|
| 1 | +--- |
| 2 | +Title: Database connectivity |
| 3 | +alwaysopen: false |
| 4 | +categories: |
| 5 | +- docs |
| 6 | +- operate |
| 7 | +- kubernetes |
| 8 | +description: Connect applications to Redis Enterprise databases in Kubernetes clusters with in-cluster and external access patterns. |
| 9 | +linkTitle: Database connectivity |
| 10 | +weight: 1 |
| 11 | +--- |
| 12 | + |
| 13 | +Connecting applications to Redis Enterprise databases in Kubernetes involves understanding service discovery, credentials management, and access patterns. This guide covers the essential connectivity aspects unique to Kubernetes deployments. |
| 14 | + |
| 15 | +## Service types and access patterns |
| 16 | + |
| 17 | +When you create a RedisEnterpriseDatabase (REDB), the Redis Enterprise operator automatically creates Kubernetes services to route traffic to your database. Understanding these service types is crucial for proper connectivity. |
| 18 | + |
| 19 | +### Default service creation |
| 20 | + |
| 21 | +By default, the operator creates two services for each database: |
| 22 | + |
| 23 | +- ClusterIP service - Provides a stable cluster-internal IP address. |
| 24 | +- Headless service - Enables direct pod-to-pod communication and service discovery. |
| 25 | + |
| 26 | +Both services are created in the same namespace as your database and follow predictable naming conventions. |
| 27 | + |
| 28 | +### Service types |
| 29 | + |
| 30 | +Redis Enterprise supports three service types for database access: |
| 31 | + |
| 32 | +| Service Type | Access Scope | Use Case | |
| 33 | +|--------------|--------------|----------| |
| 34 | +| `ClusterIP` | Cluster-internal only | Applications running within the same Kubernetes cluster | |
| 35 | +| `headless` | Cluster-internal only | Direct pod access, service discovery, StatefulSet scenarios | |
| 36 | +| `LoadBalancer` | External access | Applications outside the Kubernetes cluster | |
| 37 | + |
| 38 | +To configure the service type, use the `databaseServiceType` field in your REC's `servicesRiggerSpec`. |
| 39 | + |
| 40 | +## In-cluster database access |
| 41 | + |
| 42 | +For applications running within your Kubernetes cluster, use the automatically created services to connect to your databases. |
| 43 | + |
| 44 | +### Retrieve connection information |
| 45 | + |
| 46 | +Database connection details are stored in a Kubernetes secret maintained by the database controller. This secret contains: |
| 47 | + |
| 48 | +- Database port (`port`) |
| 49 | +- Service names (`service_names`) |
| 50 | +- Database password (`password`) |
| 51 | + |
| 52 | +1. Get the secret name from your database resource: |
| 53 | + |
| 54 | + ```sh |
| 55 | + kubectl get redb <database-name> -o jsonpath="{.spec.databaseSecretName}" |
| 56 | + ``` |
| 57 | + |
| 58 | + The secret name typically follows the pattern `redb-<database-name>`. |
| 59 | + |
| 60 | +2. Retrieve the database port: |
| 61 | + |
| 62 | + ```sh |
| 63 | + kubectl get secret redb-<database-name> -o jsonpath="{.data.port}" | base64 --decode |
| 64 | + ``` |
| 65 | + |
| 66 | +3. Get available service names: |
| 67 | + |
| 68 | + ```sh |
| 69 | + kubectl get secret redb-<database-name> -o jsonpath="{.data.service_names}" | base64 --decode |
| 70 | + ``` |
| 71 | + |
| 72 | +4. Retrieve the database password: |
| 73 | + |
| 74 | + ```sh |
| 75 | + kubectl get secret redb-<database-name> -o jsonpath="{.data.password}" | base64 --decode |
| 76 | + ``` |
| 77 | + |
| 78 | +### Service naming and DNS resolution |
| 79 | + |
| 80 | +Services follow standard Kubernetes DNS naming conventions: |
| 81 | + |
| 82 | +- Service FQDN: `<service-name>.<namespace>.svc.cluster.local` |
| 83 | +- Short name: `<service-name>` (within the same namespace) |
| 84 | + |
| 85 | +For a database named `mydb` in namespace `production`, the service names would be: |
| 86 | +- ClusterIP service: `mydb.production.svc.cluster.local` |
| 87 | +- Headless service: `mydb-headless.production.svc.cluster.local` |
| 88 | + |
| 89 | +### Connect from within the cluster |
| 90 | + |
| 91 | +Use any service name from the `service_names` list to connect: |
| 92 | + |
| 93 | +```sh |
| 94 | +redis-cli -h <service-name> -p <port> |
| 95 | +``` |
| 96 | + |
| 97 | +Then authenticate with the retrieved password: |
| 98 | + |
| 99 | +```sh |
| 100 | +auth <password> |
| 101 | +``` |
| 102 | + |
| 103 | +## External database access |
| 104 | + |
| 105 | +To access databases from outside the Kubernetes cluster, you need to configure external routing. Currently supported methods for external access are ingress controllers or OpenShift routes. |
| 106 | + |
| 107 | +### Ingress controllers |
| 108 | + |
| 109 | +Redis Enterprise for Kubernetes only supports the following ingress controllers for external database access: |
| 110 | + |
| 111 | +- NGINX Ingress - Supports SSL passthrough for Redis connections |
| 112 | +- HAProxy Ingress - Built-in SSL passthrough support |
| 113 | +- Istio Gateway - Service mesh integration with advanced traffic management |
| 114 | + |
| 115 | +See [Ingress routing]({{< relref "/operate/kubernetes/networking/ingress" >}}) for detailed configuration steps. |
| 116 | + |
| 117 | +### OpenShift routes |
| 118 | + |
| 119 | +OpenShift users can leverage routes for external access: |
| 120 | + |
| 121 | +```yaml |
| 122 | +apiVersion: route.openshift.io/v1 |
| 123 | +kind: Route |
| 124 | +metadata: |
| 125 | + name: redis-route |
| 126 | +spec: |
| 127 | + to: |
| 128 | + kind: Service |
| 129 | + name: <database-service-name> |
| 130 | + port: |
| 131 | + targetPort: redis |
| 132 | + tls: |
| 133 | + termination: passthrough |
| 134 | +``` |
| 135 | +
|
| 136 | +See [OpenShift routes]({{< relref "/operate/kubernetes/networking/routes" >}}) for complete setup instructions. |
| 137 | +
|
| 138 | +## Service ports and configuration |
| 139 | +
|
| 140 | +### Default port behavior |
| 141 | +
|
| 142 | +- Redis Enterprise databases use dynamic port allocation. |
| 143 | +- Port numbers are assigned automatically during database creation. |
| 144 | +- The actual port is stored in the database secret. |
| 145 | +
|
| 146 | +### Custom port configuration |
| 147 | +
|
| 148 | +You can specify custom ports using the `databasePort` field in your REDB specification: |
| 149 | + |
| 150 | +```yaml |
| 151 | +apiVersion: app.redislabs.com/v1alpha1 |
| 152 | +kind: RedisEnterpriseDatabase |
| 153 | +metadata: |
| 154 | + name: mydb |
| 155 | +spec: |
| 156 | + memorySize: 256MB |
| 157 | + databasePort: 6379 |
| 158 | +``` |
| 159 | + |
| 160 | +Custom ports replace the default service port and are reflected in the database secret. |
| 161 | + |
| 162 | +## Credentials and secrets management |
| 163 | + |
| 164 | +### Database secrets structure |
| 165 | + |
| 166 | +Each database has an associated Kubernetes secret containing connection details: |
| 167 | + |
| 168 | +```yaml |
| 169 | +apiVersion: v1 |
| 170 | +kind: Secret |
| 171 | +metadata: |
| 172 | + name: redb-<database-name> |
| 173 | +type: Opaque |
| 174 | +data: |
| 175 | + port: <base64-encoded-port> |
| 176 | + service_names: <base64-encoded-service-list> |
| 177 | + password: <base64-encoded-password> |
| 178 | +``` |
| 179 | + |
| 180 | +### Using secrets in applications |
| 181 | + |
| 182 | +Reference database secrets in your application deployments: |
| 183 | + |
| 184 | +```yaml |
| 185 | +apiVersion: apps/v1 |
| 186 | +kind: Deployment |
| 187 | +metadata: |
| 188 | + name: my-app |
| 189 | +spec: |
| 190 | + template: |
| 191 | + spec: |
| 192 | + containers: |
| 193 | + - name: app |
| 194 | + image: my-app:latest |
| 195 | + env: |
| 196 | + - name: REDIS_HOST |
| 197 | + value: "<service-name>" |
| 198 | + - name: REDIS_PORT |
| 199 | + valueFrom: |
| 200 | + secretKeyRef: |
| 201 | + name: redb-<database-name> |
| 202 | + key: port |
| 203 | + - name: REDIS_PASSWORD |
| 204 | + valueFrom: |
| 205 | + secretKeyRef: |
| 206 | + name: redb-<database-name> |
| 207 | + key: password |
| 208 | +``` |
| 209 | + |
| 210 | +### Default user configuration |
| 211 | + |
| 212 | +By default, databases create a default user with full access. You can disable this behavior: |
| 213 | + |
| 214 | +```yaml |
| 215 | +apiVersion: app.redislabs.com/v1alpha1 |
| 216 | +kind: RedisEnterpriseDatabase |
| 217 | +metadata: |
| 218 | + name: mydb |
| 219 | +spec: |
| 220 | + memorySize: 256MB |
| 221 | + defaultUser: false |
| 222 | +``` |
| 223 | + |
| 224 | +When `defaultUser` is disabled, the database secret is not created, and you must configure custom authentication. |
| 225 | + |
| 226 | +## Connection examples |
| 227 | + |
| 228 | +### Python application |
| 229 | + |
| 230 | +```python |
| 231 | +import redis |
| 232 | +import base64 |
| 233 | +import os |
| 234 | +
|
| 235 | +# Read from Kubernetes secret (mounted as environment variables) |
| 236 | +host = os.getenv('REDIS_HOST') |
| 237 | +port = int(os.getenv('REDIS_PORT')) |
| 238 | +password = os.getenv('REDIS_PASSWORD') |
| 239 | +
|
| 240 | +# Create Redis connection |
| 241 | +r = redis.Redis(host=host, port=port, password=password, decode_responses=True) |
| 242 | +
|
| 243 | +# Test connection |
| 244 | +r.ping() |
| 245 | +``` |
| 246 | + |
| 247 | +### Node.js application |
| 248 | + |
| 249 | +```javascript |
| 250 | +const redis = require('redis'); |
| 251 | +
|
| 252 | +const client = redis.createClient({ |
| 253 | + host: process.env.REDIS_HOST, |
| 254 | + port: process.env.REDIS_PORT, |
| 255 | + password: process.env.REDIS_PASSWORD |
| 256 | +}); |
| 257 | +
|
| 258 | +client.on('connect', () => { |
| 259 | + console.log('Connected to Redis'); |
| 260 | +}); |
| 261 | +``` |
| 262 | + |
| 263 | +## Troubleshooting connectivity |
| 264 | + |
| 265 | +### Common issues |
| 266 | + |
| 267 | +1. Connection refused - Verify service names and ports from the database secret. |
| 268 | +2. Authentication failed - Check password encoding and special characters. |
| 269 | +3. DNS resolution - Ensure applications use correct service FQDNs. |
| 270 | +4. Network policies - Verify Kubernetes network policies allow traffic. |
| 271 | + |
| 272 | +### Debugging steps |
| 273 | + |
| 274 | +1. Verify service creation: |
| 275 | + ```sh |
| 276 | + kubectl get services -l app=redis-enterprise |
| 277 | + ``` |
| 278 | + |
| 279 | +2. Check service endpoints: |
| 280 | + ```sh |
| 281 | + kubectl get endpoints <service-name> |
| 282 | + ``` |
| 283 | + |
| 284 | +3. Test connectivity from within cluster: |
| 285 | + ```sh |
| 286 | + kubectl run redis-test --image=redis:latest -it --rm -- redis-cli -h <service-name> -p <port> |
| 287 | + ``` |
| 288 | + |
| 289 | +## Related topics |
| 290 | + |
| 291 | +- [Ingress routing]({{< relref "/operate/kubernetes/networking/ingress" >}}) - Configure external access with ingress controllers |
| 292 | +- [OpenShift routes]({{< relref "/operate/kubernetes/networking/routes" >}}) - External access using OpenShift routes |
| 293 | +- [Database controller]({{< relref "/operate/kubernetes/re-databases/db-controller" >}}) - Database lifecycle management |
| 294 | +- [Security]({{< relref "/operate/kubernetes/security" >}}) - TLS configuration and access control |
0 commit comments