diff --git a/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb b/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb
index b006574a38fd270a53b273bb2dd81526ee29fa42_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3JlY2lwZXMvZW5hYmxlLnJi..8f075ef216fd60cf02a1193b8bc19f4d55452e2c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3JlY2lwZXMvZW5hYmxlLnJi 100644
--- a/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb
+++ b/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb
@@ -29,6 +29,7 @@
 redis_sentinels_master_name = node['redis']['master_name']
 gitlab_kas_redis_password_file = File.join(working_dir, 'redis_password_file')
 redis_network = redis_helper.redis_url.scheme == 'unix' ? 'unix' : 'tcp'
+redis_ssl = node['gitlab']['gitlab-rails']['redis_ssl']
 redis_address = if redis_network == 'tcp'
                   "#{redis_host}:#{redis_port}"
                 else
@@ -80,6 +81,7 @@
       authentication_secret_file: gitlab_kas_authentication_secret_file,
       redis_network: redis_network,
       redis_address: redis_address,
+      redis_ssl: redis_ssl,
       redis_password_file: redis_password ? gitlab_kas_redis_password_file : nil,
       redis_sentinels_master_name: redis_sentinels_master_name,
       redis_sentinels: redis_sentinels
diff --git a/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb b/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb
index b006574a38fd270a53b273bb2dd81526ee29fa42_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3RlbXBsYXRlcy9kZWZhdWx0L2dpdGxhYi1rYXMtY29uZmlnLnltbC5lcmI=..8f075ef216fd60cf02a1193b8bc19f4d55452e2c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3RlbXBsYXRlcy9kZWZhdWx0L2dpdGxhYi1rYXMtY29uZmlnLnltbC5lcmI= 100644
--- a/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb
+++ b/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb
@@ -18,6 +18,8 @@
   usage_reporting_period: <%= @metrics_usage_reporting_period %>s
 redis:
   network: <%= @redis_network %>
+  tls:
+    enabled: <%= @redis_ssl %>
   <%- if @redis_password_file %>
   password_file: <%= @redis_password_file %>
   <%- end %>
diff --git a/spec/chef/recipes/gitlab-kas_spec.rb b/spec/chef/recipes/gitlab-kas_spec.rb
index b006574a38fd270a53b273bb2dd81526ee29fa42_c3BlYy9jaGVmL3JlY2lwZXMvZ2l0bGFiLWthc19zcGVjLnJi..8f075ef216fd60cf02a1193b8bc19f4d55452e2c_c3BlYy9jaGVmL3JlY2lwZXMvZ2l0bGFiLWthc19zcGVjLnJi 100644
--- a/spec/chef/recipes/gitlab-kas_spec.rb
+++ b/spec/chef/recipes/gitlab-kas_spec.rb
@@ -261,6 +261,39 @@
       end
     end
 
+    context 'without sentinel but with tls enabled' do
+      before do
+        stub_gitlab_rb(
+          external_url: 'https://gitlab.example.com',
+          gitlab_kas: {
+            enable: true
+          },
+          gitlab_rails: {
+            redis_host: 'the-host',
+            redis_port: 12345,
+            redis_ssl: true,
+          }
+        )
+      end
+
+      it 'renders a configuration with tls enabled in to the kas config' do
+        expect(chef_run).to render_file('/var/opt/gitlab/gitlab-kas/gitlab-kas-config.yml').with_content { |content|
+          kas_redis_cfg = YAML.safe_load(content)['redis']
+          expect(kas_redis_cfg).to(
+            include(
+              'network' => 'tcp',
+              'tls' => {
+                'enabled' => true
+              },
+              'server' => {
+                'address' => 'the-host:12345'
+              }
+            )
+          )
+        }
+      end
+    end
+
     context 'with sentinel' do
       before do
         stub_gitlab_rb(