{
  "id": "configuration-secrets",
  "title": "Store configuration in Kubernetes Secrets",
  "url": "https://redis.io/docs/latest/operate/kubernetes/security/authentication/configuration-secrets/",
  "summary": "Store Redis Enterprise configuration items in Kubernetes Secrets for automatic updates and secure management.",
  "tags": [
    "docs",
    "operate",
    "kubernetes"
  ],
  "last_updated": "2026-07-24T10:52:10-07:00",
  "page_type": "content",
  "content_hash": "18d6fd2613edf6fc6da03ea6cefe042106b9988dd6f7f53dccd0f74e48d6e43a",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "You can store Redis Enterprise configuration items in Kubernetes Secrets for automatic updates and secure management. When you update these Secrets, the operator immediately reads the changes and propagates them to the Redis Enterprise Cluster (REC)."
    },
    {
      "id": "license-configuration",
      "title": "License configuration",
      "role": "content",
      "text": "Redis Enterprise clusters require a valid license. You can apply licenses using Kubernetes Secrets (recommended) or embed them directly in the cluster specification."
    },
    {
      "id": "determine-your-cluster-fqdn",
      "title": "Determine your cluster FQDN",
      "role": "content",
      "text": "To configure licensing, you need your Redis Enterprise cluster's fully qualified domain name (FQDN). Use this format: `<REC-name>.<namespace>.svc.cluster.local`\n\nFor example: `my-rec.my-ns.svc.cluster.local`"
    },
    {
      "id": "use-a-kubernetes-secret-recommended",
      "title": "Use a Kubernetes Secret (recommended)",
      "role": "content",
      "text": "1. Create a secret from your license file:\n\n    [code example]\n\n2. Add the secret reference to your REC specification:\n\n    [code example]"
    },
    {
      "id": "embed-license-directly-in-rec-specification",
      "title": "Embed license directly in REC specification",
      "role": "content",
      "text": "Alternatively, you can embed the license directly in the REC YAML:\n\n[code example]\n\n\nYou must include the pipe symbol (`|`) after `license:` and maintain proper indentation."
    },
    {
      "id": "cluster-credential-configuration",
      "title": "Cluster credential configuration",
      "role": "content",
      "text": "Redis Enterprise clusters require admin credentials for the operator to manage the cluster. You can configure these credentials using Kubernetes Secrets."
    },
    {
      "id": "default-behavior",
      "title": "Default behavior",
      "role": "content",
      "text": "By default, the operator automatically creates a secret with a random username and auto-generated password during cluster creation. The secret name defaults to the cluster name."
    },
    {
      "id": "customize-the-credential-secret",
      "title": "Customize the credential secret",
      "role": "content",
      "text": "You can customize the credential secret name during cluster creation using the `clusterCredentialSecretName` field in your REC specification. The secret must contain `username` and `password` fields.\n\n\nThe `clusterCredentialSecretName` field cannot be changed after cluster creation.\n\n\nFor detailed instructions, see [Customize the credential secret name](https://redis.io/docs/latest/operate/kubernetes/security/authentication/manage-rec-credentials#customize-the-credential-secret-name)."
    },
    {
      "id": "tls-certificate-configuration",
      "title": "TLS certificate configuration",
      "role": "content",
      "text": "You can store TLS certificates in Kubernetes Secrets to secure communication between clients and Redis Enterprise databases."
    },
    {
      "id": "client-certificates-for-mtls",
      "title": "Client certificates for mTLS",
      "role": "content",
      "text": "1. Create a secret with your client certificate:\n\n    [code example]\n\n2. Add the secret to your REDB using the `clientAuthenticationCertificates` property. See [Add client certificates](https://redis.io/docs/latest/operate/kubernetes/security/certificates/add-client-certificates) for details."
    },
    {
      "id": "service-certificates",
      "title": "Service certificates",
      "role": "content",
      "text": "To configure certificates for proxy, API, or other services, create secrets with certificate and key files:\n\n[code example]"
    },
    {
      "id": "internode-encryption-certificates",
      "title": "Internode encryption certificates",
      "role": "content",
      "text": "You can provide custom certificates for control plane and data plane internode encryption. Create separate secrets for each encryption type:\n\n[code example]\n\n[code example]\n\nReference these secrets in your REC specification under `spec.certificates`. See [Internode encryption](https://redis.io/docs/latest/operate/kubernetes/security/certificates/internode-encryption) for complete configuration details."
    },
    {
      "id": "secrets-and-pem-files-in-redis-enterprise-pods",
      "title": "Secrets and PEM files in Redis Enterprise pods",
      "role": "content",
      "text": "Redis Enterprise pods use Kubernetes Secrets and PEM-encoded certificates and keys for cluster formation, node identity, encrypted communication, and automated recovery. Their presence is expected — not a sign of compromise.\n\nYou create the Secrets. The operator references them and manages their lifecycle (for example, when you rename the credential Secret). TLS, license, and client authentication Secrets are always user-supplied."
    },
    {
      "id": "what-you-ll-see-in-the-pod",
      "title": "What you'll see in the pod",
      "role": "content",
      "text": "- **Mounted Secret volumes** at operator-managed paths such as:\n  - `/opt/redislabs/credentials` — cluster admin credential Secret.\n  - `/opt/redislabs/proxy` — call-home proxy credentials, when configured.\n- **PEM-encoded certificates and keys** for TLS, internode encryption, and proxy or database endpoints. The operator applies these certificates through the cluster's REST API rather than as Secret volume mounts, and Redis Enterprise writes them to the pod filesystem. Exact paths vary by version and component."
    },
    {
      "id": "what-the-secrets-contain",
      "title": "What the Secrets contain",
      "role": "content",
      "text": "Field names vary by deployment.\n\n- **Cluster admin credentials** — `username` and `password` in the Secret named by `clusterCredentialSecretName`.\n- **License** — `license` field in the Secret named by `licenseSecretName`.\n- **Cluster Certificate Authority (CA)** — `ca.crt` or `ca.pem`. Validates peer certificates for mutual TLS. Optional.\n- **Service TLS certificates and keys** for API, Cluster Manager (CM), metrics exporter, proxy, syncer, and LDAP. Fields: `certificate`, `cert`, or `tls.crt`, plus `key` or `tls.key`. See [Service certificates](#service-certificates).\n- **Client authentication certificates** for databases. Set in the Redis Enterprise database (REDB) `clientAuthenticationCertificates` field."
    },
    {
      "id": "best-practices",
      "title": "Best practices",
      "role": "content",
      "text": "- Store sensitive configuration in Secrets rather than directly in YAML files.\n- Use `--from-file` to avoid manual base64 encoding.\n- Create secrets in the same namespace as your REC or REDB resources.\n- Use descriptive secret names for easy identification.\n- Regularly rotate certificates and update secrets."
    },
    {
      "id": "see-also",
      "title": "See also",
      "role": "related",
      "text": "- [Manage REC credentials](https://redis.io/docs/latest/operate/kubernetes/security/authentication/manage-rec-credentials)\n- [Manage REC certificates](https://redis.io/docs/latest/operate/kubernetes/security/certificates/manage-rec-certificates)\n- [Add client certificates](https://redis.io/docs/latest/operate/kubernetes/security/certificates/add-client-certificates)\n- [Redis Enterprise Cluster API reference](https://redis.io/docs/latest/operate/kubernetes/reference/api/redis_enterprise_cluster_api)"
    }
  ],
  "examples": [
    {
      "id": "use-a-kubernetes-secret-recommended-ex0",
      "language": "sh",
      "code": "kubectl -n <namespace> create secret generic rec-license --from-file=license=./license.txt",
      "section_id": "use-a-kubernetes-secret-recommended"
    },
    {
      "id": "use-a-kubernetes-secret-recommended-ex1",
      "language": "yaml",
      "code": "spec:\n      licenseSecretName: rec-license",
      "section_id": "use-a-kubernetes-secret-recommended"
    },
    {
      "id": "embed-license-directly-in-rec-specification-ex0",
      "language": "yaml",
      "code": "spec:\n  nodes: 3\n  license: |\n    ----- LICENSE START -----\n    eai14c/y6XNVykffDQSPUsHKcmpgOFUlmyTBDUEZEz+GLbXAgQFOmxcdbR9J\n    ...remaining license key content...\n    ----- LICENSE END -----",
      "section_id": "embed-license-directly-in-rec-specification"
    },
    {
      "id": "client-certificates-for-mtls-ex0",
      "language": "sh",
      "code": "kubectl -n <namespace> create secret generic client-cert-secret --from-file=cert=<path-to-cert>",
      "section_id": "client-certificates-for-mtls"
    },
    {
      "id": "service-certificates-ex0",
      "language": "sh",
      "code": "kubectl create secret generic <secret-name> \\\n  --from-file=certificate=</PATH/TO/certificate.pem> \\\n  --from-file=key=</PATH/TO/key.pem> \\\n  --from-literal=name=<proxy | api | cm | syncer | metrics_exporter>",
      "section_id": "service-certificates"
    },
    {
      "id": "internode-encryption-certificates-ex0",
      "language": "sh",
      "code": "kubectl create secret generic cp-internode-cert \\\n  --from-file=certificate=</path/to/cp-certificate.pem> \\\n  --from-file=key=</path/to/cp-key.pem> \\\n  --from-literal=name=cp_internode_encryption",
      "section_id": "internode-encryption-certificates"
    },
    {
      "id": "internode-encryption-certificates-ex1",
      "language": "sh",
      "code": "kubectl create secret generic dp-internode-cert \\\n  --from-file=certificate=</path/to/dp-certificate.pem> \\\n  --from-file=key=</path/to/dp-key.pem> \\\n  --from-literal=name=dp_internode_encryption",
      "section_id": "internode-encryption-certificates"
    }
  ]
}