How AlloyDB Omni uses TLS

Select a documentation version: 18.1.0 keyboard_arrow_down

• Current (18.1.0)
• 18.1.0

AlloyDB Omni uses Transport Layer Security (TLS) to secure communications between itself and external components such as PostgreSQL clients, backup servers, and database applications. If you don't configure TLS yourself, then AlloyDB Omni configures it for you using self-signed certificates.

For more information on configuring the TLS certificates required for AlloyDB Omni, see Configure TLS certificates .

The following diagram illustrates the communication and network paths used in AlloyDB Omni.

The following table lists each communication path and its required certificate.

Communication path	Required certificate
etcd <--> etcd	etcd SSL certificate
AlloyDB Omni orchestrator <--> Cluster manager	Control path SSL certificate
Cluster manager <--> etcd	etcd SSL certificate
Cluster manager <--> Node manager	Control path SSL certificate
PostgreSQL client <--> HAProxy <--> AlloyDB Omni	Data path SSL certificate
PostgreSQL Client <--> PgBouncer <--> HAProxy <--> AlloyDB Omni	Data path SSL certificate
AlloyDB Omni <--> pgBackRest repository server	Data path SSL certificate
AlloyDB Omni <--> log server (ELK stack)	Data path SSL certificate

What's next

• Configure TLS certificates .