ElastiCache

ElastiCache subnet groups and Redis/Valkey replication groups with TLS, encryption, and automatic failover.

API Group: aws.konfig.io/v1alpha1

ElastiCacheSubnetGroup # ✅ Working

Creates an ElastiCache subnet group for placing cache clusters in specific subnets. For multi-AZ deployments, include subnets from multiple Availability Zones.

Spec

Field	Type	Required	Description
subnetGroupName	string	✅	Name of the ElastiCache subnet group. Immutable after creation.
description	string	✅	Description of the subnet group.
subnetRefs	[]SubnetRef	✅	List of subnet CR names or direct IDs. At least one required. Use multiple AZs for multi-AZ replication groups.
tags	map[string]string		AWS tags applied to the subnet group.

Status

Field	Description
arn	The ARN of the ElastiCache subnet group.
conditions	Standard Kubernetes conditions.
observedGeneration	Last reconciled generation.
lastSyncTime	RFC3339 timestamp of last sync.

Example

apiVersion: aws.konfig.io/v1alpha1
kind: ElastiCacheSubnetGroup
metadata:
  name: prod-cache-subnet-group
  namespace: cache
spec:
  subnetGroupName: prod-cache-subnet-group
  description: "Production ElastiCache subnet group"
  subnetRefs:
    - prod-private-subnet-1a
    - prod-private-subnet-1b
    - prod-private-subnet-1c
  tags:
    env: prod

Notes

For multi-AZ replication groups with automaticFailover: true, include subnets in at least two different Availability Zones.

Deletion

Blocked if in use. Cannot be deleted while referenced by an ElastiCache replication group. Delete the replication group first.

ElastiCacheReplicationGroup # ✅ Working ⏱ async

Creates and manages an ElastiCache replication group for Redis or Valkey. Supports TLS, at-rest encryption, automatic failover, and auth tokens for secure access.

⏱ Async — provisioning takes several minutes. Controller polls every 30 seconds until the replication group reaches the available state.

Spec

Field	Type	Required	Description
replicationGroupId	string	✅	Unique ID for the replication group. Immutable after creation.
description	string	✅	Human-readable description of the replication group.
engine	string	✅	`redis` or `valkey`.
engineVersion	string	✅	Engine version (e.g. `7.1`, `7.2` for Valkey).
cacheNodeType	string	✅	Node type (e.g. `cache.t3.micro`, `cache.r6g.large`).
numCacheClusters	int32		Number of cache clusters in the replication group (1–6). Default: 1. Set to ≥2 to enable failover.
automaticFailover	bool		Enable automatic failover to a read replica on primary failure. Requires `numCacheClusters ≥ 2`.
subnetGroupRef	string	✅	Name of the `ElastiCacheSubnetGroup` CR.
securityGroupRefs	[]string		Names of `SecurityGroup` CRs.
atRestEncryption	bool		Enable encryption at rest. Immutable after creation.
transitEncryption	bool		Enable in-transit TLS encryption. Required when using `authToken`. Immutable after creation.
authToken	string		Auth token (password) for Redis AUTH command. Required when `transitEncryption: true`.
snapshotRetentionLimit	int32		Days to retain automatic snapshots (0–35). 0 disables snapshots.
tags	map[string]string		AWS tags applied to the replication group.

Status

Field	Description
arn	The ARN of the replication group.
primaryEndpoint	Primary endpoint for write connections.
readerEndpoint	Reader endpoint for read connections (multi-node groups).
status	Current status: `creating`, `available`, `modifying`, `deleting`.
conditions	Standard Kubernetes conditions.
observedGeneration	Last reconciled generation.
lastSyncTime	RFC3339 timestamp of last sync.

Example — Single-Node Dev Redis

apiVersion: aws.konfig.io/v1alpha1
kind: ElastiCacheReplicationGroup
metadata:
  name: dev-redis
  namespace: cache
spec:
  replicationGroupId: dev-redis
  description: "Development Redis cache"
  engine: redis
  engineVersion: "7.1"
  cacheNodeType: cache.t3.micro
  numCacheClusters: 1
  subnetGroupRef: dev-cache-subnet-group
  securityGroupRefs:
    - cache-sg
  snapshotRetentionLimit: 0
  tags:
    env: dev

Example — HA Production Redis with TLS

apiVersion: aws.konfig.io/v1alpha1
kind: ElastiCacheReplicationGroup
metadata:
  name: prod-redis
  namespace: cache
spec:
  replicationGroupId: prod-redis
  description: "Production Redis replication group"
  engine: redis
  engineVersion: "7.1"
  cacheNodeType: cache.r6g.large
  numCacheClusters: 3
  automaticFailover: true
  subnetGroupRef: prod-cache-subnet-group
  securityGroupRefs:
    - cache-sg
  atRestEncryption: true
  transitEncryption: true
  authToken: "your-strong-auth-token-here"
  snapshotRetentionLimit: 7
  tags:
    env: prod
    service: session-cache

Example — Valkey

apiVersion: aws.konfig.io/v1alpha1
kind: ElastiCacheReplicationGroup
metadata:
  name: prod-valkey
  namespace: cache
spec:
  replicationGroupId: prod-valkey
  description: "Production Valkey cache"
  engine: valkey
  engineVersion: "7.2"
  cacheNodeType: cache.r7g.large
  numCacheClusters: 2
  automaticFailover: true
  subnetGroupRef: prod-cache-subnet-group
  securityGroupRefs:
    - cache-sg
  atRestEncryption: true
  transitEncryption: true
  authToken: "your-valkey-auth-token"
  snapshotRetentionLimit: 3
  tags:
    env: prod
    engine: valkey

Notes

Updates to most fields are gated on observedGeneration (generation-gated) to avoid unnecessary ModifyReplicationGroup calls.
automaticFailover: true requires numCacheClusters ≥ 2.
The authToken is not reflected in status fields for security. Store it in a Kubernetes Secret and reference it in application configuration.
Use readerEndpoint for read connections and primaryEndpoint for write connections in multi-node setups.
atRestEncryption and transitEncryption are immutable after creation.

Deletion

Immediate. The replication group is deleted without creating a final snapshot. All cached data is permanently lost. Ensure application-side cache warm-up is acceptable before deleting.