How AlloyDB Omni uses TLS

Preview

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

For information about access to this release, see the access request page.

Select a documentation version: 18.1.0

• Current (18.1.0)
• 18.1.0

AlloyDB Omni uses Transport Layer Security (TLS) to secure communications between itself and external components such as PostgreSQL clients, backup servers, and database applications. If you don't configure TLS yourself, then AlloyDB Omni configures it for you using self-signed certificates.

For more information on configuring the TLS certificates required for AlloyDB Omni, see Configure TLS certificates.

The following diagram illustrates the communication and network paths used in AlloyDB Omni.

The following table lists each communication path and its required certificate.

Communication path	Required certificate
etcd <--> etcd	etcd SSL certificate
AlloyDB Omni orchestrator <--> Cluster manager	Control path SSL certificate
Cluster manager <--> etcd	etcd SSL certificate
Cluster manager <--> Node manager	Control path SSL certificate
PostgreSQL client <--> HAProxy <--> AlloyDB Omni	Data path SSL certificate
PostgreSQL Client <--> PgBouncer <--> HAProxy <--> AlloyDB Omni	Data path SSL certificate
AlloyDB Omni <--> pgBackRest repository server	Data path SSL certificate
AlloyDB Omni <--> log server (ELK stack)	Data path SSL certificate

What's next

• Configure TLS certificates.