mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-19 14:12:52 +00:00
108 lines
3.1 KiB
Plaintext
108 lines
3.1 KiB
Plaintext
---
|
|
title: Caching
|
|
sidebar_label: Caching
|
|
---
|
|
|
|
|
|
|
|
This guide explains how to connect Zitadel caches to Redis or Valkey on Kubernetes.
|
|
|
|
<Callout type="info">
|
|
Caching is an experimental beta feature. See the [Caches](/self-hosting/manage/cache) page for behavior, objects, and tuning guidance.
|
|
</Callout>
|
|
|
|
Zitadel supports Redis or any Redis-compatible store (for example, Valkey) in standalone mode. Sentinel and Redis Cluster are not supported because the cache connector expects a single endpoint and does not implement cluster routing or sentinel failover logic.
|
|
|
|
<Callout type="note">
|
|
Zitadel supports server-auth TLS (`EnableTLS: true`) but does not support client certificates/mTLS for cache connections.
|
|
</Callout>
|
|
|
|
Each cache uses its own Redis database index. Set `DBOffset` so Zitadel-owned indexes do not overlap with other applications. Zitadel issues `FLUSHDB` on its cache databases, so sharing an index with other apps is unsafe.
|
|
|
|
## Connect without authentication (development only)
|
|
|
|
```yaml
|
|
zitadel:
|
|
configmapConfig:
|
|
Caches:
|
|
Connectors:
|
|
Redis:
|
|
Enabled: true
|
|
Addr: "redis-master.caching.svc.cluster.local:6379"
|
|
DBOffset: 10
|
|
Instance:
|
|
Connector: "redis"
|
|
MaxAge: 1h
|
|
LastUseAge: 10m
|
|
Organization:
|
|
Connector: "redis"
|
|
MaxAge: 1h
|
|
LastUseAge: 10m
|
|
```
|
|
|
|
Use this only on isolated clusters where the Redis endpoint does not require authentication.
|
|
|
|
## Connect with password from a Kubernetes Secret
|
|
|
|
Keep credentials in a secret while the rest of the cache configuration stays in values:
|
|
|
|
```yaml
|
|
zitadel:
|
|
configSecretName: zitadel-cache-credentials
|
|
configmapConfig:
|
|
Caches:
|
|
Connectors:
|
|
Redis:
|
|
Enabled: true
|
|
Addr: "redis.database.svc.cluster.local:6379"
|
|
DBOffset: 10
|
|
Instance:
|
|
Connector: "redis"
|
|
MaxAge: 1h
|
|
LastUseAge: 10m
|
|
Organization:
|
|
Connector: "redis"
|
|
MaxAge: 1h
|
|
LastUseAge: 10m
|
|
```
|
|
|
|
Create the secret with your Redis ACL user and password:
|
|
|
|
```bash
|
|
kubectl create secret generic zitadel-cache-credentials \
|
|
--from-literal=config.yaml="
|
|
Caches:
|
|
Connectors:
|
|
Redis:
|
|
Username: cache-user # Omit for default user
|
|
Password: your-redis-password
|
|
"
|
|
```
|
|
|
|
## Connect with TLS (Redis or Valkey)
|
|
|
|
Enable TLS when your endpoint requires encryption. This uses server-auth TLS with the container's trust store.
|
|
|
|
```yaml
|
|
zitadel:
|
|
configSecretName: zitadel-cache-credentials
|
|
configmapConfig:
|
|
Caches:
|
|
Connectors:
|
|
Redis:
|
|
Enabled: true
|
|
Addr: "redis.example.com:6380"
|
|
EnableTLS: true
|
|
DBOffset: 10
|
|
Instance:
|
|
Connector: "redis"
|
|
MaxAge: 1h
|
|
LastUseAge: 10m
|
|
Organization:
|
|
Connector: "redis"
|
|
MaxAge: 1h
|
|
LastUseAge: 10m
|
|
```
|
|
|
|
Reuse the secret from the previous section for credentials if needed. Custom certificate authorities must be added to the container's trust bundle (for example, by mounting a CA file into the pod); client certificate authentication is not supported.
|