Google Cloud Memorystore for Redis

Qovery creates it in the GCP project of the environment’s cluster, as a Blueprint service in one of your environments.


Catalog name	`gcp-memorystore-redis`
Category	Databases & Caches
Provider	GCP
Engine	terraform
Major versions (latest release)	`7` (1.0.8)
Source	GCP/redis/7

New to this? You don’t need to know Kubernetes or Terraform. Qovery sets up Google Cloud Memorystore for Redis in your cloud account and manages it for you: you fill in a form, or paste the prompt below into your coding agent. The values it publishes, listed under Outputs, reach your other services as environment variables. Qovery tells you when a newer version of the Blueprint is available. Check the requirements in the Reference section before you start, and try it first in a development environment.

Create it

Console
CLI and API
Coding agent

Open the environment, then New service › Blueprint.
Find Google Cloud Memorystore for Redis in the catalog and pick the major version.
Fill in the variables. Required ones are marked; the others use their defaults.
Create the service, and deploy it now or later.

List the catalog to get the latest tag, then create the service from it. qovery api signs the requests with your CLI session.

ORG_ID="REPLACE_WITH_ORGANIZATION_ID"
ENV_ID="REPLACE_WITH_ENVIRONMENT_ID"

qovery api "organization/$ORG_ID/blueprint/catalog" | jq '.. | objects | select(.name? == "gcp-memorystore-redis")'

cat > blueprint.json <<'EOF'
{
  "name": "gcp-memorystore-redis",
  "tag": "GCP/redis/7/1.0.8",
  "icon": "app://qovery-console/redis",
  "variables": [
    {
      "name": "redis_name",
      "value": "REPLACE_WITH_REDIS_NAME"
    },
    {
      "name": "tier",
      "value": "REPLACE_WITH_TIER"
    },
    {
      "name": "memory_size_gb",
      "value": "REPLACE_WITH_MEMORY_SIZE_GB"
    }
  ],
  "spec_overrides": {
    "engine_version": "1.9.7"
  }
}
EOF
BLUEPRINT_ID=$(qovery api "environment/$ENV_ID/blueprint" --method POST --input - < blueprint.json | jq -r .id)
rm blueprint.json   # it can hold secret values
qovery api "blueprint/$BLUEPRINT_ID/deploy" --method POST
qovery api "blueprint/$BLUEPRINT_ID"   # status of the latest deployment

Replace each REPLACE_WITH_ value. Add optional variables to variables the same way.

Paste this into Claude Code, Cursor, Codex or another coding agent with the Qovery agent skills installed (curl -fsSL https://skill.qovery.com/install.sh | bash).

Prompt

Add the Qovery Blueprint Google Cloud Memorystore for Redis (gcp-memorystore-redis) to one of my Qovery environments and deploy it. Ask me for redis_name, tier and memory_size_gb.
Ask me before deploying to a production environment.
Docs: https://www.qovery.com/docs/configuration/blueprints/gcp-memorystore-redis.md

You don’t add any file to your repository. Qovery creates the Blueprint from the Console or the API.

Variables and outputs

Generated from qbm.yml at GCP/redis/7/1.0.8, the manifest the Console form is built from.

All 16 variables

Name	Type	Required	Default	Description
`redis_name`	string	Yes		Lowercase letters, digits, hyphens; must start with a letter, not end with a hyphen; max 40 chars.
`tier`	string	Yes	`BASIC`	BASIC: single node; STANDARD_HA: cross-zone replica and failover
`memory_size_gb`	number	Yes	`1`	In GiB
`redis_version`	string		`REDIS_7_2`	Redis version
`auth_enabled`	bool		`true`	Require an AUTH string to connect. The generated string is published via the redis_auth_string output.
`transit_encryption_mode`	string		`DISABLED`	In-transit TLS; DISABLED sends traffic and AUTH in clear inside the VPC
`authorized_network`	string			Empty = the project’s default network. Set the Qovery cluster’s VPC self-link so cluster pods can reach the instance.
`connect_mode`	string		`DIRECT_PEERING`	How the instance connects to authorized_network
`reserved_ip_range`	string			Empty = GCP picks a free range. Else a /29 CIDR (DIRECT_PEERING) or a named allocated range (PRIVATE_SERVICE_ACCESS).
`maxmemory_policy`	string		`noeviction`	Redis eviction policy applied once memory_size_gb is full
`persistence_mode`	string		`DISABLED`	RDB snapshot persistence
`rdb_snapshot_period`	string		`TWENTY_FOUR_HOURS`	RDB snapshot interval. Only used when persistence_mode is RDB.
`maintenance_day`	string			Maintenance window day; empty lets GCP maintain at any time
`maintenance_start_hour`	number		`2`	UTC hour, 0–23. Only used when maintenance_day is set.
`replica_count`	number		`0`	Readable cross-zone replicas, 0–5; STANDARD_HA only, where 0 still keeps a non-readable failover standby.
`gcp_project_id`	string			Leave empty — inferred from the deploy credentials. Set it only to target a different GCP project.

Outputs become environment variables that other services in the environment can use. By default Qovery also creates an alias for each output, prefixed with the Blueprint’s name; see Aliases Qovery creates for outputs for the naming rules and the cases where no alias is created.

All 8 outputs

Name	Secret	Description
`redis_id`		Memorystore instance ID
`redis_host`		Primary endpoint hostname
`redis_port`		Primary endpoint port
`redis_current_location_id`		Zone the primary node currently runs in
`redis_auth_string`	Yes	AUTH string for authenticating (set only when auth_enabled is true)
`redis_server_ca_certs`		PEM CA certificates for TLS when transit_encryption_mode is SERVER_AUTHENTICATION
`redis_read_endpoint`		Read replica endpoint hostname (empty when replica_count is 0)
`redis_read_endpoint_port`		Read replica endpoint port (empty when replica_count is 0)

Secret variables and outputs are encrypted and masked in Qovery, but Terraform can also keep their values, and values derived from them, in its state. With the Qovery-managed state backend (the default), Qovery stores the state. If you use your own backend, protect it and keep state files out of version control.

Reference

From the Blueprint’s README. Creates a GCP Memorystore for Redis 7 instance with configurable tier, memory size, auth, TLS, persistence, maintenance window, and optional cross-zone read replicas. There is no user-supplied password: when auth_enabled is true, GCP generates an AUTH string that is published via the redis_auth_string output.

Variables

Required

Name	Type	Description
`redis_name`	string	Memorystore instance ID. Lowercase letters, digits, hyphens; must start with a letter and not end with a hyphen; max 40 chars.
`tier`	string	Service `tier`. BASIC is a single node with no failover. STANDARD_HA adds cross-zone replication and automatic failover.
`memory_size_gb`	number	Instance memory size in GiB (min 1, max 300). Default suggestion: `1`.

Engine & sizing

Name	Type	Default	Description
`redis_version`	string	`REDIS_7_2`	Redis version: `REDIS_7_2`, `REDIS_7_0`
`maxmemory_policy`	string	`noeviction`	Redis eviction policy applied once `memory_size_gb` is full

Auth & network

Name	Type	Default	Description
`auth_enabled`	bool	`true`	Require an AUTH string to connect
`transit_encryption_mode`	string	`DISABLED`	In-transit (TLS) encryption. Defaults to DISABLED, meaning cache traffic and (if `auth_enabled`) the AUTH string travel unencrypted over the VPC. SERVER_AUTHENTICATION requires clients to trust the CA certificate published via the redis_server_ca_certs output.
`authorized_network`	string		VPC network self-link the instance connects to. Empty = the project’s default network. Set this to your Qovery cluster’s VPC self-link so pods in the cluster can reach the instance.
`connect_mode`	string	`DIRECT_PEERING`	How the instance connects to `authorized_network`. PRIVATE_SERVICE_ACCESS requires a pre-existing private services access connection on that network.
`reserved_ip_range`	string		CIDR /29 (DIRECT_PEERING) or named allocated range (PRIVATE_SERVICE_ACCESS) reserved for the instance. Empty = GCP picks an unused range automatically.

By default the instance attaches to the project’s default VPC network, which is usually not the Qovery cluster’s VPC. Set authorized_network to the cluster’s VPC self-link (and connect_mode/reserved_ip_range as required by that network’s setup) so pods in the cluster can reach the instance without extra peering. Security note — plaintext by default: transit_encryption_mode defaults to DISABLED. Since auth_enabled also defaults to true, the generated AUTH string and all cache traffic (including the data itself) travel unencrypted over the VPC on every connection — anyone able to observe traffic on that network path can capture both. Memorystore instances are never reachable from the public internet, but this offers no protection against other workloads sharing the same VPC. Set transit_encryption_mode = SERVER_AUTHENTICATION for anything beyond a trusted, fully isolated environment; clients then need to trust the CA certificate published via redis_server_ca_certs and connect over TLS (e.g. rediss://), which most Redis client libraries support but require explicit configuration for.

Persistence

Name	Type	Default	Description
`persistence_mode`	string	`DISABLED`	`DISABLED` or `RDB`
`rdb_snapshot_period`	string	`TWENTY_FOUR_HOURS`	Snapshot interval. Only used when `persistence_mode` is `RDB`.

Maintenance

Name	Type	Default	Description
`maintenance_day`	string		Day of week for the scheduled maintenance window. Empty disables a fixed window (GCP may perform maintenance at any time).
`maintenance_start_hour`	number	`2`	Maintenance window start hour, UTC 24h (0-23). Only used when `maintenance_day` is set.

Read replicas

Name	Type	Default	Description
`replica_count`	number	`0`	Number of exposed cross-zone read replicas (0-5). Only supported when `tier` is STANDARD_HA; read traffic can be pointed at the redis_read_endpoint output. STANDARD_HA always allocates a standby node for failover regardless of this value; 0 just means that node isn’t exposed as a readable replica.

Replicas are asynchronous, cross-zone, read-only copies of the primary; point analytics/BI tools at the redis_read_endpoint output to keep read traffic off the primary. Setting replica_count > 0 requires tier = STANDARD_HA. STANDARD_HA always allocates a standby node for automatic failover, independent of replica_count — GCP requires at least one such node once STANDARD_HA is selected. replica_count = 0 (the default) just means that standby isn’t exposed as a readable replica; the blueprint sends GCP the required minimum under the hood. Set replica_count to 1-5 to also expose it (or additional nodes) via redis_read_endpoint.

Misc

Name	Type	Default	Description
`gcp_project_id`	string		Leave empty — inferred from the credentials used to deploy (cluster credentials or the env-mode service account). Set it only to target a different GCP project.

Outputs

Name	Sensitive	Description
`redis_id`		Memorystore instance ID
`redis_host`		Primary endpoint hostname
`redis_port`		Primary endpoint port
`redis_current_location_id`		Zone the primary node currently runs in
`redis_auth_string`	yes	AUTH string for authenticating (set only when `auth_enabled` is true)
`redis_server_ca_certs`		Server CA certificates (PEM) for TLS verification when `transit_encryption_mode` is `SERVER_AUTHENTICATION`
`redis_read_endpoint`		Read replica endpoint hostname (empty when `replica_count` is 0)
`redis_read_endpoint_port`		Read replica endpoint port (empty when `replica_count` is 0)

Required GCP IAM permissions

The credentials used to deploy this blueprint must be able to manage Memorystore Redis instances in the target project:

{
  "bindings": [
    {
      "role": "roles/redis.admin",
      "members": ["<the deploying principal>"]
    }
  ]
}

roles/redis.admin (or the underlying redis.instances.* permissions) is sufficient for create, read, update, and delete. If authorized_network points at a network in a different (Shared VPC host) project, grant roles/compute.networkUser on that network to the Memorystore Redis service agent of this project — the one hosting the instance (service-PROJECT_NUMBER@cloud-redis.iam.gserviceaccount.com, where PROJECT_NUMBER is gcp_project_id’s project, or the deploy credentials’ default project when gcp_project_id is empty) — not a service agent from the network’s project.

Overview

Account & Organization

Clusters & Cloud

Source Control

Projects & Environments

Services

Deployment & CI/CD

Environment Variables & Secrets

Observability

Notifications

Networking & Advanced

Google Cloud Memorystore for Redis

Create it

Variables and outputs

Reference

Variables

Required

Engine & sizing

Auth & network

Persistence

Maintenance

Read replicas

Misc

Outputs

Required GCP IAM permissions

​Create it

​Variables and outputs

​Reference

​Variables

​Required

​Engine & sizing

​Auth & network

​Persistence

​Maintenance

​Read replicas

​Misc

​Outputs

​Required GCP IAM permissions

Create it

Variables and outputs

Reference

Variables

Required

Engine & sizing

Auth & network

Persistence

Maintenance

Read replicas

Misc

Outputs

Required GCP IAM permissions