment disabled, which drops all capabilities from the Redis Enterprise container and sets allowPrivilegeEscalation to false. All other security-related settings remain the same as in automatic resource adjustment enabled. Automatic resource adjustment disabled is the default for installations and upgrades of the Redis Enterprise operator for versions 7.22.0-6 and later.

Default behavior

Automatic resource adjustment is disabled by default for installations and upgrades of the Redis Enterprise operator for versions 7.22.0-6 and later. This default behavior is in effect if REC spec has allowAutoAdjustment set to false or removed.

Enable internode encryption

Mon, 01 Jan 0001 00:00:00 +0000

Internode encryption provides added security by encrypting communication between nodes in your Redis Enterprise cluster (REC).

Enable internode encryption

Enable internode encryption in the spec section of your REC custom resource file.