RS: Cert based auth for CRDB

[kaitlynmichael]

Note

Low Risk
Documentation-only updates to CLI, REST reference, and security guides; no application code changes in this PR.

Overview
Documents certificate-based cluster management for Redis Software when basic/digest REST auth is off or unavailable—especially Active-Active (CRDB) and node join—without changing product behavior in this diff.

crdb-cli reference pages for create, add-instance, and update now describe --instance / --credentials as accepting either username/password or client_cert / client_key / optional trusted_ca (PEM), including the mutual-exclusion error and examples for mixed clusters and migrating an instance to certs.

rladmin cluster join documents the same auth choice using file paths for cert/key/CA; rladmin tune cluster adds control_plane_basic_authentication.

REST object docs add cert fields on bootstrap credentials and a certificate_auth block on CRDB cluster_info (vs credentials).

Security guides gain a cluster management section in certificate-based authentication (bootstrap join, AA create/add-instance/update, REST certificate_auth) and a step-by-step order in disable-basic-authentication before turning off basic auth.

^{Reviewed by Cursor Bugbot for commit 5baf3bc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🧠 Redis Memory

Found 5 related items from repository history:

• PR — RS: Added limitation that disabling default password for CRDB after creation is not supported
• PR — RS: Added crdb-cli and REST API examples to enable TLS after Active-Active database creation

  DOC-5494

• PR — RS: Fixed authenticate DB connections with cert-based auth

• PR — RS: Certificate-based authentication for LDAP

• PR — RS: Added detailed instructions to update Active-Active DB admin credentials

Memory updated at 5baf3bc

[github-actions]

DOC-6928

[github-actions]

Staging links:
https://redis.io/docs/staging/DOC-6928/operate/rs/references/cli-utilities/crdb-cli/crdb/add-instance/
https://redis.io/docs/staging/DOC-6928/operate/rs/references/cli-utilities/crdb-cli/crdb/create/
https://redis.io/docs/staging/DOC-6928/operate/rs/references/cli-utilities/crdb-cli/crdb/update/
https://redis.io/docs/staging/DOC-6928/operate/rs/references/cli-utilities/rladmin/cluster/join/
https://redis.io/docs/staging/DOC-6928/operate/rs/references/cli-utilities/rladmin/tune/
https://redis.io/docs/staging/DOC-6928/operate/rs/references/rest-api/objects/bootstrap/credentials/
https://redis.io/docs/staging/DOC-6928/operate/rs/references/rest-api/objects/crdb/cluster_info/
https://redis.io/docs/staging/DOC-6928/operate/rs/security/access-control/disable-basic-authentication/
https://redis.io/docs/staging/DOC-6928/operate/rs/security/certificates/certificate-based-authentication/

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5baf3bc. Configure here.}

[cursor]

Join trusted_ca default wording

Medium Severity

For optional trusted_ca on rladmin cluster join, the new text says the joining node falls back to the cluster's mtls_trusted_ca.pem. Before a successful join, that node is not yet a member of the target cluster, so implying the target cluster’s on-disk trust store is used is inconsistent with how join authentication works.

 

^{Reviewed by Cursor Bugbot for commit 5baf3bc. Configure here.}