{
  "id": "cluster",
  "title": "Cluster object",
  "url": "https://redis.io/docs/latest/operate/rs/8.0/references/rest-api/objects/cluster/",
  "summary": "An object that represents a cluster",
  "content": "\nAn API object that represents the cluster.\n\n| Name | Type/Value | Description |\n|------|------------|-------------|\n| alert_settings | [alert_settings](https://redis.io/docs/latest/operate/rs/references/rest-api/objects/cluster/alert_settings) object | Cluster and node alert settings |\n| \u003cspan class=\"break-all\"\u003eavailability_lag_tolerance_ms\u003c/span\u003e | integer (default: 100) | The maximum replication lag in milliseconds tolerated between source and replicas during [lag-aware database availability checks](https://redis.io/docs/latest/operate/rs/monitoring/db-availability#lag-aware). |\n| bigstore_driver | \"speedb\"\u003cbr /\u003e\"rocksdb\" | Storage engine for [Redis Flex or Auto Tiering](https://redis.io/docs/latest/operate/rs/databases/flash) |\n| \u003cspan class=\"break-all\"\u003ecluster_ssh_public_key\u003c/span\u003e | string | Cluster's autogenerated SSH public key |\n|  client_maint_notifications | boolean (default: false) | Toggles sending client maintenance notifications about shard movements |\n| cm_port | integer, (range: 1024-65535) | UI HTTPS listening port |\n| \u003cspan class=\"break-all\"\u003ecm_session_timeout_minutes\u003c/span\u003e | integer (default: 15) | The timeout (in minutes) for the session to the CM |\n| \u003cspan class=\"break-all\"\u003ecnm_http_max_threads_per_worker\u003c/span\u003e | integer (default: 10) | Maximum number of threads per worker in the `cnm_http` service (deprecated) |\n| cnm_http_port | integer, (range: 1024-65535) | API HTTP listening port |\n| cnm_http_workers | integer (default: 1) | Number of workers in the `cnm_http` service |\n| cnm_https_port | integer, (range: 1024-65535) | API HTTPS listening port |\n| control_cipher_suites | string | Specifies the enabled ciphers for the control plane. The ciphers are specified in the format understood by the BoringSSL library. |\n| \u003cspan class=\"break-all\"\u003econtrol_cipher_suites_tls_1_3\u003c/span\u003e | string | Specifies the enabled TLS 1.3 ciphers for the control plane. The ciphers are specified in the format understood by the BoringSSL library. (read-only) |\n| crdb_coordinator_port | integer, (range: 1024-65535) (default: 9081) | CRDB coordinator port |\n| \u003cspan class=\"break-all\"\u003ecrdt_rest_client_retries\u003c/span\u003e | integer | Maximum number of retries for the REST client used by the Active-Active management API |\n| \u003cspan class=\"break-all\"\u003ecrdt_rest_client_timeout\u003c/span\u003e | integer | Timeout for REST client used by the Active-Active management API |\n| \u003cspan class=\"break-all\"\u003ecrdt_supported_featureset_version\u003c/span\u003e | integer | CRDB supported featureset version (read-only) |\n| \u003cspan class=\"break-all\"\u003ecrdt_supported_featureset_version_map\u003c/span\u003e | object | CRDB supported featureset version mapping by Redis version (read-only) |\n| \u003cspan class=\"break-all\"\u003ecrdt_supported_module_featureset_version_map\u003c/span\u003e | object | Mapping of module names to per-module-semantic-version supported CRDB featureset versions (read-only) |\n| \u003cspan class=\"break-all\"\u003ecrdt_supported_protocol_versions\u003c/span\u003e | array of strings | CRDB supported protocol versions (read-only) |\n| \u003cspan class=\"break-all\"\u003ecrdt_supported_protocol_versions_map\u003c/span\u003e | object | CRDB supported protocol versions mapping by Redis version (read-only) |\n| created_time | string | Cluster creation date (read-only) |\n| data_cipher_list | string | Specifies the enabled ciphers for the data plane. The ciphers are specified in the format understood by the OpenSSL library. |\n| \u003cspan class=\"break-all\"\u003edata_cipher_suites_tls_1_3\u003c/span\u003e | string | Specifies the enabled TLS 1.3 ciphers for the data plane. |\n| debuginfo_path | string | Path to a local directory used when generating support packages |\n| \u003cspan class=\"break-all\"\u003edefault_non_sharded_proxy_policy\u003c/span\u003e | string (default: single) | Default proxy_policy for newly created non-sharded databases' endpoints (read-only) |\n| \u003cspan class=\"break-all\"\u003edefault_sharded_proxy_policy\u003c/span\u003e | string (default: all-master-shards) | Default proxy_policy for newly created sharded databases' endpoints (read-only) |\n| \u003cspan class=\"break-all\"\u003edisconnect_clients_on_password_removal\u003c/span\u003e | \"enabled\"\u003cbr /\u003e\"disabled\"\u003cbr /\u003e**\"auto\"** | This flag controls whether client connections using removed, revoked, or rotated passwords are actively disconnected |\n| \u003cspan class=\"break-all\"\u003edmc_external_authentication\u003c/span\u003e | boolean (default: false) | Enable DMC to call the authentication_service for basic authentication |\n| \u003cspan class=\"break-all\"\u003edmc_external_cba_authentication\u003c/span\u003e | boolean (default: false) | Enable DMC to call the authentication_service for certificate-based authentication |\n| \u003cspan class=\"break-all\"\u003edmc_external_entraid_authentication\u003c/span\u003e | boolean (default: false) | Enable DMC to call the authentication_service for entraid authentication |\n| \u003cspan class=\"break-all\"\u003edmc_external_ldap_authentication\u003c/span\u003e | boolean (default: false) | Enable DMC to call the authentication_service for LDAP-based authentication |\n| email_alerts | boolean (default: false) | Send node/cluster email alerts (requires valid SMTP and email_from settings) |\n| email_from | string | Sender email for automated emails |\n| encrypt_pkeys | boolean (default: false) | Enable or turn off encryption of private keys |\n| envoy_admin_port | integer, (range: 1024-65535) | Envoy admin port. Changing this port during runtime might result in an empty response because envoy serves as the cluster gateway.|\n| \u003cspan class=\"break-all\"\u003eenvoy_max_downstream_connections\u003c/span\u003e | integer, (range: 100-2048) | The max downstream connections envoy is allowed to open |\n| \u003cspan class=\"break-all\"\u003eenvoy_mgmt_server_port\u003c/span\u003e | integer, (range: 1024-65535) | Envoy management server port|\n| \u003cspan class=\"break-all\"\u003egossip_envoy_admin_port\u003c/span\u003e | integer, (range: 1024-65535) | Gossip envoy admin port (deprecated; this port is no longer used because gossip functionality is handled by the main envoy process on `envoy_admin_port`) |\n| handle_redirects | boolean (default: false) | Handle API HTTPS requests and redirect to the master node internally |\n| http_support | boolean (default: false) | Enable or turn off HTTP support |\n| logrotate_settings | [logrotate_settings](https://redis.io/docs/latest/operate/rs/references/rest-api/objects/cluster/logrotate_settings) object | Settings for logrotate configuration |\n| mask_bdb_credentials | boolean (default: false) | If set to true, the BDB credentials will be masked in the BDB API responses |\n| metrics_auth | boolean (default: false) | If true, requires authentication for requests to the metrics exporter |\n| \u003cspan class=\"break-all\"\u003emin_control_TLS_version\u003c/span\u003e | \"1.2\"\u003cbr /\u003e\"1.3\" | The minimum version of TLS protocol which is supported at the control path |\n| min_data_TLS_version | \"1.2\"\u003cbr /\u003e\"1.3\" | The minimum version of TLS protocol which is supported at the data path |\n| \u003cspan class=\"break-all\"\u003emin_sentinel_TLS_version\u003c/span\u003e | \"1.2\"\u003cbr /\u003e\"1.3\" | The minimum version of TLS protocol which is supported at the data path |\n| \u003cspan class=\"break-all\"\u003emtls_authorized_subjects\u003c/span\u003e | array | [{\u003cbr /\u003e  \"CN\": string,\u003cbr /\u003e  \"O\": string,\u003cbr /\u003e  \"OU\": [array of strings],\u003cbr /\u003e  \"L\": string,\u003cbr /\u003e  \"ST\": string,\u003cbr /\u003e  \"C\": string\u003cbr /\u003e}, ...] A list of valid subjects used for additional certificate validations during TLS client authentication. All subject attributes are case-sensitive.\u003cbr /\u003e**Required subject fields**:\u003cbr /\u003e\"CN\" for Common Name\u003cbr /\u003e**Optional subject fields:**\u003cbr /\u003e\"O\" for Organization\u003cbr /\u003e\"OU\" for Organizational Unit (array of strings)\u003cbr /\u003e\"L\" for Locality (city)\u003cbr /\u003e\"ST\" for State/Province\u003cbr /\u003e\"C\" for 2-letter country code |\n| \u003cspan class=\"break-all\"\u003emtls_certificate_authentication\u003c/span\u003e | boolean | Require authentication of client certificates for mTLS connections to the cluster. The API_CA certificate should be configured as a prerequisite. |\n| \u003cspan class=\"break-all\"\u003emtls_client_cert_subject_validation_type\u003c/span\u003e | \"disabled\"\u003cbr /\u003e\"san_cn\"\u003cbr /\u003e\"full_subject\" | Enables additional certificate validations that further limit connections to clients with valid certificates during TLS client authentication.\u003cbr /\u003eValues:\u003cbr /\u003e**disabled**: Authenticates clients with valid certificates. No additional validations are enforced.\u003cbr /\u003e**san_cn**: A client certificate is valid only if its Common Name (CN) matches an entry in the list of valid subjects. Ignores other Subject attributes.\u003cbr /\u003e**full_subject**: A client certificate is valid only if its Subject attributes match an entry in the list of valid subjects. |\n| multi_commands_opt | **\"disabled\"**\u003cbr /\u003e\"batch\"\u003cbr /\u003e\"force_disabled\" | Determines the default `multi_commands_opt` setting for databases in the cluster. If set to `batch`, it reduces the overhead of transaction management by batching multiple commands into a single transaction.\u003cbr /\u003eValues:\u003cbr /\u003e**disabled**: Turns off the optimization for all databases except those that override it on the [bdb level](https://redis.io/docs/latest/operate/rs/references/rest-api/objects/bdb). Default value.\u003cbr /\u003e**batch**: Enables the optimization on all databases except those that override it on the [bdb level](https://redis.io/docs/latest/operate/rs/references/rest-api/objects/bdb).\u003cbr /\u003e**force_disabled**: Disables the optimization for all databases, even those that override it on the [bdb level](https://redis.io/docs/latest/operate/rs/references/rest-api/objects/bdb). |\n| name | string | Cluster's fully qualified domain name (read-only) |\n| options_method_forbidden | boolean (default: false) | Make OPTIONS http method forbidden over CNM HTTPS port. |\n| password_complexity | boolean (default: false) | Enforce password complexity policy |\n| \u003cspan class=\"break-all\"\u003epassword_expiration_duration\u003c/span\u003e | integer (default: 0) | The number of days a password is valid until the user is required to replace it |\n| password_min_length | integer, (range: 8-256) (default: 8) | The minimum length required for a password. |\n| proxy_certificate | string | Cluster's proxy certificate |\n| \u003cspan class=\"break-all\"\u003eproxy_max_ccs_disconnection_time\u003c/span\u003e | integer | Cluster-wide proxy timeout policy between proxy and CCS |\n| rack_aware | boolean | Cluster operates in a rack-aware mode (read-only) |\n| reserved_ports | array of strings | List of reserved ports and/or port ranges to avoid using for database endpoints (for example `\"reserved_ports\": [\"11000\", \"13000-13010\"]`) |\n| \u003cspan class=\"break-all\"\u003ereplica_sconns_on_demand\u003c/span\u003e | \"enabled\"\u003cbr /\u003e\"disabled\"\u003cbr /\u003e**\"auto\"** | Reduces DMC internode connections by at least 50%, conserving sockets, file descriptors, and `KEEPALIVE` traffic |\n| robust_crdt_syncer | boolean (default: false) | If `true`, enables the robust syncer for Active-Active databases |\n| s3_ca_cert | string | Filepath to the PEM-encoded CA certificate to use for validating TLS connections to the S3 server |\n| s3_url | string | Specifies the URL for S3 export and import |\n| \u003cspan class=\"break-all\"\u003esentinel_cipher_suites\u003c/span\u003e | array | Specifies the list of enabled ciphers for the sentinel service. The supported ciphers are those implemented by the [cipher_suites.go](\u003chttps://golang.org/src/crypto/tls/cipher_suites.go\u003e) package. |\n| \u003cspan class=\"break-all\"\u003esentinel_cipher_suites_tls_1_3\u003cspan\u003e | string | Specifies the list of enabled TLS 1.3 ciphers for the discovery (sentinel) service. The supported ciphers are those implemented by the [cipher_suites.go](\u003chttps://golang.org/src/crypto/tls/cipher_suites.go\u003e) package.(read-only) |\n| sentinel_tls_mode | \"allowed\"\u003cbr /\u003e\"disabled\" \u003cbr /\u003e\"required\" | Determines whether the discovery service allows, blocks, or requires TLS connections (previously named `sentinel_ssl_policy`)\u003cbr /\u003e**allowed**: Allows both TLS and non-TLS connections\u003cbr /\u003e**disabled**: Allows only non-TLS connections\u003cbr /\u003e**required**: Allows only TLS connections |\n| slave_ha | boolean (default: false) | Enable the replica high-availability mechanism (read-only) |\n| \u003cspan class=\"break-all\"\u003eslave_ha_bdb_cooldown_period\u003c/span\u003e | integer (default: 86400) | Time in seconds between runs of the replica high-availability mechanism on different nodes on the same database (read-only) |\n| \u003cspan class=\"break-all\"\u003eslave_ha_cooldown_period\u003c/span\u003e | integer (default: 3600) | Time in seconds between runs of the replica high-availability mechanism on different nodes (read-only) |\n| \u003cspan class=\"break-all\"\u003eslave_ha_grace_period\u003c/span\u003e | integer (default: 900) | Time in seconds between a node failure and when the replica high-availability mechanism starts relocating shards (read-only) |\n| \u003cspan class=\"break-all\"\u003eslowlog_in_sanitized_support\u003c/span\u003e | boolean | Whether to include slowlogs in the sanitized support package |\n| smtp_host | string | SMTP server for automated emails |\n| smtp_password | string | SMTP server password |\n| smtp_port | integer | SMTP server port for automated emails |\n| smtp_tls_mode | \"none\"\u003cbr /\u003e\"starttls\"\u003cbr /\u003e\"tls\" | Specifies which TLS mode to use for SMTP access |\n| smtp_use_tls | boolean (default: false) | Use TLS for SMTP access (deprecated as of Redis Software v4.3.3, use smtp_tls_mode field instead) |\n| smtp_username | string | SMTP server username (pattern does not allow special characters \u0026,\\\u003c,\u003e,\") |\n| \u003cspan class=\"break-all\"\u003estate_machine_smart_client_handoffs_delay_ms\u003c/span\u003e | integer (range: 0-10000) (default: 2000) | For smart client handoffs feature, the time in milliseconds to pause the state machine between sending the notification to clients and performing the operation |\n| syncer_certificate | string | Cluster's syncer certificate |\n| upgrade_mode | boolean (default: false) | Is cluster currently in upgrade mode |\n| use_external_ipv6 | boolean (default: true) | Should redislabs services listen on ipv6 |\n| use_ipv6 | boolean (default: true) | Should redislabs services listen on ipv6 (deprecated as of Redis Software v6.4.2, replaced with use_external_ipv6) |\n| wait_command | boolean (default: true) | Supports Redis wait command (read-only) |\n",
  "tags": ["docs","operate","rs"],
  "last_updated": "2026-07-23T12:05:56-05:00",
  "children": [{"id":"alert_settings","summary":"Documents the alert_settings object used with Redis Software REST API calls.","title":"Alert settings object","url":"https://redis.io/docs/latest/operate/rs/8.0/references/rest-api/objects/cluster/alert_settings/"},{"id":"cluster_alert_settings_with_threshold","summary":"Documents the cluster_alert_settings_with_threshold object used with Redis Software REST API calls.","title":"Cluster alert settings with threshold object","url":"https://redis.io/docs/latest/operate/rs/8.0/references/rest-api/objects/cluster/cluster_alert_settings_with_threshold/"},{"id":"logrotate_settings","summary":"Documents the logrotate_settings object used with Redis Software REST API calls.","title":"Logrotate settings object","url":"https://redis.io/docs/latest/operate/rs/8.0/references/rest-api/objects/cluster/logrotate_settings/"}]
}