From 9b8dd4cba46163eedc3c147b4c041591cea2caaa Mon Sep 17 00:00:00 2001 From: Kaitlyn Michael Date: Wed, 5 Aug 2026 18:18:38 -0500 Subject: [PATCH 1/5] document control_plane_basic_authentication in rladmin tune reference --- content/operate/rs/references/cli-utilities/rladmin/tune.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/operate/rs/references/cli-utilities/rladmin/tune.md b/content/operate/rs/references/cli-utilities/rladmin/tune.md index 13f75de660..94481a4a68 100644 --- a/content/operate/rs/references/cli-utilities/rladmin/tune.md +++ b/content/operate/rs/references/cli-utilities/rladmin/tune.md @@ -53,6 +53,7 @@ rladmin tune cluster [ default_tracking_table_max_keys_policy ] [ default_oss_sharding { enabled | disabled } ] [ filter_node_wd_health_metrics { enabled | disabled } ] + [ control_plane_basic_authentication { enabled | disabled } ] ] ``` @@ -63,6 +64,7 @@ rladmin tune cluster | acl_pubsub_default | `resetchannels`
`allchannels` | Default pub/sub ACL rule for all databases in the cluster:
•`resetchannels` blocks access to all channels (restrictive)
•`allchannels` allows access to all channels (permissive) | | automatic_node_offload | `enabled`
`disabled` | Define whether automatic node offload migration will take place | | auto_recovery | `enabled`
`disabled` | Defines whether to use automatic recovery after shard failure | +| control_plane_basic_authentication | `enabled`
`disabled` | Activates or deactivates [basic and digest authentication]({{< relref "/operate/rs/security/access-control/disable-basic-authentication" >}}) for the cluster management REST API. Enabled by default. | | data_internode_encryption | `enabled`
`disabled` | Activates or deactivates [internode encryption]({{< relref "/operate/rs/security/encryption/internode-encryption" >}}) for new databases | | db_conns_auditing | `enabled`
`disabled` | Activates or deactivates [connection auditing]({{< relref "/operate/rs/security/audit-events" >}}) by default for new databases of a cluster | | default_concurrent_restore_actions | integer
`all` | Default number of concurrent actions when restoring a node from a snapshot (positive integer or "all") | From 04f697ce34074675fcd9d84f7c78d6fbfec0a8b7 Mon Sep 17 00:00:00 2001 From: Kaitlyn Michael Date: Wed, 5 Aug 2026 21:50:48 -0500 Subject: [PATCH 2/5] document the order of operations for disabling basic authentication --- .../disable-basic-authentication.md | 29 +++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-) diff --git a/content/operate/rs/security/access-control/disable-basic-authentication.md b/content/operate/rs/security/access-control/disable-basic-authentication.md index 63abde82a1..da786752f7 100644 --- a/content/operate/rs/security/access-control/disable-basic-authentication.md +++ b/content/operate/rs/security/access-control/disable-basic-authentication.md @@ -30,9 +30,34 @@ When basic authentication is disabled, other configured authentication methods - **JWT authentication** — obtain a token with an [authorize user]({{}}) request, then send it as a bearer token on subsequent requests. -Some cluster-management flows require **certificate-based authentication** specifically when basic authentication is disabled—they don't use JWT or LDAP: +Some cluster-management flows support **certificate credentials** when Basic and Digest authentication are disabled or unavailable. These flows don't use JWT or LDAP: -- **Joining a node to the cluster** and **Active-Active (CRDB) management.** Configure these flows to use certificate credentials (client certificate, client key, and trusted CA) instead of a username and password. The client certificate's signing CA must be present in the cluster's `mtls_trusted_ca`. See [Certificate-based authentication]({{}}). +- **Joining a node to the cluster** and **Active-Active database management.** Configure these flows to use certificate credentials (client certificate, client key, and trusted CA) instead of a username and password. The client certificate's signing CA must be present in the cluster's `mtls_trusted_ca`. See [Certificate-based authentication for cluster management]({{}}). + +### Follow this order + +Set up and verify certificate-based authentication *before* you disable basic authentication. If you disable it first, you can lock yourself out of the cluster and out of Active-Active database management. + +1. Enable certificate-based authentication on the cluster (`mtls_certificate_authentication`) and add the client certificate's signing CA to the cluster's `mtls_trusted_ca`. See [Set up certificate-based authentication for the REST API]({{}}). + +1. Verify that certificate authentication works *while basic authentication is still enabled*. Enabling certificate-based authentication is additive—it doesn't disable password-based access: + + ```sh + curl --cert client.pem --key client.key https://:9443/v1/cluster + # HTTP 200 + ``` + +1. Verify that your client trusts the cluster's API certificate chain: + + ```sh + curl --cacert --cert client.pem --key client.key https://:9443/v1/cluster + ``` + +1. Configure certificate credentials for each participating cluster whose basic authentication you're disabling. Use either a username and password or certificate credentials per cluster—not both—so participating clusters can migrate one at a time. See [Manage an Active-Active database]({{}}). + +1. Disable basic authentication. + +If you lose access, see [Re-enable basic authentication](#re-enable-basic-authentication)—`rladmin` runs locally on a cluster node and doesn't require REST API access. ## Disable basic authentication From 2d62f45c0c97d0b836b0f2a25f46186103ea3f28 Mon Sep 17 00:00:00 2001 From: Kaitlyn Michael Date: Wed, 5 Aug 2026 22:14:44 -0500 Subject: [PATCH 3/5] document certificate credentials for cluster join and Active-Active --- .../certificate-based-authentication.md | 123 ++++++++++++++++++ 1 file changed, 123 insertions(+) diff --git a/content/operate/rs/security/certificates/certificate-based-authentication.md b/content/operate/rs/security/certificates/certificate-based-authentication.md index 931e310ef0..281b824940 100644 --- a/content/operate/rs/security/certificates/certificate-based-authentication.md +++ b/content/operate/rs/security/certificates/certificate-based-authentication.md @@ -192,6 +192,129 @@ The following example uses [cURL](https://curl.se/) to send a [REST API request] curl --request --url https://:9443// --cert client.pem --key client.key ``` +## Certificate-based authentication for cluster management + +Two cluster-management flows support certificate credentials when Basic and Digest authentication are disabled or unavailable: joining a node to a cluster, and managing an Active-Active database. These flows don't use JWT or LDAP. + +Certificate authentication isn't automatic—you must configure each flow to use certificate credentials instead of a username and password. First complete [Set up certificate-based authentication for the REST API](#set-up-certificate-based-authentication-for-the-rest-api) so the cluster has a trusted CA (`mtls_trusted_ca`) and mutual TLS enabled (`mtls_certificate_authentication`). + +### Certificate credentials + +Certificate credentials consist of three values: + +| Value | Required | Description | +|---|---|---| +| `client_cert` | Yes | The client certificate. | +| `client_key` | Yes | The client certificate's private key. | +| `trusted_ca` | No | The CA that validates the API certificate the peer cluster presents. If you omit it, the cluster uses the certificates in its `mtls_trusted_ca.pem` file. | + +Mutual TLS applies in both directions. The client presents its certificate, which the cluster validates against its locally configured `mtls_trusted_ca`. The cluster presents its API certificate chain, which the client validates using the CA configured for that connection. Make sure the CA that signed your client certificates is present in `mtls_trusted_ca` on the cluster. + +For any given cluster, use either a username and password or certificate credentials—never both. A request that includes both for the same cluster fails. + +The same three values take different formats depending on the interface: + +| Interface | Format | +|-----------|--------| +| Bootstrap API `credentials` | PEM strings | +| [`rladmin cluster join`]({{}}) | File paths | +| Active-Active REST API `certificate_auth` | PEM strings | +| [`crdb-cli`]({{}}) | PEM strings | + +### Join a node to the cluster + +To join a node with certificate credentials, include `client_cert`, `client_key`, and `trusted_ca` in the `credentials` object of a [bootstrap]({{}}) request. These fields take PEM strings: + +```sh +POST /v1/bootstrap/join_cluster +{ + "action": "join_cluster", + "cluster": { + "nodes": "" + }, + "credentials": { + "client_cert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n", + "client_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n", + "trusted_ca": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n" + } +} +``` + +[`rladmin cluster join`]({{}}) accepts the same three values as file paths, not PEM strings: + +```sh +rladmin cluster join nodes \ + client_cert \ + client_key \ + trusted_ca +``` + +### Manage an Active-Active database + +Each participating cluster in an Active-Active database authenticates separately. To use certificate credentials for a cluster, replace that cluster's `credentials` object with a `certificate_auth` object. + +Participating clusters can use different authentication methods, so you can migrate them from passwords to certificates one at a time. In the following example, the first cluster still uses a username and password while the second uses certificate credentials: + +```sh +POST /v1/crdbs +{ + "name": "cert-auth-aa", + "guid": "", + "default_db_config": { + "memory_size": 104857600, + "replication": true + }, + "instances": [ + { + "cluster": { + "name": "cluster1.local", + "url": "https://:9443", + "credentials": { + "username": "", + "password": "" + } + } + }, + { + "cluster": { + "name": "cluster2.local", + "url": "https://:9443", + "certificate_auth": { + "client_cert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n", + "client_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n", + "trusted_ca": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n" + } + } + } + ] +} +``` + +To create an Active-Active database with certificate credentials from the command line, use [`crdb-cli crdb create`]({{}}). The `--instance` option takes PEM strings: + +```sh +crdb-cli crdb create \ + --name cert-crdb \ + --instance "fqdn=cluster1.local,username=,password=" \ + --instance "fqdn=cluster2.local,client_cert=,client_key=,trusted_ca=" +``` + +To add a participating cluster to an existing Active-Active database, use [`crdb-cli crdb add-instance`]({{}}). Its `--instance` option accepts the same fields as `crdb-cli crdb create`: + +```sh +crdb-cli crdb add-instance \ + --crdb-guid \ + --instance "fqdn=cluster3.local,client_cert=,client_key=,trusted_ca=" +``` + +To switch an existing participating cluster from a username and password to certificate credentials, use [`crdb-cli crdb update`]({{}}) with the instance's `id`: + +```sh +crdb-cli crdb update \ + --crdb-guid \ + --credentials "id=2,client_cert=,client_key=,trusted_ca=" +``` + ## Certificate-based authentication for databases ### Set up certificate-based authentication for databases From ebad45a4a4b40ccc4b607fcd30f9998764188af2 Mon Sep 17 00:00:00 2001 From: Kaitlyn Michael Date: Wed, 5 Aug 2026 22:32:24 -0500 Subject: [PATCH 4/5] document certificate credentials across the join and Active-Active references --- .../crdb-cli/crdb/add-instance.md | 4 ++-- .../cli-utilities/crdb-cli/crdb/create.md | 14 ++++++++++--- .../cli-utilities/crdb-cli/crdb/update.md | 14 +++++++++++-- .../cli-utilities/rladmin/cluster/join.md | 21 +++++++++++++++---- .../rest-api/objects/bootstrap/credentials.md | 7 +++++-- .../rest-api/objects/crdb/cluster_info.md | 8 ++++++- 6 files changed, 54 insertions(+), 14 deletions(-) diff --git a/content/operate/rs/references/cli-utilities/crdb-cli/crdb/add-instance.md b/content/operate/rs/references/cli-utilities/crdb-cli/crdb/add-instance.md index c991a447b0..c62bb69443 100644 --- a/content/operate/rs/references/cli-utilities/crdb-cli/crdb/add-instance.md +++ b/content/operate/rs/references/cli-utilities/crdb-cli/crdb/add-instance.md @@ -14,7 +14,7 @@ Adds a peer replica to an existing Active-Active database in order to host the d ```sh crdb-cli crdb add-instance --crdb-guid - --instance fqdn=,username=,password=[,url=https://:9443,replication_endpoint=:,replication_tls_sni=] + --instance fqdn=,{ username=,password= | client_cert=,client_key=[,trusted_ca=] }[,url=https://:9443,replication_endpoint=:,replication_tls_sni=] [--compression <0-6>] [--wait | --no-wait] ``` @@ -24,7 +24,7 @@ crdb-cli crdb add-instance --crdb-guid | Parameter | Value | Description | |-----------|---------|-------------| | crdb-guid | string | The GUID of the database (required) | -| instance fqdn=\,username=\,password=\,url=https://\:9443,replication_endpoint=\:\,replication_tls_sni=\ | strings | The connection information for the new participating cluster (required)

**Required:**
• `fqdn` - Cluster fully qualified domain name
• `username` - Cluster username
• `password` - Cluster password

**Optional:**
• `url` - URL to access the cluster's REST API
• `replication_endpoint` - Address to access the database instance for peer replication
• `replication_tls_sni` - Cluster [Server Name Indication (SNI)](https://en.wikipedia.org/wiki/Server_Name_Indication) hostname for TLS connections | +| instance fqdn=\,username=\,password=\,url=https://\:9443,replication_endpoint=\:\,replication_tls_sni=\ | strings | The connection information for the new participating cluster (required)

**Required:**
• `fqdn` - Cluster fully qualified domain name
• Either a username and password, or certificate credentials:
  - `username` and `password` - Cluster username and password
  - `client_cert` and `client_key` - Client certificate and its private key, as PEM strings

Don't provide both for the same cluster. The command fails with `Use either username/password or client_cert/client_key/trusted_ca, not both`.

**Optional:**
• `trusted_ca` - CA that validates the API certificate the peer cluster presents, as a PEM string. Only valid with certificate credentials. If you omit it, the cluster uses the certificates in its `mtls_trusted_ca.pem` file.
• `url` - URL to access the cluster's REST API
• `replication_endpoint` - Address to access the database instance for peer replication
• `replication_tls_sni` - Cluster [Server Name Indication (SNI)](https://en.wikipedia.org/wiki/Server_Name_Indication) hostname for TLS connections

See [Certificate-based authentication for cluster management]({{}}). | | compression | 0-6 | The level of data compression:

0 = No compression

6 = High compression and resource load (Default: 3) | | wait | | Prevents `crdb-cli` from running another command before this command finishes | | no-wait | | `crdb-cli` can run another command before this command finishes | diff --git a/content/operate/rs/references/cli-utilities/crdb-cli/crdb/create.md b/content/operate/rs/references/cli-utilities/crdb-cli/crdb/create.md index 62560d419f..948f12830b 100644 --- a/content/operate/rs/references/cli-utilities/crdb-cli/crdb/create.md +++ b/content/operate/rs/references/cli-utilities/crdb-cli/crdb/create.md @@ -15,8 +15,8 @@ Creates an Active-Active database. ```sh crdb-cli crdb create --name --memory-size - --instance fqdn=,username=,password=[,url=https://:9443,replication_endpoint=:,replication_tls_sni=] - --instance fqdn=,username=,password=[,url=https://:9443,replication_endpoint=:,replication_tls_sni=] + --instance fqdn=,{ username=,password= | client_cert=,client_key=[,trusted_ca=] }[,url=https://:9443,replication_endpoint=:,replication_tls_sni=] + --instance fqdn=,{ username=,password= | client_cert=,client_key=[,trusted_ca=] }[,url=https://:9443,replication_endpoint=:,replication_tls_sni=] [--port ] [--wait | --no-wait] [--default-db-config ] @@ -52,7 +52,7 @@ Before you create an Active-Active database, you must have: |---------------------------------------------------------------------------------------|-------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | name \ | string | Name of the Active-Active database (required) | | memory-size \ | size in bytes, megabytes (MB), or gigabytes (GB) | Maximum database memory (required) | -| instance fqdn=\,username=\,password=\,url=https://\:9443,replication_endpoint=\:\,replication_tls_sni=\ | strings | The connection information for the participating clusters (required for each participating cluster)

**Required:**
• `fqdn` - Cluster fully qualified domain name
• `username` - Cluster username
• `password` - Cluster password

**Optional:**
• `url` - URL to access the cluster's REST API
• `replication_endpoint` - Address to access the database instance for peer replication
• `replication_tls_sni` - Cluster [Server Name Indication (SNI)](https://en.wikipedia.org/wiki/Server_Name_Indication) hostname for TLS connections | +| instance fqdn=\,username=\,password=\,url=https://\:9443,replication_endpoint=\:\,replication_tls_sni=\ | strings | The connection information for the participating clusters (required for each participating cluster)

**Required:**
• `fqdn` - Cluster fully qualified domain name
• Either a username and password, or certificate credentials:
  - `username` and `password` - Cluster username and password
  - `client_cert` and `client_key` - Client certificate and its private key, as PEM strings

Don't provide both for the same cluster. The command fails with `Use either username/password or client_cert/client_key/trusted_ca, not both`.

**Optional:**
• `trusted_ca` - CA that validates the API certificate the peer cluster presents, as a PEM string. Only valid with certificate credentials. If you omit it, the cluster uses the certificates in its `mtls_trusted_ca.pem` file.
• `url` - URL to access the cluster's REST API
• `replication_endpoint` - Address to access the database instance for peer replication
• `replication_tls_sni` - Cluster [Server Name Indication (SNI)](https://en.wikipedia.org/wiki/Server_Name_Indication) hostname for TLS connections

See [Certificate-based authentication for cluster management]({{}}). | | port \ | integer | TCP port for the Active-Active database on all participating clusters | | default-db-config \ | string | Default database configuration options. For a list of database settings, see the [CRDB database config object]({{}}) reference.| | default-db-config-file \ | filepath | Default database configuration options from a file. For a list of database settings, see the [CRDB database config object]({{}}) reference.| @@ -117,3 +117,11 @@ To create an Active-Active database with 1 shard in each instance and not wait f ```sh crdb-cli crdb create --name mycrdb --memory-size 100mb --port 12000 --instance fqdn=cluster1.redis.local,username=admin@redis.local,password=admin --instance fqdn=cluster2.redis.local,username=admin@redis.local,password=admin --no-wait ``` + +To create an Active-Active database where one participating cluster uses certificate credentials instead of a username and password: + +```sh +crdb-cli crdb create --name mycrdb --memory-size 100mb --port 12000 \ + --instance fqdn=cluster1.redis.local,username=admin@redis.local,password=admin \ + --instance fqdn=cluster2.redis.local,client_cert=,client_key=,trusted_ca= +``` diff --git a/content/operate/rs/references/cli-utilities/crdb-cli/crdb/update.md b/content/operate/rs/references/cli-utilities/crdb-cli/crdb/update.md index 5ef4f3d23e..600fb71570 100644 --- a/content/operate/rs/references/cli-utilities/crdb-cli/crdb/update.md +++ b/content/operate/rs/references/cli-utilities/crdb-cli/crdb/update.md @@ -20,7 +20,7 @@ crdb-cli crdb update --crdb-guid [--default-db-config-file ] [--compression <0-6>] [--causal-consistency { true | false } ] - [--credentials id=,username=,password= ] + [--credentials id=,{ username=,password= | client_cert=,client_key=[,trusted_ca=] } ] [--encryption { true | false } ] [--oss-cluster { true | false } ] [--featureset-version { true | false } ] @@ -42,7 +42,7 @@ If you want to change the configuration of the local instance only, use [`rladmi | memory-size \ | size in bytes, kilobytes (KB), or gigabytes (GB) | Maximum database memory (required) | | causal-consistency | true
false | [Causal consistency]({{< relref "/operate/rs/databases/active-active/causal-consistency.md" >}}) applies updates to all instances in the order they were received | | compression | 0-6 | The level of data compression:

0 = No compression

6 = High compression and resource load (Default: 3) | -| credentials id=\,username=\,password=\ | strings | Updates the credentials for access to the instance | +| credentials id=\,username=\,password=\ | strings | Updates the credentials for access to the instance identified by `id`.

Provide either a username and password, or certificate credentials—not both. The command fails with `Use either username/password or client_cert/client_key/trusted_ca, not both`.

• `username` and `password` - Cluster username and password
• `client_cert` and `client_key` - Client certificate and its private key, as PEM strings. Both are required for certificate credentials.
• `trusted_ca` - Optional CA that validates the API certificate the peer cluster presents, as a PEM string. If you omit it, the cluster uses the certificates in its `mtls_trusted_ca.pem` file.

Use this option to migrate a participating cluster from a username and password to certificate credentials. See [Certificate-based authentication for cluster management]({{}}). | | default-db-config \ | | Default database configuration from stdin. For a list of database settings, see the [CRDB database config object]({{}}) reference. | | default-db-config-file \ | filepath | Default database configuration from file. For a list of database settings, see the [CRDB database config object]({{}}) reference.| | encryption | true
false | Activates or deactivates encryption | @@ -79,3 +79,13 @@ Task created ---> Status changed: queued -> started ---> Status changed: started -> finished ``` + +The following example switches a participating cluster from a username and password to certificate credentials: + +```sh +$ crdb-cli crdb update --crdb-guid \ + --credentials id=2,client_cert=,client_key=,trusted_ca= +Task created + ---> Status changed: queued -> started + ---> Status changed: started -> finished +``` diff --git a/content/operate/rs/references/cli-utilities/rladmin/cluster/join.md b/content/operate/rs/references/cli-utilities/rladmin/cluster/join.md index 2ed1efd1dc..78b35de2a9 100644 --- a/content/operate/rs/references/cli-utilities/rladmin/cluster/join.md +++ b/content/operate/rs/references/cli-utilities/rladmin/cluster/join.md @@ -19,8 +19,8 @@ Adds a node to an existing cluster. ```sh rladmin cluster join nodes - username - password + { username password + | client_cert client_key [ trusted_ca ] } [ ephemeral_path ] [ persistent_path ] [ ccs_persistent_path ] @@ -44,6 +44,8 @@ rladmin cluster join | accept_servers | 'enabled'
'disabled' | Allows allocation of resources on the new node when enabled (optional) | | addr | IP address | Sets a node's internal IP address. If not provided, the node sets the address automatically. (optional) | | ccs_persistent_path | filepath (default: /var/opt/redislabs/persist) | Path to the CCS snapshot location (the default is the same as persistent_path) (optional) | +| client_cert | filepath | Path to a file containing the client certificate in PEM format. Use either a username and password or certificate credentials to join a node. Required with `client_key`. See [Certificate-based authentication for cluster management]({{}}). | +| client_key | filepath | Path to a file containing the client certificate's private key in PEM format. Required with `client_cert`. | | cnm_http_port | integer | Joins a cluster that has a non-default cnm_http_port (optional) | | ephemeral_path | filepath | Path to the ephemeral storage location (optional) | | external_addr | list of IP addresses | Sets a node's external IP addresses (space-delimited list). If not provided, the node sets the address automatically. (optional) | @@ -52,12 +54,13 @@ rladmin cluster join | nodes | IP address | Internal IP address of an existing node in the cluster | | override_rack_id | | Changes to a new rack, specified by `rack_id` (optional) | | override_repair | | Enables joining a cluster with a dead node (optional) | -| password | string | Admin user's password | +| password | string | Admin user's password. Required unless you use certificate credentials. | | persistent_path | filepath (default: /var/opt/redislabs/persist) | Path to the persistent storage location (optional) | | rack_id | string | Moves the node to the specified rack (optional) | | replace_node | integer | Replaces the specified node with the new node (optional) | | second_rack_id | string | The unique identifier of the node's second rack ID for two-dimensional rack awareness (optional) | -| username | email address | Admin user's email address | +| trusted_ca | filepath | Path to a file containing the CA that validates the API certificate the cluster presents, in PEM format. If you omit it, the node uses the certificates in the cluster's `mtls_trusted_ca.pem` file. (optional) | +| username | email address | Admin user's email address. Required unless you use certificate credentials. | ### Returns @@ -71,3 +74,13 @@ $ rladmin cluster join nodes 192.0.2.2 \ password admin-password Joining cluster... ok ``` + +To join a node using certificate credentials instead of a username and password, pass the file paths to the certificate, key, and CA: + +```sh +$ rladmin cluster join nodes 192.0.2.2 \ + client_cert /etc/opt/redislabs/client.pem \ + client_key /etc/opt/redislabs/client.key \ + trusted_ca /etc/opt/redislabs/ca.pem +Joining cluster... ok +``` diff --git a/content/operate/rs/references/rest-api/objects/bootstrap/credentials.md b/content/operate/rs/references/rest-api/objects/bootstrap/credentials.md index 829ca8be8a..e4642a5839 100644 --- a/content/operate/rs/references/rest-api/objects/bootstrap/credentials.md +++ b/content/operate/rs/references/rest-api/objects/bootstrap/credentials.md @@ -13,5 +13,8 @@ weight: $weight | Name | Type/Value | Description | |------|------------|-------------| -| password | string | Admin password | -| username | string | Admin username (pattern does not allow special characters &,\<,>,") | +| client_cert | string | Client certificate as a PEM string. Use certificate credentials instead of a username and password to join a node to a cluster. Required with `client_key`. See [Certificate-based authentication for cluster management]({{}}). | +| client_key | string | The client certificate's private key as a PEM string. Required with `client_cert`. | +| password | string | Admin password. Required unless you use certificate credentials. | +| trusted_ca | string | CA that validates the API certificate the cluster presents, as a PEM string. If you omit it, the cluster uses the certificates in its `mtls_trusted_ca.pem` file. | +| username | string | Admin username (pattern does not allow special characters &,\<,>,"). Required unless you use certificate credentials. | diff --git a/content/operate/rs/references/rest-api/objects/crdb/cluster_info.md b/content/operate/rs/references/rest-api/objects/crdb/cluster_info.md index 1888aa3e7c..e1972288f5 100644 --- a/content/operate/rs/references/rest-api/objects/crdb/cluster_info.md +++ b/content/operate/rs/references/rest-api/objects/crdb/cluster_info.md @@ -14,11 +14,17 @@ Configuration details for a cluster that is part of an Active-Active database. | Name | Type/Value | Description | |------|------------|-------------| +| certificate_auth | {{}} +{ + "client_cert": string, + "client_key": string, + "trusted_ca": string +} {{}} | Certificate credentials for cluster access, as PEM strings. Required unless you use `credentials`; a request that includes both for the same cluster fails.
**client_cert**: Client certificate (required)
**client_key**: Client certificate's private key (required)
**trusted_ca**: CA that validates the API certificate the peer cluster presents. If omitted, the cluster uses the certificates in its `mtls_trusted_ca.pem` file.

See [Certificate-based authentication for cluster management]({{}}). | | credentials | {{}} { "username": string, "password": string -} {{}} | Cluster access credentials (required) | +} {{}} | Cluster access credentials. Required unless you use `certificate_auth`; a request that includes both for the same cluster fails. | | name | string | Cluster fully qualified name, used to uniquely identify the cluster. Typically this is the same as the hostname used in the URL, although in some configruations the URL may point to a different name/address. (required) | | replication_endpoint | string | Address to use for peer replication. If not specified, it is assumed that standard cluster naming conventions apply. | | replication_tls_sni | string | Cluster SNI for TLS connections | From 5baf3bc2e91a2367ece49c6fa61c2a5c9f1e196e Mon Sep 17 00:00:00 2001 From: Kaitlyn Michael Date: Wed, 5 Aug 2026 22:34:50 -0500 Subject: [PATCH 5/5] fix typo in CRDB cluster info object reference --- .../operate/rs/references/rest-api/objects/crdb/cluster_info.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/operate/rs/references/rest-api/objects/crdb/cluster_info.md b/content/operate/rs/references/rest-api/objects/crdb/cluster_info.md index e1972288f5..6eac49d1b6 100644 --- a/content/operate/rs/references/rest-api/objects/crdb/cluster_info.md +++ b/content/operate/rs/references/rest-api/objects/crdb/cluster_info.md @@ -25,7 +25,7 @@ Configuration details for a cluster that is part of an Active-Active database. "username": string, "password": string } {{}} | Cluster access credentials. Required unless you use `certificate_auth`; a request that includes both for the same cluster fails. | -| name | string | Cluster fully qualified name, used to uniquely identify the cluster. Typically this is the same as the hostname used in the URL, although in some configruations the URL may point to a different name/address. (required) | +| name | string | Cluster fully qualified name, used to uniquely identify the cluster. Typically this is the same as the hostname used in the URL, although in some configurations the URL may point to a different name/address. (required) | | replication_endpoint | string | Address to use for peer replication. If not specified, it is assumed that standard cluster naming conventions apply. | | replication_tls_sni | string | Cluster SNI for TLS connections | | url | string | Cluster access URL (required) |