content/operate/kubernetes/networking/database-connectivity.md
Connecting applications to Redis Enterprise databases in Kubernetes involves understanding service discovery, credentials management, and access patterns. This guide covers the essential connectivity aspects unique to Kubernetes deployments.
When you create a RedisEnterpriseDatabase (REDB), the Redis Enterprise operator automatically creates Kubernetes services to route traffic to your database. Understanding these service types is crucial for proper connectivity.
By default, the operator creates two services for each database:
Both services are created in the same namespace as your database and follow predictable naming conventions.
Redis Enterprise supports three service types for database access:
| Service Type | Rigger Spec Exact Name | Access Scope | Use Case |
|---|---|---|---|
ClusterIP | cluster_ip | Cluster-internal only | Applications running within the same Kubernetes cluster |
headless | headless | Cluster-internal only | Direct pod access, service discovery, StatefulSet scenarios |
LoadBalancer | load_balancer | External access | Applications outside the Kubernetes cluster |
To configure the service type, use the databaseServiceType field in your REC's servicesRiggerSpec.
For example, to enable the three Service options, you may use:
{"spec":{"servicesRiggerSpec":{"databaseServiceType":"cluster_ip,headless,load_balancer"}}}
For applications running within your Kubernetes cluster, use the automatically created services to connect to your databases.
Database connection details are stored in a Kubernetes secret maintained by the database controller. This secret contains:
port)service_names)password)Get the secret name from your database resource:
kubectl get redb <database-name> -o jsonpath="{.spec.databaseSecretName}"
The secret name typically follows the pattern redb-<database-name>.
Retrieve the database port:
kubectl get secret redb-<database-name> -o jsonpath="{.data.port}" | base64 --decode
Get available service names:
kubectl get secret redb-<database-name> -o jsonpath="{.data.service_names}" | base64 --decode
Retrieve the database password:
kubectl get secret redb-<database-name> -o jsonpath="{.data.password}" | base64 --decode
Services follow standard Kubernetes DNS naming conventions:
<service-name>.<namespace>.svc.cluster.local<service-name> (within the same namespace)For a database named mydb in namespace production, the service names would be:
mydb.production.svc.cluster.localmydb-headless.production.svc.cluster.localUse any service name from the service_names list to connect:
redis-cli -h <service-name> -p <port>
Then authenticate with the retrieved password:
auth <password>
To access databases from outside the Kubernetes cluster, you need to configure external routing. Currently supported methods for external access are ingress controllers or OpenShift routes.
Redis Enterprise for Kubernetes only supports the following ingress controllers for external database access:
See [Ingress routing]({{< relref "/operate/kubernetes/networking/ingress" >}}) for detailed configuration steps.
OpenShift users can leverage routes for external access:
apiVersion: route.openshift.io/v1
kind: Route
metadata:
name: redis-route
spec:
to:
kind: Service
name: <database-service-name>
port:
targetPort: redis
tls:
termination: passthrough
See [OpenShift routes]({{< relref "/operate/kubernetes/networking/routes" >}}) for complete setup instructions.
You can specify custom ports using the databasePort field in your REDB specification:
apiVersion: app.redislabs.com/v1alpha1
kind: RedisEnterpriseDatabase
metadata:
name: mydb
spec:
memorySize: 256MB
databasePort: 6379
Custom ports replace the default service port and are reflected in the database secret.
Each database has an associated Kubernetes secret containing connection details:
apiVersion: v1
kind: Secret
metadata:
name: redb-<database-name>
type: Opaque
data:
port: <base64-encoded-port>
service_names: <base64-encoded-service-list>
password: <base64-encoded-password>
Reference database secrets in your application deployments:
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-app
spec:
template:
spec:
containers:
- name: app
image: my-app:latest
env:
- name: REDIS_HOST
value: "<service-name>"
- name: REDIS_PORT
valueFrom:
secretKeyRef:
name: redb-<database-name>
key: port
- name: REDIS_PASSWORD
valueFrom:
secretKeyRef:
name: redb-<database-name>
key: password
By default, databases create a default user with full access. You can disable this behavior:
apiVersion: app.redislabs.com/v1alpha1
kind: RedisEnterpriseDatabase
metadata:
name: mydb
spec:
memorySize: 256MB
defaultUser: false
When defaultUser is disabled, the database secret is not created, and you must configure custom authentication.
import redis
import base64
import os
# Read from Kubernetes secret (mounted as environment variables)
host = os.getenv('REDIS_HOST')
port = int(os.getenv('REDIS_PORT'))
password = os.getenv('REDIS_PASSWORD')
# Create Redis connection
r = redis.Redis(host=host, port=port, password=password, decode_responses=True)
# Test connection
r.ping()
const redis = require('redis');
const client = redis.createClient({
host: process.env.REDIS_HOST,
port: process.env.REDIS_PORT,
password: process.env.REDIS_PASSWORD
});
client.on('connect', () => {
console.log('Connected to Redis');
});
Verify service creation:
kubectl get services -l app=redis-enterprise
Check service endpoints:
kubectl get endpoints <service-name>
Test connectivity from within cluster:
kubectl run redis-test --image=redis:latest -it --rm -- redis-cli -h <service-name> -p <port>