# External Cache Configuration

This guide demonstrates how to configure an external key-value cache (such as Redis or Memcached) with the Immuta Enterprise Helm chart (IEHC).

{% hint style="info" %}
**Kubernetes namespace**

The following section(s) presume the IEHC was deployed into namespace `immuta` and that the current namespace is `immuta`.
{% endhint %}

## Prerequisite

The [Production best practices](/latest/configuration/self-managed-deployment/configure/immuta-in-production.md) guide must be completed before proceeding.

### Redis

1. Edit secret `immuta-secret` that was created in the [Immuta in production](/latest/configuration/self-managed-deployment/configure/immuta-in-production.md) guide.

   ```bash
   kubectl edit secret/immuta-secret
   ```
2. Add key-value `IMMUTA_SERVER_CACHE_PROVIDER_OPTIONS_PASSWORD=<cache-password>`.

## Edit Helm values

Edit the `immuta-values.yaml` file to include the relevant Helm values listed below. Update all [placeholder values](/latest/configuration/self-managed-deployment/conventions.md) with your own values.

### Redis

{% hint style="info" %}
**TLS configuration**

TLS must be configured both client-side and server-side. The following Helm values demonstrate connecting to Redis with TLS enabled.
{% endhint %}

```yaml
cache:
  enabled: false

secure:
  extraConfig:
    server:
      cache:
        provider:
          constructor: catbox-redis
          options:
            host: <redis-fqdn>
            port: <port>
            # Setting options.tls to an empty dict enables TLS without configuring any other options.
            tls: {}

            # Dict representation of TLS config options json-object for package ioredis
            # https://github.com/redis/ioredis
            #
            # tls:
            #   ca:
            #   key:
            #   cert:

  extraEnvVars:
  - name: IMMUTA_SERVER_CACHE_PROVIDER_OPTIONS_PASSWORD
    valueFrom:
      secretKeyRef:
        key: IMMUTA_SERVER_CACHE_PROVIDER_OPTIONS_PASSWORD
        name: immuta-secret
```

### Memcached

```yaml
cache:
  enabled: false

secure:
  extraConfig:
    server:
      cache:
        provider:
          constructor: catbox-memcached
          options:
            host: <memcached-fqdn>
            port: <port>
```

## Apply Helm values

Perform a [Helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) to apply the changes made to `immuta-values.yaml`.

```shell
helm upgrade <release-name> oci://ocir.immuta.com/stable/immuta-enterprise --values immuta-values.yaml --version 2026.1.4
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://documentation.immuta.com/latest/configuration/self-managed-deployment/configure/external-cache-configuration.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.