Configure TLS

You can enable Transport Layer Security (TLS) for several surfaces in a Dremio Kubernetes deployment: coordinator web, client, and Arrow Flight connections; Open Catalog external access; internal fabric communication between coordinators and executors; and OpenSearch.

Create a TLS Secret

Before enabling TLS for any coordinator or catalog surface, create a Kubernetes TLS secret from your certificate and private key files.

Run kubectl to create a TLS secret

kubectl create secret tls <your-tls-secret-name> --key privkey.pem --cert cert.pem

For more information, see kubectl create secret tls in the Kubernetes documentation.

warning

TLS for OpenSearch requires a secret of a different format. See Configure TLS for OpenSearch.

Configure Coordinator TLS

You can enable TLS independently for the coordinator's web interface, JDBC/ODBC client connections, and Arrow Flight connections. For each surface you want to enable, set enabled: true and provide the name of the TLS secret you created above.

Coordinator TLS configuration

coordinator:
  client:
    tls:
      enabled: false
      secret: <your-tls-secret>
  flight:
    tls:
      enabled: false
      secret: <your-tls-secret>
  web:
    tls:
      enabled: false
      secret: <your-tls-secret>
  ...

note

If you enable web TLS on the coordinator, additional configuration is required for the Open Catalog. See Configure Open Catalog When Coordinator Web Uses TLS.

Configure TLS for Open Catalog External Access

You can require TLS for clients connecting to the Open Catalog from outside the namespace.

1. Create a TLS secret as described in Create a TLS Secret.

2. Enable external access with TLS in your values-overrides.yaml file:

   Open Catalog external access TLS configuration

   catalog:
     externalAccess:
       enabled: true
       tls:
         enabled: true
         secret: <your-catalog-tls-secret>
     ...

Configure Open Catalog When Coordinator Web Uses TLS

When the coordinator's web interface uses TLS (coordinator.web.tls.enabled: true), the Helm chart automatically constructs the coordinator's authentication URL from the pod name and namespace. You do not need to set authServerUrl unless the auto-generated value is incorrect for your environment — for example, when using a custom cluster DNS domain.

If you need to override the URL, set authServerUrl to the full HTTPS address of the coordinator:

Open Catalog configuration with explicit auth server URL

catalog:
  externalAccess:
    enabled: true
    authentication:
      authServerUrl: https://dremio-master-0.dremio-cluster-pod.{{ .Release.Namespace }}.svc.cluster.local:9047
  ...

The URL must resolve to the coordinator's web interface. If the coordinator's TLS certificate does not cover the resolved hostname — for example, when using a wildcard certificate — you can disable hostname verification as a last resort:

Open Catalog configuration with hostname verification disabled

catalog:
  externalAccess:
    enabled: true
    authentication:
      disableHostnameVerification: true
  ...

Configure Fabric TLS

You can enable TLS for internal communication between coordinators and executors using the dremioConfExtraOptions block. The example below uses auto-generated self-signed certificates.

Fabric TLS configuration using auto-generated certificates

dremio:
  dremioConfExtraOptions:
    "services.fabric.ssl.enabled": true
    "services.fabric.ssl.auto-certificate.enabled": true
  ...

Configure TLS for OpenSearch

Dremio generates TLS certificates for OpenSearch by default and rotates them monthly. If you want to provide your own certificates, create two secrets containing the relevant files. The tls.crt, tls.key, and ca.crt files must be in PEM format.

Run kubectl to create TLS secrets for OpenSearch

kubectl create secret generic opensearch-tls-certs \
  --from-file=tls.crt --from-file=tls.key --from-file=ca.crt

kubectl create secret generic opensearch-tls-certs-admin \
  --from-file=tls.crt --from-file=tls.key --from-file=ca.crt

Add the following to your values-overrides.yaml before deploying. Because OpenSearch requires TLS, if you disable certificate generation you must provide your own certificate.

OpenSearch custom TLS certificate configuration

opensearch:
  tlsCertsSecretName: <opensearch-tls-certs>
  disableTlsCertGeneration: true
...

Configure TLS with S3-Compatible Storage

When using S3-compatible storage (such as MinIO) as the distributed storage and Open Catalog storage backend, you need to configure TLS verification and add your S3 CA certificate to Dremio's truststore.

Before starting, complete the following:

• Create a TLS Secret for the coordinator and, if using Open Catalog external access, for the catalog
• Configure Coordinator TLS
• Configure Distributed Storage for your S3-compatible endpoint, enabling TLS verification
• Configure Open Catalog Storage for your S3-compatible backend
• Configure TLS for Open Catalog External Access if exposing the catalog outside the cluster

Trust the S3-Compatible Certificate

Both the coordinator and executors need your CA certificate added to their JVM truststore. The JVM's default cacerts file lives inside the Dremio image and cannot be modified directly. Instead, an init container copies cacerts to a shared emptyDir volume, imports your CA certificate PEM into it using keytool, and the main container's JVM reads from that copy on startup.

For Managed Engines, the four pieces are intentionally split across engine, engine.executor, and executor keys.

First, store your CA certificate as a Kubernetes Secret:

Create a Kubernetes Secret for the CA certificate

kubectl create secret generic s3-ca-cert \
  --from-file=ca.crt=/path/to/your-s3-ca.pem \
  -n <dremio-namespace>

Then add the following to your values-overrides.yaml:

Coordinator truststore configuration

coordinator:
  extraInitContainers: |
    - name: import-s3-ca
      image: {{ $.Values.dremio.image.repository }}:{{ $.Values.dremio.image.tag }}
      command: ["sh", "-c"]
      args:
        - |
          set -e
          cp $JAVA_HOME/lib/security/cacerts /shared-tls/cacerts
          chmod 644 /shared-tls/cacerts
          keytool -importcert -noprompt \
            -alias s3-endpoint-ca \
            -file /ca/ca.crt \
            -keystore /shared-tls/cacerts \
            -storepass changeit
      volumeMounts:
        - name: shared-tls
          mountPath: /shared-tls
        - name: s3-ca
          mountPath: /ca
  extraVolumes:
    - name: shared-tls
      emptyDir: {}
    - name: s3-ca
      secret:
        secretName: s3-ca-cert
  extraVolumeMounts:
    - name: shared-tls
      mountPath: /shared-tls
  extraStartParams: >-
    -Djavax.net.ssl.trustStore=/shared-tls/cacerts
    -Djavax.net.ssl.trustStorePassword=changeit

Managed Engine truststore configuration

engine:
  extraVolumes:
    - name: shared-tls
      emptyDir: {}
    - name: s3-ca
      secret:
        secretName: s3-ca-cert
  executor:
    extraInitContainers: |
      - name: import-s3-ca
        image: {{ $.Values.dremio.image.repository }}:{{ $.Values.dremio.image.tag }}
        command: ["sh", "-c"]
        args:
          - |
            set -e
            cp $JAVA_HOME/lib/security/cacerts /shared-tls/cacerts
            chmod 644 /shared-tls/cacerts
            keytool -importcert -noprompt \
              -alias s3-endpoint-ca \
              -file /ca/ca.crt \
              -keystore /shared-tls/cacerts \
              -storepass changeit
        volumeMounts:
          - name: shared-tls
            mountPath: /shared-tls
          - name: s3-ca
            mountPath: /ca
  options:
    javaOptions:
      - name: "S3TrustStore"
        pattern: "-Djavax.net.ssl.trustStore=%s"
        valueMatcher: "^/[\\w./-]+$"
        applyByDefault: false
      - name: "S3TrustStorePassword"
        pattern: "-Djavax.net.ssl.trustStorePassword=%s"
        valueMatcher: "^\\S+$"
        applyByDefault: false

executor:
  extraVolumeMounts:
    - name: shared-tls
      mountPath: /shared-tls

For classic engines, all four pieces live under executor.*:

Classic engine truststore configuration

executor:
  extraInitContainers: |
    - name: import-s3-ca
      image: {{ $.Values.dremio.image.repository }}:{{ $.Values.dremio.image.tag }}
      command: ["sh", "-c"]
      args:
        - |
          set -e
          cp $JAVA_HOME/lib/security/cacerts /shared-tls/cacerts
          chmod 644 /shared-tls/cacerts
          keytool -importcert -noprompt \
            -alias s3-endpoint-ca \
            -file /ca/ca.crt \
            -keystore /shared-tls/cacerts \
            -storepass changeit
      volumeMounts:
        - name: shared-tls
          mountPath: /shared-tls
        - name: s3-ca
          mountPath: /ca
  extraVolumes:
    - name: shared-tls
      emptyDir: {}
    - name: s3-ca
      secret:
        secretName: s3-ca-cert
  extraVolumeMounts:
    - name: shared-tls
      mountPath: /shared-tls
  extraStartParams: >-
    -Djavax.net.ssl.trustStore=/shared-tls/cacerts
    -Djavax.net.ssl.trustStorePassword=changeit

Verify the Configuration

After deploying, confirm the CA is present in the truststore:

Confirm CA is present in the truststore

kubectl exec -n <dremio-namespace> <pod-name> -- \
  keytool -list -keystore /shared-tls/cacerts -storepass changeit | grep -i s3-endpoint-ca

For a functional test, add or edit the S3-compatible source in the Dremio console. A successful save confirms the coordinator trusts the endpoint; a query that reads data confirms the executors do too.