{ "schema_version": 2, "id": "operate/kubernetes/networking/database-connectivity", "title": "Database connectivity", "url": "https://redis.io/docs/latest/operate/kubernetes/networking/database-connectivity/", "summary": "Connect applications to Redis Enterprise databases in Kubernetes clusters with in-cluster and external access patterns.", "tags": [ "docs", "operate", "kubernetes" ], "last_updated": "2026-09-28T16:14:52+01:00", "page_type": "content", "content_hash": "8e769e0a888516856182e75dec1039c860c34ad926503764f9110d61705d2663", "sections": [ { "id": "overview", "title": "Overview", "role": "overview", "text": "Connecting applications to Redis Enterprise databases in Kubernetes involves understanding service discovery, credentials management, and access patterns. This guide covers the essential connectivity aspects unique to Kubernetes deployments." }, { "id": "service-types-and-access-patterns", "title": "Service types and access patterns", "role": "content", "text": "When you create a RedisEnterpriseDatabase (REDB), the Redis Enterprise operator automatically creates Kubernetes services to route traffic to your database. Understanding these service types is crucial for proper connectivity." }, { "id": "default-service-creation", "title": "Default service creation", "role": "content", "text": "By default, the operator creates two services for each database:\n\n- ClusterIP service - Provides a stable cluster-internal IP address.\n- Headless service - Enables direct pod-to-pod communication and service discovery.\n\nBoth services are created in the same namespace as your database and follow predictable naming conventions." }, { "id": "service-types", "title": "Service types", "role": "content", "text": "Redis Enterprise supports three service types for database access:\n\n| Service Type | Rigger Spec Exact Name | Access Scope | Use Case |\n|--------------|--------------|--------------|----------|\n| `ClusterIP` | `cluster_ip` | Cluster-internal only | Applications running within the same Kubernetes cluster |\n| `headless` | `headless` | Cluster-internal only | Direct pod access, service discovery, StatefulSet scenarios |\n| `LoadBalancer` | `load_balancer` | External access | Applications outside the Kubernetes cluster |\n\nTo configure the service type, use the `databaseServiceType` field in your REC's `servicesRiggerSpec`.\n\nFor example, to enable the three Service options, you may use:\n[code example]" }, { "id": "in-cluster-database-access", "title": "In-cluster database access", "role": "content", "text": "For applications running within your Kubernetes cluster, use the automatically created services to connect to your databases." }, { "id": "retrieve-connection-information", "title": "Retrieve connection information", "role": "content", "text": "Database connection details are stored in a Kubernetes secret maintained by the database controller. This secret contains:\n\n- Database port (`port`)\n- Service names (`service_names`) \n- Database password (`password`)\n\n1. Get the secret name from your database resource:\n\n [code example]\n\n The secret name typically follows the pattern `redb-`.\n\n2. Retrieve the database port:\n\n [code example]\n\n3. Get available service names:\n\n [code example]\n\n4. Retrieve the database password:\n\n [code example]" }, { "id": "service-naming-and-dns-resolution", "title": "Service naming and DNS resolution", "role": "content", "text": "Services follow standard Kubernetes DNS naming conventions:\n\n- Service FQDN: `..svc.cluster.local`\n- Short name: `` (within the same namespace)\n\nFor a database named `mydb` in namespace `production`, the service names would be:\n- ClusterIP service: `mydb.production.svc.cluster.local`\n- Headless service: `mydb-headless.production.svc.cluster.local`" }, { "id": "connect-from-within-the-cluster", "title": "Connect from within the cluster", "role": "content", "text": "Use any service name from the `service_names` list to connect:\n\n[code example]\n\nThen authenticate with the retrieved password:\n\n[code example]" }, { "id": "external-database-access", "title": "External database access", "role": "content", "text": "To access databases from outside the Kubernetes cluster, you need to configure external routing. Currently supported methods for external access are ingress controllers or OpenShift routes." }, { "id": "ingress-controllers", "title": "Ingress controllers", "role": "content", "text": "Redis Enterprise for Kubernetes only supports the following ingress controllers for external database access:\n\n- HAProxy Ingress - Built-in SSL passthrough support.\n- Istio Gateway - Service mesh integration with advanced traffic management.\n- Ingress-NGINX - SSL passthrough is off by default; start the controller with `--enable-ssl-passthrough`. The community `kubernetes/ingress-nginx` project is retired (maintenance ended March 2026); existing deployments only.\n\nSee [Ingress routing](https://redis.io/docs/latest/operate/kubernetes/networking/ingress) for detailed configuration steps." }, { "id": "openshift-routes", "title": "OpenShift routes", "role": "content", "text": "OpenShift users can leverage routes for external access:\n\n[code example]\n\nSee [OpenShift routes](https://redis.io/docs/latest/operate/kubernetes/networking/routes) for complete setup instructions." }, { "id": "service-ports-and-configuration", "title": "Service ports and configuration", "role": "content", "text": "" }, { "id": "default-port-behavior", "title": "Default port behavior", "role": "content", "text": "- Redis Enterprise databases use dynamic port allocation.\n- Port numbers are assigned automatically during database creation.\n- The actual port is stored in the database secret." }, { "id": "custom-port-configuration", "title": "Custom port configuration", "role": "content", "text": "You can specify custom ports using the `databasePort` field in your REDB specification:\n\n[code example]\n\nCustom ports replace the default service port and are reflected in the database secret." }, { "id": "credentials-and-secrets-management", "title": "Credentials and secrets management", "role": "content", "text": "" }, { "id": "database-secrets-structure", "title": "Database secrets structure", "role": "content", "text": "Each database has an associated Kubernetes secret containing connection details:\n\n[code example]" }, { "id": "using-secrets-in-applications", "title": "Using secrets in applications", "role": "content", "text": "Reference database secrets in your application deployments:\n\n[code example]" }, { "id": "rotate-the-database-password", "title": "Rotate the database password", "role": "content", "text": "To rotate a database password, update the `password` key in the database secret. See [Change the REDB password](https://redis.io/docs/latest/operate/kubernetes/security/authentication/manage-redb-credentials#change-the-redb-password)." }, { "id": "default-user-configuration", "title": "Default user configuration", "role": "content", "text": "By default, databases create a default user with full access. You can disable this behavior:\n\n[code example]\n\nWhen `defaultUser` is disabled, the database secret is not created, and you must configure custom authentication." }, { "id": "connection-examples", "title": "Connection examples", "role": "content", "text": "" }, { "id": "python-application", "title": "Python application", "role": "content", "text": "[code example]" }, { "id": "nodejs-application", "title": "Node.js application", "role": "content", "text": "[code example]" }, { "id": "troubleshooting-connectivity", "title": "Troubleshooting connectivity", "role": "errors", "text": "" }, { "id": "common-issues", "title": "Common issues", "role": "content", "text": "1. Connection refused - Verify service names and ports from the database secret.\n2. Authentication failed - Check password encoding and special characters.\n3. DNS resolution - Ensure applications use correct service FQDNs.\n4. Network policies - Verify Kubernetes network policies allow traffic." }, { "id": "debugging-steps", "title": "Debugging steps", "role": "content", "text": "1. Verify service creation:\n [code example]\n\n2. Check service endpoints:\n [code example]\n\n3. Test connectivity from within cluster:\n [code example]" }, { "id": "related-topics", "title": "Related topics", "role": "related", "text": "- [Ingress routing](https://redis.io/docs/latest/operate/kubernetes/networking/ingress) - Configure external access with ingress controllers\n- [OpenShift routes](https://redis.io/docs/latest/operate/kubernetes/networking/routes) - External access using OpenShift routes \n- [Database controller](https://redis.io/docs/latest/operate/kubernetes/re-databases/db-controller) - Database lifecycle management\n- [Security](https://redis.io/docs/latest/operate/kubernetes/security) - TLS configuration and access control" } ], "examples": [ { "id": "service-types-ex0", "language": "plaintext", "code": "{\"spec\":{\"servicesRiggerSpec\":{\"databaseServiceType\":\"cluster_ip,headless,load_balancer\"}}}", "section_id": "service-types" }, { "id": "retrieve-connection-information-ex0", "language": "sh", "code": "kubectl get redb -o jsonpath=\"{.spec.databaseSecretName}\"", "section_id": "retrieve-connection-information" }, { "id": "retrieve-connection-information-ex1", "language": "sh", "code": "kubectl get secret redb- -o jsonpath=\"{.data.port}\" | base64 --decode", "section_id": "retrieve-connection-information" }, { "id": "retrieve-connection-information-ex2", "language": "sh", "code": "kubectl get secret redb- -o jsonpath=\"{.data.service_names}\" | base64 --decode", "section_id": "retrieve-connection-information" }, { "id": "retrieve-connection-information-ex3", "language": "sh", "code": "kubectl get secret redb- -o jsonpath=\"{.data.password}\" | base64 --decode", "section_id": "retrieve-connection-information" }, { "id": "connect-from-within-the-cluster-ex0", "language": "sh", "code": "redis-cli -h -p ", "section_id": "connect-from-within-the-cluster" }, { "id": "connect-from-within-the-cluster-ex1", "language": "sh", "code": "auth ", "section_id": "connect-from-within-the-cluster" }, { "id": "openshift-routes-ex0", "language": "yaml", "code": "apiVersion: route.openshift.io/v1\nkind: Route\nmetadata:\n name: redis-route\nspec:\n to:\n kind: Service\n name: \n port:\n targetPort: redis\n tls:\n termination: passthrough", "section_id": "openshift-routes" }, { "id": "custom-port-configuration-ex0", "language": "yaml", "code": "apiVersion: app.redislabs.com/v1alpha1\nkind: RedisEnterpriseDatabase\nmetadata:\n name: mydb\nspec:\n memorySize: 256MB\n databasePort: 6379", "section_id": "custom-port-configuration" }, { "id": "database-secrets-structure-ex0", "language": "yaml", "code": "apiVersion: v1\nkind: Secret\nmetadata:\n name: redb-\ntype: Opaque\ndata:\n port: \n service_names: \n password: ", "section_id": "database-secrets-structure" }, { "id": "using-secrets-in-applications-ex0", "language": "yaml", "code": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: my-app\nspec:\n template:\n spec:\n containers:\n - name: app\n image: my-app:latest\n env:\n - name: REDIS_HOST\n value: \"\"\n - name: REDIS_PORT\n valueFrom:\n secretKeyRef:\n name: redb-\n key: port\n - name: REDIS_PASSWORD\n valueFrom:\n secretKeyRef:\n name: redb-\n key: password", "section_id": "using-secrets-in-applications" }, { "id": "default-user-configuration-ex0", "language": "yaml", "code": "apiVersion: app.redislabs.com/v1alpha1\nkind: RedisEnterpriseDatabase\nmetadata:\n name: mydb\nspec:\n memorySize: 256MB\n defaultUser: false", "section_id": "default-user-configuration" }, { "id": "python-application-ex0", "language": "python", "code": "import redis\nimport base64\nimport os\n\n# Read from Kubernetes secret (mounted as environment variables)\nhost = os.getenv('REDIS_HOST')\nport = int(os.getenv('REDIS_PORT'))\npassword = os.getenv('REDIS_PASSWORD')\n\n# Create Redis connection\nr = redis.Redis(host=host, port=port, password=password, decode_responses=True)\n\n# Test connection\nr.ping()", "section_id": "python-application" }, { "id": "nodejs-application-ex0", "language": "javascript", "code": "const redis = require('redis');\n\nconst client = redis.createClient({\n host: process.env.REDIS_HOST,\n port: process.env.REDIS_PORT,\n password: process.env.REDIS_PASSWORD\n});\n\nclient.on('connect', () => {\n console.log('Connected to Redis');\n});", "section_id": "nodejs-application" }, { "id": "debugging-steps-ex0", "language": "sh", "code": "kubectl get services -l app=redis-enterprise", "section_id": "debugging-steps" }, { "id": "debugging-steps-ex1", "language": "sh", "code": "kubectl get endpoints ", "section_id": "debugging-steps" }, { "id": "debugging-steps-ex2", "language": "sh", "code": "kubectl run redis-test --image=redis:latest -it --rm -- redis-cli -h -p ", "section_id": "debugging-steps" } ] }