Certificates and encryption
Manage TLS certificates, client certificates, and internode encryption for Redis Software on Kubernetes.
| Redis Enterprise for Kubernetes |
|---|
Certificates and encryption use Kubernetes Secrets and cert-manager integration to provision, distribute, and rotate the TLS certificates that Redis Software relies on. The operator distributes referenced certificates across every cluster node.
How certificates work on Redis for Kubernetes
- Cluster certificates live in Kubernetes Secrets that the
RedisEnterpriseClusterspec references. The operator distributes them to every cluster node. - cert-manager can issue and rotate certificates automatically.
- Client certificates live in a Secret that the database references for mutual TLS authentication.
- Internode encryption is configured on the REC spec. The operator places the certificates on each node.
What's the same as Redis Software
The underlying certificate roles, requirements, and TLS behavior are unchanged. For concepts and reference details, see the existing Redis Software docs:
- Certificate roles and types — which certificate is used for what.
- Create certificates — certificate requirements (SAN, CN, validity).
- Update certificates — rotation considerations on Redis Software.
- Monitor certificates — certificate expiration alerts.
- Client certificate authentication — how the cluster validates client certificates.
- TLS protocols and ciphers — protocol and cipher selection.
- Enable TLS — TLS for management, replication, and client connections.
- Internode encryption — purpose and scope.
- PEM encryption — encrypted private keys.
What's different on Kubernetes
- You capture certificates in Kubernetes Secrets and reference them declaratively in the REC spec. The operator applies them to the cluster through the Redis Software REST API — the same way certificates are applied on Redis Software, cluster-wide rather than file-by-file on each node.
- cert-manager can issue and rotate certificates automatically, replacing manual rotation steps.
In this section
- Manage REC certificates — configure cluster TLS certificates.
- cert-manager integration — automate certificate issuance and rotation with cert-manager.
- Add client certificates — enable client certificate authentication for databases.
- Internode encryption — enable encryption between cluster nodes.