New to KubeDB? Please start here.

Reconfiguring TLS of Neo4j Database

This guide gives an overview of how KubeDB Ops-manager reconfigures TLS for a Neo4j database, including adding TLS, rotating certificates, updating issuer reference, and removing TLS through Neo4jOpsRequest.

Before You Begin

• You should be familiar with Neo4j.
• You should be familiar with Neo4jOpsRequest.

How Reconfiguring Neo4j TLS Works

The following diagram shows the TLS reconfiguration flow for a Neo4j database. Open the image in a new tab to see the enlarged version.

The process consists of the following steps:

1. A user creates a Neo4j Custom Resource.
2. KubeDB Provisioner reconciles the database and creates required workloads and secrets.
3. To update TLS settings, the user creates a Neo4jOpsRequest with spec.type: ReconfigureTLS.
4. KubeDB Ops-manager watches the Neo4jOpsRequest and validates the spec.tls fields.
5. Ops-manager temporarily pauses conflicting reconciliation for the target database.
6. It applies the requested TLS action (add/update via issuerRef, rotate via rotateCertificates, or disable via remove).
7. It rolls/restarts the required pods so updated TLS configuration is picked up.
8. After successful checks, Ops-manager marks the request Successful and resumes normal reconciliation.

In the next guide, we show the step-by-step workflow for each TLS reconfiguration operation.

Next Step

• Follow: Reconfigure TLS in Neo4j.