> ## Documentation Index
> Fetch the complete documentation index at: https://www.qovery.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud Memorystore for Redis

> GCP Memorystore for Redis 7 instance with configurable tier, memory size, auth, TLS, persistence, maintenance window, and optional read replicas

Qovery creates it in the GCP project of the environment's cluster, as a [Blueprint](https://www.qovery.com/docs/configuration/blueprints.md) service in one of your environments.

| | |
| - | - |
| Catalog name | `gcp-memorystore-redis` |
| Category | Databases & Caches |
| Provider | GCP |
| Engine | terraform |
| Major versions (latest release) | `7` (1.0.8) |
| Source | [GCP/redis/7](https://github.com/Qovery/service-catalog/tree/GCP/redis/7/1.0.8/GCP/redis/7) |

> [!TIP]
>
> **New to this?** You don't need to know Kubernetes or Terraform. Qovery sets up Google Cloud Memorystore for Redis in your cloud account and manages it for you: you fill in a form, or paste the prompt below into your coding agent. The values it publishes, listed under Outputs, reach your other services as environment variables. Qovery tells you when a newer version of the Blueprint is available. Check the requirements in the Reference section before you start, and try it first in a development environment.

## Create it

> [tab] Console
>
> 1. Open the environment, then **New service** › **Blueprint**.
> 2. Find **Google Cloud Memorystore for Redis** in the catalog and pick the major version.
> 3. Fill in the variables. Required ones are marked; the others use their defaults.
> 4. Create the service, and deploy it now or later.

> [tab] CLI and API
>
> List the catalog to get the latest tag, then create the service from it. `qovery api` signs the requests with your CLI session.
>
> ```bash theme={null}
> ORG_ID="REPLACE_WITH_ORGANIZATION_ID"
> ENV_ID="REPLACE_WITH_ENVIRONMENT_ID"
>
> qovery api "organization/$ORG_ID/blueprint/catalog" | jq '.. | objects | select(.name? == "gcp-memorystore-redis")'
>
> cat > blueprint.json <<'EOF'
> {
>   "name": "gcp-memorystore-redis",
>   "tag": "GCP/redis/7/1.0.8",
>   "icon": "app://qovery-console/redis",
>   "variables": [
>     {
>       "name": "redis_name",
>       "value": "REPLACE_WITH_REDIS_NAME"
>     },
>     {
>       "name": "tier",
>       "value": "REPLACE_WITH_TIER"
>     },
>     {
>       "name": "memory_size_gb",
>       "value": "REPLACE_WITH_MEMORY_SIZE_GB"
>     }
>   ],
>   "spec_overrides": {
>     "engine_version": "1.9.7"
>   }
> }
> EOF
> BLUEPRINT_ID=$(qovery api "environment/$ENV_ID/blueprint" --method POST --input - < blueprint.json | jq -r .id)
> rm blueprint.json   # it can hold secret values
> qovery api "blueprint/$BLUEPRINT_ID/deploy" --method POST
> qovery api "blueprint/$BLUEPRINT_ID"   # status of the latest deployment
> ```
>
> Replace each `REPLACE_WITH_` value. Add optional variables to `variables` the same way.

> [tab] Coding agent
>
> Paste this into Claude Code, Cursor, Codex or another coding agent with the [Qovery agent skills](https://www.qovery.com/docs/getting-started/quickstart/agent-skills.md) installed (`curl -fsSL https://skill.qovery.com/install.sh | bash`).
>
> ```text Prompt wrap theme={null}
> Add the Qovery Blueprint Google Cloud Memorystore for Redis (gcp-memorystore-redis) to one of my Qovery environments and deploy it. Ask me for redis_name, tier and memory_size_gb.
> Ask me before deploying to a production environment.
> Docs: https://www.qovery.com/docs/configuration/blueprints/gcp-memorystore-redis.md
> ```

You don't add any file to your repository. Qovery creates the Blueprint from the Console or the API.

## Variables and outputs

Generated from `qbm.yml` at `GCP/redis/7/1.0.8`, the manifest the Console form is built from.

> [accordion] All 16 variables
>
> | Name | Type | Required | Default | Secret | Description |
> | - | - | - | - | - | - |
> | `redis_name` | string | Yes | | | Lowercase letters, digits, hyphens; must start with a letter, not end with a hyphen; max 40 chars. |
> | `tier` | string | Yes | `BASIC` | | BASIC: single node; STANDARD\_HA: cross-zone replica and failover |
> | `memory_size_gb` | number | Yes | `1` | | In GiB |
> | `redis_version` | string | | `REDIS_7_2` | | Redis version |
> | `auth_enabled` | bool | | `true` | | Require an AUTH string to connect. The generated string is published via the redis\_auth\_string output. |
> | `transit_encryption_mode` | string | | `DISABLED` | | In-transit TLS; DISABLED sends traffic and AUTH in clear inside the VPC |
> | `authorized_network` | string | | | | Empty = the project's default network. Set the Qovery cluster's VPC self-link so cluster pods can reach the instance. |
> | `connect_mode` | string | | `DIRECT_PEERING` | | How the instance connects to authorized\_network |
> | `reserved_ip_range` | string | | | | Empty = GCP picks a free range. Else a /29 CIDR (DIRECT\_PEERING) or a named allocated range (PRIVATE\_SERVICE\_ACCESS). |
> | `maxmemory_policy` | string | | `noeviction` | | Redis eviction policy applied once memory\_size\_gb is full |
> | `persistence_mode` | string | | `DISABLED` | | RDB snapshot persistence |
> | `rdb_snapshot_period` | string | | `TWENTY_FOUR_HOURS` | | RDB snapshot interval. Only used when persistence\_mode is RDB. |
> | `maintenance_day` | string | | | | Maintenance window day; empty lets GCP maintain at any time |
> | `maintenance_start_hour` | number | | `2` | | UTC hour, 0–23. Only used when maintenance\_day is set. |
> | `replica_count` | number | | `0` | | Readable cross-zone replicas, 0–5; STANDARD\_HA only, where 0 still keeps a non-readable failover standby. |
> | `gcp_project_id` | string | | | | Leave empty — inferred from the deploy credentials. Set it only to target a different GCP project. |

Outputs become environment variables that other services in the environment can use. By default Qovery also creates an alias for each output, prefixed with the Blueprint's name; see [Aliases Qovery creates for outputs](https://www.qovery.com/docs/configuration/environment-variables.md#aliases-qovery-creates-for-outputs) for the naming rules and the cases where no alias is created.

> [accordion] All 8 outputs
>
> | Name | Secret | Description |
> | - | - | - |
> | `redis_id` | | Memorystore instance ID |
> | `redis_host` | | Primary endpoint hostname |
> | `redis_port` | | Primary endpoint port |
> | `redis_current_location_id` | | Zone the primary node currently runs in |
> | `redis_auth_string` | Yes | AUTH string for authenticating (set only when auth\_enabled is true) |
> | `redis_server_ca_certs` | | PEM CA certificates for TLS when transit\_encryption\_mode is SERVER\_AUTHENTICATION |
> | `redis_read_endpoint` | | Read replica endpoint hostname (empty when replica\_count is 0) |
> | `redis_read_endpoint_port` | | Read replica endpoint port (empty when replica\_count is 0) |

> [!WARNING]
>
> Secret variables and outputs are encrypted and masked in Qovery, but Terraform can also keep their values, and values derived from them, in its state. With the Qovery-managed state backend (the default), Qovery stores the state. If you use your own backend, protect it and keep state files out of version control.

## Reference

From the Blueprint's [README](https://github.com/Qovery/service-catalog/blob/GCP/redis/7/1.0.8/GCP/redis/7/README.md).

Creates a GCP Memorystore for Redis 7 instance with configurable tier, memory size, auth, TLS, persistence, maintenance window, and optional cross-zone read replicas. There is no user-supplied password: when `auth_enabled` is true, GCP generates an AUTH string that is published via the `redis_auth_string` output.

### Variables

#### Required

| Name | Type | Sensitive | Description |
| - | - | - | - |
| `redis_name` | string | | Memorystore instance ID. Lowercase letters, digits, hyphens; must start with a letter and not end with a hyphen; max 40 chars. |
| `tier` | string | | Service `tier`. BASIC is a single node with no failover. STANDARD\_HA adds cross-zone replication and automatic failover. |
| `memory_size_gb` | number | | Instance memory size in GiB (min 1, max 300). Default suggestion: `1`. |

#### Engine & sizing

| Name | Type | Default | Description |
| - | - | - | - |
| `redis_version` | string | `REDIS_7_2` | Redis version: `REDIS_7_2`, `REDIS_7_0` |
| `maxmemory_policy` | string | `noeviction` | Redis eviction policy applied once `memory_size_gb` is full |

#### Auth & network

| Name | Type | Default | Description |
| - | - | - | - |
| `auth_enabled` | bool | `true` | Require an AUTH string to connect |
| `transit_encryption_mode` | string | `DISABLED` | In-transit (TLS) encryption. Defaults to DISABLED, meaning cache traffic and (if `auth_enabled`) the AUTH string travel unencrypted over the VPC. SERVER\_AUTHENTICATION requires clients to trust the CA certificate published via the redis\_server\_ca\_certs output. |
| `authorized_network` | string | | VPC network self-link the instance connects to. Empty = the project's default network. Set this to your Qovery cluster's VPC self-link so pods in the cluster can reach the instance. |
| `connect_mode` | string | `DIRECT_PEERING` | How the instance connects to `authorized_network`. PRIVATE\_SERVICE\_ACCESS requires a pre-existing private services access connection on that network. |
| `reserved_ip_range` | string | | CIDR /29 (DIRECT\_PEERING) or named allocated range (PRIVATE\_SERVICE\_ACCESS) reserved for the instance. Empty = GCP picks an unused range automatically. |

By default the instance attaches to the project's **default** VPC network, which is usually *not* the Qovery cluster's VPC. Set `authorized_network` to the cluster's VPC self-link (and `connect_mode`/`reserved_ip_range` as required by that network's setup) so pods in the cluster can reach the instance without extra peering.

**Security note — plaintext by default:** `transit_encryption_mode` defaults to `DISABLED`. Since `auth_enabled` also defaults to `true`, the generated AUTH string and all cache traffic (including the data itself) travel **unencrypted** over the VPC on every connection — anyone able to observe traffic on that network path can capture both. Memorystore instances are never reachable from the public internet, but this offers no protection against other workloads sharing the same VPC. Set `transit_encryption_mode = SERVER_AUTHENTICATION` for anything beyond a trusted, fully isolated environment; clients then need to trust the CA certificate published via `redis_server_ca_certs` and connect over TLS (e.g. `rediss://`), which most Redis client libraries support but require explicit configuration for.

#### Persistence

| Name | Type | Default | Description |
| - | - | - | - |
| `persistence_mode` | string | `DISABLED` | `DISABLED` or `RDB` |
| `rdb_snapshot_period` | string | `TWENTY_FOUR_HOURS` | Snapshot interval. Only used when `persistence_mode` is `RDB`. |

#### Maintenance

| Name | Type | Default | Description |
| - | - | - | - |
| `maintenance_day` | string | | Day of week for the scheduled maintenance window. Empty disables a fixed window (GCP may perform maintenance at any time). |
| `maintenance_start_hour` | number | `2` | Maintenance window start hour, UTC 24h (0-23). Only used when `maintenance_day` is set. |

#### Read replicas

| Name | Type | Default | Description |
| - | - | - | - |
| `replica_count` | number | `0` | Number of exposed cross-zone read replicas (0-5). Only supported when `tier` is STANDARD\_HA; read traffic can be pointed at the redis\_read\_endpoint output. STANDARD\_HA always allocates a standby node for failover regardless of this value; 0 just means that node isn't exposed as a readable replica. |

Replicas are asynchronous, cross-zone, read-only copies of the primary; point analytics/BI tools at the `redis_read_endpoint` output to keep read traffic off the primary. Setting `replica_count > 0` requires `tier = STANDARD_HA`.

`STANDARD_HA` always allocates a standby node for automatic failover, independent of `replica_count` — GCP requires at least one such node once `STANDARD_HA` is selected. `replica_count = 0` (the default) just means that standby isn't exposed as a readable replica; the blueprint sends GCP the required minimum under the hood. Set `replica_count` to 1-5 to also expose it (or additional nodes) via `redis_read_endpoint`.

#### Misc

| Name | Type | Default | Description |
| - | - | - | - |
| `gcp_project_id` | string | | Leave empty — inferred from the credentials used to deploy (cluster credentials or the env-mode service account). Set it only to target a different GCP project. |

### Outputs

| Name | Sensitive | Description |
| - | - | - |
| `redis_id` | | Memorystore instance ID |
| `redis_host` | | Primary endpoint hostname |
| `redis_port` | | Primary endpoint port |
| `redis_current_location_id` | | Zone the primary node currently runs in |
| `redis_auth_string` | yes | AUTH string for authenticating (set only when `auth_enabled` is true) |
| `redis_server_ca_certs` | | Server CA certificates (PEM) for TLS verification when `transit_encryption_mode` is `SERVER_AUTHENTICATION` |
| `redis_read_endpoint` | | Read replica endpoint hostname (empty when `replica_count` is 0) |
| `redis_read_endpoint_port` | | Read replica endpoint port (empty when `replica_count` is 0) |

### Required GCP IAM permissions

The credentials used to deploy this blueprint must be able to manage Memorystore Redis instances in the target project:

```json theme={null}
{
  "bindings": [
    {
      "role": "roles/redis.admin",
      "members": ["<the deploying principal>"]
    }
  ]
}
```

`roles/redis.admin` (or the underlying `redis.instances.*` permissions) is sufficient for create, read, update, and delete. If `authorized_network` points at a network in a different (Shared VPC host) project, grant `roles/compute.networkUser` on that network to the Memorystore Redis service agent of *this* project — the one hosting the instance (`service-PROJECT_NUMBER@cloud-redis.iam.gserviceaccount.com`, where `PROJECT_NUMBER` is `gcp_project_id`'s project, or the deploy credentials' default project when `gcp_project_id` is empty) — not a service agent from the network's project.


## Related topics

- [Blueprints](https://www.qovery.com/docs/configuration/blueprints.md)
- [Databases](https://www.qovery.com/docs/configuration/database.md)
- [Cloud Credentials](https://www.qovery.com/docs/configuration/organization/cloud-credentials.md)
- [Google GKE Integration](https://www.qovery.com/docs/configuration/integrations/kubernetes/gke/overview.md)
- [Google BigQuery Dataset](https://www.qovery.com/docs/configuration/blueprints/bigquery-dataset.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.