kubeblocks-configure-tls

To enable TLS on an existing KubeBlocks cluster, you configure TLS settings directly in the Cluster CR. You can choose built-in TLS using cert-manager or apply user-provided certificates by validating Secrets.

Yes, you can enable mTLS for cross-service communication on existing clusters without recreation. The configuration applies mutual TLS settings to secure database connections safely across services.

KubeBlocks supports user-provided certificates for database security by validating your existing TLS Secrets. This allows you to migrate from built-in TLS to your own certificate management workflow.

Cert-manager handles built-in TLS provisioning for KubeBlocks clusters by automatically generating and managing certificates. This integrated approach enables encrypted database connections without needing external certificate setup.

TLS configuration limitations depend on engine capability matrices. You must reference these matrices to validate scope and verify TLS connections across engines like MySQL and PostgreSQL to prevent unsafe configurations.

The best way to migrate to user-provided TLS certificates is to update the Cluster CR with your validated Secrets. This workflow ensures continuous database security by transitioning from built-in TLS to custom certificates.