Redis Enterprise for Kubernetes version 6.2.8-11 introduces the ability to use an Istio Ingress gateway as an alternative to NGINX or HaProxy Ingress controllers.

Istio can also understand Ingress resources, but using that mechanism takes away the advantages and options that the native Istio resources provide. Istio offers its own configuration methods using custom resources.

To configure Istio to work with the Redis Kubernetes operator, we will use two custom resources: a Gateway and a VirtualService. Then you’ll be able to establish external access to your database.

Install and configure Istio for Redis Enterprise

  1. Download and install Istio (see instructions from Istio’s Getting Started guide).

    Once the installation is complete, all the deployments, pods, and services will be deployed in a namespace called istio-system. This namespace contains a LoadBalancer type service called service/istio-ingressgateway that exposes the external IP address.

  2. Find the EXTERNAL-IP for the istio-ingressgateway service.

    kubectl get svc istio-ingressgateway -n istio-system
    NAME                   TYPE           CLUSTER-IP     EXTERNAL-IP      PORT(S)                                                                      AGE
    istio-ingressgateway   LoadBalancer   15021:12345/TCP,80:67891/TCP,443:23456/TCP,31400:78901/TCP,15443:10112/TCP   3h8m
  3. Create a DNS entry that resolves your chosen database hostname (or a wildcard * followed by your domain) to the Istio EXTERNAL-IP. Use this hostname to access your database from outside the cluster.

    In this example, any hostname that ends with will resolve to the Istio LoadBalancer’s external IP of Substitute your own values accordingly.

  4. Verify the record was created successfully.


    Look in the ANSWER SECTION for the record you just created.

    ;; ANSWER SECTION: 0 IN    A

Create custom resources

Gateway custom resource

  1. On a different namespace from istio-system, create a Gateway custom resource file (redis-gateway.yaml).

    kind: Gateway
      name: redis-gateway
        istio: ingressgateway 
      - hosts:
        - '*'
          name: https
          number: 443
          protocol: HTTPS
          mode: PASSTHROUGH
    • Replace with the domain that matches your DNS record.
    • TLS passthrough mode is required to allow secure access to the database.
  2. Apply gateway.yaml to create the Ingress gateway.

    kubectl apply -f gateway.yaml
  3. Verify the gateway was created successfully.

    kubectl get gateway
    NAME            AGE
    redis-gateway   3h33m

VirtualService custom resource

  1. On a different namespace than istio-system, create the VirtualService custom resource file (redis-vs.yaml).

    kind: VirtualService
      name: redis-vs
      - redis-gateway
      - "*"
      - match:
        - port: 443
        - destination:
            host: rec1
              number: 9443
      - match:
        - port: 443
        - destination:
            host: db1

    This creates both a route to contact the API server on the REC (rec1) and a route to contact one of the databases (db1).

    • Replace with the domain that matches your DNS record.
    • The gateway’s metadata name must be similar to the gateway’s spec name (redis-gateway in this example).
    • When creating an Active-Active database with the crdb-cli command,
  2. Apply redis-vs.yaml to create the virtual service.

    kubectl apply -f redis-vs.yaml
  3. Verify the virtual service was created successfully.

    kubectl get vs
    NAME       GATEWAYS            HOSTS                              AGE
    redis-vs   ["redis-gateway"]   ["*"]   3h33m
  4. Deploy the operator, Redis Enterprise Cluster (REC), and Redis Enterprise Database (REDB) on the same namespace as the gateway and virtual service.

Test your external access to the database

To test your external access to the database, you need a client that supports TLS and SNI.

See Test your access with Openssl or Test your access with Python for more info.