A newer version of Hazelcast Operator is available.

View latest

Configuring TLS

latest-snapshot 5.16 5.15 5.14 5.13 5.12 5.11 5.10 5.9 5.8 5.7

Hazelcast TLS is a security feature that provides encryption and authentication of data transmitted between Hazelcast nodes, preventing unauthorized access and eavesdropping.

Hazelcast TLS uses standard SSL/TLS certificates, which can be obtained from trusted Certificate Authorities (CA) or self-signed. The certificates are used to establish trust between the communicating parties and ensure the authenticity of the communication channel.

See TLS/SSL Basics for more detailed information about the configuration and behavior of TLS in Hazelcast.

Prerequisites for TLS

Before you create and configure TLS, you need to create Kubernetes secret:

kubectl create secret tls example --cert=example.crt --key=example.key

Configuring Hazelcast TLS

Below are the configuration options for the TLS.

Field Description

secretName

Specifies the name of Kubernetes TLS secret.

mutualAuthentication

Mutual authentication configuration, available values are:

  • None (default): The client side of the connection is not authenticated.

  • Required: Server forces usage of a trusted client certificate

  • Optional: Server asks for a client certificate, but it doesn’t require it

Example Configuration

The example configuration does the following:

  • Enables member to member and member-client Hazelcast TLS connections

  • Enforces mutual TLS authentication for cluster members

Example Hazelcast configuration
apiVersion: hazelcast.com/v1alpha1
kind: Hazelcast
metadata:
  name: hazelcast
spec:
  clusterSize: 3
  repository: 'docker.io/hazelcast/hazelcast-enterprise'
  licenseKeySecretName: hazelcast-license-key
  tls:
    secretName: example
Example Management Center configuration
apiVersion: hazelcast.com/v1alpha1
kind: ManagementCenter
metadata:
  name: managementcenter
spec:
  repository: 'hazelcast/management-center'
  licenseKeySecretName: hazelcast-license-key
  hazelcastClusters:
  - address: hazelcast
    name: dev
    tls:
      secretName: example

Help and support