Security on Docs

Manage Redis Enterprise cluster (REC) credentials

Mon, 01 Jan 0001 00:00:00 +0000

Redis Enterprise for Kubernetes uses a custom resource called RedisEnterpriseCluster to create a Redis Enterprise cluster (REC). During creation, it generates random credentials for the operator to use. The credentials are saved in a Kubernetes (K8s) secret. The secret name defaults to the cluster name and is specified by the clusterCredentialSecretName field in the REC specification.

Note:

This procedure is only supported for operator versions 6.0.20-12 and above.

Retrieve the current username and password

The credentials can be used to access the Redis Enterprise admin console or the API. Connectivity must be configured to the REC pods using an appropriate service (or port forwarding).

Enable SSO authentication

Mon, 01 Jan 0001 00:00:00 +0000

Redis Enterprise Software supports SAML 2.0 single sign-on (SSO) for the Cluster Manager UI with both IdP-initiated and SP-initiated authentication. User accounts are automatically created on first sign-in using just-in-time (JIT) provisioning.

IdP requirements

Your identity provider must support:

Manage Redis Enterprise cluster (REC) certificates

Mon, 01 Jan 0001 00:00:00 +0000

By default, Redis Enterprise Software for Kubernetes generates TLS certificates for the cluster during creation. These self-signed certificates are generated on the first node of each Redis Enterprise cluster (REC) and are copied to all other nodes added to the cluster. For the list of of certificates used by Redis Enterprise Software and the traffic they encrypt, see the certificates table.

To install and use your own certificates with Kubernetes on your Redis Enterprise cluster, they need to be stored in secrets. The REC custom resource also needs to be configured with those secret names to read and use the certificates.

Add client certificates

Mon, 01 Jan 0001 00:00:00 +0000

For each client certificate you want to use with your database, you need to create a Kubernetes secret to hold it. You can then reference that secret in your Redis Enterprise database (REDB) custom resource spec.

Create a secret to hold the new certificate

Create the secret config file with the required fields shown below.

Enable LDAP authentication

Mon, 01 Jan 0001 00:00:00 +0000

LDAP support for Redis Enterprise Software

Redis Enterprise Software supports LDAP authentication and authorization through role-based access controls (RBAC). You can map LDAP groups to Redis Enterprise roles to control access to your database and the Cluster Manager UI. For more details on how LDAP works with Redis Enterprise, see LDAP authentication.

Store configuration in Kubernetes Secrets

Mon, 01 Jan 0001 00:00:00 +0000

You can store Redis Enterprise configuration items in Kubernetes Secrets for automatic updates and secure management. When you update these Secrets, the operator immediately reads the changes and propagates them to the Redis Enterprise Cluster (REC).

License configuration

Redis Enterprise clusters require a valid license. You can apply licenses using Kubernetes Secrets (recommended) or embed them directly in the cluster specification.

Integrate HashiCorp Vault with Redis Enterprise for Kubernetes

Mon, 01 Jan 0001 00:00:00 +0000

You can configure HashiCorp Vault as the centralized secret management system for the Redis Enterprise Kubernetes operator, replacing the default Kubernetes secrets. This integration provides enhanced security, centralized secret management, and advanced features like secret rotation and audit logging.

What secrets are managed by Vault?

When Vault integration is enabled, all secrets referenced in Redis Enterprise custom resources are retrieved from Vault instead of Kubernetes secrets, including:

Allow automatic resource adjustment

Mon, 01 Jan 0001 00:00:00 +0000

Redis Enterprise for Kubernetes 7.22.0-6 introduces the ability to run with automatic resource adjustment disabled, which drops all capabilities from the Redis Enterprise container and sets allowPrivilegeEscalation to false. All other security-related settings remain the same as in automatic resource adjustment enabled. Automatic resource adjustment disabled is the default for installations and upgrades of the Redis Enterprise operator for versions 7.22.0-6 and later.

Default behavior

Automatic resource adjustment is disabled by default for installations and upgrades of the Redis Enterprise operator for versions 7.22.0-6 and later. This default behavior is in effect if REC spec has allowAutoAdjustment set to false or removed.

Enable internode encryption

Mon, 01 Jan 0001 00:00:00 +0000

Internode encryption provides added security by encrypting communication between nodes in your Redis Enterprise cluster (REC).

Enable internode encryption

Enable internode encryption in the spec section of your REC custom resource file.