diff --git a/content/operate/kubernetes/7.22/_index.md b/content/operate/kubernetes/7.22/_index.md new file mode 100644 index 0000000000..b3b6d47fc6 --- /dev/null +++ b/content/operate/kubernetes/7.22/_index.md @@ -0,0 +1,111 @@ +--- +Title: Redis Enterprise for Kubernetes +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Deploy and manage Redis Enterprise on Kubernetes with the Redis Enterprise operator. +hideListLinks: true +linkTitle: 7.22 +weight: 30 +bannerText: This documentation applies to version 7.22. +bannerChildren: true +url: '/operate/kubernetes/7.22/' +--- + +Redis Enterprise for Kubernetes brings Redis Enterprise to Kubernetes environments through the Redis Enterprise operator. You can deploy, scale, and manage Redis Enterprise clusters and databases by using native Kubernetes resources and workflows. + +Redis Enterprise for Kubernetes provides all the enterprise features of Redis Software: + +- Linear scalability with Redis clustering +- High availability with automatic failover +- Active-Active geo-distribution +- Auto Tiering for cost optimization +- Enterprise-grade security and encryption +- 24/7 support + +The Redis Enterprise operator simplifies deployment and management by providing custom resource definitions (CRDs) for Redis Enterprise clusters (REC) and databases (REDB). This approach enables GitOps workflows and Kubernetes-native operations. + +## Get started + +Deploy Redis Enterprise on your Kubernetes cluster and create your first database. + +- [Quick start deployment]({{< relref "/operate/kubernetes/7.22/deployment/quick-start" >}}) +- [Deploy with Helm]({{< relref "/operate/kubernetes/7.22/deployment/helm" >}}) +- [Deploy on OpenShift]({{< relref "/operate/kubernetes/7.22/deployment/openshift" >}}) +- [Supported Kubernetes distributions]({{< relref "/operate/kubernetes/7.22/reference/supported_k8s_distributions" >}}) + +## Redis Enterprise clusters (REC) + +Create and manage [Redis Enterprise clusters]({{< relref "/operate/kubernetes/7.22/re-clusters" >}}) on Kubernetes. + +- [Connect to admin console]({{< relref "/operate/kubernetes/7.22/re-clusters/connect-to-admin-console" >}}) +- [Auto Tiering]({{< relref "/operate/kubernetes/7.22/re-clusters/auto-tiering" >}}) +- [Multi-namespace deployment]({{< relref "/operate/kubernetes/7.22/re-clusters/multi-namespace" >}}) +- [Cluster recovery]({{< relref "/operate/kubernetes/7.22/re-clusters/cluster-recovery" >}}) +- [REC API reference]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api" >}}) + +## Redis Enterprise databases (REDB) + +Create and manage [Redis Enterprise databases]({{< relref "/operate/kubernetes/7.22/re-databases" >}}) using Kubernetes resources. + +- [Database controller]({{< relref "/operate/kubernetes/7.22/re-databases/db-controller" >}}) +- [Create replica databases]({{< relref "/operate/kubernetes/7.22/re-databases/replica-redb" >}}) +- [REDB API reference]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_database_api" >}}) + +## Active-Active databases + +Set up globally distributed [Active-Active databases]({{< relref "/operate/kubernetes/7.22/active-active" >}}) across multiple Kubernetes clusters. + +- [Prepare participating clusters]({{< relref "/operate/kubernetes/7.22/active-active/prepare-clusters" >}}) +- [Create Active-Active database]({{< relref "/operate/kubernetes/7.22/active-active/create-reaadb" >}}) +- [Global configuration]({{< relref "/operate/kubernetes/7.22/active-active/global-config" >}}) +- [REAADB API reference]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_active_active_database_api" >}}) +- [Remote cluster API reference]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_remote_cluster_api" >}}) + +## Security + +Manage [secure connections]({{< relref "/operate/kubernetes/7.22/security" >}}) and access control for your Redis Enterprise deployment. + +- [Manage REC credentials]({{< relref "/operate/kubernetes/7.22/security/manage-rec-credentials" >}}) +- [Manage REC certificates]({{< relref "/operate/kubernetes/7.22/security/manage-rec-certificates" >}}) +- [Internode encryption]({{< relref "/operate/kubernetes/7.22/security/internode-encryption" >}}) +- [LDAP authentication]({{< relref "/operate/kubernetes/7.22/security/ldap" >}}) + +## Reference + +Use the Kubernetes API and command-line tools to manage your Redis Enterprise deployment. + +- [Redis Enterprise cluster API (REC)]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api" >}}) +- [Redis Enterprise database API (REDB)]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_database_api" >}}) +- [Active-Active database API (REAADB)]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_active_active_database_api" >}}) +- [Remote cluster API (RERC)]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_remote_cluster_api" >}}) + +## Logs & monitoring + +Monitor and troubleshoot your Redis Enterprise deployment. + +- [Collect logs]({{< relref "/operate/kubernetes/7.22/logs/collect-logs" >}}) +- [Connect to Prometheus operator]({{< relref "/operate/kubernetes/7.22/re-clusters/connect-prometheus-operator" >}}) + +## Upgrade + +Keep your Redis Enterprise deployment up to date. + +- [Upgrade Redis cluster]({{< relref "/operate/kubernetes/7.22/upgrade/upgrade-redis-cluster" >}}) +- [Upgrade with OpenShift CLI]({{< relref "/operate/kubernetes/7.22/upgrade/openshift-cli" >}}) +- [Upgrade with OLM]({{< relref "/operate/kubernetes/7.22/upgrade/upgrade-olm" >}}) + +## Release notes + +Stay informed about new features, enhancements, and fixes. + +- [Release notes]({{< relref "/operate/kubernetes/release-notes" >}}) + +## Related info + +- [Redis Enterprise Software]({{< relref "/operate/rs" >}}) +- [Redis Cloud]({{< relref "/operate/rc" >}}) +- [Redis Open Source]({{< relref "/operate/oss_and_stack" >}}) +- [Glossary]({{< relref "/glossary" >}}) \ No newline at end of file diff --git a/content/operate/kubernetes/7.22/active-active/_index.md b/content/operate/kubernetes/7.22/active-active/_index.md new file mode 100644 index 0000000000..f34b414a5d --- /dev/null +++ b/content/operate/kubernetes/7.22/active-active/_index.md @@ -0,0 +1,84 @@ +--- +Title: Active-Active databases +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Create and manage Active-Active Redis Enterprise databases across multiple Kubernetes clusters. +hideListLinks: true +linkTitle: Active-Active databases +weight: 40 +url: '/operate/kubernetes/7.22/active-active/' +--- + +Redis Enterprise [Active-Active]({{< relref "/operate/rs/databases/active-active/" >}}) databases on Kubernetes provide read and write access to the same dataset from different Kubernetes clusters. This enables globally distributed applications with local read and write access, automatic conflict resolution, and seamless failover capabilities. + +Active-Active databases use multi-master replication to keep data synchronized across participating clusters, allowing applications to read and write data locally while maintaining global consistency. + +## Active-Active setup methods + +There are two methods for creating an Active-Active database with Redis Enterprise for Kubernetes: + +- The `RedisEnterpriseActiveActiveDatabase` (REAADB) custom resource is available for versions 6.4.2 and later. +- The `crdb-cli` method is available for versions 6.4.2 or earlier. + + +We recommend creating new Active-Active databases using the RedisEnterpriseActiveActiveDatabase (REAADB) custom resource. This allows you to manage your Active-Active database with the operator and ensures you have the latest features and functionality. + +### Active-Active controller method + +Versions 6.4.2-6 or later fully support the Active-Active controller. Some of these features were available as a preview in 6.4.2-4 and 6.4.2-5. Please upgrade to 6.4.2-6 for the full set of general availability features and bug fixes. + +This setup method includes the following steps: + +1. Gather REC credentials and [prepare participating clusters]({{< relref "/operate/kubernetes/7.22/active-active/prepare-clusters" >}}). +2. Create [`RedisEnterpriseRemoteCluster` (RERC)]({{< relref "/operate/kubernetes/7.22/active-active/create-reaadb#create-rerc" >}}) resources. +3. Create [`RedisEnterpriseActiveActiveDatabase` (REAADB)]({{< relref "/operate/kubernetes/7.22/active-active/create-reaadb#create-reaadb" >}}) resource. + +### `crdb-cli` method + +For versions 6.4.2 or earlier, this Active-Active setup method includes the following steps: + +1. Install and configure an ingress. +2. Gather configuration details. +3. Add the `ActiveActive` field to the REC spec. +4. Create the database with the `crdb-cli` tool. + +## Redis Enterprise Active-Active controller for Kubernetes + +{{}}These features are supported for general availability in releases 6.4.2-6 and later.{{}} + +[Active-Active]({{< relref "/operate/rs/databases/active-active/" >}}) databases give you read-and-write access to Redis Enterprise clusters (REC) in different Kubernetes clusters or namespaces. Active-Active deployments managed by the Redis Enterprise operator require two additional custom resources: Redis Enterprise Active-Active database (REAADB) and Redis Enterprise remote cluster (RERC). + +To create an Active-Active Redis Enterprise deployment for Kubernetes with these new features, first [prepare participating clusters]({{< relref "/operate/kubernetes/7.22/active-active/prepare-clusters" >}}) then [create an Active-Active database]({{< relref "/operate/kubernetes/7.22/active-active/create-reaadb" >}}). + +### REAADB custom resource + +Redis Enterprise Active-Active database (REAADB) contains a link to the RERC for each participating cluster, and provides configuration and status to the management plane. + +For a full list of fields and options, see the [REAADB API reference]({{}}). + +For examples, see the [YAML examples]({{< relref "/operate/kubernetes/7.22/reference/yaml/active-active" >}}) section. + +### RERC custom resource + +Redis Enterprise remote cluster (RERC) custom resource contains configuration details for all the participating clusters. + +For a full list of fields and options, see the [RERC API reference]({{}}). + +For examples, see the [YAML examples]({{< relref "/operate/kubernetes/7.22/reference/yaml/active-active" >}}) section. + +### Limitations + +* Existing Redis databases cannot be migrated to a REAADB. (DOC-3594) +* Admission is not blocking REAADB with `shardCount` which exceeds license quota. (RED-96301) + Workaround: Fix the problems with the REAADB and reapply. +* The `/` value must be unique for each RERC resource. (RED-96302) +* Only global database options are supported, no support for specifying configuration per location. +* No support for migration from old (`crdb-cli`) Active-Active database method to new Active-Active controller. +* No support for REAADB with participating clusters co-located within the same Kubernetes cluster, except for a single designated local participating cluster. + +## More info + +For more general information about Active-Active, see the [Redis Enterprise Software docs]({{< relref "/operate/rs/databases/active-active/" >}}). diff --git a/content/operate/kubernetes/7.22/active-active/create-aa-crdb-cli.md b/content/operate/kubernetes/7.22/active-active/create-aa-crdb-cli.md new file mode 100644 index 0000000000..dd5c9c6c3c --- /dev/null +++ b/content/operate/kubernetes/7.22/active-active/create-aa-crdb-cli.md @@ -0,0 +1,217 @@ +--- +Title: Create Active-Active databases with crdb-cli +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: This section shows how to set up an Active-Active Redis Enterprise database + on Kubernetes using the Redis Enterprise Software operator. +linkTitle: Create Active-Active with crdb-cli +weight: 99 +url: '/operate/kubernetes/7.22/active-active/create-aa-crdb-cli/' +--- +{{}} Versions 6.4.2 and later support the Active-Active database controller. This controller allows you to create Redis Enterprise Active-Active databases (REAADB) and Redis Enterprise remote clusters (RERC) with custom resources. We recommend using the [REAADB method for creating Active-Active databases]({{< relref "/operate/kubernetes/7.22/active-active/create-reaadb" >}}).{{}} + +On Kubernetes, Redis Enterprise [Active-Active]({{< relref "/operate/rs/databases/active-active/" >}}) databases provide read-and-write access to the same dataset from different Kubernetes clusters. For more general information about Active-Active, see the [Redis Enterprise Software docs]({{< relref "/operate/rs/databases/active-active/" >}}). + +Creating an Active-Active database requires routing [network access]({{< relref "/operate/kubernetes/7.22/networking/" >}}) between two Redis Enterprise clusters residing in different Kubernetes clusters. Without the proper access configured for each cluster, syncing between the databases instances will fail. + +This process consists of: + +1. Documenting values to be used in later steps. It's important these values are correct and consistent. +1. Editing the Redis Enterprise cluster (REC) spec file to include the `ActiveActive` section. This will be slightly different depending on the K8s distribution you are using. +1. Creating the database with the `crdb-cli` command. These values must match up with values in the REC resource spec. + +## Prerequisites + +Before creating Active-Active databases, you'll need admin access to two or more working Kubernetes clusters that each have: + +- Routing for external access with an [ingress resources]({{< relref "/operate/kubernetes/7.22/networking/ingress" >}}) (or [route resources]({{< relref "/operate/kubernetes/7.22/networking/routes" >}}) on OpenShift). +- A working [Redis Enterprise cluster (REC)]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api" >}}) with a unique name. +- Enough memory resources available for the database (see [hardware requirements]({{< relref "/operate/rs/installing-upgrading/install/plan-deployment/hardware-requirements" >}})). + +{{}} The `activeActive` field and the `ingressOrRouteSpec` field cannot coexist in the same REC. If you configured your ingress via the `ingressOrRouteSpec` field in the REC, create your Active-Active database with the RedisEnterpriseActiveActiveDatabase (REAADB) custom resource.{{}} + +## Document required parameters + +The most common mistake when setting up Active-Active databases is incorrect or inconsistent parameter values. The values listed in the resource file must match those used in the crdb-cli command. + +- **Database name** ``: + - Description: Combined with ingress suffix to create the Active-Active database hostname + - Format: string + - Example value: `myaadb` + - How you get it: you choose + - The database name requirements are: + - Maximum of 63 characters + - Only letter, number, or hyphen (-) characters + - Starts with a letter; ends with a letter or digit. + - Database name is not case-sensitive + +You'll need the following information for each participating Redis Enterprise cluster (REC): + +{{}} +You'll need to create DNS aliases to resolve your API hostname ``,``, `` to the IP address for the ingress controller’s LoadBalancer (or routes in Openshift) for each database. To avoid entering multiple DNS records, you can use a wildcard in your alias (such as *.ijk.example.com). +{{}} + +- **REC hostname** ``: + - Description: Hostname used to identify your Redis Enterprise cluster in the `crdb-cli` command. This MUST be different from other participating clusters. + - Format: `..svc.cluster.local` + - Example value: `rec01.ns01.svc.cluster.local` + - How to get it: List all your Redis Enterprise clusters + ```bash + kubectl get rec + ``` +- **API hostname** ``: + - Description: Hostname used to access the Redis Enterprise cluster API from outside the K8s cluster + - Format: string + - Example value: `api.ijk.example.com` +- **Ingress suffix** ``: + - Description: Combined with database name to create the Active-Active database hostname + - Format: string + - Example value: `-cluster.ijk.example.com` +- [**REC admin credentials**]({{< relref "/operate/kubernetes/7.22/security/manage-rec-credentials" >}}) ` `: + - Description: Admin username and password for the REC stored in a secret + - Format: string + - Example value: username: `user@example.com`, password: `something` + - How to get them: + ```sh + kubectl get secret \ + -o jsonpath='{.data.username}' | base64 --decode + kubectl get secret \ + -o jsonpath='{.data.password}' | base64 --decode + ``` +- **Replication hostname** ``: + - Description: Hostname used inside the ingress for the database + - Format: `` + - Example value: `myaadb-cluster.ijk.example.com` + - How to get it: Combine `` and ` values you documented above. +- **Replication endpoint** ``: + - Description: Endpoint used externally to contact the database + - Format: `:443` + - Example value: `myaadb-cluster.ijk.example.com:443` + - How to get it:`:443` + +## Add `activeActive` section to the REC resource file + +From inside your K8s cluster, edit your Redis Enterprise cluster (REC) resource to add the following to the `spec` section. Do this for each participating cluster. + + The operator uses the API hostname (``) to create an ingress to the Redis Enterprise cluster's API; this only happens once per cluster. Every time a new Active-Active database instance is created on this cluster, the operator creates a new ingress route to the database with the ingress suffix (``). The hostname for each new database will be in the format ``. + +### Using ingress controller + +1. If your cluster uses an [ingress controller]({{< relref "/operate/kubernetes/7.22/networking/ingress" >}}), add the following to the `spec` section of your REC resource file. + + Nginx: + + ```sh + activeActive: + apiIngressUrl: + dbIngressSuffix: + ingressAnnotations: + kubernetes.io/ingress.class: nginx + nginx.ingress.kubernetes.io/backend-protocol: HTTPS + nginx.ingress.kubernetes.io/ssl-passthrough: "true" + method: ingress + ``` + +HAproxy: + + ```sh + activeActive: + apiIngressUrl: + dbIngressSuffix: + ingressAnnotations: + kubernetes.io/ingress.class: haproxy + ingress.kubernetes.io/ssl-passthrough: "true" + method: ingress + ``` + +2. After the changes are saved and applied, you can verify a new ingress was created for the API. + + ```sh + $ kubectl get ingress + NAME HOSTS ADDRESS PORTS AGE + rec01 api.abc.cde.example.com 225161f845b278-111450635.us.cloud.com 80 24h + ``` + +3. Verify you can access the API from outside the K8s cluster. + + ```sh + curl -k -L -i -u : https:///v1/cluster + ``` + + If the API call fails, create a DNS alias that resolves your API hostname (``) to the IP address for the ingress controller's LoadBalancer. + +4. Make sure you have DNS aliases for each database that resolve your API hostname ``,``, `` to the IP address of the ingress controller’s LoadBalancer. To avoid entering multiple DNS records, you can use a wildcard in your alias (such as `*.ijk.example.com`). + +#### If using Istio Gateway and VirtualService + +No changes are required to the REC spec if you are using [Istio]({{< relref "/operate/kubernetes/7.22/networking/istio-ingress" >}}) in place of an ingress controller. The `activeActive` section added above creates ingress resources. The two custom resources used to configure Istio (Gateway and VirtualService) replace the need for ingress resources. + +{{}} +These custom resources are not controlled by the operator and will need to be configured and maintained manually. +{{}} + +For each cluster, verify the VirtualService resource has two `- match:` blocks in the `tls` section. The hostname under `sniHosts:` should match your ``. + +### Using OpenShift routes + +1. Make sure your Redis Enterprise cluster (REC) has a different name (``) than any other participating clusters. If not, you'll need to manually rename the REC or move it to a different namespace. + You can check your new REC name with: + ```sh + oc get rec -o jsonpath='{.items[0].metadata.name}' + ``` + + If the rec name was modified, reapply [scc.yaml](https://github.com/RedisLabs/redis-enterprise-k8s-docs/blob/master/openshift/scc.yaml) to the namespace to reestablish security privileges. + + ```sh + oc apply -f scc.yaml + oc adm policy add-scc-to-group redis-enterprise-scc-v2 system:serviceaccounts: + ``` + + Releases before 6.4.2-6 use the earlier version of the SCC, named `redis-enterprise-scc`. + +1. Make sure you have DNS aliases for each database that resolve your API hostname ``,``, `` to the route IP address. To avoid entering multiple DNS records, you can use a wildcard in your alias (such as `*.ijk.example.com`). + +1. If your cluster uses [OpenShift routes]({{< relref "/operate/kubernetes/7.22/networking/routes" >}}), add the following to the `spec` section of your Redis Enterprise cluster (REC) resource file. + + ```sh + activeActive: + apiIngressUrl: + dbIngressSuffix: + method: openShiftRoute + ``` + +1. Make sure you have DNS aliases that resolve to the routes IP for both the API hostname (``) and the replication hostname (``) for each database. To avoid entering each database individually, you can use a wildcard in your alias (such as `*.ijk.example.com`). + +1. After the changes are saved and applied, you can see that a new route was created for the API. + + ```sh + $ oc get route + NAME HOST/PORT PATH SERVICES PORT TERMINATION WILDCARD + rec01 api-openshift.apps.abc.example.com rec01 api passthrough None + ``` + +## Create an Active-Active database with `crdb-cli` + +The `crdb-cli` command can be run from any Redis Enterprise pod hosted on any participating K8s cluster. You'll need the values for the [required parameters]({{< relref "/operate/kubernetes/7.22/active-active/create-aa-crdb-cli#document-required-parameters" >}}) for each Redis Enterprise cluster. + +```sh +crdb-cli crdb create \ + --name \ + --memory-size \ + --encryption yes \ + --instance fqdn=,url=https://,username=,password=,replication_endpoint=,replication_tls_sni= \ + --instance fqdn=,url=https://,username=,password=,replication_endpoint=,replication_tls_sni= +``` + +To create a database that syncs between more than two instances, add additional `--instance` arguments. + +See the [`crdb-cli` reference]({{< relref "/operate/rs/references/cli-utilities/crdb-cli" >}}) for more options. + +## Test your database + +The easiest way to test your Active-Active database is to set a key-value pair in one database and retrieve it from the other. + +You can connect to your databases with the instructions in [Manage databases]({{< relref "/operate/kubernetes/7.22/re-databases/db-controller#connect-to-a-database" >}}). Set a test key with `SET foo bar` in the first database. If your Active-Active deployment is working properly, when connected to your second database, `GET foo` should output `bar`. diff --git a/content/operate/kubernetes/7.22/active-active/create-reaadb.md b/content/operate/kubernetes/7.22/active-active/create-reaadb.md new file mode 100644 index 0000000000..92d4daf7bc --- /dev/null +++ b/content/operate/kubernetes/7.22/active-active/create-reaadb.md @@ -0,0 +1,138 @@ +--- +Title: Create Active-Active database (REAADB) +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: null +linkTitle: Create database +weight: 30 +url: '/operate/kubernetes/7.22/active-active/create-reaadb/' +--- + + + +## Prerequisites + +To create an Active-Active database, make sure you've completed all the following steps and have gathered the information listed below each step. + +1. Configure the [admission controller and ValidatingWebhook]({{< relref "/operate/kubernetes/7.22/deployment/quick-start#enable-the-admission-controller/" >}}). + {{}}These are installed and enabled by default on clusters created via the OpenShift OperatorHub. {{}} + +2. Create two or more [RedisEnterpriseCluster (REC) custom resources]({{< relref "/operate/kubernetes/7.22/deployment/quick-start#create-a-redis-enterprise-cluster-rec" >}}) with enough [memory resources]({{< relref "/operate/rs/installing-upgrading/install/plan-deployment/hardware-requirements" >}}). + * Name of each REC (``) + * Namespace for each REC (``) + +3. Configure the REC [`ingressOrRoutes` field]({{< relref "/operate/kubernetes/7.22/networking/ingressorroutespec" >}}) and [create DNS records]({{< relref "/operate/kubernetes/7.22/networking/ingressorroutespec#configure-dns/" >}}). + * REC API hostname (`api--.`) + * Database hostname suffix (`-db--.`) + +4. [Prepare participating clusters]({{< relref "/operate/kubernetes/7.22/active-active/prepare-clusters" >}}) + * RERC name (`) + * RERC secret name (`redis-enterprise-`) + +For a list of example values used throughout this article, see the [Example values](#example-values) section. + +## Create RERC custom resources {#create-rerc} + +1. Create a `RedisEnterpriseRemoteCluster` (RERC) custom resource file for each participating Redis Enterprise cluster (REC). + +Below are examples of RERC resources for two participating clusters. Substitute your own values to create your own resource. + +Example RERC (`rerc-ohare`) for the REC named `rec-chicago` in the namespace `ns-illinois`: + +{{}} + +Example RERC (`rerc-raegan`) for the REC named `rec-arlington` in the namespace `ns-virginia`: + +{{}} + +For more details on RERC fields, see the [RERC API reference]({{}}). + +2. Create a Redis Enterprise remote cluster from each RERC custom resource file. + +```sh +kubectl create -f +``` + +3. Check the status of your RERC. If `STATUS` is `Active` and `SPEC STATUS` is `Valid`, then your configurations are correct. + +```sh +kubectl get rerc +``` + +The output should look similar to: + +```sh +kubectl get rerc rerc-ohare + +NAME STATUS SPEC STATUS LOCAL +rerc-ohare Active Valid true +``` + +In case of errors, review the RERC custom resource events and the Redis Enterprise operator logs. + +## Create the REAADB {#create-reaadb} + +1. Create a `RedisEnterpriseActiveActiveDatabase` (REAADB) custom resource file meeting the naming requirements and listing the names of the RERC custom resources created in the last step. + +Naming requirements: +* less than 63 characters +* contains only lowercase letters, numbers, or hyphens +* starts with a letter +* ends with a letter or digit + +Example REAADB named `reaadb-boeing` linked to the REC named `rec-chicago` with two participating clusters and a global database configuration with shard count set to 3: + +{{}} + +{{}}Sharding is disabled on Active-Active databases created with a `shardCount` of 1. Sharding cannot be enabled after database creation. {{}} + +For more details on RERC fields, see the [RERC API reference]({{}}). + +2. Create a Redis Enterprise Active-Active database from the REAADB custom resource file. + +```sh +kubectl create -f +``` + +3. Check the status of your RERC. If `STATUS` is `Active` and `SPEC STATUS` is `Valid`, your configurations are correct. + +```sh +kubectl get reaadb +``` + +The output should look similar to: + +```sh +kubectl get reaadb reaadb-boeing + +NAME STATUS SPEC STATUS LINKED REDBS REPLICATION STATUS +reaadb-boeing active Valid up +``` + +In case of errors, review the REAADB custom resource events and the Redis Enterprise operator logs. + +## Example values + +This article uses the example values listed below. You can also find them in the [YAML examples]({{< relref "/operate/kubernetes/7.22/reference/yaml/active-active" >}}) section. + +Example cluster 1: + +* REC name: `rec-chicago` +* REC namespace: `ns-illinois` +* RERC name: `rerc-ohare` +* RERC secret name: `redis-enterprise-rerc-ohare` +* API FQDN: `api-rec-chicago-ns-illinois.example.com` +* DB FQDN suffix: `-db-rec-chicago-ns-illinois.example.com` + +Example cluster 2: + +* REC name: `rec-arlington` +* REC namespace: `ns-virginia` +* RERC name: `rerc-raegan` +* RERC secret name: `redis-enterprise-rerc-reagan` +* API FQDN: `api-rec-arlington-ns-virginia.example.com` +* DB FQDN suffix: `-db-rec-arlington-ns-virginia.example.com` + diff --git a/content/operate/kubernetes/7.22/active-active/edit-clusters.md b/content/operate/kubernetes/7.22/active-active/edit-clusters.md new file mode 100644 index 0000000000..af5f7f451b --- /dev/null +++ b/content/operate/kubernetes/7.22/active-active/edit-clusters.md @@ -0,0 +1,158 @@ +--- +Title: Edit participating clusters for Active-Active database +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Steps to add or remove a participating cluster to an existing Active-Active + database with Redis Enterprise for Kubernetes. +linkTitle: Edit participating clusters +weight: 40 +url: '/operate/kubernetes/7.22/active-active/edit-clusters/' +--- +{{}}This feature is supported for general availability in releases 6.4.2-6 and later. Some of these features were available as a preview in 6.4.2-4 and 6.4.2-5. Please upgrade to 6.4.2-6 for the full set of general availability features and bug fixes. and later.{{}} + +## Add a participating cluster + +Use the following steps to add a participating cluster to an existing Redis Enterprise Active-Active database (REAADB) for Kubernetes. + +### Prerequisites + +To prepare the Redis Enterprise cluster (REC) to participate in an Active-Active database, perform the following tasks from [Prepare participating clusters]({{< relref "/operate/kubernetes/7.22/active-active/prepare-clusters" >}}): + +- Make sure the cluster meets the hardware and naming requirements. +- Enable the Active-Active controllers. +- Configure external routing. +- Configure `ValidatingWebhookConfiguration`. + +### Collect REC credentials + +To communicate with other clusters, all participating clusters need access to the admin credentials for all other clusters. + +1. Get the REC credentials secret for the new participating cluster. + + ```sh + kubectl get secret -o yaml + ``` + + This example shows an admin credentials secret for an REC named `rec-boston`: + + ```yaml + apiVersion: v1 + data: + password: ABcdef12345 + username: GHij56789 + kind: Secret + metadata: + name: rec-boston + type: Opaque + ``` + +1. Create a secret for the new participating cluster named `redis-enterprise-` and add the username and password. + + The example below shows a secret file for a remote cluster named `rerc-logan` . + + ```yaml + apiVersion: v1 + data: + password: ABcdef12345 + username: GHij56789 + kind: Secret + metadata: + name: redis-enterprise-rerc-logan + type: Opaque + ``` + +1. Apply the file of collected secrets to every participating REC. + + ```sh + kubectl apply -f + ``` + + If the admin credentials for any of the clusters change, update and reapply the file to all clusters. + +### Create RERC + +1. From one of the existing participating clusters, create a `RedisEnterpriseRemoteCluster` (RERC) custom resource for the new participating cluster. + + This example (rerc-logan) shows an RERC custom resource for an REC named `rec-boston` in the namespace `ns-massachusetts`. + + ```yaml + apiVersion: app.redislabs.com/v1alpha1 + kind: RedisEnterpriseRemoteCluster + metadata: + name: rerc-logan + spec: + recName: rec-boston + recNamespace: ns-massachusetts + apiFqdnUrl: test-example-api-rec-boston-ns-massachusetts.example.com + dbFqdnSuffix: -example-cluster-rec-boston-ns-massachusetts.example.com + secretName: redis-enterprise-rerc-logan + ``` + +1. Create the RERC custom resource. + + ```sh + kubectl create -f + ``` + +1. Check the status of the newly created RERC custom resource. + + ```sh + kubectl get rerc + ``` + + The output should look like this: + + ```sh + NAME STATUS SPEC STATUS LOCAL + rerc-logan Active Valid true + ``` + +### Edit REAADB spec + +1. Patch the REAADB spec to add the new RERC name to the `participatingClusters`, replacing `` and `` with your own values. + + ```sh + kubectl patch reaadb < --type merge --patch '{"spec": {"participatingClusters": [{"name": ""}]}}' + ``` + +1. View the REAADB `participatingClusters` status to verify the cluster was added. + + ```sh + kubectl get reaadb -o=jsonpath='{.status.participatingClusters}' + ``` + + The output should look like this: + + ```sh + [{"id":1,"name":"rerc-ohare"},{"id":2,"name":"rerc-reagan"},{"id":3,"name":"rerc-logan"}] + ``` + +## Remove a participating cluster + +1. On an existing participating cluster,remove the desired cluster from the `participatingCluster` section of the REAADB spec. + + ```sh + kubectl edit reaadb + ``` + +1. On each of the other participating clusters, verify the status is `active` and the spec status is `Valid` and the cluster was removed. + + ```sh + kubectl get reaadb }}This feature is supported for general availability in releases 6.4.2-6 and later. Some of these features were available as a preview in 6.4.2-4 and 6.4.2-5. Please upgrade to 6.4.2-6 for the full set of general availability features and bug fixes. and later.{{}} + +Before a RedisEnterpriseCluster (REC) can participate in an Active-Active database, it needs an accompanying RedisEnterpriseRemoteCluster (RERC) custom resource. The RERC contains details allowing the REC to link to the RedisEnterpriseActiveActiveDatabase (REAADB). The RERC resource is listed in the REAADB resource to become a participating cluster for the Active-Active database. + +The RERC controller periodically connects to the local REC endpoint via its external address, to ensure it’s setup correctly. For this to work, the external load balancer must support [NAT hairpinning](https://en.wikipedia.org/wiki/Network_address_translation#NAT_loopback). In some cloud environments, this may involve disabling IP preservation for the load balancer target groups. + +For more details, see the [RERC API reference]({{}}). + +## Edit RERC + +Use the `kubectl patch rerc --type merge --patch` command to patch the local RERC custom resource with your changes. For a full list of available fields, see the [RERC API reference]({{}}). + +The following example edits the `dbFqdnSuffix` field for the RERC named `rerc-ohare`. + +```sh +kubectl patch rerc rerc-ohare --type merge --patch \ +'{"spec":{"dbFqdnSuffix": "-example2-cluster-rec-chicago-ns-illinois.example.com"}}' +``` + +## Update RERC secret + +If the credentials are changed or updated for a REC participating cluster, you need to manually edit the RERC secret and apply it to all participating clusters. + +1. On the local cluster, update the secret with new credentials and name it with the following convention: `redis-enterprise-`. + + A secret for a remote cluster named `rerc-ohare` would be similar to the following: + + ```yaml + apiVersion: v1 + data: + password: PHNvbWUgcGFzc3dvcmQ+ + username: PHNvbWUgdXNlcj4 + kind: Secret + metadata: + name: redis-enterprise-rerc-ohare + type: Opaque + ``` + +1. Apply the file. + + ```sh + kubectl apply -f + ``` + +1. Watch the RERC to verify the status is "Active" and the spec status is "Valid." + + ```sh + kubectl get rerc + ``` + + The output should look like this: + + ```sh + NAME STATUS SPEC STATUS LOCAL + rerc-ohare Active Valid true + ``` + + To troubleshoot invalid configurations, view the RERC custom resource events and the [Redis Enterprise operator logs]({{< relref "/operate/kubernetes/7.22/logs/" >}}). + +1. Verify the status of each REAADB using that RERC is "Active" and the spec status is "Valid." + + ```sh + kubectl get reaadb reaadb-boeing + ``` + The output should look similar to: + + ```sh + NAME STATUS SPEC STATUS LINKED REDBS REPLICATION STATUS + reaadb-boeing active Valid up + ``` + + To troubleshoot invalid configurations, view the RERC custom resource events and the [Redis Enterprise operator logs]({{< relref "/operate/kubernetes/7.22/logs/" >}}). + +1. Repeat the above steps on all other participating clusters. \ No newline at end of file diff --git a/content/operate/kubernetes/7.22/active-active/global-config.md b/content/operate/kubernetes/7.22/active-active/global-config.md new file mode 100644 index 0000000000..6a779aa6c3 --- /dev/null +++ b/content/operate/kubernetes/7.22/active-active/global-config.md @@ -0,0 +1,174 @@ +--- +Title: Set global database configurations +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: The REAADB contains the field '.spec.globalConfigurations' and through + this the database configurations are set. +linkTitle: Global configuration +weight: 50 +url: '/operate/kubernetes/7.22/active-active/global-config/' +--- + + +The Redis Enterprise Active-Active database (REAADB) custom resource contains the field `.spec.globalConfigurations`. This field sets configurations for the Active-Active database across all participating clusters, such as memory size, shard count, and the global database secrets. + +The [REAADB API reference]({{}}) contains a full list of available fields. + +## Edit global configurations + +1. Edit or patch the REAADB custom resource with your global configuration changes. + + The example command below patches the REAADB named `reaadb-boeing` to set the global memory size to 200MB: + + ```sh + kubectl patch reaadb reaadb-boeing --type merge --patch \ + '{"spec": {"globalConfigurations": {"memorySize": "200mb"}}}' + ``` + +1. Verify the status is `active` and the spec status is `Valid`. + + This example shows the status for the `reaadb-boeing` database. + + ```sh + kubectl get reaadb reaadb-boeing + + NAME STATUS SPEC STATUS GLOBAL CONFIGURATIONS REDB LINKED REDBS + reaadb-boeing active Valid + ``` + +1. View the global configurations on each participating cluster to verify they are synced. + + ```sh + kubectl get reaadb -o yaml + ``` + +## Edit global configuration secrets + +This section edits the secrets under the REAADB `.spec.globalConfigurations` section. For more information and all available fields, see the [REAADB API reference]({{}}). + +1. On an existing participating cluster, generate a YAML file containing the database secret with the relevant data. + + This example shoes a secret named `my-db-secret` with the password `my-password` encoded in base 64. + + ```yaml + apiVersion: v1 + data: + password: bXktcGFzcw + kind: Secret + metadata: + name: my-db-secret + type: Opaque + ``` + +1. Apply the secret file from the previous step, substituting your own value for ``. + + ```sh + kubectl apply -f + ``` + +1. Patch the REAADB custom resource to specify the database secret, substituting your own values for `` and ``. + + ```sh + kubectl patch reaadb --type merge --patch \ + '{"spec": {"globalConfigurations": {"databaseSecretName": "secret-name"}}}' + ``` + +1. Check the REAADB status for an `active` status and `Valid` spec status. + + ```sh + kubectl get reaadb + + NAME STATUS SPEC STATUS GLOBAL CONFIGURATIONS REDB LINKED REDBS + reaadb-boeing active Valid + ``` + +1. On each other participating cluster, check the secret status. + + ```sh + kubectl get reaadb -o=jsonpath='{.status.secretsStatus}' + ``` + + The output should show the status as `Invalid`. + + ```sh + [{"name":"my-db-secret","status":"Invalid"}] + ``` + +1. Sync the secret on each participating cluster. + + ```sh + kubectl apply -f + ``` + +1. Repeat the previous two steps on every participating cluster. + +## Configure role permissions + +You can configure role-based access control (RBAC) permissions for Active-Active databases using the `rolesPermissions` field in the REAADB `.spec.globalConfigurations` section. The role permissions configuration is propagated across all participating clusters, but the underlying roles and Redis ACLs must be manually created on each cluster. + +{{}}You must manually create the specified roles and Redis ACLs on all participating clusters before configuring role permissions. The operator only propagates the role permissions configuration—it does not create the underlying roles and ACLs. If roles or ACLs are missing on any cluster, the operator will log errors and dispatch an Event associated with the REAADB object until they are manually created.{{}} + +### Prerequisites + +Before configuring role permissions: + +1. Manually create the required roles and Redis ACLs on all participating clusters using the Redis Enterprise admin console or REST API. +2. Ensure role and ACL names match exactly across all clusters (names are case-sensitive). +3. Verify that roles and ACLs are properly configured on each cluster. + +{{}}The operator does not automatically create or synchronize roles and ACLs across clusters. You are responsible for manually creating identical roles and ACLs on each participating cluster.{{}} + +### Add role permissions to REAADB + +1. Create or update your REAADB custom resource to include `rolesPermissions` in the global configurations. + + Example REAADB with role permissions: + + ```yaml + apiVersion: app.redislabs.com/v1alpha1 + kind: RedisEnterpriseActiveActiveDatabase + metadata: + name: reaadb-boeing + spec: + globalConfigurations: + databaseSecretName: + memorySize: 200MB + shardCount: 3 + rolesPermissions: + - role: + acl: + type: redis-enterprise + participatingClusters: + - name: rerc-ohare + - name: rerc-reagan + ``` + + Replace `` and `` with the exact names of your Redis Enterprise role and ACL. + +2. Apply the REAADB custom resource: + + ```sh + kubectl apply -f + ``` + + Alternatively, patch an existing REAADB to add role permissions: + + ```sh + kubectl patch reaadb --type merge --patch \ + '{"spec": {"globalConfigurations": {"rolesPermissions": [{"role": "", "acl": "", "type": "redis-enterprise"}]}}}' + ``` + +3. After the REAADB is active and its replication status is "Up", verify role permissions are applied to the local database using the Redis Enterprise REST API. See [Database requests]({{}}) for details. + +### Troubleshooting role permissions + +If you encounter issues with role permissions: + +- **Missing role or ACL errors**: Manually create the specified roles and ACLs on all participating clusters with exact name matches. The operator cannot create these automatically. +- **Permission propagation failures**: Verify that the roles and ACLs are properly configured and accessible on each cluster. Remember that you must manually create identical roles and ACLs on every participating cluster. +- **Case sensitivity issues**: Verify that role and ACL names match exactly, including capitalization, across all clusters. + +For more details on the `rolesPermissions` field structure, see the [REAADB API reference]({{}}). \ No newline at end of file diff --git a/content/operate/kubernetes/7.22/active-active/global-db-secret.md b/content/operate/kubernetes/7.22/active-active/global-db-secret.md new file mode 100644 index 0000000000..0363155d47 --- /dev/null +++ b/content/operate/kubernetes/7.22/active-active/global-db-secret.md @@ -0,0 +1,76 @@ +--- +Title: Set global database secret +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: The REAADB contains the field '.spec.globalConfigurations' to set the + global database secret. +linkTitle: Global database secret +weight: 50 +url: '/operate/kubernetes/7.22/active-active/global-db-secret/' +--- + + +## Set global database secret + +One of the fields available for `globalConfigurations` is `databaseSecretName` which can point to a secret containing the database password. To set the database secret name and sync the data to all participating clusters, follow the steps below. + +To edit other global configruations, see [global configuration]({{< relref "/operate/kubernetes/7.22/active-active/global-config" >}}) + +1. On an existing participating cluster, generate a YAML file containing the database secret with the database password. + + This example shoes a secret named `my-db-secret` with the password `my-password` encoded in base 64. + + ```yaml + apiVersion: v1 + data: + password: bXktcGFzcw + kind: Secret + metadata: + name: my-db-secret + type: Opaque + ``` + +1. Apply the secret file from the previous step, substituting your own value for ``. + + ```sh + kubectl apply -f + ``` + +1. Patch the REAADB custom resource to specify the database secret, substituting your own values for `` and ``. + + ```sh + kubectl patch reaadb --type merge --patch \ + '{"spec": {"globalConfigurations": {"databaseSecretName": "secret-name"}}}' + ``` + +1. Check the REAADB status for an `active` status and `Valid` spec status. + + ```sh + kubectl get reaadb + + NAME STATUS SPEC STATUS GLOBAL CONFIGURATIONS REDB LINKED REDBS + example-aadb-1 active Valid + ``` + +1. On each other participating cluster, check the secret status. + + ``sh + kubectl get reaadb -o=jsonpath='{.status.secretsStatus}' + ``` + + The output should show the status as `Invalid`. + + ```sh + [{"name":"my-db-secret","status":"Invalid"}] + ``` + +1. Sync the secret on each participating cluster. + + ```sh + kubectl apply -f + ``` + +1. Repeat the previous two steps on every participating cluster. diff --git a/content/operate/kubernetes/7.22/active-active/prepare-clusters.md b/content/operate/kubernetes/7.22/active-active/prepare-clusters.md new file mode 100644 index 0000000000..3671ae5049 --- /dev/null +++ b/content/operate/kubernetes/7.22/active-active/prepare-clusters.md @@ -0,0 +1,148 @@ +--- +Title: Prepare participating clusters +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Prepare your participating RECs to be part of an Active-Active database + deployment. +linkTitle: Prepare clusters +weight: 10 +url: '/operate/kubernetes/7.22/active-active/prepare-clusters/' +--- + +## Prepare participating clusters + +Before you prepare your clusters to participate in an Active-Active database, make sure you've completed all the following steps and have gathered the information listed below each step. + +1. Configure the [admission controller and ValidatingWebhook]({{< relref "/operate/kubernetes/7.22/deployment/quick-start#enable-the-admission-controller/" >}}). + +2. Create two or more [RedisEnterpriseCluster (REC) custom resources]({{< relref "/operate/kubernetes/7.22/deployment/quick-start#create-a-redis-enterprise-cluster-rec" >}}) with enough [memory resources]({{< relref "/operate/rs/installing-upgrading/install/plan-deployment/hardware-requirements" >}}). + * Name of each REC (``) + * Namespace for each REC (``) + +3. Configure the REC [`ingressOrRoutes` field]({{< relref "/operate/kubernetes/7.22/networking/ingressorroutespec" >}}) and [create DNS records]({{< relref "/operate/kubernetes/7.22/networking/ingressorroutespec#configure-dns/" >}}). + * REC API hostname (`api--.`) + * Database hostname suffix (`-db--.`) + +Next you'll [collect credentials](#collect-rec-credentials) for your participating clusters and create secrets for the RedisEnterprsieRemoteCluster (RERC) to use. + +For a list of example values used throughout this article, see the [Example values](#example-values) section. + +## Collect REC credentials + +To communicate with other clusters, all participating clusters will need access to the admin credentials for all other clusters. + +1. Create a file to hold the admin credentials for all participating RECs (such as `all-rec-secrets.yaml`). + +1. Within that file, create a new secret for each participating cluster named `redis-enterprise-`. + + The example below shows a file (`all-rec-secrets.yaml`) holding secrets for two participating clusters: + + ```yaml + apiVersion: v1 + data: + password: + username: + kind: Secret + metadata: + name: redis-enterprise-rerc-ohare + type: Opaque + + --- + + apiVersion: v1 + data: + password: + username: + kind: Secret + metadata: + name: redis-enterprise-rerc-reagan + type: Opaque + + ``` + +1. Get the REC credentials secret for each participating cluster. + + ```sh + kubectl get secret -o yaml + ``` + + The admin credentials secret for an REC named `rec-chicago` would be similar to this: + + ```yaml + apiVersion: v1 + data: + password: ABcdef12345 + username: GHij56789 + kind: Secret + metadata: + name: rec-chicago + type: Opaque + ``` + + {{< note >}} + The `username` and `password` values should be base64 encoded, not plain text. + {{< /note >}} + +1. Add the username and password to the new secret for that REC and namespace. + + This example shows the collected secrets file (`all-rec-secrets.yaml`) for `rerc-ohare` (representing `rec-chicago` in namespace `ns-illinois`) and `rerc-reagan` (representing `rec-arlington` in namespace `ns-virginia`). + + ```yaml + apiVersion: v1 + data: + password: ABcdef12345 + username: GHij56789 + kind: Secret + metadata: + name: redis-enterprise-rerc-ohare + type: Opaque + + --- + + apiVersion: v1 + data: + password: KLmndo123456 + username: PQrst789010 + kind: Secret + metadata: + name: redis-enterprise-rerc-reagan + type: Opaque + + ``` + +1. Apply the file of collected secrets to every participating REC. + + ```sh + kubectl apply -f + ``` + + If the admin credentials for any of the clusters changes, the file will need to be updated and reapplied to all clusters. + +## Next steps + +Now you are ready to [create your Redis Enterprise Active-Active database]({{< relref "/operate/kubernetes/7.22/active-active/create-reaadb" >}}). + +## Example values + +This article uses the example values listed below. They can also be found in the [YAML examples]({{< relref "/operate/kubernetes/7.22/reference/yaml/active-active" >}}) section. + +Example cluster 1: + +* REC name: `rec-chicago` +* REC namespace: `ns-illinois` +* RERC name: `rerc-ohare` +* RERC secret name: `redis-enterprise-rerc-ohare` +* API FQDN: `api-rec-chicago-ns-illinois.example.com` +* DB FQDN suffix: `-db-rec-chicago-ns-illinois.example.com` + +Example cluster 2: + +* REC name: `rec-arlington` +* REC namespace: `ns-virginia` +* RERC name: `rerc-raegan` +* RERC secret name: `redis-enterprise-rerc-reagan` +* API FQDN: `api-rec-arlington-ns-virginia.example.com` +* DB FQDN suffix: `-db-rec-arlington-ns-virginia.example.com` diff --git a/content/operate/kubernetes/7.22/architecture/_index.md b/content/operate/kubernetes/7.22/architecture/_index.md new file mode 100644 index 0000000000..6d20921e6d --- /dev/null +++ b/content/operate/kubernetes/7.22/architecture/_index.md @@ -0,0 +1,160 @@ +--- +Title: Redis Enterprise for Kubernetes architecture +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Overview of the architecture and components of Redis Enterprise for Kubernetes. +hideListLinks: true +linkTitle: Architecture +weight: 1 +aliases: [/operate/kubernetes/architecture/operator/, /operate/kubernetes/architecture/operator-architecture/, /operate/kubernetes/architecture/operator-architecture] +url: '/operate/kubernetes/7.22/architecture/' +--- + +Redis Enterprise for Kubernetes gives you the speed and durability of [Redis Enterprise](https://redis.io/redis-enterprise/advantages/), with the flexibility and ease of [Kubernetes (K8s)](https://kubernetes.io/). Redis Enterprise for Kubernetes uses the Kubernetes operator pattern and custom controllers to bring the best of Redis Enterprise to the Kubernetes platform. + +## Lifecycle + +Kubernetes is a rapidly evolving platform with a short release cycle (around 4 months). This frequent influx of new features, enhancements and bug fixes means Kubernetes distributions move in and out of support quickly. Redis Enterprise is also a fast-moving product, and is compatible and tested only on distributions listed as [supported distributions.]({{}}) + +Each version of Redis Enterprise for Kubernetes is tested to ensure the version of Redis Enterprise works with the [supported Kubernetes distributions]({{}}) at the time. Both the Kubernetes version and the Redis Enterprise version must be supported for the operator to function correctly. We encourage you to upgrade Redis Enterprise for Kubernetes frequently, not only to get the benefit of enhancements and bug fixes, but to keep your software supported. + +Supported platforms are listed in the [release notes]({{}}) and in the [supported platforms reference.]({{}}) + +## Architecture + +The image below illustrates the components of a single namespace, three node deployment. + +{{< image filename="/images/k8s/k8s-arch-v4.png" >}} + +## Operator + +An [operator](https://kubernetes.io/docs/concepts/extend-kubernetes/operator/) is a custom extension of the Kubernetes API designed to manage complex, stateful applications and their components. This operator pattern is commonly used by databases and other applications to extend the cluster's behavior without changing its underlying code. Kubernetes.io/docs has a great explanation of the [operator pattern](https://kubernetes.io/docs/concepts/extend-kubernetes/operator/). + +The operator is a deployment that runs within a [namespace](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/) and uses [controllers](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/#custom-controllers) to manage [custom resources (CRs)](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/), ensuring these resources are continuously monitored and maintained. + +When the operator is installed, the following resources are created: + +- [service account](https://kubernetes.io/docs/concepts/security/service-accounts/) under which the operator will run +- set of [roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole) to define the privileges necessary for the operator to perform its tasks +- set of [role bindings](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding) to authorize the service account +- [CustomResourceDefinition (CRD)](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/#customresourcedefinitions) for each Redis Enterprise custom resource +- the operator deployment + +## Namespace + +The Redis Enterprise [operator](https://kubernetes.io/docs/concepts/extend-kubernetes/operator/) is deployed within a [namespace](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/). Each namespace can host only one operator and one [RedisEnterpriseCluster (REC)](#redisenterprisecluster-rec). Namespaces create logical boundaries between resources, allowing organization and security. Some resources are limited to a namespace, while others are cluster-wide. + +Redis Enterprise for Kubernetes also supports [multi-namespace deployments]({{}}), meaning the operator can monitor other namespaces (that host applications) for custom resources and apply any changes. + +## Custom resources + +Kubernetes [custom resources (CRs)](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) are commonly used by databases and other applications to extend the cluster's behavior without changing its underlying code. [Custom resources (CRs)](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) extend the Kubernetes API, enabling users to manage Redis databases the Kubernetes way. Custom resources are created and managed using YAML configuration files. + +This [declarative configuration approach](https://kubernetes.io/docs/tasks/manage-kubernetes-objects/declarative-config/) allows you to specify the desired state for your resources, and the operator makes the necessary changes to achieve that state. This simplifies [installation]({{}}), [upgrades]({{}}), and [scaling]({{}}) both vertically and horizontally. + +The operator continuously monitors CRs for changes, automatically reconciling any differences between the desired state you specified in your YAML configuration file, and the actual state of your resources. Custom resources can also reside in separate namespaces from the operator managing them, such as in [multi-namespace installations]({{}}). + +## Custom resource definitions + +A [custom resource definition (CRD)](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/#customresourcedefinitions) is a cluster-wide resource that specifies which settings can be configured via custom resource files. Any setting not defined by the CRD is not managed by the operator. You can still make changes to these unmanaged settings using standard Redis Enterprise Software methods. + +For settings managed by the operator, any changes made outside of the CR YAML files (e.g., through the management UI) will be overwritten by the operator. Ensure that all operator-managed settings are updated using the CR YAML files to prevent conflicts. + +## RedisEnterpriseCluster REC + +A Redis Enterprise cluster is a set of Redis Enterprise nodes pooling resources. Each node is capable of running multiple Redis instances ([shards]({{}})). + +{{< image filename="/images/k8s/k8s-node-arch.png">}} + +A Redis cluster is created and managed by the [RedisEnterpriseCluster (REC)]({{}}) [custom resource](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/). Changes to the REC configuration file prompt the operator to make changes to the cluster. The REC is required for both standard databases ([REDB](#redisenterprisedatabase-redb)) and Active-Active databases ([REAADB](#redisenterpriseactiveactivedatabase-reaadb)). + +See the [RedisEnterpriseCluster API Reference]({{}}) for a full list of fields and settings. + +## RedisEnterpriseDatabase REDB + +A Redis Enterprise database is a logical entity that manages your entire dataset across multiple Redis instances. A Redis instance is a single-threaded database process ([commonly referred to as a shard]({{}})). + +Redis databases are created and managed by the [RedisEnterpriseDatabase (REDB)]({{}}) [custom resource (CR)](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/). Changes to the REDB YAML configuration file prompt the operator to make changes to the database. + +An operator can manage a database in the same namespace, or a different namespace. See ["Flexible deployment"]({{}}) options and ["Manage databases in multiple namespaces"]({{}}) for more information. + +See the [RedisEnterpriseDatabase (REDB) API Reference]({{}}) for a full list of fields and settings. + +## Security + +Redis Enterprise for Kubernetes uses [secrets](https://kubernetes.io/docs/concepts/configuration/secret/) to manage your cluster credentials, cluster certificates, and client certificates. You can configure [LDAP]({{}}) and [internode encryption]({{}}) using the [RedisEnterpriseCluster (REC)](#redisenterprisecluster-rec) spec. + +### REC credentials + +Redis Enterprise for Kubernetes uses the [RedisEnterpriseCluster (REC)]({{}}) [custom resource](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) to create a Redis Enterprise cluster. During creation it generates random credentials for the operator to use. The credentials are saved in a Kubernetes (K8s) [secret](https://kubernetes.io/docs/concepts/configuration/secret/). The secret name defaults to the name of the cluster. + +See [Manage REC credentials]({{}}) for more details. + +### REC certificates + +By default, Redis Enterprise Software for Kubernetes generates TLS certificates for the cluster during creation. These self-signed certificates are generated on the first node of each Redis Enterprise cluster (REC) and are copied to all other nodes in the cluster. + +See [Manage REC certificates]({{}}) for more details. + +### Client certificates + +For each client certificate you want to use, you need to create a [Kubernetes secret](https://kubernetes.io/docs/concepts/configuration/secret/) to hold it. You can then reference that secret in your [Redis Enterprise database (REDB)](#redisenterprisedatabase-redb) custom resource. + +See [Add client certificates]({{}}) for more details. + +## Storage + +[Persistent storage is mandatory for Redis Enterprise.]({{}}) Redis Enterprise for Kubernetes [requires network-attached storage](https://en.wikipedia.org/wiki/Network-attached_storage). + +Redis Enterprise for Kubernetes uses [PersistentVolumeClaims (PVC)](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#expanding-persistent-volumes-claims) to manage storage resources. The PVC is an abstract representation of the [PersistentVolume (PV)](https://kubernetes.io/docs/concepts/storage/persistent-volumes) resources used by your Redis pods. PVCs are created by the Redis Enterprise operator and used by the [RedisEnterpriseCluster (REC)](#redisenterprisecluster-rec). + +PVCs are created with a specific size and [can be expanded](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#expanding-persistent-volumes-claims), if the underlying [storage class](https://kubernetes.io/docs/concepts/storage/storage-classes/) supports it. + +### Auto Tiering + +Redis Enterprise Software for Kubernetes supports [Auto Tiering]({{}}) (previously known as Redis on Flash), which extends your node memory to use both RAM and flash storage. SSDs (solid state drives) can store infrequently used (warm) values while your keys and frequently used (hot) values are still stored in RAM. This improves performance and lowers costs for large datasets. + +NVMe (non-volatile memory express) SSDs are strongly recommended to achieve the best performance. + +## Networking + +By default, Kubernetes doesn't allow you to access your Redis database from outside your K8s cluster. Redis Enterprise for Kubernetes supports several ways to route external traffic to your [Redis Enterprise cluster (REC)](#redisenterprisecluster-rec): + +- Ingress controllers [HAProxy](https://haproxy-ingress.github.io/) and [NGINX](https://kubernetes.github.io/ingress-nginx/) require an `ingress` API resource. +- [Istio](https://istio.io/latest/docs/setup/getting-started/) requires `Gateway` and `VirtualService` API resources. +- OpenShift uses [routes]({{< relref "/operate/kubernetes/7.22/networking/routes" >}}) to route external traffic. + +The [Active-Active databases](#active-active-databases) require one of above routing methods to be configured in the REC with the [ingressOrRouteSpec field]({{}}). + +## Services Rigger + +The services rigger is responsible for creating and updating services related to database objects. It identifies database objects within the cluster and creates services in accordance with [`redisEnterpriseCluster.Spec.servicesRiggerSpec` setting]({{}}) to allow access to those databases. By default, each database has two services, a `cluster_ip` Service with the same name as the database and a `headless` Service with the same name as the database suffixed with `-headless`. It also creates other types of Services such as Ingress Services or OpenshiftRoutes (defined in `redisEnterpriseCluster.Spec.ingressOrRouteSpec`) meant to provide access to REAADB objects. + +You can view a list of services with the `kubectl get services` command. + +Kubernetes is a dynamic environment, with nodes and pods changing as needed. The services rigger monitors the cluster for these changes and updates the database services to ensure reliable communication with the databases. + +## Active-Active databases + +On Kubernetes, Redis Enterprise [Active-Active]({{< relref "/operate/rs/databases/active-active/" >}}) databases provide read and write access to the same dataset from different Kubernetes clusters. Creating an Active-Active database requires routing [network access]({{< relref "/operate/kubernetes/7.22/networking/" >}}) between two Redis Enterprise clusters residing in different Kubernetes clusters. Without the proper access configured for each cluster, syncing between the databases instances will fail.The admission controller is also required for Active-Active databases on Kubernetes, to validate changes to the custom resources. + +For more details and installation information, see [Active-Active databases]({{}}). For more general information about Active-Active, see the [Redis Enterprise Software docs]({{< relref "/operate/rs/databases/active-active/" >}}). + +## RedisEnterpriseRemoteCluster RERC + +The [RedisEnterpriseRemoteCluster (RERC)]({{}}) contains details allowing the REC to link to the RedisEnterpriseActiveActiveDatabase (REAADB). The RERC resource is listed in the [REAADB](#redisenterpriseactiveactivedatabase-reaadb) resource to become a participating cluster for the Active-Active database. + +See the [RERC API reference]({{}}) for a full list of fields and settings. + +## RedisEnterpriseActiveActiveDatabase REAADB + +The RedisEnterpriseActiveActiveDatabase (REAADB) resource creates and manages a database that spans more than one Kubernetes cluster. An REAADB requires [external routing](#networking), at least two [RECs](#redisenterprisecluster-rec), and at least two [RERCs](#redisenterpriseremotecluster-rerc). + +See the [REAADB API reference]({{}}) for a full list of fields and settings. + +## Metrics + +To collect metrics data from your databases and Redis Enterprise cluster (REC), you can [connect your Prometheus]({{}}) server to an endpoint exposed on your REC. Redis Enterprise for Kubernetes creates a dedicated service to expose the `prometheus` port (8070) for data collection. A custom resource called `ServiceMonitor` allows the [Prometheus operator](https://github.com/prometheus-operator/prometheus-operator/tree/main/Documentation) to connect to this port and collect data from Redis Enterprise. diff --git a/content/operate/kubernetes/7.22/architecture/deployment-options.md b/content/operate/kubernetes/7.22/architecture/deployment-options.md new file mode 100644 index 0000000000..30fade78bc --- /dev/null +++ b/content/operate/kubernetes/7.22/architecture/deployment-options.md @@ -0,0 +1,58 @@ +--- +Title: Flexible deployment options +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Redis Enterprise for Kubernetes allows you to deploy to multiple namespaces. + This article describes flexible deployment options you can use to meet your specific + needs. +linkTitle: Deployment options +aliases: [/operate/kubernetes/deployment/deployment-options/] +url: '/operate/kubernetes/7.22/architecture/deployment-options/' +--- +You can deploy Redis Enterprise for Kubernetes in several different ways depending on your database needs. + +Multiple RedisEnterpriseDatabase (REDB) resources can be associated with a single Redis Enterprise cluster resource (REC) even if they reside in different namespaces. + +The Redis Enterprise cluster (REC) custom resource must reside in the same namespace as the Redis Enterprise operator. + +{{}} Multi-namespace installations don't support Active-Active databases (REEADB). Only databases created with the REDB resource are supported in multi-namespace deployments at this time.{{}} + +## Single REC and single namespace (one-to-one) + +The standard and simplest deployment deploys your Redis Enterprise databases (REDB) in the same namespace as the Redis Enterprise cluster (REC). No additional configuration is required for this, since there is no communication required to cross namespaces. See [Deploy Redis Enterprise for Kubernetes]({{< relref "/operate/kubernetes/7.22/deployment/quick-start" >}}). + +{{< image filename="/images/k8s/k8s-deploy-one-to-one.png" >}} + +## Single REC and multiple namespaces (one-to-many) + +Multiple Redis Enterprise databases (REDB) spread across multiple namespaces within the same K8s cluster can be associated with the same Redis Enterprise cluster (REC). See [Manage databases in multiple namespaces]({{< relref "/operate/kubernetes/7.22/re-clusters/multi-namespace" >}}) for more information. + +{{< image filename="/images/k8s/k8s-deploy-one-to-many.png" >}} + +## Multiple RECs and multiple namespaces (many-to-many) + +A single Kubernetes cluster can contain multiple Redis Enterprise clusters (REC), as long as they reside in different namespaces. Each namespace can host only one REC and each operator can only manage one REC. + +You have the flexibility to create databases in separate namespaces, or in the same namespace as the REC, or combine any of the supported deployment options above. This configuration is geared towards use cases that require multiple Redis Enterprise clusters with greater isolation or different cluster configurations. + +See [Manage databases in multiple namespaces]({{< relref "/operate/kubernetes/7.22/re-clusters/multi-namespace" >}}) for more information. + + +{{< image filename="/images/k8s/k8s-deploy-many-to-many-new.png" >}} + +## Unsupported deployment patterns + +### Cross-cluster operations + +Redis Enterprise for Kubernetes does not support operations that cross Kubernetes clusters. Redis Enterprise clusters (REC) work inside a single K8s cluster. Crossing clusters could result in functional and security issues. + +{{< image filename="/images/k8s/k8s-deploy-cross-namespaces.png" >}} + +### Multiple RECs in one namespace + +Redis Enterprise for Kubernetes does not support multiple Redis Enterprise clusters (REC) in the same namespace. Creating more than one REC in the same namespace will result in errors. + +{{< image filename="/images/k8s/k8s-deploy-multicluster-antipattern.png" >}} diff --git a/content/operate/kubernetes/7.22/deployment/_index.md b/content/operate/kubernetes/7.22/deployment/_index.md new file mode 100644 index 0000000000..a52e3a6b6e --- /dev/null +++ b/content/operate/kubernetes/7.22/deployment/_index.md @@ -0,0 +1,62 @@ +--- +Title: Deployment +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Deploy Redis Enterprise for Kubernetes using the Redis Enterprise operator on various Kubernetes distributions. +hideListLinks: true +linkTitle: Deployment +weight: 11 +url: '/operate/kubernetes/7.22/deployment/' +--- + +Deploy Redis Enterprise for Kubernetes by using the Redis Enterprise operator. The operator provides a simple way to deploy and manage Redis Enterprise clusters on various Kubernetes distributions, both on-premises and in the cloud. + +The Redis Enterprise operator uses custom resource definitions (CRDs) to manage Redis Enterprise clusters (REC) and databases (REDB) as native Kubernetes resources. This approach enables GitOps workflows and Kubernetes-native operations. + +## Quick start + +Get started quickly with a basic Redis Enterprise deployment: + +- [Deploy Redis Enterprise for Kubernetes]({{< relref "/operate/kubernetes/7.22/deployment/quick-start" >}}) - Step-by-step guide for most Kubernetes distributions +- [Deploy on OpenShift]({{< relref "/operate/kubernetes/7.22/deployment/openshift" >}}) - Specific instructions for OpenShift environments + +## Deployment methods + +Choose the deployment method that best fits your environment: + +- [Deploy with Helm]({{< relref "/operate/kubernetes/7.22/deployment/helm" >}}) - Use Helm charts for simplified deployment and management +- [Deploy with operator bundle]({{< relref "/operate/kubernetes/7.22/deployment/quick-start" >}}) - Direct deployment using kubectl and operator manifests + +## Container images + +Understand the container images used by the Redis Enterprise operator: + +- [Container images]({{< relref "/operate/kubernetes/7.22/deployment/container-images" >}}) - Details about Redis Enterprise container images and registries + +## Compatibility + +Before installing, verify compatibility with your environment: + +- [Supported Kubernetes distributions]({{< relref "/operate/kubernetes/7.22/reference/supported_k8s_distributions" >}}) - Check which Redis Enterprise operator version supports your Kubernetes distribution + +## Prerequisites + +Before deploying Redis Enterprise for Kubernetes, ensure you have: + +- A Kubernetes cluster running a [supported distribution]({{< relref "/operate/kubernetes/7.22/reference/supported_k8s_distributions" >}}) +- Minimum of three worker nodes for high availability +- Kubernetes client (kubectl) configured to access your cluster +- Access to container registries (DockerHub, Red Hat Container Catalog, or private registry) +- Sufficient resources as outlined in [sizing recommendations]({{< relref "/operate/kubernetes/7.22/recommendations/sizing-on-kubernetes" >}}) + +## Next steps + +After deployment, you can: + +- [Create a Redis Enterprise cluster (REC)]({{< relref "/operate/kubernetes/7.22/re-clusters" >}}) +- [Create Redis Enterprise databases (REDB)]({{< relref "/operate/kubernetes/7.22/re-databases" >}}) +- [Configure networking]({{< relref "/operate/kubernetes/7.22/networking" >}}) +- [Set up security]({{< relref "/operate/kubernetes/7.22/security" >}}) \ No newline at end of file diff --git a/content/operate/kubernetes/7.22/deployment/container-images.md b/content/operate/kubernetes/7.22/deployment/container-images.md new file mode 100644 index 0000000000..fd014a2ff3 --- /dev/null +++ b/content/operate/kubernetes/7.22/deployment/container-images.md @@ -0,0 +1,264 @@ +--- +Title: Use a private registry for container images +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: This section details how the Redis Enterprise Software and Kubernetes + operator images can be configured to be pulled from a variety of sources. This page + describes how to configure alternate private repositories for images, plus some + techniques for handling public repositories with rate limiting. +linktitle: Use a private container registry +weight: 92 +url: '/operate/kubernetes/7.22/deployment/container-images/' +--- + +Redis Enterprise Software, its Kubernetes operator, and the Service Rigger +are all distributed as separate container images. +Your Kubernetes deployment will pull these images as needed. +You can control where these images are +pulled from within the operator deployment and also via the +Redis Enterprise custom resources. + +The operator image also includes the admission controller, which runs as part of the operator container and provides validation for Redis Enterprise database resources. + +In general, images for deployments that do not have a registry domain +name (e.g., `gcr.io` or `localhost:5000`) are pulled from the default registry associated +with the Kubernetes cluster. A plain reference to `redislabs/redis` will likely pull from DockerHub +(except on OpenShift where it pulls from Red Hat). + +For security reasons (e.g., in air-gapped environments), you may want to pull the images +from a public registry once and then push them to a private registry under +your control. + +{{}}It is very important that the images you are pushing to the private registry have the same exact version tag as the original images. {{}} + +Furthermore, because [Docker rate limits public pulls](https://www.docker.com/blog/scaling-docker-to-serve-millions-more-developers-network-egress/), +you may want to consider pulling images from a +private registry to avoid deployment failures when you hit your DockerHub rate limit. + +The information below will help you track and configure where your deployments pull container images. + +{{< note >}} +**IMPORTANT** +* Each version of the Redis Enterprise operator is mapped to a specific version of Redis Enterprise Software. The semantic versions always match (for example, 7.22.0), although the specific release numbers may be different (for example, 7.22.0-7 is the operator version for Redis Enterprise Software 7.22.0-28). +* A specific operator version only supports a specific Redis Enterprise version. Other combinations of operator and Redis Enterprise versions are **not supported**. +{{< /note >}} + + +## Find container sources + +Every pod in your deployed application has a source registry. Any image not prefixed by a registry domain name (e.g., "gcr.io") will pull from the default registry for the Kubernetes cluster (i.e., DockerHub). You can use the commands below to discover the pull sources for the images on your cluster. + +To list all the images used by your cluster: + +```sh +kubectl get pods --all-namespaces -o jsonpath="{..image}" |tr -s '[[:space:]]' '\n' | uniq -c +``` + +To specifically determine the pull source for the Redis Enterprise operator itself, run the following command: + +```sh +kubectl get pods --all-namespaces -o jsonpath="{..image}" |tr -s '[[:space:]]' '\n' | uniq -c | grep redislabs +``` + +You can limit this command to specific namespaces by replacing the `--all-namespaces` parameter with +a set of `-n {namespace}` parameters, where each `{namespace}` is a specific +namespace of interest on your cluster. + +## Create a private container registry + +You can set up a private container registry in a couple of ways: + +* On-premise via [Docker registry](https://docs.docker.com/registry/deploying/), [Red Hat Quay](https://www.redhat.com/en/technologies/cloud-computing/quay), or other providers +* Cloud provider based registries (e.g., Azure Container Registry, Google Container Registry, etc.). + +Once you have set up a private container registry, you will identify the container registry using: + +* A domain name +* A port (optional) +* A repository path (optional) + +## Push images to a private container registry + +Important images for a Redis Enterprise Software deployment include: + +* Redis Enterprise Software +* Bootstrapping a Redis Enterprise cluster node (in the operator image) +* The Service Rigger +* The Redis Enterprise Software operator (which also includes the admission controller) + +You will need to push all these images to your private container registry. In general, +to push the images you must: + + 1. [Pull](https://docs.docker.com/engine/reference/commandline/pull/) the various images locally for the Redis Enterprise Software, the Service Rigger, and the operator. + 2. Tag the local images with the private container registry, repository, and version tag. + 3. [Push](https://docs.docker.com/engine/reference/commandline/push/) the newly tagged images. + +The example below shows the commands for pushing the images for Redis Enterprise Software and its operator to a private container registry: + +```sh +PRIVATE_REPO=...your repo... +RS_VERSION=7.22.0-28 +OPERATOR_VERSION=7.22.0-7 +docker pull redislabs/redis:${RS_VERSION} +docker pull redislabs/operator:${OPERATOR_VERSION} +docker pull redislabs/k8s-controller:${OPERATOR_VERSION} +docker tag redislabs/redis:${RS_VERSION} ${PRIVATE_REPO}/redislabs/redis:${RS_VERSION} +docker tag redislabs/operator:${OPERATOR_VERSION} ${PRIVATE_REPO}/redislabs/operator:${OPERATOR_VERSION} +docker tag redislabs/k8s-controller:${OPERATOR_VERSION} ${PRIVATE_REPO}/redislabs/k8s-controller:${OPERATOR_VERSION} +docker push ${PRIVATE_REPO}/redislabs/redis:${RS_VERSION} +docker push ${PRIVATE_REPO}/redislabs/operator:${OPERATOR_VERSION} +docker push ${PRIVATE_REPO}/redislabs/k8s-controller:${OPERATOR_VERSION} +``` + +## Configure deployments to use a private container registry + +Once you push your images to your private container registry, you need to +configure your deployments to use that registry for Redis Enterprise Software and operator +deployments. The operator container image is configured directly by the operator deployment +bundle. The Redis Enterprise cluster pod (RS and bootstrapper) and Service Rigger +images are configured in the Redis Enterprise custom resource. + +Depending on your Kubernetes platform, your private container registry may +require authentication. If you do need authentication, add a [pull secret](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) to your namespace. Then you'll need to configure Kubernetes and the operator to use the pull secret. The two following sections have examples of adding the `imagePullSecrets` to the operator deployment and `pullSecrets` to the cluster custom resource. + +### Specify the operator image source + +The operator bundle contains the operator deployment and the reference to the operator image (`redislabs/operator`). This image includes both the operator functionality and the admission controller. To use a private container registry, you must +change this image reference in your operator deployment file **before** you deploy the operator. If you apply this change to modify an existing operator deployment, the operator's pod will restart. + +In the operator deployment file, 'containers:image' should point to the same repository and tag you used when [pushing]({{< relref "/operate/kubernetes/7.22/deployment/container-images#push-images-to-a-private-container-registry" >}}) to the private container registry: + +```sh +${PRIVATE_REPO}/redislabs/operator:${OPERATOR_VERSION} +``` + +The example below specifies a 7.22.0-7 operator image in a Google Container Registry: + +```YAML +apiVersion: apps/v1 +kind: Deployment +metadata: + name: redis-enterprise-operator +spec: + replicas: 1 + selector: + matchLabels: + name: redis-enterprise-operator + template: + metadata: + labels: + name: redis-enterprise-operator + spec: + serviceAccountName: redis-enterprise-operator + containers: + - name: redis-enterprise-operator + image: gcr.io/yourproject/redislabs/operator:7.22.0-7 +... +``` + +If your container registry requires a pull secret, configure `imagePullSecrets` on the operator deployment: + +```YAML +spec: + template: + spec: + imagePullSecrets: + - name: regcred +``` + +### Specify the Redis Enterprise cluster images source + +A Redis Enterprise cluster managed by the operator consists of three +container images: + +* **`redislabs/redis`**: the Redis Enterprise Software container image +* **`redislabs/operator`**: the bootstrapper is packaged within the operator container image +* **`redislabs/k8s-controller`**: the Service Rigger container image + +By default, a new Redis Enterprise cluster is created using the +container images listed above. These container images are pulled from the K8s cluster's default +container registry. + +To [pull](https://docs.docker.com/engine/reference/commandline/pull/) the Redis Enterprise container images from +a private container registry, you must specify them in the +Redis Enterprise cluster custom resource. + +Add the following sections to the `spec` section of your RedisEnterpriseCluster resource file: + + * **`redisEnterpriseImageSpec`**: controls the Redis Enterprise Software container image. *The version should match the RS version associated with the operator version*. + * **`bootstrapperImageSpec`**": controls the bootstrapper container image. *The version must match the operator version*. + * **`redisEnterpriseServicesRiggerImageSpec`**: controls the Service Rigger container image. *The version must match the operator version*. + +The REC custom resource example below pulls all three container images from a GCR private registry: + +```YAML +apiVersion: app.redislabs.com/v1 +kind: RedisEnterpriseCluster +metadata: + name: rec +spec: + nodes: 3 + redisEnterpriseImageSpec: + imagePullPolicy: IfNotPresent + repository: gcr.io/yourproject/redislabs/redis + versionTag: 7.22.0-28 + bootstrapperImageSpec: + imagePullPolicy: IfNotPresent + repository: gcr.io/yourproject/redislabs/operator + versionTag: 7.22.0-7 + redisEnterpriseServicesRiggerImageSpec: + imagePullPolicy: IfNotPresent + repository: gcr.io/yourproject/redislabs/k8s-controller + versionTag: 7.22.0-7 +``` + +If your private container registry requires pull secrets, you must add `pullSecrets` +to the `spec` section: + +```YAML +apiVersion: app.redislabs.com/v1 +kind: RedisEnterpriseCluster +metadata: + name: rec +spec: + nodes: 3 + pullSecrets: + - name: regcred + redisEnterpriseImageSpec: + imagePullPolicy: IfNotPresent + repository: gcr.io/yourproject/redislabs/redis + versionTag: 7.22.0-28 + bootstrapperImageSpec: + imagePullPolicy: IfNotPresent + repository: gcr.io/yourproject/redislabs/operator + versionTag: 7.22.0-7 + redisEnterpriseServicesRiggerImageSpec: + imagePullPolicy: IfNotPresent + repository: gcr.io/yourproject/redislabs/k8s-controller + versionTag: 7.22.0-7 +``` + +## Admission controller + +The admission controller is included as part of the operator container image and does not require a separate container image. When you configure a private container registry for the operator image, the admission controller functionality is automatically included. + +The admission controller runs within the operator pod and provides validation for Redis Enterprise database resources. It exposes an HTTPS endpoint on port 8443 that Kubernetes uses to validate resource configurations before they are applied to the cluster. + +For more information about configuring the admission controller, see [Enable the admission controller]({{< relref "/operate/kubernetes/7.22/deployment/quick-start#enable-the-admission-controller" >}}). + +## Rate limiting with DockerHub + +Docker has [rate limits for image pulls](https://www.docker.com/blog/scaling-docker-to-serve-millions-more-developers-network-egress/). +Anonymous users are allowed a certain number of pulls every 6 hours. For authenticated users, the limit is larger. +These rate limits may affect your Kubernetes cluster in a number of ways: + +* The cluster nodes will likely be treated as a single anonymous user. +* The number of pulls during a deployment might exceed the rate limit for other deployment dependencies, including the operator, Redis Enterprise Software, or other non-Redis pods. +* Pull failures may prevent your deployment from downloading the required images in a timely manner. Delays here can affect the stability of deployments used by the Redis Enterprise operator. + +For these reasons, you should seriously consider where your images +are pulled from to **avoid failures caused by rate limiting**. The easiest solution +is to push the required images to a private container registry under your control. diff --git a/content/operate/kubernetes/7.22/deployment/helm.md b/content/operate/kubernetes/7.22/deployment/helm.md new file mode 100644 index 0000000000..309e6b6e3f --- /dev/null +++ b/content/operate/kubernetes/7.22/deployment/helm.md @@ -0,0 +1,173 @@ +--- +Title: Install Redis Enterprise Helm chart +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Install Redis Enterprise for Kubernetes version 7.8.6 using Helm charts. +linkTitle: Helm +weight: 11 +url: '/operate/kubernetes/7.22/deployment/helm/' +--- +Helm charts provide a simple way to install the Redis Enterprise for Kubernetes operator in just a few steps. For more information about Helm, go to [https://helm.sh/docs/](https://helm.sh/docs/). + +## Prerequisites + +- A [supported distribution]({{< relref "/operate/kubernetes/7.22/reference/supported_k8s_distributions" >}}) of Kubernetes. +- At least three worker nodes. +- [Kubernetes client (kubectl)](https://kubernetes.io/docs/tasks/tools/). +- [Helm 3.10 or later](https://helm.sh/docs/intro/install/) + or 3.18 for migrating from a non-Helm installation. + +If you suspect your file descriptor limits are below 100,000, you must either manually increase limits or [Allow automatic resource adjustment]({{< relref "/operate/kubernetes/7.22/security/allow-resource-adjustment" >}}). Most major cloud providers and standard container runtime configurations set default file descriptor limits well above the minimum required by Redis Enterprise. In these environments, you can safely run without enabling automatic resource adjustment. + +### Example values + +The steps below use the following placeholders to indicate command line parameters you must provide: + +- `` is the name of the repo holding your Helm chart (example: `redis`). +- `` is the name you give a specific installation of the Helm chart (example: `my-redis-enterprise-operator`) +- `` is the version of the Helm chart you are installing (example: `7.8.2-2`) +- `` is the name of the new namespace the Redis operator will run in (example: `ns1`) +- `` is the filepath to the Helm chart, if it is stored in a local directory (example: `/home/charts/redis-enterprise-operator`) + +## Install + +1. Add the Redis repository. + + ```sh + helm repo add https://helm.redis.io/ + ``` + +2. Install the Helm chart into a new namespace. + +```sh +helm install /redis-enterprise-operator \ + --version \ + --namespace \ + --create-namespace +``` + +To install with Openshift, add `--set openshift.mode=true`. + +To monitor the installation add the `--debug` flag. The installation runs several jobs synchronously and may take a few minutes to complete. + +### Install from local directory + +1. Find the latest release on the [redis-enterprise-k8s-docs](https://github.com/RedisLabs/redis-enterprise-k8s-docs/releases) repo and download the `tar.gz` source code into a local directory. + +2. Install the Helm chart from your local directory. + +```sh +helm install \ + --namespace \ + --create-namespace +``` + +To install with Openshift, add `--set openshift.mode=true`. + +To monitor the installation add the `--debug` flag. The installation runs several jobs synchronously and may take a few minutes to complete. + +### Specify values during install + +1. View configurable values with `helm show values /redis-enterprise-operator`. + +2. Install the Helm chart, overriding specific value defaults using `--set`. + +```sh +helm install /redis-enterprise-operator \ + --version \ + --namespace \ + --create-namespace + --set = \ + --set = +``` + +### Install with values file + +1. View configurable values with `helm show values /redis-enterprise-operator`. + +2. Create a YAML file to specify the values you want to configure. + +3. Install the chart with the `--values` option. + +```sh +helm install /redis-enterprise-operator \ + --version \ + --namespace \ + --create-namespace \ + --values +``` + +## Migrate from a non-Helm installation + +To migrate an existing non-Helm installation of the Redis Enterprise operator to a Helm-based installation: + +1. [Upgrade]({{}}) your existing Redis Enterprise operator to match the version of the Helm chart you want to install. Use the same non-Helm method you used for the original installation. + +2. [Install](#install) the Helm chart adding the `--take-ownership` flag: + + ```sh + helm install /redis-enterprise-operator --take-ownership + ``` + + - The `--take-ownership` flag is available with Helm versions 3.18 or later. + - This flag is only needed for the first installation of the chart. Subsequent upgrades don't require this flag. + - Use the `helm install` command, not `helm upgrade`. + +3. Delete the old `ValidatingWebhookConfiguration` object from the previous non-Helm installation: + + ```sh + kubectl delete validatingwebhookconfiguration redis-enterprise-admission + ``` + + This step is only needed when the `admission.limitToNamespace` chart value is set to `true` (the default). In this case, the webhook object installed by the chart is named `redis-enterprise-admission-`, and the original webhook object, named `redis-enterprise-admission`, becomes redundant. If `admission.limitToNamespace` is set to `false`, the webhook installed by the chart is named `redis-enterprise-admission`, and the existing webhook object is reused. + +## Upgrade the chart + +To upgrade an existing Helm chart installation: + +```sh +helm upgrade /redis-enterprise-operator --version +``` + +You can also upgrade from a local directory: + +```sh +helm upgrade +``` + +For example, to upgrade a chart with the release name `my-redis-enterprise` from the chart's root directory: + +```sh +helm upgrade my-redis-enterprise . +``` + +To upgrade with OpenShift, add `--set openshift.mode=true`. + +The upgrade process automatically updates the operator and its components, including the Custom Resource Definitions (CRDs). The CRDs are versioned and update only if the new version is higher than the existing version. + +After you upgrade the operator, you might need to upgrade your Redis Enterprise clusters, depending on the Redis software version bundled with the operator. For detailed information about the upgrade process, see [Redis Enterprise for Kubernetes upgrade documentation](https://redis.io/docs/latest/operate/kubernetes/upgrade/). + +For more information and options when upgrading charts, see [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/). + +## Uninstall + +1. Delete any custom resources managed by the operator. See [Delete custom resources]({{}}) for detailed steps. You must delete custom resources in the correct order to avoid errors. + +2. Uninstall the Helm chart. + +```sh +helm uninstall +``` + +This removes all Kubernetes resources associated with the chart and deletes the release. + +{{}}Custom Resource Definitions (CRDs) installed by the chart are not removed during chart uninstallation. To remove them manually after uninstalling the chart, run `kubectl delete crds -l app=redis-enterprise`.{{}} + +## Known limitations + +- The steps for [creating the RedisEnterpriseCluster (REC)]({{}}) and other custom resources remain the same. +- The chart doesn't include configuration options for multiple namespaces, rack-awareness, and Vault integration. The steps for configuring these options remain the same. +- The chart has had limited testing in advanced setups, including Active-Active configurations, air-gapped deployments, and IPv6/dual-stack environments. \ No newline at end of file diff --git a/content/operate/kubernetes/7.22/deployment/openshift/_index.md b/content/operate/kubernetes/7.22/deployment/openshift/_index.md new file mode 100644 index 0000000000..68a5c4a3cf --- /dev/null +++ b/content/operate/kubernetes/7.22/deployment/openshift/_index.md @@ -0,0 +1,43 @@ +--- +Title: Deploy Redis Enterprise for Kubernetes with OpenShift +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: A quick introduction to the steps necessary to get a Redis Enterprise + cluster installed in your OpenShift Kubernetes cluster +hideListLinks: true +linkTitle: OpenShift +weight: 11 +url: '/operate/kubernetes/7.22/deployment/openshift/' +--- +The deployment of Redis Enterprise clusters is managed with the Redis Enterprise operator that you deploy in the namespace for your project. +To create a database that your application +workloads can use: + +1. Install the Redis Enterprise operator. + +1. Create a Redis Enterprise CRD to describe your desired cluster. + +1. The operator reads this cluster description and deploys the various components on your K8s cluster. + +1. Once running, use the Redis Enterprise cluster to create a database. + +1. The operator automatically exposes the new database as a K8s service. + +## For OpenShift via the OperatorHub + +To [create a database on an OpenShift 4.x cluster via the OperatorHub]({{< relref "/operate/kubernetes/7.22/deployment/openshift/openshift-operatorhub" >}}) you only need to have the [OpenShift 4.x cluster installed](https://docs.openshift.com/container-platform/4.3/welcome/index.html) with at least three nodes that each meet the [minimum requirements for a development installation]({{< relref "/operate/rs/installing-upgrading/install/plan-deployment/hardware-requirements" >}}). + +## For OpenShift via the CLI + +To [create a database on an OpenShift cluster via the CLI]({{< relref "/operate/kubernetes/7.22/deployment/openshift/openshift-cli" >}}), you need: + +1. An [OpenShift cluster installed](https://docs.openshift.com/container-platform/4.3/welcome/index.html) with at least three nodes that each meet the [minimum requirements for a development installation]({{< relref "/operate/rs/installing-upgrading/install/plan-deployment/hardware-requirements" >}}). +1. The [kubectl package installed](https://kubernetes.io/docs/tasks/tools/install-kubectl/) at version 1.9 or higher +1. The [OpenShift cli installed](https://docs.openshift.com/container-platform/4.2/cli_reference/openshift_cli/getting-started-cli.html) + +## Version compatibility + +To see which version of Redis Enterprise for Kubernetes supports your OpenShift version, see [Supported Kubernetes distributions]({{< relref "/operate/kubernetes/7.22/reference/supported_k8s_distributions" >}}). \ No newline at end of file diff --git a/content/operate/kubernetes/7.22/deployment/openshift/openshift-cli.md b/content/operate/kubernetes/7.22/deployment/openshift/openshift-cli.md new file mode 100644 index 0000000000..a4c4323917 --- /dev/null +++ b/content/operate/kubernetes/7.22/deployment/openshift/openshift-cli.md @@ -0,0 +1,225 @@ +--- +Title: Deployment with OpenShift CLI for Redis Enterprise for Kubernetes +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Redis Enterprise for Kubernetes and cluster can be installed via CLI + tools OpenShift +linkTitle: OpenShift CLI +weight: 60 +url: '/operate/kubernetes/7.22/deployment/openshift/openshift-cli/' +--- + +Use these steps to set up a Redis Enterprise Software cluster with OpenShift. + +## Prerequisites + +- [OpenShift cluster](https://docs.openshift.com/container-platform/4.8/installing/index.html) with at least 3 nodes (each meeting the [minimum requirements for a development installation]({{< relref "/operate/rs/installing-upgrading/install/plan-deployment/hardware-requirements" >}})) +- [OpenShift CLI](https://docs.openshift.com/container-platform/latest/cli_reference/openshift_cli/getting-started-cli.html) + +To see which version of Redis Enterprise for Kubernetes supports your OpenShift version, see [Supported Kubernetes distributions]({{< relref "/operate/kubernetes/7.22/reference/supported_k8s_distributions" >}}). + +{{}} +If you suspect your file descriptor limits are below 100,000, you must either manually increase limits or [Allow automatic resource adjustment]({{< relref "/operate/kubernetes/7.22/security/allow-resource-adjustment" >}}). Most major cloud providers and standard container runtime configurations set default file descriptor limits well above the minimum required by Redis Enterprise. In these environments, you can safely run without enabling automatic resource adjustment. +{{}} + +## Deploy the operator + +1. Create a new project. + + ```sh + oc new-project + ``` + +1. Verify the newly created project. + + ```sh + oc project + ``` + +1. Get the deployment files. + + ```sh + git clone https://github.com/RedisLabs/redis-enterprise-k8s-docs + ``` + +1. Deploy the OpenShift operator bundle. + + If you are using version 6.2.18-41 or earlier, you must [apply the security context constraint](#install-security-context-constraint) before the operator bundle. + + ```sh + oc apply -f openshift.bundle.yaml + ``` + + {{< warning >}} +Changes to the `openshift.bundle.yaml` file can cause unexpected results. + {{< /warning >}} + +1. Verify that your `redis-enterprise-operator` deployment is running. + + ```sh + oc get deployment + ``` + + A typical response looks like this: + + ```sh + NAME READY UP-TO-DATE AVAILABLE AGE + redis-enterprise-operator 1/1 1 1 0m36s + ``` + + {{}} +DO NOT modify or delete the StatefulSet created during the deployment process. Doing so could destroy your Redis Enterprise cluster (REC). + {{}} + +## Security context constraints + +Versions 7.22.0-6 and later run in without permissions to [allow automatic resource adjustment]({{< relref "/operate/kubernetes/7.22/security/allow-resource-adjustment" >}}). If you use the recommended default security constraints, remove the existing `redis-enterprise-scc-v2` SCC and unbind it from the REC service account after upgrading. + +## Create a Redis Enterprise cluster custom resource + +1. Apply the `RedisEnterpriseCluster` resource file ([rec_rhel.yaml](https://github.com/RedisLabs/redis-enterprise-k8s-docs/blob/master/openshift/rec_rhel.yaml)). + + You can rename the file to `.yaml`, but it is not required. Examples below use `.yaml`. [Options for Redis Enterprise clusters]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api" >}}) has more info about the Redis Enterprise cluster (REC) custom resource, or see the [Redis Enterprise cluster API]({{}}) for a full list of options. + + {{}} +If you suspect your file descriptor limits are below 100,000, you must either manually increase limits or [Allow automatic resource adjustment]({{< relref "/operate/kubernetes/7.22/security/allow-resource-adjustment" >}}). Most major cloud providers and standard container runtime configurations set default file descriptor limits well above the minimum required by Redis Enterprise. In these environments, you can safely run without enabling automatic resource adjustment. + {{}} + + The REC name cannot be changed after cluster creation. + + {{}} +Each Redis Enterprise cluster requires at least 3 nodes. Single-node RECs are not supported. + {{}} + +2. Apply the custom resource file to create your Redis Enterprise cluster. + + {{}} +If you enabled automatic resource adjustment in your configuration, this step will trigger the operator to apply elevated capabilities. Ensure your security context allows it. + {{}} + + ```sh + oc apply -f .yaml + ``` + + The operator typically creates the REC within a few minutes. + +1. Check the cluster status. + + ```sh + oc get pod + ``` + + You should receive a response similar to the following: + + ```sh + NAME | READY | STATUS | RESTARTS | AGE | + | -------------------------------- | ----- | ------- | -------- | --- | + | rec-name-0 | 2/2 | Running | 0 | 1m | + | rec-name-1 | 2/2 | Running | 0 | 1m | + | rec-name-2 | 2/2 | Running | 0 | 1m | + | rec-name-controller-x-x | 1/1 | Running | 0 | 1m | + | Redis-enterprise-operator-x-x | 1/1 | Running | 0 | 5m | + ``` + +## Configure the admission controller + +{{< embed-md "k8s-admission-webhook-cert.md" >}} + +### Limit the webhook to relevant namespaces + +If not limited, the webhook intercepts requests from all namespaces. If you have several REC objects in your Kubernetes cluster, limit the webhook to the relevant namespaces. If you aren't using multiple namespaces, skip this step. + +1. Verify your namespace is labeled and the label is unique to this namespace, as shown in the next example. + + ```sh + apiVersion: v1 + kind: Namespace + metadata: + labels: + namespace-name: staging + name: staging + ``` + +1. Patch the webhook spec with the `namespaceSelector` field. + + ```sh + cat > modified-webhook.yaml <}} +For releases before 6.4.2-4, use this command instead: + +```sh +oc patch ValidatingWebhookConfiguration \ + redb-admission --patch "$(cat modified-webhook.yaml)" +``` + +The 6.4.2-4 release introduces a new `ValidatingWebhookConfiguration` to replace `redb-admission`. See the [6.4.2-4 release notes]({{< relref "/operate/kubernetes/release-notes/6-4-2-releases/" >}}). + {{}} + +### Verify admission controller installation + +Apply an invalid resource as shown below to force the admission controller to reject it. If it applies successfully, the admission controller is not installed correctly. + +```sh +oc apply -f - << EOF +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseDatabase +metadata: + name: redis-enterprise-database +spec: + evictionPolicy: illegal +EOF +``` + +You should see this error from the admission controller webhook `redisenterprise.admission.redislabs`. + +```sh +Error from server: error when creating "STDIN": admission webhook "redisenterprise.admission.redislabs" denied the request: eviction_policy: u'illegal' is not one of [u'volatile-lru', u'volatile-ttl', u'volatile-random', u'allkeys-lru', u'allkeys-random', u'noeviction', u'volatile-lfu', u'allkeys-lfu'] +``` + +## Create a Redis Enterprise database custom resource + +The operator uses the instructions in the Redis Enterprise database (REDB) custom resources to manage databases on the Redis Enterprise cluster. + +1. Create a `RedisEnterpriseDatabase` custom resource. + + This example creates a test database. For production databases, see [create a database]({{< relref "/operate/kubernetes/7.22/re-databases/db-controller.md#create-a-database" >}}) and [RedisEnterpriseDatabase API reference]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_database_api" >}}). + + ```sh + cat << EOF > /tmp/redis-enterprise-database.yml + apiVersion: app.redislabs.com/v1alpha1 + kind: RedisEnterpriseDatabase + metadata: + name: redis-enterprise-database + spec: + memorySize: 100MB + EOF + ``` + +1. Apply the newly created REDB resource. + + ```sh + oc apply -f /tmp/redis-enterprise-database.yml + ``` + +## More info + +- [Redis Enterprise cluster API]({{}}) +- [Redis Enterprise database API]({{}}) diff --git a/content/operate/kubernetes/7.22/deployment/openshift/openshift-operatorhub.md b/content/operate/kubernetes/7.22/deployment/openshift/openshift-operatorhub.md new file mode 100644 index 0000000000..32e02d0d2b --- /dev/null +++ b/content/operate/kubernetes/7.22/deployment/openshift/openshift-operatorhub.md @@ -0,0 +1,65 @@ +--- +Title: Deploy Redis Enterprise with OpenShift OperatorHub +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: OpenShift provides the OperatorHub where you can install the Redis Enterprise + operator from the administrator user interface. +linkTitle: OpenShift OperatorHub +weight: 70 +url: '/operate/kubernetes/7.22/deployment/openshift/openshift-operatorhub/' +--- +You can deploy Redis Enterprise for Kubernetes from the Red Hat OpenShift CLI. You can also use a UI, [OperatorHub](https://docs.openshift.com/container-platform/4.11/operators/index.html) (Red Hat) to install operators and create custom resources. + +{{}}If you suspect your file descriptor limits are below 100,000, you must either manually increase limits or [Allow automatic resource adjustment]({{< relref "/operate/kubernetes/7.22/security/allow-resource-adjustment" >}}). Most major cloud providers and standard container runtime configurations set default file descriptor limits well above the minimum required by Redis Enterprise. In these environments, you can safely run without enabling automatic resource adjustment.{{}} + +To see which version of Redis Enterprise for Kubernetes supports your OpenShift version, see [Supported Kubernetes distributions]({{< relref "/operate/kubernetes/7.22/reference/supported_k8s_distributions" >}}). + +## Install the Redis Enterprise operator + +{{}} If using version 6.2.18-41 or earlier, [Install the security context constraint](#install-security-context-constraint) before installing the operator. {{}} + +1. Select **Operators > OperatorHub**. + +2. Search for _Redis Enterprise_ in the search dialog and select the **Redis Enterprise Operator provided by Redis** marked as **Certified**. + + By default, the image is pulled from Red Hat's registry. + +3. On the **Install Operator** page, specify the namespace for the operator. + + Only one namespace per operator is supported. + +4. Update the **channel** with the version you're installing. + + For more information about specific versions, see the [release notes]({{< relref "/operate/kubernetes/release-notes/" >}}). + +5. Choose an approval strategy. + + Use **Manual** for production systems to ensure the operator is only upgraded by approval. + +6. Select **Install** and approve the install plan. + + You can monitor the subscription status in **Operators > Installed Operators**. + +{{}}DO NOT modify or delete the StatefulSet created during the deployment process. Doing so could destroy your Redis Enterprise cluster (REC).{{}} + +## Security context constraints + +Versions 7.22.0-6 and later run in without permissions to [allow automatic resource adjustment]({{< relref "/operate/kubernetes/7.22/security/allow-resource-adjustment" >}}). If you use the recommended default security constraints, remove the existing `redis-enterprise-scc-v2` SCC and unbind it from the REC service account after upgrading. + +## Create Redis Enterprise custom resources + +The **Installed Operators**->**Operator details** page shows the provided APIs: **RedisEnterpriseCluster** and **RedisEnterpriseDatabase**. You can select **Create instance** to create custom resources using the OperatorHub interface. + + +Use the YAML view to create a custom resource file or let OperatorHub generate the YAML file for you by specifying your configuration options in the form view. + +{{}} +If you suspect your file descriptor limits are below 100,000, you must either manually increase limits or [Allow automatic resource adjustment]({{< relref "/operate/kubernetes/7.22/security/allow-resource-adjustment" >}}). Most major cloud providers and standard container runtime configurations set default file descriptor limits well above the minimum required by Redis Enterprise. In these environments, you can safely run without enabling automatic resource adjustment. +{{}} + + The REC name cannot be changed after cluster creation. + +For more information on creating and maintaining Redis Enterprise custom resources, see [Redis Enterprise clusters (REC)]({{< relref "/operate/kubernetes/7.22/re-clusters/" >}}) and [Redis Enterprise databases (REDB)]({{< relref "/operate/kubernetes/7.22/re-databases/" >}}). diff --git a/content/operate/kubernetes/7.22/deployment/quick-start.md b/content/operate/kubernetes/7.22/deployment/quick-start.md new file mode 100644 index 0000000000..18781bcd0c --- /dev/null +++ b/content/operate/kubernetes/7.22/deployment/quick-start.md @@ -0,0 +1,271 @@ +--- +Title: Deploy Redis Enterprise Software for Kubernetes +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: How to install Redis Enterprise Software for Kubernetes. +linkTitle: Kubernetes +weight: 10 +url: '/operate/kubernetes/7.22/deployment/quick-start/' +--- +To deploy Redis Enterprise Software for Kubernetes and start your Redis Enterprise cluster (REC), you need to do the following: + +- Create a new namespace in your Kubernetes cluster. +- Download the operator bundle. +- Apply the operator bundle and verify it's running. +- Create a Redis Enterprise cluster (REC). + +This guide works with most supported Kubernetes distributions. If you're using OpenShift, see [Redis Enterprise on OpenShift]({{< relref "/operate/kubernetes/7.22/deployment/openshift" >}}). For details on what is currently supported, see [supported distributions]({{< relref "/operate/kubernetes/7.22/reference/supported_k8s_distributions" >}}). + +## Prerequisites + +To deploy Redis Enterprise for Kubernetes, you'll need: + +- Kubernetes cluster in a [supported distribution]({{< relref "/operate/kubernetes/7.22/reference/supported_k8s_distributions" >}}) +- minimum of three worker nodes +- Kubernetes client (kubectl) +- access to DockerHub, RedHat Container Catalog, or a private repository that can hold the required images. + +If you suspect your file descriptor limits are below 100,000, you must either manually increase limits or [Allow automatic resource adjustment]({{< relref "/operate/kubernetes/7.22/security/allow-resource-adjustment" >}}). Most major cloud providers and standard container runtime configurations set default file descriptor limits well above the minimum required by Redis Enterprise. In these environments, you can safely run without enabling automatic resource adjustment. + +{{}}If you are applying version 7.8.2-6 or above, check if the [OS](https://redis.io/docs/latest/operate/kubernetes/release-notes/7-8-2-releases/7-8-2-6-nov24/#breaking-changes) installed on the node is supported.{{}} + +### Create a new namespace + +**Important:** Each namespace can only contain one Redis Enterprise cluster. Multiple RECs with different operator versions can coexist on the same Kubernetes cluster, as long as they are in separate namespaces. + +Throughout this guide, each command is applied to the namespace in which the Redis Enterprise cluster operates. + +1. Create a new namespace + + ```sh + kubectl create namespace + ``` + +1. Change the namespace context to make the newly created namespace default for future commands. + + ```sh + kubectl config set-context --current --namespace= + ``` + +You can use an existing namespace as long as it does not contain any existing Redis Enterprise cluster resources. It's best practice to create a new namespace to make sure there are no Redis Enterprise resources that could interfere with the deployment. + +## Install the operator + +Redis Enterprise for Kubernetes bundle is published as a container image. A list of required images is available in the [release notes]({{< relref "/operate/kubernetes/release-notes/_index" >}}) for each version. + +The operator [definition and reference materials](https://github.com/RedisLabs/redis-enterprise-k8s-docs) are available on GitHub. The operator definitions are [packaged as a single generic YAML file](https://github.com/RedisLabs/redis-enterprise-k8s-docs/blob/master/bundle.yaml). + +{{}} +If you do not pull images from DockerHub or another public registry, you need to use a [private container registry]({{< relref "/operate/kubernetes/7.22/deployment/container-images#manage-image-sources" >}}). +{{}} + +### Download the operator bundle + +Pull the latest version of the operator bundle: + +```sh +VERSION=`curl --silent https://api.github.com/repos/RedisLabs/redis-enterprise-k8s-docs/releases/latest | grep tag_name | awk -F'"' '{print $4}'` +``` + + If you need a different release, replace `VERSION` with a specific release tag. + + Check version tags listed with the [operator releases on GitHub](https://github.com/RedisLabs/redis-enterprise-k8s-docs/releases) or by [using the GitHub API](https://docs.github.com/en/rest/reference/repos#releases) to ensure the version of the bundle is correct. + +### Deploy the operator bundle + +Apply the operator bundle in your REC namespace: + +```sh +kubectl apply -f https://raw.githubusercontent.com/RedisLabs/redis-enterprise-k8s-docs/$VERSION/bundle.yaml +``` + + You should see a result similar to this: + + ```sh + role.rbac.authorization.k8s.io/redis-enterprise-operator created + serviceaccount/redis-enterprise-operator created + rolebinding.rbac.authorization.k8s.io/redis-enterprise-operator created + customresourcedefinition.apiextensions.k8s.io/redisenterpriseclusters.app.redislabs.com configured + customresourcedefinition.apiextensions.k8s.io/redisenterprisedatabases.app.redislabs.com configured + deployment.apps/redis-enterprise-operator created + ``` + +{{}}DO NOT modify or delete the StatefulSet created during the deployment process. Doing so could destroy your Redis Enterprise cluster (REC).{{}} + +#### Verify the operator is running + +Check the operator deployment to verify it's running in your namespace: + +```sh +kubectl get deployment redis-enterprise-operator +``` + +You should see a result similar to this: + +```sh +NAME READY UP-TO-DATE AVAILABLE AGE +redis-enterprise-operator 1/1 1 1 0m36s +``` + +## Create a Redis Enterprise cluster (REC) + +A Redis Enterprise cluster (REC) is created from a `RedisEnterpriseCluster` custom resource +that contains cluster specifications. + +The following example creates a minimal Redis Enterprise cluster. See the [RedisEnterpriseCluster API reference]({{}}) for more information on the various options available. + +{{}} +If you suspect your file descriptor limits are below 100,000, you must either manually increase limits or [Allow automatic resource adjustment]({{< relref "/operate/kubernetes/7.22/security/allow-resource-adjustment" >}}). Most major cloud providers and standard container runtime configurations set default file descriptor limits well above the minimum required by Redis Enterprise. In these environments, you can safely run without enabling automatic resource adjustment. +{{}} + +1. Create a file that defines a Redis Enterprise cluster with three nodes. + + {{}} +The REC name (`my-rec` in this example) cannot be changed after cluster creation. + {{}} + + ```sh + cat < my-rec.yaml + apiVersion: "app.redislabs.com/v1" + kind: "RedisEnterpriseCluster" + metadata: + name: my-rec + spec: + nodes: 3 + EOF + ``` + + This will request a cluster with three Redis Enterprise nodes using the default requests (i.e., 2 CPUs and 4GB of memory per node). + + To test with a larger configuration, use the example below to add node resources to the `spec` section of your test cluster (`my-rec.yaml`). + + ```sh + redisEnterpriseNodeResources: + limits: + cpu: 2000m + memory: 16Gi + requests: + cpu: 2000m + memory: 16Gi + ``` + + {{}} +Each cluster must have at least 3 nodes. Single-node RECs are not supported. + {{}} + + See the [Redis Enterprise hardware requirements]({{< relref "/operate/rs/installing-upgrading/install/plan-deployment/hardware-requirements" >}}) for more information on sizing Redis Enterprise node resource requests. + + {{}} +If you enabled automatic resource adjustment in your configuration, this step will trigger the operator to apply elevated capabilities. Ensure your security context allows it. + {{}} + +1. Apply your custom resource file in the same namespace as `my-rec.yaml`. + + ```sh + kubectl apply -f my-rec.yaml + ``` + + You should see a result similar to this: + + ```sh + redisenterprisecluster.app.redislabs.com/my-rec created + ``` + +1. You can verify the creation of the cluster with: + + ```sh + kubectl get rec + ``` + + You should see a result similar to this: + + ```sh + NAME AGE + my-rec 1m + ``` + + At this point, the operator will go through the process of creating various services and pod deployments. + + You can track the progress by examining the StatefulSet associated with the cluster: + + ```sh + kubectl rollout status sts/my-rec + ``` + + or by looking at the status of all of the resources in your namespace: + + ```sh + kubectl get all + ``` + +## Enable the admission controller + +The admission controller dynamically validates REDB resources configured by the operator. It is strongly recommended that you use the admission controller on your Redis Enterprise Cluster (REC). The admission controller only needs to be configured once per operator deployment. + +As part of the REC creation process, the operator stores the admission controller certificate in a Kubernetes secret called `admission-tls`. You may have to wait a few minutes after creating your REC to see the secret has been created. + +{{< embed-md "k8s-admission-webhook-cert" >}} + +### Limit the webhook to the relevant namespaces {#webhook} + +The operator bundle includes a webhook file. The webhook will intercept requests from all namespaces unless you edit it to target a specific namespace. You can do this by adding the `namespaceSelector` section to the webhook spec to target a label on the namespace. + +1. Make sure the namespace has a unique `namespace-name` label. + + ```sh + apiVersion: v1 + kind: Namespace + metadata: + labels: + namespace-name: example-ns + name: example-ns + ``` + +1. Patch the webhook to add the `namespaceSelector` section. + + ```sh + cat > modified-webhook.yaml <}}) to create a new REDB. diff --git a/content/operate/kubernetes/7.22/kubernetes-archive.md b/content/operate/kubernetes/7.22/kubernetes-archive.md new file mode 100644 index 0000000000..1457e01c38 --- /dev/null +++ b/content/operate/kubernetes/7.22/kubernetes-archive.md @@ -0,0 +1,27 @@ +--- +Title: Archive +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Describes where to view the archive of Redis Enterprise for Kubernetes + documentation. +linkTitle: Archive +weight: 99999999999 +url: '/operate/kubernetes/7.22/kubernetes-archive/' +--- + +The Redis Enterprise for Kubernetes documentation is versioned. You are looking at the documentation for the latest release. + +- View the [7.8.6 docs](https://redis.io/docs/latest/operate/kubernetes/7.8.6/) for Redis Enterprise for Kubernetes version 7.8.6-1. +- View the [7.8.4 docs](https://redis.io/docs/latest/operate/kubernetes/7.8.4/) for Redis Enterprise for Kubernetes versions 7.8.2-6, 7.8.4-8, and 7.8.4-9. +- View the [7.4.6 docs](https://redis.io/docs/latest/operate/kubernetes/7.4.6/) for Redis Enterprise for Kubernetes versions 7.4.6-2 and 7.4.6-6. + +Older versions of Redis Enterprise for Kubernetes documentation are available on the archived web site: + +- [Redis Enterprise for Kubernetes v7.4 documentation archive](https://docs.redis.com/7.4/kubernetes/) + +- [Redis Enterprise for Kubernetes v7.2 documentation archive](https://docs.redis.com/7.2/kubernetes/)   + +- [Redis Enterprise for Kubernetes v6.x documentation archive](https://docs.redis.com/6.4/kubernetes/) diff --git a/content/operate/kubernetes/7.22/logs/_index.md b/content/operate/kubernetes/7.22/logs/_index.md new file mode 100644 index 0000000000..4dc4e2c1f3 --- /dev/null +++ b/content/operate/kubernetes/7.22/logs/_index.md @@ -0,0 +1,48 @@ +--- +Title: Logs +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Access and manage Redis Enterprise logs on Kubernetes for monitoring and troubleshooting. +hideListLinks: true +linkTitle: Logs +weight: 60 +url: '/operate/kubernetes/7.22/logs/' +--- + +Access and manage Redis Enterprise logs on Kubernetes for monitoring, troubleshooting, and debugging your Redis Enterprise deployment. Logs provide valuable insights into cluster operations, database performance, and system health. + +## Log collection and access + +Learn how to collect and access logs from your Redis Enterprise deployment: + +- [Collect logs]({{< relref "/operate/kubernetes/7.22/logs/collect-logs" >}}) - Methods for collecting logs from Redis Enterprise pods and containers + +## Log storage and access + +Each Redis Enterprise container stores its logs under `/var/opt/redislabs/log`. When using persistent storage, this path is automatically mounted to the `redis-enterprise-storage` volume, making logs accessible through sidecar containers or external log collection tools. + +For example, in the REC (Redis Enterprise Cluster) spec you can add a sidecar container, such as a busybox, and mount the logs to there: + +```yaml +sideContainersSpec: + - name: busybox + image: busybox + args: + - /bin/sh + - -c + - while true; do echo "hello"; sleep 1; done + + volumeMounts: + - name: redis-enterprise-storage + mountPath: /home/logs + subPath: logs +``` + +Now the logs can be accessed from in the sidecar. For example by running + +```kubectl exec -it -c busybox -- tail home/logs/supervisord.log``` + +The sidecar container is user determined and can be used to format, process and share logs in a specified format and protocol. diff --git a/content/operate/kubernetes/7.22/logs/collect-logs.md b/content/operate/kubernetes/7.22/logs/collect-logs.md new file mode 100644 index 0000000000..fe43c71284 --- /dev/null +++ b/content/operate/kubernetes/7.22/logs/collect-logs.md @@ -0,0 +1,63 @@ +--- +Title: Collect logs +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Run the log collector script to package relevant logs into a tar.gz file + to send to Redis Support for help troubleshooting your Kubernetes environment. +linkTitle: Collect logs +weight: 89 +url: '/operate/kubernetes/7.22/logs/collect-logs/' +--- + +The Redis Enterprise cluster (REC) log collector script ([`log_collector.py`](https://github.com/RedisLabs/redis-enterprise-k8s-docs/blob/master/log_collector/log_collector.py)) creates and fills a directory with the relevant logs for your environment. These logs will help the support team with troubleshooting. + +The log collector tool has two modes: + +- **restricted** collects only resources and logs created by the operator and Redis Enterprise deployments +- **all** collects everything from your environment + +{{}} This script requires Python 3.6 or later. {{}} + +## Prerequisites + +Before running the log collector, ensure you have the appropriate RBAC permissions configured. See [Log collector RBAC examples]({{< relref "/operate/kubernetes/7.22/reference/yaml/log-collector-rbac" >}}) for detailed RBAC configuration instructions. + +## Collect logs + +1. Download the latest [`log_collector.py`](https://github.com/RedisLabs/redis-enterprise-k8s-docs/blob/master/log_collector/log_collector.py) file. + +1. Ensure your `kubectl` or `oc` CLI is configured to access the Kubernetes cluster you want to collect logs from. + +1. Have a K8s administrator run the script on the system that runs your `kubectl` or `oc` commands. + + ```bash + python log_collector.py + ``` + +## Options + +You can run `log_collector.py` with the following options: + +| Option | Description | +|--------|-------------| +| `-n`, `--namespace` | Sets the namespace(s) to collect from. Can be set to a single namespace, or multiple namespaces (comma-separated). When left empty, will use the current context's namespace from kubeconfig. | +| `-o`, `--output_dir` | Sets the output directory. Defaults to current working directory. | +| `-a`, `--logs_from_all_pods` | Collect logs from all pods in the selected namespace(s), and otherwise collect only from the operator and pods run by the operator. | +| `-t`, `--timeout` | Time to wait for external commands to finish execution (Linux only). Defaults to 180s. Specify 0 to disable timeout. | +| `--k8s_cli` | The K8s cli client to use (kubectl/oc/auto-detect). Defaults to auto-detect (chooses between 'kubectl' and 'oc'). Full paths can also be used. | +| `-m`, `--mode` | Controls which resources are collected. In 'restricted' mode, only resources associated with the operator and have the label 'app=redis-enterprise' are collected. In 'all' mode, all resources are collected. Defaults to 'restricted' mode. | +| `--collect_istio` | Collect data from istio-system namespace to debug potential problems related to istio ingress method. | +| `--collect_empty_files` | Collect empty log files for missing resources. | +| `--helm_release_name` | Collect resources related to the given Helm release name. | +| `--collect_rbac_resources` | Temporary development flag. Collect all role based access control related custom resources. | +| `-h`, `--help` | Show help message and exit. | + +{{< note >}} If you get an error because the yaml module is not found, install the pyYAML module with `pip install pyyaml`. +{{< /note >}} + +1. Upload the resulting `tar.gz` file containing all the logs to [Redis Support](https://support.redislabs.com/). + + diff --git a/content/operate/kubernetes/7.22/networking/_index.md b/content/operate/kubernetes/7.22/networking/_index.md new file mode 100644 index 0000000000..b13b6ddbe3 --- /dev/null +++ b/content/operate/kubernetes/7.22/networking/_index.md @@ -0,0 +1,51 @@ +--- +Title: Networking +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Configure networking and external access for Redis Enterprise clusters and databases on Kubernetes. +hideListLinks: true +linkTitle: Networking +weight: 40 +url: '/operate/kubernetes/7.22/networking/' +--- + +Configure networking and external access for your Redis Enterprise deployment on Kubernetes. By default, Kubernetes doesn't allow external access to your Redis databases. Redis Enterprise for Kubernetes provides several methods to route external traffic to your clusters and databases. + +## Database connectivity + +Connect applications to your Redis Enterprise databases: + +- [Database connectivity]({{< relref "/operate/kubernetes/7.22/networking/database-connectivity" >}}) - Comprehensive guide to in-cluster and external database access, service discovery, and credentials management. + +## External routing methods + +Choose the appropriate method for your environment to enable external access: + +- [Ingress routing]({{< relref "/operate/kubernetes/7.22/networking/ingress" >}}) - Use NGINX or HAProxy ingress controllers with `ingress` API resources +- [Istio ingress routing]({{< relref "/operate/kubernetes/7.22/networking/istio-ingress" >}}) - Use Istio service mesh with `Gateway` and `VirtualService` API resources +- [OpenShift routes]({{< relref "/operate/kubernetes/7.22/networking/routes" >}}) - Use OpenShift-specific route resources for external traffic + +## Automatic ingress configuration + +For Active-Active databases, configure automatic ingress creation: + +- [REC external routing]({{< relref "/operate/kubernetes/7.22/networking/ingressorroutespec" >}}) - Use `ingressOrRouteSpec` field in RedisEnterpriseCluster (REC) for automatic ingress creation + +## `ingressOrRouteSpec` for Active-Active databases + +Versions 6.4.2 or later of Redis Enterprise for Kubernetes include a feature for ingress configuration. The `ingressOrRouteSpec` field is available in the RedisEnterpriseCluster spec to automatically create an Ingress (or route) for the API service and databases (REAADB) on that REC. See [REC external routing]({{< relref "/operate/kubernetes/7.22/networking/ingressorroutespec" >}}) for more details. + +This feature only supports automatic Ingress creation for Active-Active databases created and managed with the RedisEnterpriseActiveActiveDatabase (REAADB) custom resource. Use with the standard Redis Enterprise database (REDB) is not currently supported. + +## OSS Cluster API limitations + +When using [OSS Cluster API]({{< relref "/operate/rs/databases/configure/oss-cluster-api" >}}), clients must specify the IP addresses of Redis instances to perform operations. Since Pod IP addresses are internal to the Kubernetes cluster and not publicly accessible, **OSS Cluster API can only be used by clients running on pods within the same Kubernetes cluster as the Redis Enterprise pods.** Using OSS Cluster API from outside the Kubernetes cluster is not tested and currently not supported. + +For applications that need to access Redis databases from outside the Kubernetes cluster, use standard Redis Enterprise connectivity methods with the external routing options described above (Ingress controllers, load balancers, or OpenShift routes). These methods do not support OSS Cluster API but provide reliable external access to your Redis databases. + +## REC domain name + +The RedisEnterpriseCluster does not support custom domain names. Domain names for the REC are in the following format: `..svc.cluster.local`. diff --git a/content/operate/kubernetes/7.22/networking/database-connectivity.md b/content/operate/kubernetes/7.22/networking/database-connectivity.md new file mode 100644 index 0000000000..4b9012e1e7 --- /dev/null +++ b/content/operate/kubernetes/7.22/networking/database-connectivity.md @@ -0,0 +1,295 @@ +--- +Title: Database connectivity +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Connect applications to Redis Enterprise databases in Kubernetes clusters with in-cluster and external access patterns. +linkTitle: Database connectivity +weight: 1 +url: '/operate/kubernetes/7.22/networking/database-connectivity/' +--- + +Connecting applications to Redis Enterprise databases in Kubernetes involves understanding service discovery, credentials management, and access patterns. This guide covers the essential connectivity aspects unique to Kubernetes deployments. + +## Service types and access patterns + +When you create a RedisEnterpriseDatabase (REDB), the Redis Enterprise operator automatically creates Kubernetes services to route traffic to your database. Understanding these service types is crucial for proper connectivity. + +### Default service creation + +By default, the operator creates two services for each database: + +- ClusterIP service - Provides a stable cluster-internal IP address. +- Headless service - Enables direct pod-to-pod communication and service discovery. + +Both services are created in the same namespace as your database and follow predictable naming conventions. + +### Service types + +Redis Enterprise supports three service types for database access: + +| Service Type | Access Scope | Use Case | +|--------------|--------------|----------| +| `ClusterIP` | Cluster-internal only | Applications running within the same Kubernetes cluster | +| `headless` | Cluster-internal only | Direct pod access, service discovery, StatefulSet scenarios | +| `LoadBalancer` | External access | Applications outside the Kubernetes cluster | + +To configure the service type, use the `databaseServiceType` field in your REC's `servicesRiggerSpec`. + +## In-cluster database access + +For applications running within your Kubernetes cluster, use the automatically created services to connect to your databases. + +### Retrieve connection information + +Database connection details are stored in a Kubernetes secret maintained by the database controller. This secret contains: + +- Database port (`port`) +- Service names (`service_names`) +- Database password (`password`) + +1. Get the secret name from your database resource: + + ```sh + kubectl get redb -o jsonpath="{.spec.databaseSecretName}" + ``` + + The secret name typically follows the pattern `redb-`. + +2. Retrieve the database port: + + ```sh + kubectl get secret redb- -o jsonpath="{.data.port}" | base64 --decode + ``` + +3. Get available service names: + + ```sh + kubectl get secret redb- -o jsonpath="{.data.service_names}" | base64 --decode + ``` + +4. Retrieve the database password: + + ```sh + kubectl get secret redb- -o jsonpath="{.data.password}" | base64 --decode + ``` + +### Service naming and DNS resolution + +Services follow standard Kubernetes DNS naming conventions: + +- Service FQDN: `..svc.cluster.local` +- Short name: `` (within the same namespace) + +For a database named `mydb` in namespace `production`, the service names would be: +- ClusterIP service: `mydb.production.svc.cluster.local` +- Headless service: `mydb-headless.production.svc.cluster.local` + +### Connect from within the cluster + +Use any service name from the `service_names` list to connect: + +```sh +redis-cli -h -p +``` + +Then authenticate with the retrieved password: + +```sh +auth +``` + +## External database access + +To access databases from outside the Kubernetes cluster, you need to configure external routing. Currently supported methods for external access are ingress controllers or OpenShift routes. + +### Ingress controllers + +Redis Enterprise for Kubernetes only supports the following ingress controllers for external database access: + +- NGINX Ingress - Supports SSL passthrough for Redis connections +- HAProxy Ingress - Built-in SSL passthrough support +- Istio Gateway - Service mesh integration with advanced traffic management + +See [Ingress routing]({{< relref "/operate/kubernetes/7.22/networking/ingress" >}}) for detailed configuration steps. + +### OpenShift routes + +OpenShift users can leverage routes for external access: + +```yaml +apiVersion: route.openshift.io/v1 +kind: Route +metadata: + name: redis-route +spec: + to: + kind: Service + name: + port: + targetPort: redis + tls: + termination: passthrough +``` + +See [OpenShift routes]({{< relref "/operate/kubernetes/7.22/networking/routes" >}}) for complete setup instructions. + +## Service ports and configuration + +### Default port behavior + +- Redis Enterprise databases use dynamic port allocation. +- Port numbers are assigned automatically during database creation. +- The actual port is stored in the database secret. + +### Custom port configuration + +You can specify custom ports using the `databasePort` field in your REDB specification: + +```yaml +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseDatabase +metadata: + name: mydb +spec: + memorySize: 256MB + databasePort: 6379 +``` + +Custom ports replace the default service port and are reflected in the database secret. + +## Credentials and secrets management + +### Database secrets structure + +Each database has an associated Kubernetes secret containing connection details: + +```yaml +apiVersion: v1 +kind: Secret +metadata: + name: redb- +type: Opaque +data: + port: + service_names: + password: +``` + +### Using secrets in applications + +Reference database secrets in your application deployments: + +```yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: my-app +spec: + template: + spec: + containers: + - name: app + image: my-app:latest + env: + - name: REDIS_HOST + value: "" + - name: REDIS_PORT + valueFrom: + secretKeyRef: + name: redb- + key: port + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: redb- + key: password +``` + +### Default user configuration + +By default, databases create a default user with full access. You can disable this behavior: + +```yaml +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseDatabase +metadata: + name: mydb +spec: + memorySize: 256MB + defaultUser: false +``` + +When `defaultUser` is disabled, the database secret is not created, and you must configure custom authentication. + +## Connection examples + +### Python application + +```python +import redis +import base64 +import os + +# Read from Kubernetes secret (mounted as environment variables) +host = os.getenv('REDIS_HOST') +port = int(os.getenv('REDIS_PORT')) +password = os.getenv('REDIS_PASSWORD') + +# Create Redis connection +r = redis.Redis(host=host, port=port, password=password, decode_responses=True) + +# Test connection +r.ping() +``` + +### Node.js application + +```javascript +const redis = require('redis'); + +const client = redis.createClient({ + host: process.env.REDIS_HOST, + port: process.env.REDIS_PORT, + password: process.env.REDIS_PASSWORD +}); + +client.on('connect', () => { + console.log('Connected to Redis'); +}); +``` + +## Troubleshooting connectivity + +### Common issues + +1. Connection refused - Verify service names and ports from the database secret. +2. Authentication failed - Check password encoding and special characters. +3. DNS resolution - Ensure applications use correct service FQDNs. +4. Network policies - Verify Kubernetes network policies allow traffic. + +### Debugging steps + +1. Verify service creation: + ```sh + kubectl get services -l app=redis-enterprise + ``` + +2. Check service endpoints: + ```sh + kubectl get endpoints + ``` + +3. Test connectivity from within cluster: + ```sh + kubectl run redis-test --image=redis:latest -it --rm -- redis-cli -h -p + ``` + +## Related topics + +- [Ingress routing]({{< relref "/operate/kubernetes/7.22/networking/ingress" >}}) - Configure external access with ingress controllers +- [OpenShift routes]({{< relref "/operate/kubernetes/7.22/networking/routes" >}}) - External access using OpenShift routes +- [Database controller]({{< relref "/operate/kubernetes/7.22/re-databases/db-controller" >}}) - Database lifecycle management +- [Security]({{< relref "/operate/kubernetes/7.22/security" >}}) - TLS configuration and access control diff --git a/content/operate/kubernetes/7.22/networking/ingress.md b/content/operate/kubernetes/7.22/networking/ingress.md new file mode 100644 index 0000000000..036b2fde68 --- /dev/null +++ b/content/operate/kubernetes/7.22/networking/ingress.md @@ -0,0 +1,225 @@ +--- +Title: Configure Ingress for external routing +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Configure an ingress controller to access your Redis Enterprise databases + from outside the Kubernetes cluster. +linkTitle: Ingress routing +weight: 5 +url: '/operate/kubernetes/7.22/networking/ingress/' +--- + +## Prerequisites + +Before creating an Ingress, you'll need: + + - A RedisEnterpriseDatabase (REDB) with TLS enabled for client connections + - A supported Ingress controller with `ssl-passthrough` enabled + - [Ingress-NGINX Controller](https://kubernetes.github.io/ingress-nginx/deploy/) + - Be sure to use the `kubernetes/ingress-nginx` controller and NOT the `nginxinc/kubernetes-ingress` controller. + - [HAProxy Ingress](https://haproxy-ingress.github.io/docs/getting-started/) + - To use Istio for your Ingress resources, see [Configure Istio for external routing]({{< relref "/operate/kubernetes/7.22/networking/istio-ingress" >}}) + +{{}}Make sure your Ingress controller has `ssl-passthrough`enabled. This is enabled by default for HAProxy, but disabled by default for NGINX. See the [NGINX User Guide](https://kubernetes.github.io/ingress-nginx/user-guide/tls/#ssl-passthrough) for details. {{}} + +## Create an Ingress resource + +1. Retrieve the hostname of your Ingress controller's `LoadBalancer` service. + + ``` sh + $ kubectl get svc \ + -n + ``` + + Below is example output for an HAProxy running on a K8s cluster hosted by AWS. + + ``` sh + NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE + haproxy-ingress LoadBalancer 10.43.62.53 a56e24df8c6173b79a63d5da54fd9cff-676486416.us-east-1.elb.amazonaws.com 80:30610/TCP,443:31597/TCP 21m + ``` + +1. Choose the hostname you will use to access your database (this value will be represented in this article with ``). + +1. Create a DNS entry that resolves your chosen database hostname to the IP address for the Ingress controller's LoadBalancer. + +1. Create the Ingress resource YAML file. + + ``` YAML + apiVersion: networking.k8s.io/v1 + kind: Ingress + metadata: + name: rec-ingress + annotations: + + spec: + rules: + - host: + http: + paths: + - path: / + pathType: ImplementationSpecific + backend: + service: + name: + port: + name: redis + ``` + + For HAProxy, insert the following into the `annotations` section: + + ``` YAML + kubernetes.io/ingress.class: haproxy + ingress.kubernetes.io/ssl-passthrough: "true" + ``` + + For NGINX, insert the following into the `annotations` section: + + ``` YAML + kubernetes.io/ingress.class: nginx + nginx.ingress.kubernetes.io/ssl-passthrough: "true" + ``` + + The `ssl-passthrough` annotation is required to allow access to the database. The specific format changes depending on your Ingress controller and any additional customizations. See [NGINX Configuration annotations](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/) and [HAProxy Ingress Options](https://www.haproxy.com/documentation/kubernetes/latest/configuration/ingress/) for updated annotation formats. + +## Test your external access + +To test your external access to the database, you need a client that supports [TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security) and [SNI](https://en.wikipedia.org/wiki/Server_Name_Indication). + +#### Test your access with Openssl + +1. Get the default CA certificate from the `redis-enterprise-node` container on any of the Redis Enterprise pods. + + ``` sh + $ kubectl exec -it -c redis-enterprise-node \ + -- cat /etc/opt/redislabs/proxy_cert.pem + ``` + +1. Run the following `openssl` command, substituting your own values for ``. + + ``` sh + $ openssl s_client \ + -connect :443 \ + -crlf -CAfile ./proxy_cert.pem \ + -servername + ``` + + If you are connected to the database, you will receive `PONG` back, as shown below: + + ``` sh + ... + Verify return code: 0 (ok) + --- + + PING + +PONG + ``` + +#### Test your access with Python + +You can use the code below to test your access with Python, substituting your own values for `` and ``. + +``` python +import redis + +r = redis.StrictRedis(host='', + port=443, db=0, ssl=True, + ssl_ca_certs='//proxy_cert.pem') + + +print(r.info()) +``` + +Your output should look something like this: + +``` sh +$ /Users/example-user/Documents/Projects/test_client/venv3.7/bin/python \ + /Users/example-user/Documents/Projects/test_client/test_ssl.py +{ + 'redis_version': '5.0.5', + 'redis_git_sha1': 0, + 'redis_git_dirty': 0, + 'redis_build_id': 0, + 'redis_mode': 'standalone', + 'os': 'Linux 4.14.154-128.181.amzn2.x86_64 x86_64', + 'arch_bits': 64, + 'multiplexing_api': 'epoll', + 'gcc_version': '7.4.0', + 'process_id': 1, + 'run_id': '3ce7721b096517057d28791aab555ed8ac02e1de', + 'tcp_port': 10811, + 'uptime_in_seconds': 316467, + 'uptime_in_days': 3, + 'hz': 10, + 'lru_clock': 0, + 'config_file': '', + 'connected_clients': 1, + 'client_longest_output_list': 0, + 'client_biggest_input_buf': 0, + 'blocked_clients': 0, + 'used_memory': 12680016, + 'used_memory_human': '12.9M', + 'used_memory_rss': 12680016, + 'used_memory_peak': 13452496, + 'used_memory_peak_human': '12.82M', + 'used_memory_lua': 151552, + 'mem_fragmentation_ratio': 1, + 'mem_allocator': 'jemalloc-5.1.0', + 'loading': 0, + 'rdb_changes_since_last_save': 0, + 'rdb_bgsave_in_progress': 0, + 'rdb_last_save_time': 1577753916, + 'rdb_last_bgsave_status': 'ok', + 'rdb_last_bgsave_time_sec': 0, + 'rdb_current_bgsave_time_sec': -1, + 'aof_enabled': 0, + 'aof_rewrite_in_progress': 0, + 'aof_rewrite_scheduled': 0, + 'aof_last_rewrite_time_sec': -1, + 'aof_current_rewrite_time_sec': -1, + 'aof_last_bgrewrite_status': 'ok', + 'aof_last_write_status': 'ok', + 'total_connections_received': 4, + 'total_commands_processed': 6, + 'instantaneous_ops_per_sec': 14, + 'total_net_input_bytes': 0, + 'total_net_output_bytes': 0, + 'instantaneous_input_kbps': 0.0, + 'instantaneous_output_kbps': 0.0, + 'rejected_connections': 0, + 'sync_full': 1, + 'sync_partial_ok': 0, + 'sync_partial_err': 0, + 'expired_keys': 0, + 'evicted_keys': 0, + 'keyspace_hits': 0, + 'keyspace_misses': 0, + 'pubsub_channels': 0, + 'pubsub_patterns': 0, + 'latest_fork_usec': 0, + 'migrate_cached_sockets': 0, + 'role': 'master', + 'connected_slaves': 1, + 'slave0': { + 'ip': '0.0.0.0', + 'port': 0, + 'state': 'online', + 'offset': 0, + 'lag': 0 + }, + 'master_repl_offset': 0, + 'repl_backlog_active': 0, + 'repl_backlog_size': 1048576, + 'repl_backlog_first_byte_offset': 0, + 'repl_backlog_histlen': 0, + 'used_cpu_sys': 0.0, + 'used_cpu_user': 0.0, + 'used_cpu_sys_children': 0.0, + 'used_cpu_user_children': 0.0, + 'cluster_enabled': 0 +} + +Process finished with exit code 0 +``` diff --git a/content/operate/kubernetes/7.22/networking/ingressorroutespec.md b/content/operate/kubernetes/7.22/networking/ingressorroutespec.md new file mode 100644 index 0000000000..a9747e0927 --- /dev/null +++ b/content/operate/kubernetes/7.22/networking/ingressorroutespec.md @@ -0,0 +1,87 @@ +--- +Title: Establish external routing on the RedisEnterpriseCluster +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: null +linkTitle: REC external routing +weight: 30 +url: '/operate/kubernetes/7.22/networking/ingressorroutespec/' +--- +An Ingress is an API resource that provides a standardized and flexible way to manage external access to services running within a Kubernetes cluster. + +## Install Ingress controller + +Redis Enterprise for Kubernetes supports the Ingress controllers below: +* [HAProxy](https://haproxy-ingress.github.io/) +* [NGINX](https://kubernetes.github.io/ingress-nginx/) +* [Istio](https://istio.io/latest/docs/setup/getting-started/) + +OpenShift users can use [routes]({{< relref "/operate/kubernetes/7.22/networking/routes" >}}) instead of an Ingress. + +Install your chosen Ingress controller, making sure `ssl-passthrough` is enabled. `ssl-passthrough` is turned off by default for NGINX but enabled by default for HAProxy. + +## Configure DNS + +1. Choose the hostname (FQDN) you will use to access your database according to the recommended naming conventions below, replacing `` with your own values. + + REC API hostname: `api--.` + REAADB hostname: `-db--.` + + We recommend using a wildcard (`*`) in place of the database name, followed by the hostname suffix. + +1. Retrieve the `EXTERNAL-IP` of your Ingress controller's `LoadBalancer` service. + + ``` sh + $ kubectl get svc \ + -n + ``` + + Below is example output for an HAProxy ingress controller running on a K8s cluster hosted by AWS. + + ``` sh + NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE + haproxy-ingress LoadBalancer 10.43.62.53 a56e24df8c6173b79a63d5da54fd9cff-676486416.us-east-1.elb.amazonaws.com 80:30610/TCP,443:31597/TCP 21m + ``` + +1. Create DNS records to resolve your chosen REC API hostname and database hostname to the `EXTERNAL-IP` found in the previous step. + +## Edit the REC spec + +Edit the RedisEnterpriseCluster (REC) spec to add the `ingressOrRouteSpec` field, replacing `` below with your own values. + +### NGINX or HAproxy ingress controllers + +* Define the REC API hostname (`apiFqdnUrl`) and database hostname suffix (`dbFqdnSuffix`) you chose when configuring DNS. +* Set `method` to `ingress`. +* Set `ssl-passthrough` to "true". +* Add any additional annotations required for your ingress controller. See [NGINX docs](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/) or [HAproxy docs](https://haproxy-ingress.github.io/docs/configuration/keys/) for more information. + +```sh +kubectl patch rec --type merge --patch "{\"spec\": \ + {\"ingressOrRouteSpec\": \ + {\"apiFqdnUrl\": \"api--.example.com\", \ + \"dbFqdnSuffix\": \"-db--.example.com\", \ + \"ingressAnnotations\": \ + {\".io/ingress.class\": \ + \"\", \ + \"/ssl-passthrough\": \ \"true\"}, \ + \"method\": \"ingress\"}}}" +``` + +### OpenShift routes + +* Define the REC API hostname (`apiFqdnUrl`) and database hostname suffix (`dbFqdnSuffix`) you chose when configuring DNS. +* Set `method` to `openShiftRoute`. + +```sh +kubectl patch rec --type merge --patch "{\"spec\": \ + {\"ingressOrRouteSpec\": \ + {\"apiFqdnUrl\": \"api--.example.com\" \ + \"dbFqdnSuffix\": \"-db--.example.com\", \ + \"method\": \"openShiftRoute\"}}}" +``` + +OpenShift routes do not require any `ingressAnnotations` in the `ingressOrRouteSpec`. \ No newline at end of file diff --git a/content/operate/kubernetes/7.22/networking/istio-ingress.md b/content/operate/kubernetes/7.22/networking/istio-ingress.md new file mode 100644 index 0000000000..50ea707a00 --- /dev/null +++ b/content/operate/kubernetes/7.22/networking/istio-ingress.md @@ -0,0 +1,158 @@ +--- +Title: Configure Istio for external routing +alwaysOpen: false +categories: +- docs +- operate +- kubernetes +description: Configure Istio as an ingress controller for access to your Redis Enterprise + databases from outside the Kubernetes cluster. +linkTitle: Istio ingress routing +weight: 20 +url: '/operate/kubernetes/7.22/networking/istio-ingress/' +--- + +Redis Enterprise for Kubernetes has the ability to use an Istio Ingress gateway as an alternative to NGINX or HaProxy Ingress controllers. + +Istio can also understand Ingress resources, but using that mechanism takes away the advantages and options that the native Istio resources provide. Istio offers its own configuration methods using custom resources. + +To configure Istio to work with the Redis Kubernetes operator, we will use two custom resources: a `Gateway` and a `VirtualService`. Then you'll be able to establish external access to your database. + +## Install and configure Istio for Redis Enterprise + +1. [Download](https://istio.io/latest/docs/setup/getting-started/) and [install](https://istio.io/latest/docs/setup/getting-started/) Istio (see instructions from Istio's [Getting Started](https://istio.io/latest/docs/setup/getting-started/) guide). + + Once the installation is complete, all the deployments, pods, and services will be deployed in a namespace called `istio-system`. This namespace contains a `LoadBalancer` type service called `service/istio-ingressgateway` that exposes the external IP address. + +1. Find the `EXTERNAL-IP` for the `istio-ingressgateway` service. + + ```sh + kubectl get svc istio-ingressgateway -n istio-system + + NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE + istio-ingressgateway LoadBalancer 10.34.67.89 10.145.78.91 15021:12345/TCP,80:67891/TCP,443:23456/TCP,31400:78901/TCP,15443:10112/TCP 3h8m + ``` + +1. Create a DNS entry that resolves your chosen database hostname (or a wildcard `*` followed by your domain) to the Istio `EXTERNAL-IP`. Use this hostname to access your database from outside the cluster. + + In this example, any hostname that ends with `.istio.k8s.my.example.com` will resolve to the Istio LoadBalancer's external IP of `10.145.78.91`. Substitute your own values accordingly. + +1. Verify the record was created successfully. + + ```sh + dig api.istio.k8s.my.example.com + ``` + + Look in the `ANSWER SECTION` for the record you just created. + + ```sh + ;; ANSWER SECTION: + api.istio.k8s.my.example.com 0 IN A 10.145.78.91 + ``` + +## Create custom resources + +### `Gateway` custom resource + +1. On a different namespace from `istio-system`, create a `Gateway` custom resource file (`redis-gateway.yaml` in this example). + + - Replace `.istio.k8s.my.example.com` with the domain that matches your DNS record. + - Replace `` with the label set on your Istio ingress gateway pod (most common is `istio: ingress`). + - TLS passthrough mode is required to allow secure access to the database. + + ```yaml + apiVersion: networking.istio.io/v1beta1 + kind: Gateway + metadata: + name: redis-gateway + spec: + selector: + istio: + servers: + - hosts: + - '*.istio.k8s.my.example.com' + port: + name: https + number: 443 + protocol: HTTPS + tls: + mode: PASSTHROUGH + ``` + + + +1. Apply the `Gateway` custom resource file to create the Ingress gateway. + + ```sh + kubectl apply -f redis-gateway.yaml + ``` + +1. Verify the gateway was created successfully. + + ```sh + kubectl get gateway + + NAME AGE + redis-gateway 3h33m + ``` + +### `VirtualService` custom resource + +1. On a different namespace than `istio-system`, create the `VirtualService` custom resource file (`redis-vs.yaml` in this example). + + ```yaml + apiVersion: networking.istio.io/v1beta1 + kind: VirtualService + metadata: + name: redis-vs + spec: + gateways: + - redis-gateway + hosts: + - "*.istio.k8s.my.example.com" + tls: + - match: + - port: 443 + sniHosts: + - api.istio.k8s.my.example.com + route: + - destination: + host: rec1 + port: + number: 9443 + - match: + - port: 443 + sniHosts: + - db1.istio.k8s.my.example.com + route: + - destination: + host: db1 + ``` + + This creates both a route to contact the API server on the REC (`rec1`) and a route to contact one of the databases (`db1`). + + - Replace `.istio.k8s.my.example.com` with the domain that matches your DNS record. + - The gateway's metadata name must be similar to the gateway's spec name (`redis-gateway` in this example). + +1. Apply `VirtualService` custom resource file to create the virtual service. + + ```sh + kubectl apply -f redis-vs.yaml + ``` + +1. Verify the virtual service was created successfully. + + ```sh + kubectl get vs + + NAME GATEWAYS HOSTS AGE + redis-vs ["redis-gateway"] ["*.istio.k8s.my.example.com"] 3h33m + ``` + +1. [Deploy the operator]({{< relref "/operate/kubernetes/7.22/deployment/quick-start" >}}), Redis Enterprise Cluster (REC), and Redis Enterprise Database (REDB) on the same namespace as the gateway and virtual service. + +## Test your external access to the database + +To [test your external access]({{< relref "/operate/kubernetes/7.22/networking/ingress" >}}) to the database, you need a client that supports [TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security) and [SNI](https://en.wikipedia.org/wiki/Server_Name_Indication). + +See [Test your access with Openssl]({{< relref "/operate/kubernetes/7.22/networking/ingress#test-your-access-with-openssl" >}}) or [Test your access with Python]({{< relref "/operate/kubernetes/7.22/networking/ingress#test-your-access-with-python" >}}) for more info. diff --git a/content/operate/kubernetes/7.22/networking/routes.md b/content/operate/kubernetes/7.22/networking/routes.md new file mode 100644 index 0000000000..47360f0cbb --- /dev/null +++ b/content/operate/kubernetes/7.22/networking/routes.md @@ -0,0 +1,59 @@ +--- +Title: Use OpenShift routes for external database access +alwaysOpen: false +categories: +- docs +- operate +- kubernetes +description: null +linkTitle: OpenShift routes +weight: 15 +url: '/operate/kubernetes/7.22/networking/routes/' +--- + +OpenShift routes allow requests to be routed to the database or cluster API from outside the cluster. For more information about routes, see [OpenShift documentation](https://docs.openshift.com/container-platform/4.13/networking/routes/route-configuration.html). + +## Prerequisites + +* Before you can connect to your database from outside the cluster, you'll need the root CA certificate of the DMC Proxy server to validate the server certificate. + + By default, the DMC Proxy uses a self-signed certificate. You can retrieve it from the Redis Enterprise admin console, or from the machine at `/etc/opt/redislabs/proxy_cert.pem` (default location), and save it as a file (for example, named "ca.pem") on the client machine. + +* Your database also needs TLS encryption enabled. + +## Create OpenShift route + +1. Select the **Networking/Routes** section of the OpenShift web console. + +1. Select **Create route** and fill out the following fields: + + * **Name**: Choose any name you want as the first part of your generated hostname + * **Hostname**: Leave blank + * **Path**: Leave as is ("/") + * **Service**: Select the service for the database you want to access + * **TLS Termination**: Choose "passthrough" + * **Insecure Traffic**: Select "None" + +1. Select **Create**. + +1. Find the hostname for your new route. After route creation, it appears in the "Host" field. + +1. Verify you have a DNS entry to resolve the hostname for your new route to the cluster's load balancer. + +## Access database + +Access the database from outside the cluster using `redis-cli` or `openssl`. + +To connect with `redis-cli`: + + ```sh + redis-cli -h -p 443 --tls --cacert ./ca.pem --sni + ``` + +Replace the `` value with the hostname for your new route. + +To connect with `openssl`: + + ```sh + openssl s_client -connect :443 -crlf -CAfile ./ca.pem -servername + ``` diff --git a/content/operate/kubernetes/7.22/re-clusters/_index.md b/content/operate/kubernetes/7.22/re-clusters/_index.md new file mode 100644 index 0000000000..f464f998af --- /dev/null +++ b/content/operate/kubernetes/7.22/re-clusters/_index.md @@ -0,0 +1,66 @@ +--- +Title: Redis Enterprise clusters (REC) +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Create and manage Redis Enterprise clusters (REC) on Kubernetes using the Redis Enterprise operator. +hideListLinks: true +linkTitle: Redis Enterprise clusters (REC) +weight: 30 +url: '/operate/kubernetes/7.22/re-clusters/' +--- + +A Redis Enterprise cluster (REC) is a custom Kubernetes resource that represents a Redis Enterprise cluster deployment. The Redis Enterprise operator manages the lifecycle of REC resources, including deployment, scaling, upgrades, and recovery operations. + +REC resources define the cluster configuration, including node specifications, storage requirements, security settings, and networking configuration. After you deploy the cluster, it provides a foundation for creating and managing Redis Enterprise databases (REDB). + +## Cluster management + +Manage your Redis Enterprise cluster lifecycle and configuration: + +- [Connect to admin console]({{< relref "/operate/kubernetes/7.22/re-clusters/connect-to-admin-console" >}}) - Access the Redis Enterprise web UI for cluster management +- [Multi-namespace deployment]({{< relref "/operate/kubernetes/7.22/re-clusters/multi-namespace" >}}) - Deploy clusters across multiple Kubernetes namespaces +- [Delete custom resources]({{< relref "/operate/kubernetes/7.22/re-clusters/delete-custom-resources" >}}) - Safely remove REC and related resources + +## Storage and performance + +Optimize storage and performance for your Redis Enterprise cluster: + +- [Auto Tiering]({{< relref "/operate/kubernetes/7.22/re-clusters/auto-tiering" >}}) - Configure automatic data tiering between RAM and flash storage +- [Expand PVC]({{< relref "/operate/kubernetes/7.22/re-clusters/expand-pvc" >}}) - Expand persistent volume claims for additional storage + +## Monitoring and observability + +Monitor cluster health and performance: + +- [Connect to Prometheus operator]({{< relref "/operate/kubernetes/7.22/re-clusters/connect-prometheus-operator" >}}) - Integrate with Prometheus for metrics collection and monitoring + +### Call home client + +The call home client sends health or error data from your deployment(s) back to Redis. You can disable it by adding the following to your REC specification: + +```yaml +spec: + usageMeter: + callHomeClient: + disabled: true +``` + +{{}} +The REST API approach used for Redis Software deployments will have no effect on Kubernetes deployments. You must use the REC specification method shown above. +{{}} + +## Recovery and troubleshooting + +Handle cluster recovery and troubleshooting scenarios: + +- [Cluster recovery]({{< relref "/operate/kubernetes/7.22/re-clusters/cluster-recovery" >}}) - Recover from cluster failures and restore operations + +## Related topics + +- [Redis Enterprise databases (REDB)]({{< relref "/operate/kubernetes/7.22/re-databases" >}}) - Create and manage databases on your cluster +- [Security]({{< relref "/operate/kubernetes/7.22/security" >}}) - Configure security settings for your cluster +- [Networking]({{< relref "/operate/kubernetes/7.22/networking" >}}) - Set up networking and ingress for cluster access +- [REC API reference]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api" >}}) - Complete API specification for REC resources diff --git a/content/operate/kubernetes/7.22/re-clusters/auto-tiering.md b/content/operate/kubernetes/7.22/re-clusters/auto-tiering.md new file mode 100644 index 0000000000..aceefadd56 --- /dev/null +++ b/content/operate/kubernetes/7.22/re-clusters/auto-tiering.md @@ -0,0 +1,90 @@ +--- +Title: Use Auto Tiering on Kubernetes +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Deploy a cluster with Auto Tiering on Kubernetes. +linkTitle: Auto Tiering +weight: 16 +url: '/operate/kubernetes/7.22/re-clusters/auto-tiering/' +--- + +## Prerequisites + +Redis Enterprise Software for Kubernetes supports using Auto Tiering (previously known as Redis on Flash), which extends your node memory to use both RAM and flash storage. SSDs (solid state drives) can store infrequently used (warm) values while your keys and frequently used (hot) values are still stored in RAM. This improves performance and lowers costs for large datasets. + +{{}} +NVMe (non-volatile memory express) SSDs are strongly recommended to achieve the best performance. +{{}} + +Before creating your Redis clusters or databases, these SSDs must be: + +- [locally attached to worker nodes in your Kubernetes cluster](https://kubernetes.io/docs/concepts/storage/volumes/#local) +- formatted and mounted on the nodes that will run Redis Enterprise pods +- dedicated to Auto Tiering and not shared with other parts of the database, (e.g. durability, binaries) +- [provisioned as local persistent volumes](https://kubernetes.io/docs/concepts/storage/volumes/#local) + - You can use a [local volume provisioner](https://github.com/kubernetes-sigs/sig-storage-local-static-provisioner/blob/master/README.md) to do this [dynamically](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#dynamic) +- a [StorageClass](https://kubernetes.io/docs/concepts/storage/storage-classes/#local) resource with a unique name + +For more information on node storage, see [Node persistent and ephemeral storage]({{< relref "/operate/rs/installing-upgrading/install/plan-deployment/persistent-ephemeral-storage" >}}). + +## Create a Redis Enterprise cluster + +To deploy a Redis Enterprise cluster (REC) with Auto Tiering, you'll need to specify the following in the `redisOnFlashSpec` section of your [REC custom resource]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api" >}}): + +- enable Auto Tiering (`enabled: true`) +- flash storage driver (`bigStoreDriver`) + - `rocksdb` or `speedb`(default) +- storage class name (`storageClassName`) +- minimal flash disk size (`flashDiskSize`) + +{{}} Clusters upgraded to version 7.2.4-2 from an earlier version will change the `bigStoreDriver` (previously called `flashStorageEngine`) to the new default `speedb`, regardless of previous configuration. {{}} + +{{}}Switching between storage engines (`speedb` and `rocksdb`) requires guidance by Redis Support or your Account Manager.{{}} + +{{}}PVC expansion is not supported when using Auto Tiering. Do not enable `enablePersistentVolumeResize` in the REC `persistentSpec` if you are using `redisOnFlashSpec` as this will result in conflicts. {{}} + +Here is an example of an REC custom resource with these attributes: + +```YAML +apiVersion: app.redislabs.com/v1 +kind: RedisEnterpriseCluster +metadata: + name: "rec" +spec: + + nodes: 3 + redisOnFlashSpec: + enabled: true + bigStoreDriver: speedb + storageClassName: local-scsi + flashDiskSize: 100G +``` + +### Create a Redis Enterprise database + +By default, any new database will use RAM only. To create a Redis Enterprise database (REDB) that can use flash storage, specify the following in the `redisEnterpriseCluster` section of the REDB custom resource definition: + +- `isRof: true` enables Auto Tiering +- `rofRamSize` defines the RAM capacity for the database + +Below is an example REDB custom resource: + +```YAML +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseDatabase +metadata: + name: autoteiring-redb +spec: + redisEnterpriseCluster: + name: rec + isRof: true + memorySize: 2GB + rofRamSize: 0.5GB +``` + +{{< note >}} +This example defines both `memorySize` and `rofRamSize`. When using Auto Tiering, `memorySize` refers to the total combined memory size (RAM + flash) allocated for the database. `rofRamSize` specifies only the RAM capacity for the database. `rofRamSize` must be at least 10% of `memorySize`. +{{< /note >}} diff --git a/content/operate/kubernetes/7.22/re-clusters/cluster-recovery.md b/content/operate/kubernetes/7.22/re-clusters/cluster-recovery.md new file mode 100644 index 0000000000..d3f2a18d40 --- /dev/null +++ b/content/operate/kubernetes/7.22/re-clusters/cluster-recovery.md @@ -0,0 +1,49 @@ +--- +Title: Recover a Redis Enterprise cluster on Kubernetes +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: This task describes how to recover a Redis Enterprise cluster on Kubernetes. +linkTitle: Recover a Redis cluster +weight: 20 +url: '/operate/kubernetes/7.22/re-clusters/cluster-recovery/' +--- +When a Redis Enterprise cluster loses contact with more than half of its nodes either because of failed nodes or network split, +the cluster stops responding to client connections. +When this happens, you must recover the cluster to restore the connections. + +You can also perform cluster recovery to reset cluster nodes, to troubleshoot issues, or in a case of active/passive failover. + +The Redis Enterprise for Kubernetes automates these recovery steps: + +1. Recreates a fresh Redis Enterprise cluster +1. Mounts the persistent storage with the recovery files from the original cluster to the nodes of the new cluster +1. Recovers the cluster configuration on the first node in the new cluster +1. Joins the remaining nodes to the new cluster. + +{{}}Redis Enterprise for Kubernetes 7.2.4-2 introduces a new limitation. You cannot recover or upgrade your cluster if there are databases with old module versions or manually uploaded modules. See the [Redis Enterprise Software 7.2.4 known limitations]({{< relref "/operate/rs/release-notes/rs-7-2-4-releases/rs-7-2-4-52#cluster-recovery-with-manually-uploaded-modules" >}}) for more details.{{}} + +## Prerequisites + +- For cluster recovery, the cluster must be [deployed with persistence]({{< relref "/operate/kubernetes/7.22/recommendations/persistent-volumes" >}}). + +## Recover a cluster + +1. Edit the REC resource to set the `clusterRecovery` flag to `true`. + + ```sh + kubectl patch rec --type merge --patch '{"spec":{"clusterRecovery":true}}' + ``` + + +1. Wait for the cluster to recover until it is in the "Running" state. + + To see the state of the cluster, run: + + ```sh + watch "kubectl describe rec | grep State" + ``` + +1. To recover the database, see [Recover a failed database]({{< relref "/operate/rs/databases/recover" >}}). \ No newline at end of file diff --git a/content/operate/kubernetes/7.22/re-clusters/connect-prometheus-operator.md b/content/operate/kubernetes/7.22/re-clusters/connect-prometheus-operator.md new file mode 100644 index 0000000000..b26c5386c2 --- /dev/null +++ b/content/operate/kubernetes/7.22/re-clusters/connect-prometheus-operator.md @@ -0,0 +1,72 @@ +--- +Title: Connect the Prometheus operator to Redis Enterprise for Kubernetes +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: This article describes how to configure a Prometheus operator custom + resource to allow it to export metrics from Redis Enterprise for Kubernetes. +linkTitle: Export metrics to Prometheus +weight: 92 +url: '/operate/kubernetes/7.22/re-clusters/connect-prometheus-operator/' +--- + +To collect metrics data from your databases and Redis Enterprise cluster (REC), you can connect your [Prometheus](https://prometheus.io/) server to an endpoint exposed on your REC. Redis Enterprise for Kubernetes creates a dedicated service to expose the `prometheus` port (8070) for data collection. A custom resource called `ServiceMonitor` allows the [Prometheus operator](https://github.com/prometheus-operator/prometheus-operator/tree/main/Documentation) to connect to this port and collect data from Redis Enterprise. + +## Prerequisites + +Before connecting Redis Enterprise to Prometheus on your Kubernetes cluster, make sure you've done the following: + +- [Deploy Redis Enterprise for Kubernetes]({{< relref "/operate/kubernetes/7.22/deployment/quick-start" >}}) (version 6.2.10-4 or newer) +- [Deploy the Prometheus operator](https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/user-guides/getting-started.md) (version 0.19.0 or newer) +- [Create a Redis Enterprise cluster]({{< relref "/operate/kubernetes/7.22/deployment/quick-start#create-a-redis-enterprise-cluster-rec" >}}) + +## Create a `ServiceMonitor` custom resource + +Below is an example `ServiceMonitor` custom resource file. By specifying the service label (`app: redis.io/service=prom-metrics`) in the `selector.matchLabels` section, you can point the Prometheus operator to the correct Redis Enterprise service (`-prom`). + +You'll need to configure the following fields to connect Prometheus to Redis Enterprise: + +| Section | Field | Value | +|---|---|---| +| `spec.endpoints` | `port` | Name of exposed port (`prometheus`) | +| `spec.namespaceSelector` | `matchNames` | Namespace for your REC | +| `spec.selector` | `matchLabels` | REC service label (`app: redis.io/service=prom-metrics`) | + +Apply the file in the same namespace as your Redis Enterprise cluster (REC). + {{}}If Redis Enterprise and Prometheus are deployed in different namespaces, you'll also need to add the [`serviceMonitorNamespaceSelector`](https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md) field to your Prometheus resource. See the [Prometheus operator documentation](https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/user-guides/running-exporters.md) for more details on cross-namespace `ServiceMonitor` configuration.{{}} + + +```YAML +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: redis-enterprise +spec: + endpoints: + - interval: 15s + port: prometheus + scheme: https + tlsConfig: + insecureSkipVerify: true + namespaceSelector: + matchNames: + - + selector: + matchLabels: + redis.io/service: prom-metrics +``` + +For more info about configuring the `ServiceMonitor` resource, see the [`ServiceMonitorSpec` API documentation](https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.ServiceMonitorSpec). + +## More info + +- github.com/prometheus-operator + - [Getting started](https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/user-guides/getting-started.md) + - [Running exporters](https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/user-guides/running-exporters.md) + - [Related resources](https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/user-guides/getting-started.md#related-resources) + - [Troubleshooting ServiceMonitor changes](https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/troubleshooting.md) +- redis.io/docs + - [Metrics in Prometheus]({{< relref "/integrate/prometheus-with-redis-enterprise/prometheus-metrics-definitions" >}}) + - [Monitoring and metrics]({{< relref "/operate/rs/monitoring/" >}}) diff --git a/content/operate/kubernetes/7.22/re-clusters/connect-to-admin-console.md b/content/operate/kubernetes/7.22/re-clusters/connect-to-admin-console.md new file mode 100644 index 0000000000..11bf872241 --- /dev/null +++ b/content/operate/kubernetes/7.22/re-clusters/connect-to-admin-console.md @@ -0,0 +1,59 @@ +--- +Title: Connect to the admin console +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Connect to the Redis Enterprise admin console to manage your Redis Enterprise + cluster. +linkTitle: Connect to the admin console +weight: 10 +url: '/operate/kubernetes/7.22/re-clusters/connect-to-admin-console/' +--- + +The username and password for the Redis Enterprise Software [admin console]({{< relref "/operate/rs/" >}}) are stored in a Kubernetes [secret](https://kubernetes.io/docs/concepts/configuration/secret/). After retrieving your credentials, you can use port forwarding to connect to the admin console. + +{{}} +There are several methods for accessing the admin console. Port forwarding is the simplest, but not the most efficient method for long-term use. You could also use a load balancer service or Ingress. +{{}} + +1. Switch to the namespace with your Redis Enterprise cluster (REC). + + ```sh + kubectl config set-context --current --namespace= + ``` + +1. Find your cluster name from your list of secrets. + + ```sh + kubectl get secret + ``` + + In this example, the cluster name is `rec`. + +1. Extract and decode your credentials from the secret. + + ```sh + kubectl get secret -o jsonpath='{.data.username}' | base64 --decode + kubectl get secret -o jsonpath='{.data.password}' | base64 --decode + ``` + +1. Find the port for the REC UI service in the `spec:ports` section of the service definition file. + + ```sh + kubectl get service/-ui -o yaml + ``` + + {{}} + The default port is 8443. + {{}} + +1. Use `kubectl port-forward` to forward your local port to the service port. + + ```sh + kubectl port-forward service/-ui : + ``` + +1. View the admin console from a web browser on your local machine at `https://localhost:8443`. + diff --git a/content/operate/kubernetes/7.22/re-clusters/delete-custom-resources.md b/content/operate/kubernetes/7.22/re-clusters/delete-custom-resources.md new file mode 100644 index 0000000000..ffc3d0961b --- /dev/null +++ b/content/operate/kubernetes/7.22/re-clusters/delete-custom-resources.md @@ -0,0 +1,133 @@ +--- +Title: Delete custom resources +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: This article explains how to delete Redis Enterprise clusters and Redis + Enterprise databases from your Kubernetes environment. +linkTitle: Delete custom resources +weight: 70 +aliases: [/operate/kubernetes/delete-custom-resources/] +url: '/operate/kubernetes/7.22/re-clusters/delete-custom-resources/' +--- + +## Multi-namespace management + +Before you can delete a namespace, you must remove the Redis custom resources ([REDB](#delete-a-database-redb), [REC](#delete-a-redis-enterprise-cluster-rec), and [operator](#delete-operator-from-one-namespace)) residing within a namespace before you can delete that namespace. Deleting namespace containing an REDB may cause errors or data loss. + +## Delete a database (REDB) + +To delete a database managed by the Redis Enterprise Kubernetes operator, run `kubectl delete redb ` from your K8s cluster. + +When you delete a database, your data and the REDB custom resource are also deleted. + +## Delete a Redis Enterprise cluster (REC) + +To delete a Redis Enterprise cluster managed by the operator: + +1. Delete all the databases in your cluster. + +2. Run `kubectl delete rec ` from your K8s cluster. + +When you delete your cluster, your databases and the REC custom resource are also deleted. However, persistent volume claims (PVCs) for your cluster are not deleted in the process. If you want to delete your PVCs, you'll have to delete them manually. + +## Delete the operator + +There are two ways to delete the operator. You can delete the entire operator bundle, but this will also delete any cluster-wide resources created by the operator. To only delete resources within a specific namespace and leave other cluster-wide resources intact, you need to delete each resource manually. + +Whether you decide to delete the entire bundle or just resources from a specific namespace, it's important to delete the operator ConfigMap (`operator-environment-config`). + +```sh +kubectl delete cm operator-environment-config +``` + +### Delete operator bundle + +To delete the operator from your K8s cluster, you can delete the operator bundle with: + +- `kubectl delete -f bundle.yaml` for non-OpenShift K8s deployments +- `kubectl delete -f openshift.bundle.yaml` for OpenShift deployments + +This will remove the operator and its custom resource definitions (CRDs) from your K8s cluster. + +{{< warning >}} The Redis Enterprise CRDs are non-namespaced resources, meaning they are shared across your entire K8s cluster. Deleting CRDs in one namespace will delete custom resources in every other namespace across the K8s cluster.{{}} + +### Delete operator from one namespace + +If you have Redis Enterprise clusters running in different namespaces on the same K8s cluster, deleting the entire operator bundle might cause data loss. + +To safely delete the operator from one namespace without affecting the others, delete the operator files individually, excluding the CRD files: + +```sh +kubectl delete -f role.yaml +kubectl delete -f role_binding.yaml +kubectl delete -f service_account.yaml +kubectl delete -f admission-service.yaml +kubectl delete -f operator.yaml +``` + +You will also need to remove [the `namespaceSelector` section from the validating webhook]({{< relref "/operate/kubernetes/7.22/deployment/quick-start#webhook" >}}). + +## Delete an Active-Active database (REAADB) + +1. On one of the existing participating clusters, delete the REEADB (substituting `` with your database name). + + ```sh + kubectl delete reaadb + ``` + +2. Verify the REAADB no longer exists. + + ```sh + kubectl get reaadb -o=jsonpath='{range .items[*]}{.metadata.name}' + ``` + +## Delete a remote cluster (RERC) + +1. Verify the RERC you want to delete isn't listed as a participating cluster in any REAADB resources. + + If an RERC is still listed as a participating cluster in any database, the deletion will be blocked. + +2. On one of the existing participating clusters, delete the RERC (substituting `` with your database name). + + ```sh + kubectl delete rerc + ``` + +3. Verify the RERC no longer exists. + + ```sh + kubectl get rerc -o=jsonpath='{range .items[*]}{.metadata.name}' + ``` + +## Troubleshoot REDB deletion + +The operator attaches a finalizer to the Redis Enterprise database (REDB) object. This makes sure the database is deleted before the REDB custom resource is removed from the K8s cluster. + +If the operator isn't running, or some other fatal error occurs, the finalizer isn't removed automatically by the operator. In this case, you won't be able to delete your REDB resource. + +If this happens, you can remove the finalizer manually. + +{{}} If you remove the finalizer manually, there is no guarantee that the underlying REDB has been deleted. This may cause resource issues and require manual intervention. {{}} + +```sh +kubectl patch redb --type=json -p \ + '[{"op":"remove","path":"/metadata/finalizers","value":"finalizer.redisenterprisedatabases.app.redislabs.com"}]' +``` + +## Troubleshoot REC deletion + +The operator attaches a finalizer to the Redis Enterprise cluster (REC) object. This makes sure the Redis cluster is deleted before the REC custom resource is removed from the K8s cluster. + +If the operator isn't running, or some other fatal error occurs, the finalizer isn't removed automatically by the operator. In this case, you won't be able to delete your REC resource. + +If this happens, you can remove the finalizer manually. + +{{}} If you remove the finalizer manually, there is no guarantee that the underlying REC has been deleted. This may cause resource issues and require manual intervention. {{}} + +```sh +kubectl patch rec --type=json -p \ + '[{"op":"remove","path":"/metadata/finalizers","value":"redbfinalizer.redisenterpriseclusters.app.redislabs.com"}]' +``` diff --git a/content/operate/kubernetes/7.22/re-clusters/expand-pvc.md b/content/operate/kubernetes/7.22/re-clusters/expand-pvc.md new file mode 100644 index 0000000000..7a18b90d19 --- /dev/null +++ b/content/operate/kubernetes/7.22/re-clusters/expand-pvc.md @@ -0,0 +1,120 @@ +--- +Title: Expand PersistentVolumeClaim (PVC) +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Expand your persistent volume claim by editing the REC. +linkTitle: Expand PVC +weight: 82 +url: '/operate/kubernetes/7.22/re-clusters/expand-pvc/' +--- + +This article outlines steps to increase the size of the persistent volume claim for your Redis Enterprise cluster (REC). + +{{}} This feature is only supported in versions 7.4.2-12 and above. {{}} + +[PersistentVolumeClaims (PVC)](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#expanding-persistent-volumes-claims) are created by the Redis Enterprise operator and used by the RedisEnterpriseCluster (REC). PVCs are created with a specific size and [can be expanded](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#expanding-persistent-volumes-claims) with the following steps, if the underlying [storage class](https://kubernetes.io/docs/concepts/storage/storage-classes/) supports it. + +This process involves deleting and recreating the REC StatefulSet with a larger persistent volume size. The pods owned by the StatefulSet are not restarted or affected by the deletion and recreation process, except when they are left without an owner momentarily. + +{{}}Shrinking (reducing the size) of your PVC is not allowed. This process only allows you to expand (size up) your PVC.{{}} + +### Default PVC size + +By default, if you omit [`spec.persistentSpec.volumeSize`]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api#specpersistentspec" >}}), the operator allocates a persistent volume that is five times (5x) the Redis Enterprise node memory request defined in [`spec.redisEnterpriseNodeResources.requests.memory`]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api#specredisenterprisenoderesources" >}}) (per node). This 5x ratio is the recommended minimum capacity. + +- If you set [`spec.persistentSpec.volumeSize`]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api#specpersistentspec" >}}) explicitly, that exact size is used and the 5x default does not apply. +- Changing node memory requests does not automatically resize existing PVCs. Use the procedure below to expand the PVC if you want to maintain the 5x ratio after changing memory. +- If you omit [`spec.redisEnterpriseNodeResources.requests.memory`]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api#specredisenterprisenoderesources" >}}), the operator uses its default memory request (4Gi). With `volumeSize` omitted, this results in a default PVC size of approximately 20Gi per node (5 × 4Gi). See [sizing on Kubernetes]({{< relref "/operate/kubernetes/7.22/recommendations/sizing-on-kubernetes" >}}) for defaults. + +- See the [volume size recommendations]({{< relref "/operate/kubernetes/7.22/recommendations/persistent-volumes#volume-size" >}}) and [hardware requirements]({{< relref "/operate/rs/installing-upgrading/install/plan-deployment/hardware-requirements" >}}) for guidance. + +## Prerequisites + +{{}}Do not change any other REC fields related to the StatefulSet while resizing is in progress. +{{}} + +- PVC expansion must be supported and enabled by the StorageClass and underlying storage driver of the REC PVCs. + - The relevant StorageClass is the one associated with the REC PVCs. The StorageClass for existing PVCs cannot be changed. +- The StorageClass must be configured with `allowVolumeExpansion: true`. +- Your storage driver must support online expansion. +- We highly recommend you backup your databases before beginning this PVC expansion process. + +{{}} OpenShift users should be aware that (`ClusterResourceQuota`) can limit the PVC expansion. Check your quota before resizing using `oc describe clusterresourcequota `.{{}} + +{{}} PVC expansion is not supported when using Auto Tiering (Redis on Flash). Do not enable `enablePersistentVolumeResize` if your REC uses `redisOnFlashSpec` as this will result in conflicts. {{}} + +## Expand REC PVC + +1. Enable the REC persistent volume resize flag. + + ```YAML + spec: + persistentSpec: + enablePersistentVolumeResize: true + ``` + +1. Set the value of `volumeSize` to your desired size. + + ```YAML + spec: + persistentSpec: + enablePersistentVolumeResize: true + volumeSize: Gi + ``` + +1. Apply the changes to the REC, replacing `` with the name of your REC. + + ```sh + kubectl apply -f + ``` + +After applying the REC changes, the PVCs will begin to expand to the new size. + +Once all the PVCs finish the resizing process, the operator will delete and recreate the StatefulSet with the new volume size. + +### Track progress + +You can track the progress by monitoring the status of the REC and PersistentVolumeClaim objects. + +The REC status will correspond to the status of one or more PVCs, and will reflect if the resizing is successful or failed. + +While the resizing is in progress, the status will be: + +```yaml +status: + persistenceStatus: + status: Resizing + succeeded: 2/3 +``` + +When the resizing is complete, the status becomes Provisioned and the new volume size is available for use by the REC pods. + +```yaml +status: + persistenceStatus: + status: Provisioned + succeeded: 3/3 +``` + +### Troubleshooting + +If an error occurs during this process: + +- Examine the status and events of the REC and PVC objects. + + ```sh + kubectl describe pvc + ``` + + ```sh + kubectl get events + ``` + +- Examine the logs of the operator pods. + + ```sh + kubectl logs + ``` diff --git a/content/operate/kubernetes/7.22/re-clusters/multi-namespace.md b/content/operate/kubernetes/7.22/re-clusters/multi-namespace.md new file mode 100644 index 0000000000..d8777d56c2 --- /dev/null +++ b/content/operate/kubernetes/7.22/re-clusters/multi-namespace.md @@ -0,0 +1,162 @@ +--- +Title: Manage databases in multiple namespaces +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Redis Enterprise for Kubernetes allows you to deploy to multiple namespaces + within your Kubernetes cluster. This article shows you how to configure your Redis + Enterprise cluster to connect to databases in multiple namespaces +linktitle: Manage multiple namespaces +weight: 17 +url: '/operate/kubernetes/7.22/re-clusters/multi-namespace/' +--- + +Multiple Redis Enterprise database resources (REDBs) can be associated with a single Redis Enterprise cluster resource (REC) even if they reside in different namespaces. + +To learn more about designing a multi-namespace Redis Enterprise cluster, see [flexible deployment options]({{< relref "/operate/kubernetes/7.22/architecture/deployment-options" >}}). + +{{}} +Multi-namespace installations now support Active-Active databases (REAADB) with certain configuration requirements. For details, see [Multi-namespace Active-Active databases](#multi-namespace-active-active-databases). +{{}} + +## Prerequisites + +Before configuring a multi-namespace deployment, you must have a running [Redis Enterprise cluster (REC)]({{< relref "/operate/kubernetes/7.22/deployment/quick-start" >}}). See more information in the [deployment]({{< relref "/operate/kubernetes/7.22/deployment/" >}}) section. + +## Create role and role binding for managed namespaces + +Both the operator and the RedisEnterpriseCluster (REC) resource need access to each namespace the REC will manage. For each **managed** namespace, create a `consumer_role.yaml` and `consumer_role_binding.yaml` file within the managed namespace, as shown in the examples below. + +{{}}These will need to be reapplied each time you [upgrade]({{< relref "/operate/kubernetes/7.22/upgrade/upgrade-redis-cluster" >}}). {{}} + +Replace `` with the namespace the REC resides in. +Replace `` with your own value (defaults to the REC name). + +`consumer_role.yaml` example: + +{{}} + +`consumer_role_binding.yaml` example: + +{{}} + +{{}} +**Alternative approach**: Instead of creating individual `Role` objects for each namespace, you can create a single `ClusterRole` and bind it with multiple `RoleBinding` objects. This reduces the number of objects and simplifies role management. + +To use this approach: +1. Change `kind: Role` to `kind: ClusterRole` in the role definition above +2. Change `roleRef.kind: Role` to `roleRef.kind: ClusterRole` in the role binding definition above +3. Apply the ClusterRole once globally, then apply a RoleBinding in each managed namespace +{{}} + +Apply the files, replacing `` with your own values: + +```sh +kubectl apply -f consumer_role.yaml -n +kubectl apply -f consumer_role_binding.yaml -n +``` + +{{}} +If the REC is configured to watch a namespace without setting the role and role binding permissions, or a namespace that is not yet created, the operator will fail and halt normal operations. +{{}} + +## Update Redis Enterprise operator ConfigMap + +There are two methods of updating the operator ConfigMap (`operator-environment-config`) to specify which namespaces to manage. + +- Method 1: Configure the operator to watch for a namespace label and add this label to managed namespaces (available in versions 6.4.2-4 or later). +- Method 2: Configure the operator with an explicit list of namespaces to manage. + +You can create this ConfigMap manually before deployment, or it will be created automatically after the operator was deployed. + +{{}} +Only configure the operator to watch a namespace after the namespace is created and configured with the role/role_binding as explained above. If configured to watch a namespace without setting those permissions or a namespace that is not created yet, the operator will fail and not perform normal operations. +{{}} + +### Method 1: Namespace label (available in versions 6.4.2-4 or later) + +1. Create the `cluster_role_binding.yaml` and `cluster_role.yaml` files. Replace the `` with the namespace the Redis Enterprise cluster (REC) resides in. + + `operator_cluster_role.yaml` example: + +{{}} + + `operator_cluster_role_binding.yaml` example: + +{{}} + +2. Apply the files. + + ```sh + kubectl apply -f operator_cluster_role.yaml + kubectl apply -f operator_cluster_role_binding.yaml + ``` + +3. Patch the ConfigMap in the REC namespace (``) to identify the managed namespaces with your label (``). + + ```sh + kubectl patch ConfigMap/operator-environment-config \ + -n \ + --type merge \ + -p '{"data": {"REDB_NAMESPACES_LABEL": ""}}' + ``` + +4. For each managed namespace, apply the same label. Replace `` with the namespace the REC will manage. Replace `` with the value used in the previous step. If you specify a value for ``, both the label name and value in managed namespaces must match to be detected by the operator. If the `` is empty, only the label name needs to match on managed namespaces and the value is disregarded. + + + ```sh + kubectl label namespace = + ``` + +{{}} +The operator restarts when it detects a namespace label was added or removed. +{{}} + +### Method 2: Explicit namespace list + +Patch the `operator-environment-config` in the REC namespace with a new environment variable (`REDB_NAMESPACES`). + +```sh +kubectl patch ConfigMap/operator-environment-config \ +-n \ +--type merge \ +-p '{"data":{"REDB_NAMESPACES": "}}). +3. In your REAADB custom resource, specify the target consumer namespace using `metadata.namespace`. For each participating cluster, use the `namespace` field under `spec.participatingClusters` to indicate the namespace where the REAADB should be deployed. +4. If you are using a [global database secret]({{}}), deploy the secret in each consumer namespace. + +{{}} +Apply the REAADB object to only one Kubernetes cluster. Based on the specified participating clusters and namespaces, the operator automatically creates the necessary resources in the other clusters. +{{}} + +For example: + +```yaml +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseActiveActiveDatabase +metadata: + name: consumer-reaadb + namespace: consumer-namespace-main +spec: + participatingClusters: + - name: participating-cluster-main + - name: participating-cluster-peer + namespace: consumer-namespace-peer + globalConfigurations: + +``` + +{{}} +Configure the operator to watch a namespace only after the namespace exists and the required `Role` and `RoleBinding` resources have been applied. If the operator is configured to watch a namespace that lacks these permissions or does not exist, it will fail and halt normal operations. +{{}} diff --git a/content/operate/kubernetes/7.22/re-databases/_index.md b/content/operate/kubernetes/7.22/re-databases/_index.md new file mode 100644 index 0000000000..8895bad191 --- /dev/null +++ b/content/operate/kubernetes/7.22/re-databases/_index.md @@ -0,0 +1,57 @@ +--- +Title: Redis Enterprise databases (REDB) +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Create and manage Redis Enterprise databases (REDB) on Kubernetes using the Redis Enterprise operator. +hideListLinks: true +linkTitle: Redis Enterprise databases (REDB) +weight: 31 +url: '/operate/kubernetes/7.22/re-databases/' +--- + +A Redis Enterprise database (REDB) is a custom Kubernetes resource that represents a Redis database running on a Redis Enterprise cluster. The Redis Enterprise operator manages REDB resources and handles database creation, configuration, scaling, and lifecycle operations. + +REDB resources define database specifications including memory limits, persistence settings, security configurations, networking options, and Redis modules. You can deploy databases on existing Redis Enterprise clusters (REC) and manage them by using standard Kubernetes tools and workflows. + +## Database management + +Create and manage Redis Enterprise databases on your cluster: + +- [Database controller]({{< relref "/operate/kubernetes/7.22/re-databases/db-controller" >}}) - Understand how the database controller manages REDB resources and database lifecycle + +## Replication and high availability + +Set up database replication for high availability and disaster recovery: + +- [Create replica databases]({{< relref "/operate/kubernetes/7.22/re-databases/replica-redb" >}}) - Configure replica databases for read scaling and disaster recovery scenarios + +## Advanced database configurations + +Explore advanced database features and configurations: + +- [Active-Active databases]({{< relref "/operate/kubernetes/7.22/active-active" >}}) - Set up globally distributed Active-Active databases across multiple Kubernetes clusters + +## Database connectivity + +Connect applications to your Redis Enterprise databases: + +- [Database connectivity]({{< relref "/operate/kubernetes/7.22/networking/database-connectivity" >}}) - Comprehensive guide to in-cluster and external database access, service discovery, and credentials management. +- [Networking]({{< relref "/operate/kubernetes/7.22/networking" >}}) - Configure ingress, routes, and service exposure for database access +- [Security]({{< relref "/operate/kubernetes/7.22/security" >}}) - Set up TLS, authentication, and access control for secure database connections + +## Monitoring and troubleshooting + +Monitor database performance and troubleshoot issues: + +- [Logs]({{< relref "/operate/kubernetes/7.22/logs" >}}) - Collect and analyze database logs for troubleshooting +- [Connect to Prometheus operator]({{< relref "/operate/kubernetes/7.22/re-clusters/connect-prometheus-operator" >}}) - Monitor database metrics with Prometheus + +## Related topics + +- [Redis Enterprise clusters (REC)]({{< relref "/operate/kubernetes/7.22/re-clusters" >}}) - Manage the underlying cluster infrastructure +- [REDB API reference]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_database_api" >}}) - Complete API specification for REDB resources +- [Active-Active database API]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_active_active_database_api" >}}) - API reference for Active-Active databases +- [Remote cluster API]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_remote_cluster_api" >}}) - API reference for remote cluster configurations diff --git a/content/operate/kubernetes/7.22/re-databases/db-controller.md b/content/operate/kubernetes/7.22/re-databases/db-controller.md new file mode 100644 index 0000000000..885bca7357 --- /dev/null +++ b/content/operate/kubernetes/7.22/re-databases/db-controller.md @@ -0,0 +1,121 @@ +--- +Title: Manage Redis Enterprise databases for Kubernetes +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: This section describes how the database controller provides the ability + to create, manage, and use databases via a database custom resource. +linkTitle: Manage databases +weight: 5 +url: '/operate/kubernetes/7.22/re-databases/db-controller/' +--- +## Redis Enterprise database (REDB) lifecycle + +A Redis Enterprise database (REDB) is created with a custom resource file. The custom resource defines the size, name, and other specifications for the REDB. The database is created when you apply the custom resource file. + +The database controller in Redis Enterprise for Kubernetes: + +- Discovers the custom resource +- Makes sure the REDB is created in the same namespace as the Redis Enterprise cluster (REC) +- Maintains consistency between the custom resource and the REDB + +The database controller recognizes the new custom resource and validates the specification. +If valid, the controller combines the values specified in +the custom resource with default values to create a full specification. It then uses this full specification to create the +database on the specified Redis Enterprise cluster (REC). + +Once the database is created, it is exposed with the same service mechanisms by the service rigger for the Redis Enterprise cluster. +If the database [custom resource is deleted]({{< relref "/operate/kubernetes/7.22/re-clusters/delete-custom-resources" >}}), the database and its services are deleted from the cluster. + +### Flexible deployment options + +Databases in multiple namespaces can be managed by the same operator. To learn more, see [Manage databases in multiple namespaces]({{}}). + +To learn more about designing a multi-namespace Redis Enterprise cluster, see [flexible deployment options]({{< relref "/operate/kubernetes/7.22/architecture/deployment-options" >}}). + +## Create a database + +Your Redis Enterprise database custom resource must be of the `kind: RedisEnterpriseDatabase` and have values for `name` and `memorySize`. All other values are optional and will be defaults if not specified. + +1. Create a file (in this example mydb.yaml) that contains your database custom resource. + + ```YAML + apiVersion: app.redislabs.com/v1alpha1 + kind: RedisEnterpriseDatabase + metadata: + name: mydb + spec: + memorySize: 1GB + ``` + + To create a REDB in a different namespace from your REC, you need to specify the cluster with `redisEnterpriseCluster` in the `spec` section of your RedisEnterpriseDatabase custom resource. + + ```YAML + redisEnterpriseCluster: + name: rec + ``` + +1. Apply the file in the namespace you want your database to be in. + + ```sh + kubectl apply -f mydb.yaml + ``` + +1. Check the status of your database. + + ```sh + kubectl get redb mydb -o jsonpath="{.status.status}" + ``` + + When the status is `active`, the database is ready to use. + +## Modify a database + +The custom resource defines the properties of the database. +To change the database, you can edit your original specification and apply the change or use `kubectl edit`. + +To modify the database: + +1. Edit the definition: + + ```sh + kubectl edit redb mydb + ``` + +1. Change the specification (only properties in `spec` section) and save the changes. + For more details, see [RedisEnterpriseDatabaseSpec](https://github.com/RedisLabs/redis-enterprise-k8s-docs/blob/master/redis_enterprise_database_api.md#redisenterprisedatabasespec) or [Options for Redis Enterprise databases]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_database_api" >}}). + +1. Monitor the status to see when the changes take effect: + + ```sh + kubectl get redb mydb -o jsonpath="{.status.status}" + ``` + + When the status is `active`, the database is ready for use. + +## Delete a database + +The database exists as long as the custom resource exists. +If you delete the custom resource, the database controller deletes the database. +The database controller removes the database and its services from the cluster. + +To delete a database, run: + +```sh +kubectl delete redb mydb +``` + +## Connect to a database + +After the database controller creates a database, services for accessing the database are automatically created in the same namespace. Connection information is stored in a Kubernetes [secret](https://kubernetes.io/docs/concepts/configuration/secret/) maintained by the database controller. + +For comprehensive information about connecting to your database, including: + +- Service types and access patterns +- Retrieving connection information from secrets +- In-cluster and external access methods +- Connection examples and troubleshooting + +See [Database connectivity]({{< relref "/operate/kubernetes/7.22/networking/database-connectivity" >}}). diff --git a/content/operate/kubernetes/7.22/re-databases/modules.md b/content/operate/kubernetes/7.22/re-databases/modules.md new file mode 100644 index 0000000000..34950d0fd4 --- /dev/null +++ b/content/operate/kubernetes/7.22/re-databases/modules.md @@ -0,0 +1,103 @@ +--- +Title: Configure modules +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Deploy Redis Enterprise databases with modules using the Redis Enterprise operator for Kubernetes. +linkTitle: Configure modules +weight: 15 +url: '/operate/kubernetes/7.22/re-databases/modules/' +--- + +Redis Enterprise modules extend Redis functionality with additional data types, commands, and capabilities. The Redis Enterprise operator supports deploying databases with modules through the `RedisEnterpriseDatabase` (REDB) and `RedisEnterpriseActiveActiveDatabase` (REAADB) custom resources. + +## Prerequisites + +Before you begin, verify that you have: + +- [Redis Enterprise operator deployed]({{< relref "/operate/kubernetes/7.22/deployment/quick-start" >}}) in your Kubernetes cluster +- [Redis Enterprise Cluster (REC)]({{< relref "/operate/kubernetes/7.22/re-clusters" >}}) running and in a healthy state +- Modules uploaded to the Redis Enterprise cluster (see [Check available modules](#check-available-modules)) + +## Available modules + +Redis Enterprise includes several built-in modules: + +| Module | Name | Description | +|--------|------|-------------| +| **[RediSearch]({{< relref "/develop/ai/search-and-query/" >}})** | `search` | Full-text search and secondary indexing | +| **[RedisJSON]({{< relref "/develop/data-types/json" >}})** | `ReJSON` | JSON data type support | +| **[RedisTimeSeries]({{< relref "/develop/data-types/timeseries" >}})** | `timeseries` | Time series data structures | +| **[RedisBloom]({{< relref "/develop/data-types/probabilistic" >}})** | `bf` | Probabilistic data structures (Bloom filters, etc.) | + +### Check available modules + +Before configuring databases with modules, check which modules are available in your cluster: + +```bash +kubectl get rec -o jsonpath='{.status.modules}' | jq +``` + +This command shows the modules installed in the cluster along with their available versions. + +{{< note >}} +Use the `NAME` field instead of the `DISPLAY_NAME` field when configuring databases with modules. +{{< /note >}} + +## Install additional modules + +If you need to install additional modules or specific versions, upload them using the Redis Enterprise API. See [Upload module v2]({{< relref "/operate/rs/references/rest-api/requests/modules/#post-module-v2" >}}) for more information. + +## Module configuration + +Each module in the [`modulesList`]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_database_api#specmoduleslist" >}}) supports the following fields: + +- **name** (required): The module name (for example, "search", "ReJSON") +- **version** (optional): Specific module version. For Active-Active databases, if specified for one participating cluster, it must be specified for all participating clusters. If omitted, modules will auto-update. +- **config** (optional): Module-specific configuration parameters + +For detailed module configuration options and parameters, see [Redis modules]({{< relref "/develop/reference/modules" >}}). + +## Upgrade considerations + +When upgrading Redis Enterprise clusters or the operator with modules, follow these guidelines: + +#### Pre-upgrade planning + +- **Check module compatibility**: Verify that your current module versions are compatible with the target Redis Enterprise version. Check each module's [`min_redis_version`](https://redis.io/docs/latest/operate/rs/references/rest-api/objects/module/) requirement. +- **Review module dependencies**: Some modules may have specific version requirements or dependencies +- **Document current configurations**: Record all module versions and configurations before upgrading +- **Test in non-production**: Always test module upgrades in a development or staging environment first + +#### Module version management during upgrades + +- **Upload required modules**: Ensure all necessary module versions are uploaded to the cluster before upgrading +- **Version consistency**: For Active-Active databases, ensure module versions are consistent across all participating clusters. If you specify a version for one cluster, specify the same version for all clusters. Omit versions to allow auto-updates. +- **Compatibility requirements**: Consult the Redis Enterprise documentation for module compatibility matrices and verify each module's [`min_redis_version`](https://redis.io/docs/latest/operate/rs/references/rest-api/objects/module/) requirement + +#### Upgrade sequence + +1. **Upload new module versions** (if required) to the cluster before upgrading Redis Enterprise +2. **Upgrade the Redis Enterprise cluster** following standard upgrade procedures +3. **Verify module functionality** after the cluster upgrade completes +4. **Update database configurations** if new module versions require configuration changes + +#### Post-upgrade verification + +- **Check module status**: Verify all modules are loaded correctly: `kubectl get rec -o jsonpath='{.status.modules}'` +- **Test module functionality**: Validate that module-specific commands and features work as expected +- **Monitor performance**: Watch for any performance changes after the upgrade +- **Update documentation**: Record the new module versions and any configuration changes + +For detailed upgrade procedures, see [Upgrade Redis Enterprise clusters]({{< relref "/operate/kubernetes/7.22/upgrade/upgrade-redis-cluster" >}}). + +## Related information + +- [Database controller]({{< relref "/operate/kubernetes/7.22/re-databases/db-controller" >}}) - Learn how to create and manage Redis Enterprise databases +- [Active-Active databases]({{< relref "/operate/kubernetes/7.22/active-active" >}}) - Set up globally distributed Active-Active databases +- [Database connectivity]({{< relref "/operate/kubernetes/7.22/networking/database-connectivity" >}}) - Connect applications to your Redis Enterprise databases +- [REDB API reference]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_database_api" >}}) - Complete API specification for REDB resources +- [REAADB API reference]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_active_active_database_api" >}}) - API reference for Active-Active databases +- [Redis modules documentation](https://redis.io/docs/latest/develop/reference/modules/) - Official Redis modules documentation diff --git a/content/operate/kubernetes/7.22/re-databases/replica-redb.md b/content/operate/kubernetes/7.22/re-databases/replica-redb.md new file mode 100644 index 0000000000..796d72210c --- /dev/null +++ b/content/operate/kubernetes/7.22/re-databases/replica-redb.md @@ -0,0 +1,255 @@ +--- +Title: Create replica databases on Kubernetes +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: How to create and automate database replicas using the database controller +linkTitle: Create replica databases +weight: 42 +url: '/operate/kubernetes/7.22/re-databases/replica-redb/' +--- + +You can configure a replica of a database by creating an item in +the [`replicaSources`]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_database_api#specreplicasources" >}}) section of the RedisEnterpriseDatabase (REDB) custom resource. + +A secret must be created with the `stringData` section containing the replica source URI as follows: + +Create a secret with the replica source URI listed in the `stringData` field as follows: + +```yaml +apiVersion: v1 +kind: Secret +metadata: + name: my-replica-source +stringData: + uri: +``` + +The replica source URL can be retrieved by going to "UI > database > configuration > Press the button Get Replica of source URL" +in the administrative UI. But, this information can also be retrieved directly from +the REST API as well. + +A replica of database CR simply uses the secret in the `replicaSources` section: + +```yaml +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseDatabase +metadata: + name: name-of-replica +spec: + redisEnterpriseCluster: + name: name-of-cluster + replicaSources: + - replicaSourceType: SECRET + replicaSourceName: my-replica-source +``` + +In the above, `name-of-replica` database will be created as a replica of the +source database as long as the source database exists on the source cluster +and the secret contains the correct replica source URL for that database. + +## Retrieving the replica source URL via kubectl + +You will need `kubectl`, `curl`, and `jq` installed for this procedure. + +1. Set your metadata: + + ```js + CLUSTER_NAME=test + SOURCE_DB=db1 + TARGET_DB=db2 + TARGET_CLUSTER_NAME=test + ``` + +1. Retrieve the cluster authentication: + + ```js + CLUSTER_USER=`kubectl get secret/${CLUSTER_NAME} -o json | jq -r .data.username | base64 -d` + CLUSTER_PASSWORD=`kubectl get secret/${CLUSTER_NAME} -o json | jq -r .data.password | base64 -d` + ``` + +1. Forward the port of the REST API service for your source cluster: + + ```sh + kubectl port-forward pod/${CLUSTER_NAME}-0 9443 + ``` + +1. Request the information from the REST API: + + ```js + JQ='.[] | select(.name=="' + JQ+="${SOURCE_DB}" + JQ+='") | ("redis://admin:" + .authentication_admin_pass + "@"+.name+":"+(.endpoints[0].port|tostring))' + URI=`curl -sf -k -u "$CLUSTER_USER:$CLUSTER_PASSWORD" "https://localhost:9443/v1/bdbs?fields=uid,name,endpoints,authentication_admin_pass" | jq "$JQ" | sed 's/"//g'` + ``` + + Note: URI now contains the replica source URI. + +1. Construct the secret for the replica: + + ```yaml + cat << EOF > secret.yaml + apiVersion: v1 + kind: Secret + metadata: + name: ${SOURCE_DB}-url + stringData: + uri: ${URI} + EOF + kubectl apply -f secret.yaml + ``` + +1. Create the replica database: + + ```yaml + cat << EOF > target.yaml + apiVersion: app.redislabs.com/v1alpha1 + kind: RedisEnterpriseDatabase + metadata: + name: ${TARGET_DB} + spec: + redisEnterpriseCluster: + name: ${TARGET_CLUSTER_NAME} + replicaSources: + - replicaSourceType: SECRET + replicaSourceName: ${SOURCE_DB}-url + EOF + kubectl apply -f target.yaml + ``` + +## Automating the creation via a job + +The following procedure uses a ConfigMap and a Job to construct the replica +source URL secret from the source database and configure the target database. + +There are four parameters: + +- `source` - the name of the source database +- `cluster` - the name of the cluster for the source database +- `target` - the name of the target database +- `targetCluster` - the name of the cluster for the target database + +These parameters can be set by: + +```sh +kubectl create configmap replica-of-database-parameters \ +--from-literal=source=name-of-source \ +--from-literal=cluster=name-of-cluster \ +--from-literal=target=name-of-target \ +--from-literal=targetCluster=name-of-cluster +``` + +where "name-of-..." is replaced with the database source, source cluster, +database target, and target cluster names. + +The Job and ConfigMap below, when submitted, will create the secret and +replica database: + +```yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: replica-of-database +spec: + backoffLimit: 4 + template: + spec: + serviceAccountName: redis-enterprise-operator + restartPolicy: Never + volumes: + - name: scripts + configMap: + name: replica-of-database + containers: + - name: createdb + image: debian:stable-slim + env: + - name: MY_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: SCRIPT + value: create.sh + - name: SOURCE_DB + valueFrom: + configMapKeyRef: + name: replica-of-database-parameters + key: source + - name: TARGET_DB + valueFrom: + configMapKeyRef: + name: replica-of-database-parameters + key: target + - name: CLUSTER_SERVICE + value: .svc.cluster.local + - name: CLUSTER_NAME + valueFrom: + configMapKeyRef: + name: replica-of-database-parameters + key: cluster + - name: CLUSTER_PORT + value: "9443" + - name: TARGET_CLUSTER_NAME + valueFrom: + configMapKeyRef: + name: replica-of-database-parameters + key: targetCluster + volumeMounts: + - mountPath: /opt/scripts/ + name: scripts + command: + - /bin/bash + - -c + - | + apt-get update; apt-get install -y curl jq apt-transport-https gnupg2 + apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 6A030B21BA07F4FB + curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add - + echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" | tee -a /etc/apt/sources.list.d/kubernetes.list + apt-get update + apt-get install -y kubectl + bash /opt/scripts/$SCRIPT +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: replica-of-database +data: + create.sh: | + CLUSTER_USER=`kubectl get secret/${CLUSTER_NAME} -o json | jq -r .data.username | base64 -d` + CLUSTER_PASSWORD=`kubectl get secret/${CLUSTER_NAME} -o json | jq -r .data.password | base64 -d` + CLUSTER_HOST=${CLUSTER_NAME}.${MY_NAMESPACE}${CLUSTER_SERVICE} + JQ='.[] | select(.name=="' + JQ+="${SOURCE_DB}" + JQ+='") | ("redis://admin:" + .authentication_admin_pass + "@"+.endpoints[0].dns_name+":"+(.endpoints[0].port|tostring))' + URI=`curl -sf -k -u "$CLUSTER_USER:$CLUSTER_PASSWORD" "https://${CLUSTER_HOST}:${CLUSTER_PORT}/v1/bdbs?fields=uid,name,endpoints,authentication_admin_pass" | jq "$JQ" | sed 's/"//g'` + echo "URL: ${URL}" + echo "" + cat << EOF > /tmp/secret.yaml + apiVersion: v1 + kind: Secret + metadata: + name: ${SOURCE_DB}-url + stringData: + uri: ${URI} + EOF + cat /tmp/secret.yaml + cat << EOF > /tmp/target.yaml + apiVersion: app.redislabs.com/v1alpha1 + kind: RedisEnterpriseDatabase + metadata: + name: ${TARGET_DB} + spec: + redisEnterpriseCluster: + name: ${TARGET_CLUSTER_NAME} + replicaSources: + - replicaSourceType: SECRET + replicaSourceName: ${SOURCE_DB}-url + EOF + echo "---" + cat /tmp/target.yaml + echo "" + kubectl -n ${MY_NAMESPACE} apply -f /tmp/secret.yaml + kubectl -n ${MY_NAMESPACE} apply -f /tmp/target.yaml +``` diff --git a/content/operate/kubernetes/7.22/recommendations/_index.md b/content/operate/kubernetes/7.22/recommendations/_index.md new file mode 100644 index 0000000000..c9ec9e4ace --- /dev/null +++ b/content/operate/kubernetes/7.22/recommendations/_index.md @@ -0,0 +1,34 @@ +--- +Title: Configuration recommendations +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Best practices and configuration recommendations for Redis Enterprise on Kubernetes deployments. +hideListLinks: false +linkTitle: Recommendations +weight: 80 +url: '/operate/kubernetes/7.22/recommendations/' +--- + +Follow these best practices and configuration recommendations to optimize your Redis Enterprise deployment on Kubernetes for performance, reliability, and scalability. + +## Infrastructure recommendations + +Configure your Kubernetes infrastructure for optimal Redis Enterprise performance: + +- [Node resources]({{< relref "/operate/kubernetes/7.22/recommendations/node-resources" >}}) - CPU, memory, and resource allocation recommendations +- [Node selection]({{< relref "/operate/kubernetes/7.22/recommendations/node-selection" >}}) - Best practices for selecting and configuring Kubernetes nodes +- [Persistent volumes]({{< relref "/operate/kubernetes/7.22/recommendations/persistent-volumes" >}}) - Storage configuration and persistent volume recommendations + +## Deployment recommendations + +Optimize your Redis Enterprise deployment configuration: + +- [Sizing on Kubernetes]({{< relref "/operate/kubernetes/7.22/recommendations/sizing-on-kubernetes" >}}) - Guidelines for sizing clusters and databases +- [Pod stability]({{< relref "/operate/kubernetes/7.22/recommendations/pod-stability" >}}) - Ensure stable pod operations and prevent disruptions + +## Performance optimization + +Configure your deployment for optimal performance and reliability based on your workload requirements and infrastructure capabilities. diff --git a/content/operate/kubernetes/7.22/recommendations/node-resources.md b/content/operate/kubernetes/7.22/recommendations/node-resources.md new file mode 100644 index 0000000000..f3fb9c2d1a --- /dev/null +++ b/content/operate/kubernetes/7.22/recommendations/node-resources.md @@ -0,0 +1,61 @@ +--- +Title: Manage node resources +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Recommendations on managing node resources and setting eviction thresholds + with Redis Enterprise for Kubernetes. +linktitle: Manage resources +weight: 17 +url: '/operate/kubernetes/7.22/recommendations/node-resources/' +--- + + + +## Node eviction thresholds + + Kubernetes uses [node-pressure eviction](https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/) to terminate pods and free up node resources. Redis Enterprise for Kubernetes works best when you use the recommendations below. + +Eviction thresholds are managed by [kubelet arguments](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/). + +Redis recommends setting a high [soft eviction threshold](https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#soft-eviction-thresholds). This changes the node condition early enough to alert the administrator. + +We also recommend setting the [`eviction-soft-grace-period`](https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#soft-eviction-thresholds) high enough for the administrator to scale the cluster. + +For more information about configuring eviction thresholds on specific platforms, see [Freeing node resources](https://docs.openshift.com/container-platform/4.9/nodes/nodes/nodes-nodes-garbage-collection.html) for OpenShift or [Cluster architecture](https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-architecture#node_allocatable) for GKE. + +### Monitor node conditions + +Redis recommends monitoring the node conditions. If both `MemoryPressure` and `DiskPressure` are true, the eviction threshold was met. + +```sh +> kubectl get nodes -o jsonpath='{range .items[*]}name:{.metadata.name}{"\t"}MemoryPressure:{.status.conditions[?(@.type == "MemoryPressure")].status}{"\t"}DiskPressure:{.status.conditions[?(@.type == "DiskPressure")].status}{"\n"}{end}' +name:gke-55d1ac88-213c MemoryPressure:False DiskPressure:False +name:gke-55d1ac88-vrpp MemoryPressure:False DiskPressure:False +name:gke-7253cc19-42g0 MemoryPressure:False DiskPressure:False +``` + +For more information about monitoring node conditions, see [Node conditions](https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#node-conditions) on [kubernetes.io](https://kubernetes.io/docs/home/). + +## Resource quotas + +Kubernetes uses the `ResourceQuota` object to limit resource consumption per namespace. This lets you limit the number of objects created by a namespace or the amount of compute resources consumed by a namespace. + +The resource settings for Redis Enterprise for Kubernetes are defined in the `operator.yaml` and the [`RedisEnterpriseCluster`](https://github.com/RedisLabs/redis-enterprise-k8s-docs/blob/master/redis_enterprise_cluster_api.md#redisenterpriseclusterspec) custom resource. + +The following settings are the minimum workloads for the operator to function. + +```yaml + resources: + limits: + cpu: 0.5 + memory: 256Mi + requests: + cpu: 0.5 + memory: 256Mi +``` +For more details on using resource quotas, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/policy/resource-quotas/). + + diff --git a/content/operate/kubernetes/7.22/recommendations/node-selection.md b/content/operate/kubernetes/7.22/recommendations/node-selection.md new file mode 100644 index 0000000000..0cb66930da --- /dev/null +++ b/content/operate/kubernetes/7.22/recommendations/node-selection.md @@ -0,0 +1,250 @@ +--- +Title: Control node selection +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: This section provides information about how Redis Enterprise cluster + pods can be scheduled to only be placed on specific nodes or node pools. +linkTitle: Node selection +weight: 80 +url: '/operate/kubernetes/7.22/recommendations/node-selection/' +--- + +Kubernetes clusters often include nodes with different CPU and memory profiles. You control where Redis Enterprise cluster (REC) pods run by setting fields in the REC custom resource (CRD). + +A Redis Enterprise cluster (REC) runs as a StatefulSet. The Kubernetes scheduler assigns nodes when you create or resize the cluster, or when a pod restarts. + +Use these options to control pod placement: + +## Use node selectors + +The [`nodeSelector`]({{}}) field matches the Kubernetes [`nodeSelector`](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) syntax. +Label the nodes you want to target. For example, if nodes 'n1' and 'n2' are labeled with `memory=high`: + +```sh +kubectl label nodes n1 memory=high +kubectl label nodes n2 memory=high +``` + +The Redis Enterprise cluster CRD can request to be scheduled on these nodes: + +```yaml +apiVersion: app.redislabs.com/v1 +kind: RedisEnterpriseCluster +metadata: + name: rec +spec: + nodes: 3 + nodeSelector: + memory: high +``` + +The operator copies [`nodeSelector`]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api#spec" >}}) into the pod spec. The scheduler places pods only on nodes that match the selector. + +## Use node pools + +Node pools group similar nodes. Providers label nodes by pool. + +Use [`nodeSelector`]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api#spec" >}}) to target a pool by label. For example, on GKE: + +```yaml +apiVersion: app.redislabs.com/v1 +kind: RedisEnterpriseCluster +metadata: + name: rec +spec: + nodes: 3 + nodeSelector: + cloud.google.com/gke-nodepool: 'high-memory' +``` + +### Provider resources + +Cloud providers label nodes by pool. See links below for specific documentation. + +- GKE: + - [Create and manage cluster and node pool labels](https://cloud.google.com/kubernetes-engine/docs/how-to/creating-managing-labels) + - [Update node labels and taints for existing node pools](https://cloud.google.com/kubernetes-engine/docs/how-to/update-existing-nodepools) +- AKS: + - [Use labels in an AKS cluster](https://learn.microsoft.com/en-us/azure/aks/use-labels) + - [Manage node pools in AKS](https://learn.microsoft.com/en-us/azure/aks/manage-node-pools) +- EKS: + - [Create a managed node group with labels (AWS CLI)](https://docs.aws.amazon.com/cli/latest/reference/eks/create-nodegroup.html) + - [Update a managed node group to add labels (AWS CLI)](https://docs.aws.amazon.com/cli/latest/reference/eks/update-nodegroup-config.html) + + +## Use node taints + +Use node taints and pod tolerations to control REC pod scheduling. Set tolerations with [`spec.podTolerations`]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api#specpodtolerations" >}}) (standard [Kubernetes tolerations](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/#concepts)). + +Example: on a single node pool, reserve nodes n1–n3 for REC by adding taints: + +```sh +kubectl taint nodes n1 db=rec:NoSchedule +kubectl taint nodes n2 db=rec:NoSchedule +kubectl taint nodes n3 db=rec:NoSchedule +``` + +This blocks pods unless they tolerate the `db=rec` taint. + +Then add a matching toleration to the REC: + +```yaml +apiVersion: app.redislabs.com/v1 +kind: RedisEnterpriseCluster +metadata: + name: rec +spec: + nodes: 3 + podTolerations: + - key: db + operator: Equal + value: rec + effect: NoSchedule +``` + +A set of taints can also handle more complex use cases. +For example, a `role=test` or `role=dev` taint can be used to designate a node as dedicated for testing or development workloads via pod tolerations. + +## Use pod anti-affinity + +By default, REC node pods are not scheduled on the same node within the same cluster: + +```yaml +podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + app: redis-enterprise + redis.io/cluster: rec + redis.io/role: node + topologyKey: kubernetes.io/hostname +``` + +Each pod has these labels. `redis.io/cluster` is your cluster name. + +Modify this rule to widen or narrow placement. For example, remove the `redis.io/cluster` label to prevent pods from different clusters from sharing a node: + +```yaml +apiVersion: app.redislabs.com/v1 +kind: RedisEnterpriseCluster +metadata: + name: rec +spec: + nodes: 3 + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + app: redis-enterprise + redis.io/role: node + topologyKey: kubernetes.io/hostname +``` + +To avoid co-locating with other database workloads, label those pods `local/role: database` and add anti-affinity to keep one database per node: + +```yaml +apiVersion: app.redislabs.com/v1 +kind: RedisEnterpriseCluster +metadata: + name: rec +spec: + nodes: 3 + extraLabels: + local/role: database + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + local/role: database + app: redis-enterprise + redis.io/cluster: rec + redis.io/role: node + topologyKey: kubernetes.io/hostname +``` + +Kubernetes will not schedule two pods with label `local/role: database` on the same node. + +## Enable rack awareness + +Enable rack-zone awareness to improve availability during rack or zone failures. + +{{%note%}}When creating your rack-zone ID, there are some constraints to consider; see [rack-zone awareness]({{< relref "/operate/rs/clusters/configure/rack-zone-awareness#rack-zone-id-rules" >}}) for more info. {{%/note%}} + +Configure it with [`spec.rackAwarenessNodeLabel`]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api#spec" >}}) in the REC. + +### Choose a node label + +The most common label used for rack-zone awareness is topology.kubernetes.io/zone, a standard Kubernetes label that shows the zone a node runs in. Many Kubernetes platforms add this label to nodes by default, as noted in the [Kubernetes documentation](https://kubernetes.io/docs/setup/best-practices/multiple-zones/#nodes-are-labeled). + +If your platform doesn’t set this label automatically, you can use any custom label that describes the node’s topology (such as rack, zone, or region). + +### Label all eligible nodes + +{{< warning >}} +All eligible nodes **must** have the label for rack awareness to work. The operator requires every node that might run Redis Enterprise pods to be labeled. If any nodes are missing the label, reconciliation fails. +{{< /warning >}} + +Eligible nodes are nodes where REC pods can run. By default, this means all worker nodes. You can limit eligibility with [`spec.nodeSelector`]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api#spec" >}}). + +Give each eligible node a label value that reflects its rack, zone, or region. + +Check node label values: + +```sh +kubectl get nodes -o custom-columns="name:metadata.name","rack\\zone:metadata.labels.topology\.kubernetes\.io/zone" + +name rack\zone +ip-10-0-x-a.eu-central-1.compute.internal eu-central-1a +ip-10-0-x-b.eu-central-1.compute.internal eu-central-1a +ip-10-0-x-c.eu-central-1.compute.internal eu-central-1b +ip-10-0-x-d.eu-central-1.compute.internal eu-central-1b +``` + +### Enable the cluster role + +Grant the operator read access to node labels with a ClusterRole and ClusterRoleBinding. + +ClusterRole: + +{{}} + +Bind to the `redis-enterprise-operator` service account: + +{{}} + +Apply these files with `kubectl apply`. For example: + +```sh +kubectl apply -f rack-aware-cluster-role.yaml +kubectl apply -f rack-aware-cluster-role-binding.yaml +``` + +After you apply the role and binding, you can configure rack awareness. + +### Configure rack awareness + +Set [`spec.rackAwarenessNodeLabel`]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api#spec" >}}) to the node label to use: + +{{}} + +{{< note >}} +When you set [`spec.rackAwarenessNodeLabel`]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api#spec" >}}), the operator sets the anti-affinity `topologyKey` to that label unless you define [`spec.podAntiAffinity`]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api#specpodantiaffinity" >}}). If you define both, make sure `topologyKey` matches your node label. +{{< /note >}} + +### Rack awareness limitations + +{{< warning >}} +**Pod restart distribution maintenance**: When rack awareness is enabled, node pods and shards are initially deployed based on rack constraints to ensure proper distribution across zones. However, Redis Enterprise does not automatically maintain this distribution when node pods are restarted. + +After pod restarts, the rack awareness policy may be violated, requiring manual intervention to restore proper shard distribution. While Redis Enterprise provides tools to identify shards that need to be moved to restore correct rack distribution, it does not provide automated orchestration to perform these moves. +{{< /warning >}} + +**Important considerations for production deployments:** + +- At scale, manual shard redistribution can become operationally challenging +- This limitation is particularly important for edge deployments where automated recovery is preferred +- Plan for operational procedures to handle rack awareness policy violations after pod restarts +- Consider monitoring tools to detect when rack awareness constraints are violated diff --git a/content/operate/kubernetes/7.22/recommendations/persistent-volumes.md b/content/operate/kubernetes/7.22/recommendations/persistent-volumes.md new file mode 100644 index 0000000000..a1b5f35fad --- /dev/null +++ b/content/operate/kubernetes/7.22/recommendations/persistent-volumes.md @@ -0,0 +1,108 @@ +--- +Title: Use persistent volumes in Redis Enterprise clusters +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: This section covers details about how persistent volumes are sized and + specified for Redis Enterprise cluster deployments. +linkTitle: Persistent volumes +weight: 40 +url: '/operate/kubernetes/7.22/recommendations/persistent-volumes/' +--- +## Storage types + +Redis Enterprise for Kubernetes can only use storage classes supported by block storage. Block storage is mounted at the Kubernetes node level and utilizes EXT4 or XFS file systems. It can be sourced from enterprise-grade SANs or cloud environments such as EBS, Azure Managed Disks, or GCP persistent disks. + +{{}} +NFS, NFS-like, and multi-read-write/shared storage options are not supported. These types of storage are often slow and can cause locking behaviors that are incompatible with the requirements of database storage. +{{}} + +## REC `persistentSpec` field +To deploy a Redis Enterprise cluster with Redis Enterprise operator the +spec should include a *persistentSpec* section, in the +*redis-enterprise-cluster.yaml* file: + + spec: + nodes: 3 + persistentSpec: + enabled: true + storageClassName: "standard" + volumeSize: "23Gi" #optional + +Persistence storage is a requirement for production deployments. + +{{< note >}} +For **production deployments** of Redis Enterprise Cluster on Kubernetes, +the Redis Enterprise Cluster (REC) must be deployed with persistence enabled. +The REC deployment files in the [Kubernetes documentation](https://github.com/RedisLabs/redis-enterprise-k8s-docs) contain this declaration by default. +{{< /note >}} + +## Volume size + +*volumeSize* is an optional definition. By default, if the definition is +omitted, operator allocates five times (5x) the amount of memory (RAM) +defined for nodes (see example below), which is the recommended +persistent storage size as described in the [Hardware +requirements]({{< relref "/operate/rs/installing-upgrading/install/plan-deployment/hardware-requirements" >}}) article. + +To explicitly specify the persistent storage size, use the *volumeSize* +property as described in the example above. + +Persistent volume claims can be expanded, but not reduced after creation. See [Expand PersistentVolumeClaim (PVC)]({{}}) for details. + +{{< note >}} +We recommend that you omit the volumeSize definition from the REC declaration +so that the Redis Enterprise Cluster deployment on Kubernetes use the default volume size. +{{< /note >}} + +## Storage class name + +*storageClassName* determines the Storage Class resource, which is +defined by the Kubernetes cluster administrator, to be used for +persistent storage. + +Different Kubernetes distributions and different deployments use +different Storage Class resources. + +In order to determine the Storage Class resources available for your K8s +deployment, use the following command: + + kubectl get StorageClass + +Typically, AWS provides "gp2" as the Storage Class name while GKE uses "standard." +Azure provides two Storage Classes: "default" using HDDs, and "managed-premium" using SSDs. + +Below is an example of a response to the command. + +| | | +| ----------------------- | ------------------------------------------------------- | +| *Name:* | *gp2* | +| *IsDefaultClass:* | *Yes* | +| *Annotations:* | *storageclass.beta.kubernetes.io/is-default-class=true* | +| *Provisioner:* | *kubernetes.io/aws-ebs* | +| *Parameters:* | *encrypted=false,kmsKeyId=,type=gp2* | +| *AllowVolumeExpansion:* | *\* | +| *MountOptions:* | *\* | +| *ReclaimPolicy:* | *Delete* | +| *VolumeBindingMode:* | *Immediate* | +| *Events:* | *\* | + +{{< note >}} +storageClassName must be specified for this deployment type. +{{< /note >}} + +{{< warning >}} +The storage class cannot be changed after deployment. Trying to change this value after deployment could result in unexpected and potentially damaging behavior. +{{< /warning >}} + +Example of the redisEnterpriseNodeResources definition: + + redisEnterpriseNodeResources: + limits: + cpu: "4000m" + memory: 4Gi + requests: + cpu: "4000m" + memory: 4Gi diff --git a/content/operate/kubernetes/7.22/recommendations/pod-stability.md b/content/operate/kubernetes/7.22/recommendations/pod-stability.md new file mode 100644 index 0000000000..1da42ce75d --- /dev/null +++ b/content/operate/kubernetes/7.22/recommendations/pod-stability.md @@ -0,0 +1,115 @@ +--- +Title: Manage pod stability +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: This section provides information about how you can use quality of service, + priority class, eviction thresholds and resource monitoring to maintain cluster + node pod stability. +linkTitle: Pod stability +weight: 90 +url: '/operate/kubernetes/7.22/recommendations/pod-stability/' +--- + +Kubernetes clusters manage the allocation of system resources and can evict pods to release system resources. +Here are some ways that you can configure the Redis Enterprise node pods to maintain pod stability: + +## Guaranteed quality of service + +A running pod has a quality of service measure assigned to it that is +one of three [quality of service classes](https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/): +Guaranteed, Burstable, and Best Effort. +You can assure the Guaranteed class is assigned to the Redis Enterprise node pods +by following the right guidelines. + +To get a Guaranteed quality of service class assigned: + + * Every container in the pod must have a memory limit and a memory request, and they must be the same. + * Every container in the pod must have a CPU limit and a CPU request, and they must be the same. + +If resources limits and requests are not specified in the Redis Enterprise CRD, +these requirements are met in the default version created by the operator. of your Redis Enterprise cluster CRD, +Otherwise, you must set the limits and requests to the same value for memory and CPU in the `redisEnterpriseNodeResources` +section of the CRD. + +Sidecar containers also impact the quality of service class assignment for the pod. + +To check the quality of service class of any running Redis Enterprise node pod, run: + +```sh +kubectl get pod rec-0 --o jsonpath="{.status.qosClass}" +``` + +where `rec-0` is the name of one of the pods associated with the Redis Enterprise cluster. + +## Using priority to protect from preemption + +When a Redis Enterprise node pod is scheduled, it can be assigned a +[priority class](https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/) +with the `priorityClassName` property. This property value is the name of +a priority class that must already exist within the cluster. + +A sufficiently high priority will prevent other workloads with a lower +priority from preempting the scheduling of Redis Enterprise Nodes. Similarly, +a high value may also prevent eviction when lower priority workloads +are deployed on the same cluster. + +The successful use of this strategy involves first creating a priority class with a very large priority value: + +```yaml +apiVersion: scheduling.k8s.io/v1 +kind: PriorityClass +metadata: + name: redis-enterprise-priority +value: 1000000000 +globalDefault: false +description: "This priority class should be used for Redis Enterprise pods only." +``` + +Then, you refer to the priority class by name in your Redis Enterprise cluster CRD: + +```yaml +apiVersion: app.redislabs.com/v1 +kind: RedisEnterpriseCluster +metadata: + name: example-redisenterprisecluster +spec: + size: 3 + priorityClassName: "redis-enterprise-priority" +``` + +Alternatively, you can also [disable preemption entirely](https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#how-to-disable-preemption). + +## Managing eviction thresholds + +Eviction thresholds are typically managed by kubelet arguments. +You can set the thresholds: + +- On OpenShift - In the [config file](https://docs.openshift.com/container-platform/3.11/admin_guide/out_of_resource_handling.html#out-of-resource-create-config). +- On GKE - In the [managed settings](https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-architecture#node_allocatable). + +We recommend that you: + + * Set the [soft eviction threshold](https://kubernetes.io/docs/tasks/administer-cluster/out-of-resource/#soft-eviction-thresholds) + to be higher than the [hard eviction threshold](https://kubernetes.io/docs/tasks/administer-cluster/out-of-resource/#hard-eviction-thresholds). + The high soft threshold makes the node condition change earlier, and alerts the administrator. + * Set `eviction-max-pod-grace-period` high enough to allow the RS pods to migrate the Redis databases before the pods are force killed. + * Set the `eviction-soft-grace-period` high enough that the administrator (or a k8s auto-scaling mechanism) scales k8s up or out. + +## Monitoring for memory and disk usage + +We recommend that you monitor the node for MemoryPressure and DiskPressure. +When both of these conditions are true, then an [eviction threshold](https://kubernetes.io/docs/tasks/administer-cluster/out-of-resource/#eviction-thresholds) +is met and the pod is evicted. + +To retrieve the flags, run the command: + +```sh +$kubectl get nodes -o jsonpath='{range .items[*]}name:{.metadata.name}{"\t"}MemoryPressure:{.status.conditions[?(@.type == "MemoryPressure")].status}{"\t"}DiskPressure:{.status.conditions[?(@.type == "DiskPressure")].status}{"\n"}{end}' + +name:gke-55d1ac88-213c MemoryPressure:False DiskPressure:False +name:gke-55d1ac88-vrpp MemoryPressure:False DiskPressure:False +name:gke-7253cc19-42g0 MemoryPressure:False DiskPressure:False +``` diff --git a/content/operate/kubernetes/7.22/recommendations/sizing-on-kubernetes.md b/content/operate/kubernetes/7.22/recommendations/sizing-on-kubernetes.md new file mode 100644 index 0000000000..cc9d4e54f8 --- /dev/null +++ b/content/operate/kubernetes/7.22/recommendations/sizing-on-kubernetes.md @@ -0,0 +1,121 @@ +--- +Title: Size and scale a Redis Enterprise cluster deployment on Kubernetes +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: This section provides information about sizing and scaling Redis Enterprise + in a Kubernetes deployment. +linkTitle: Sizing and scaling +weight: 50 +url: '/operate/kubernetes/7.22/recommendations/sizing-on-kubernetes/' +--- +The following article reviews the mechanism and methods available for sizing +and scaling a Redis Enterprise cluster deployment. + +For minimum and recommended sizing, always follow the sizing guidelines +detailed in the [Redis Enterprise hardware requirements]({{< relref "/operate/rs/installing-upgrading/install/plan-deployment/hardware-requirements" >}}). + +## Sizing and scaling cluster nodes + +### Setting the number of cluster nodes + +Define the number of cluster nodes in redis-enterprise-cluster.yaml file. + + spec: + + nodes: 3 + +The number of nodes in the cluster must be an uneven number +equal to or greater than 3. Refer to the article [Highly Available Redis](https://redislabs.com/redis-enterprise/technology/highly-available-redis/) +for a detailed explanation on this topic. + +Set the number of cluster nodes during deployment +by editing the redis-enterprise-cluster.yaml file and +applying the file by running: + + kubectl apply -f redis-enterprise-cluster.yaml + +### Scaling out + +To scale out a Redis Enterprise Cluster deployment, increase the number of nodes +in the spec. For example, to scale the cluster out from 3 nodes to 5 nodes, +edit the redis-enterprise-cluster.yaml file with the following: + + spec: + + nodes: 5 + +To apply the new cluster configuration run: + + kubectl apply -f redis-enterprise-cluster.yaml + +{{}} Decreasing the number of nodes is not supported.{{}} + +### Sizing compute resources + +To set the compute resources required for each node, +use the redisEnterpriseNodeResources spec field. + +Under redisEnterpriseNodeResources spec, set the following fields +according to the provided guidelines. + +- limits – specifies the maximum compute resources for a Redis node +- requests – specifies the minimum compute resources for a Redis node + +For example: + + redisEnterpriseNodeResources: + + limits: + + cpu: "2000m" + + memory: 4Gi + + requests: + + cpu: "2000m" + + memory: 4Gi + +The default values, if unspecified, are 2 cores (2000m) and 4GB (4Gi). + +Set the compute resources for cluster nodes during deployment +by editing the redis-enterprise-cluster.yaml file and +applying the file by running: + + kubectl apply -f redis-enterprise-cluster.yaml + +### Scaling up node compute resources + +To scale up nodes in an existing Redis Enterprise Cluster deployment, +adjust the cpu and memory parameters in the spec. For example, +to scale nodes up to the recommended amount of compute resources, +edit the redis-enterprise-cluster.yaml file with the following: + +redisEnterpriseNodeResources: + + limits: + + cpu: "8000m" + + memory: 30Gi + + requests + + cpu: "8000m" + + memory: 30Gi + +Then, apply the file by running: + + kubectl apply -f redis-enterprise-cluster.yaml + +{{< warning >}} +When adjusting compute resources, make sure the ratio of persistent volume size and the new memory size are in accordance to the [Hardware +requirements]({{< relref "/operate/rs/installing-upgrading/install/plan-deployment/hardware-requirements" >}}). + +Persistent volume claims can be expanded, but not reduced after creation. See [Expand PersistentVolumeClaim (PVC)]({{}}) for details. +{{< /warning >}} diff --git a/content/operate/kubernetes/7.22/reference/_index.md b/content/operate/kubernetes/7.22/reference/_index.md new file mode 100644 index 0000000000..e9e98ad7e0 --- /dev/null +++ b/content/operate/kubernetes/7.22/reference/_index.md @@ -0,0 +1,106 @@ +--- +Title: Reference +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Resources to help you manage Redis Enterprise custom resources on Kubernetes. +hideListLinks: true +linkTitle: Reference +weight: 89 +url: '/operate/kubernetes/7.22/reference/' +--- + +This reference documentation covers Redis Enterprise custom resources, API specifications, and practical instructions for creating, configuring, and managing Redis Enterprise deployments on Kubernetes. + +## Work with custom resources + +Redis Enterprise for Kubernetes uses custom resources to manage clusters and databases. Use standard Kubernetes tools to create, modify, and delete these resources. + +### Create custom resources + +Use `kubectl apply` with YAML manifests to create custom resources: + +```bash +kubectl apply -f my-redis-cluster.yaml +kubectl apply -f my-redis-database.yaml +``` + +### View custom resources + +Use these commands to list and inspect existing custom resources: + +```bash +# List Redis Enterprise clusters +kubectl get rec + +# List Redis Enterprise databases +kubectl get redb + +# List Active-Active databases +kubectl get reaadb + +# List remote clusters +kubectl get rerc + +# Get detailed information about a specific resource +kubectl describe rec my-cluster +kubectl describe redb my-database +``` + +### Modify custom resources + +Edit the YAML manifest and reapply to update custom resources: + +```bash +# Edit and apply updated manifest +kubectl apply -f updated-redis-cluster.yaml + +# Or edit directly (not recommended for production) +kubectl edit rec my-cluster +kubectl edit redb my-database +``` + +## YAML examples + +Find complete YAML examples for common deployment scenarios: + +- [YAML examples]({{< relref "/operate/kubernetes/7.22/reference/yaml" >}}) - Ready-to-use YAML configurations for different deployment types + +### Example categories + +- [Basic deployment]({{< relref "/operate/kubernetes/7.22/reference/yaml/basic-deployment" >}}) - Essential YAML files for simple Redis Enterprise deployment +- [Rack awareness]({{< relref "/operate/kubernetes/7.22/reference/yaml/rack-awareness" >}}) - YAML examples for rack-aware deployments across availability zones +- [Active-Active]({{< relref "/operate/kubernetes/7.22/reference/yaml/active-active" >}}) - YAML examples for Active-Active databases across multiple clusters +- [Multi-namespace]({{< relref "/operate/kubernetes/7.22/reference/yaml/multi-namespace" >}}) - YAML examples for deploying across multiple namespaces + +## API reference + +Review complete API specifications for all Redis Enterprise custom resources: + +### Core resources + +- [Redis Enterprise cluster API (REC)]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api" >}}) - Manage Redis Enterprise clusters +- [Redis Enterprise database API (REDB)]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_database_api" >}}) - Manage Redis databases + +### Active-Active resources + +- [Active-Active database API (REAADB)]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_active_active_database_api" >}}) - Manage Active-Active databases +- [Remote cluster API (RERC)]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_remote_cluster_api" >}}) - Configure remote cluster connections + +## Compatibility + +Check supported Kubernetes distributions and versions: + +- [Supported Kubernetes distributions]({{< relref "/operate/kubernetes/7.22/reference/supported_k8s_distributions" >}}) - Compatible Kubernetes platforms and versions + +## Best practices + +Follow these best practices when working with custom resources: + +- **Use version control**: Store your YAML manifests in version control systems +- **Validate before applying**: Use `kubectl apply --dry-run=client` to validate changes +- **Monitor resource status**: Check resource status after you apply changes +- **Follow naming conventions**: Use consistent naming for easier management +- **Document configurations**: Add annotations and labels to describe resource purpose \ No newline at end of file diff --git a/content/operate/kubernetes/7.22/reference/api/_index.md b/content/operate/kubernetes/7.22/reference/api/_index.md new file mode 100644 index 0000000000..70fa23cbb5 --- /dev/null +++ b/content/operate/kubernetes/7.22/reference/api/_index.md @@ -0,0 +1,57 @@ +--- +title: API reference +categories: +- docs +- operate +- kubernetes +linkTitle: API reference +description: Reference documentation for Redis Enterprise operator APIs +weight: 30 +alwaysopen: false +hideListLinks: true +aliases: +url: '/operate/kubernetes/7.22/reference/api/' +--- + +The Redis Enterprise operator provides Kubernetes custom resource definitions (CRDs) that let you manage Redis Enterprise clusters and databases declaratively. This section contains the complete API reference for all operator resources. + +## API versions and stability + +The operator uses different API versions to indicate stability and feature maturity: + +- **`app.redislabs.com/v1`** - Stable APIs for production use +- **`app.redislabs.com/v1alpha1`** - Alpha APIs that may change in future releases + +## Custom resources + +| Resource | API Version | Purpose | +|----------|-------------|---------| +| [RedisEnterpriseCluster (REC)](redis_enterprise_cluster_api) | `v1` | Manages Redis Enterprise cluster deployments | +| [RedisEnterpriseDatabase (REDB)](redis_enterprise_database_api) | `v1alpha1` | Creates and configures Redis databases | +| [RedisEnterpriseActiveActiveDatabase (REAADB)](redis_enterprise_active_active_database_api) | `v1alpha1` | Sets up active-active databases across clusters | +| [RedisEnterpriseRemoteCluster (RERC)](redis_enterprise_remote_cluster_api) | `v1alpha1` | Defines remote cluster connections for active-active | + +## Working with the APIs + +### Using kubectl + +Manage all resources using standard `kubectl` commands: + +```bash +# List all Redis Enterprise clusters +kubectl get rec + +# Get detailed information about a specific database +kubectl describe redb my-database + +# Apply a configuration from a YAML file +kubectl apply -f my-redis-config.yaml +``` + +### Resource relationships + +- Create a `RedisEnterpriseCluster` (REC) first to provide the Redis Enterprise infrastructure +- Create `RedisEnterpriseDatabase` (REDB) resources within a cluster to provision individual databases +- Use `RedisEnterpriseActiveActiveDatabase` (REAADB) with `RedisEnterpriseRemoteCluster (RERC)` resources to define participating clusters + +For complete YAML configuration examples, see the [YAML examples]({{< relref "/operate/kubernetes/7.22/reference/yaml/" >}}) section. diff --git a/content/operate/kubernetes/7.22/reference/api/kubernetes-api-reference-template.tmpl b/content/operate/kubernetes/7.22/reference/api/kubernetes-api-reference-template.tmpl new file mode 100644 index 0000000000..7a33c42c89 --- /dev/null +++ b/content/operate/kubernetes/7.22/reference/api/kubernetes-api-reference-template.tmpl @@ -0,0 +1,105 @@ +{{- $group:= index .Groups 0 -}} +{{- $kinds:= index $group.Kinds 0 -}} +{{- $resource := $kinds.Name -}} +{{- $title:= printf "%s %s" $kinds.Name "API Reference" -}} +--- +title: {{ $title }} +alwaysopen: false +categories: +- docs +- operate +- kubernetes +linkTitle: {{ $title }} +weight: 30 +url: '/operate/kubernetes/7.22/reference/api/kubernetes-api-reference-template.tmpl/' +--- + +apiVersion: +{{ $group:= index .Groups 0 }} + +- [{{$group.Group}}/{{$group.Version}}](#{{ anchorize (printf "%s/%s" $group.Group $group.Version) }}) + + +{{ $group:= index .Groups 0 }} + +# {{$group.Group}}/{{$group.Version}} + +{{range $group.Kinds}} +{{- $kind := . -}} +{{range .Types}} + +{{if not .IsTopLevel}} +### {{.Name}} +{{if .ParentKey}}[↩ Parent](#{{.ParentKey}}){{end}} +{{end}} +{{.Description}} + + + + + + + + + + + + {{- if .IsTopLevel -}} + + + + + + + + + + + + + + + + + + + {{- end -}} + {{- range .Fields -}} + + + + + + + {{- end -}} + +
NameTypeDescriptionRequired
apiVersionstring{{$group.Group}}/{{$group.Version}}true
kindstring{{$kind.Name}}true
metadataobjectRefer to the Kubernetes API documentation for the fields of the `metadata` field.true
{{if .TypeKey}}{{.Name}}{{else}}{{.Name}}{{end}}{{.Type}} + {{.Description}}
+ {{- if or .Schema.XValidations .Schema.Format .Schema.Enum .Schema.Default .Schema.Minimum .Schema.Maximum }} +
+ {{- end}} + {{- if .Schema.XValidations }} + Validations: + {{- range .Schema.XValidations -}} +
  • {{ .Rule }}: {{ .Message }}
    • + {{- end -}} + {{- end }} + {{- if .Schema.Format }} + Format: {{ .Schema.Format }}
    + {{- end }} + {{- if .Schema.Enum }} + Enum: {{ .Schema.Enum | toStrings | join ", " }}
    + {{- end }} + {{- if .Schema.Default }} + Default: {{ .Schema.Default }}
    + {{- end }} + {{- if .Schema.Minimum }} + Minimum: {{ .Schema.Minimum }}
    + {{- end }} + {{- if .Schema.Maximum }} + Maximum: {{ .Schema.Maximum }}
    + {{- end }} +     		{{.Required}}
    + +{{- end}}{{/* range .Types */}} +{{- end}}{{/* range .Kinds */}} diff --git a/content/operate/kubernetes/7.22/reference/api/redis_enterprise_active_active_database_api.md b/content/operate/kubernetes/7.22/reference/api/redis_enterprise_active_active_database_api.md new file mode 100644 index 0000000000..79b072e753 --- /dev/null +++ b/content/operate/kubernetes/7.22/reference/api/redis_enterprise_active_active_database_api.md @@ -0,0 +1,1686 @@ +--- +title: RedisEnterpriseActiveActiveDatabase API Reference +alwaysopen: false +categories: +- docs +- operate +- kubernetes +aliases: [/operate/kubernetes/reference/redis_enterprise_active_active_database_api] +linkTitle: REAADB API +weight: 30 +url: '/operate/kubernetes/7.22/reference/api/redis_enterprise_active_active_database_api/' +--- + +apiVersion: + + +- [app.redislabs.com/v1alpha1](#appredislabscomv1alpha1) + + + + +# app.redislabs.com/v1alpha1 + + + + +RedisEnterpriseActiveActiveDatabase is the Schema for the redisenterpriseactiveactivedatabase API + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    apiVersionstringapp.redislabs.com/v1alpha1true
    kindstringRedisEnterpriseActiveActiveDatabasetrue
    metadataobjectRefer to the Kubernetes API documentation for the fields of the `metadata` field.true
    specobject + RedisEnterpriseActiveActiveDatabaseSpec defines the desired state of RedisEnterpriseActiveActiveDatabase
    +     		false
    statusobject + RedisEnterpriseActiveActiveDatabaseStatus defines the observed state of RedisEnterpriseActiveActiveDatabase
    +     		false
    + + +### spec +[↩ Parent](#) + +RedisEnterpriseActiveActiveDatabaseSpec defines the desired state of RedisEnterpriseActiveActiveDatabase + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    participatingClusters[]object + The list of instances/ clusters specifications and configurations.
    +     		true
    globalConfigurationsobject + The Active-Active database global configurations, contains the global properties for each of the participating clusters/ instances databases within the Active-Active database.
    +     		false
    redisEnterpriseClusterobject + Connection to Redis Enterprise Cluster
    +     		false
    + + +### spec.participatingClusters[] +[↩ Parent](#spec) + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + The name of the remote cluster CR to link.
    +     		true
    externalReplicationPortinteger + The desired replication endpoint's port number for users who utilize LoadBalancers for sync between AA replicas and need to provide the specific port number that the LoadBalancer listens to.
    +     		false
    namespacestring + Namespace in which the REAADB object will be deployed to within the corresponding participating cluster. The user must ensure that the Redis Enterprise operator is configured to watch this namespace in the corresponding cluster, and the required RBAC configuration is properly set up. See https://redis.io/docs/latest/operate/kubernetes/re-clusters/multi-namespace/ for more information how to set up multiple namespaces. If no namespace is specified, then the REAADB is deployed to the REC's namespace in the corresponding cluster.
    +     		false
    + + +### spec.globalConfigurations +[↩ Parent](#spec) + +The Active-Active database global configurations, contains the global properties for each of the participating clusters/ instances databases within the Active-Active database. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    activeActiveobject + Connection/ association to the Active-Active database.
    +     		false
    alertSettingsobject + Settings for database alerts. Note - Alert settings are not supported for Active-Active database.
    +     		false
    backupobject + Target for automatic database backups.
    +     		false
    clientAuthenticationCertificates[]string + The Secrets containing TLS Client Certificate to use for Authentication
    +     		false
    dataInternodeEncryptionboolean + Internode encryption (INE) setting. An optional boolean setting, overriding a similar cluster-wide policy. If set to False, INE is guaranteed to be turned off for this DB (regardless of cluster-wide policy). If set to True, INE will be turned on, unless the capability is not supported by the DB ( in such a case we will get an error and database creation will fail). If left unspecified, will be disabled if internode encryption is not supported by the DB (regardless of cluster default). Deleting this property after explicitly setting its value shall have no effect.
    +     		false
    databasePortinteger + Database port number. TCP port on which the database is available. Will be generated automatically if omitted. can not be changed after creation
    +     		false
    databaseSecretNamestring + The name of the secret that holds the password to the database (redis databases only). If secret does not exist, it will be created. To define the password, create an opaque secret and set the name in the spec. The password will be taken from the value of the 'password' key. Use an empty string as value within the secret to disable authentication for the database. Notes - For Active-Active databases this secret will not be automatically created, and also, memcached databases must not be set with a value, and a secret/password will not be automatically created for them. Use the memcachedSaslSecretName field to set authentication parameters for memcached databases.
    +     		false
    databaseServicePortinteger + A custom port to be exposed by the database services. Can be be modified/added/removed after REDB creation. If set, it'll replace the default service port (namely, databasePort or defaultRedisPort).
    +     		false
    defaultUserboolean + Is connecting with a default user allowed? If disabled, the DatabaseSecret will not be created or updated
    +     		false
    evictionPolicystring + Database eviction policy. see more https://docs.redislabs.com/latest/rs/administering/database-operations/eviction-policy/
    +     		false
    isRofboolean + Whether it is an RoF database or not. Applicable only for databases of type "REDIS". Assumed to be false if left blank.
    +     		false
    memcachedSaslSecretNamestring + Credentials used for binary authentication in memcached databases. The credentials should be saved as an opaque secret and the name of that secret should be configured using this field. For username, use 'username' as the key and the actual username as the value. For password, use 'password' as the key and the actual password as the value. Note that connections are not encrypted.
    +     		false
    memorySizestring + memory size of database. use formats like 100MB, 0.1GB. minimum value in 100MB. When redis on flash (RoF) is enabled, this value refers to RAM+Flash memory, and it must not be below 1GB.
    +     		false
    modulesList[]object + List of modules associated with the database. The list of valid modules for the specific cluster can be retrieved from the status of the REC object. Use the "name" and "versions" fields for the specific module configuration. If specifying an explicit version for a module, automatic modules versions upgrade must be disabled by setting the '.upgradeSpec.upgradeModulesToLatest' field in the REC to 'false'. Note that the option to specify module versions is deprecated, and will be removed in future releases.
    +     		false
    ossClusterboolean + OSS Cluster mode option. Note that not all client libraries support OSS cluster mode.
    +     		false
    persistenceenum + Database on-disk persistence policy
    +
    + Enum: disabled, aofEverySecond, aofAlways, snapshotEvery1Hour, snapshotEvery6Hour, snapshotEvery12Hour
    +     		false
    proxyPolicystring + The policy used for proxy binding to the endpoint. Supported proxy policies are: single/all-master-shards/all-nodes When left blank, the default value will be chosen according to the value of ossCluster - single if disabled, all-master-shards when enabled
    +     		false
    rackAwareboolean + Whether database should be rack aware. This improves availability - more information: https://docs.redislabs.com/latest/rs/concepts/high-availability/rack-zone-awareness/
    +     		false
    redisEnterpriseClusterobject + Connection to Redis Enterprise Cluster
    +     		false
    redisVersionstring + Redis OSS version. Version can be specified via prefix, or via channels - for existing databases - Upgrade Redis OSS version. For new databases - the version which the database will be created with. If set to 'major' - will always upgrade to the most recent major Redis version. If set to 'latest' - will always upgrade to the most recent Redis version. Depends on 'redisUpgradePolicy' - if you want to set the value to 'latest' for some databases, you must set redisUpgradePolicy on the cluster before. Possible values are 'major' or 'latest' When using upgrade - make sure to backup the database before. This value is used only for database type 'redis'. Note - Specifying Redis version is currently not supported for Active-Active database.
    +     		false
    replicaSources[]object + What databases to replicate from
    +     		false
    replicationboolean + In-memory database replication. When enabled, database will have replica shard for every master - leading to higher availability. Defaults to false.
    +     		false
    resp3boolean + Whether this database supports RESP3 protocol. Note - Deleting this property after explicitly setting its value shall have no effect. Please view the corresponding field in RS doc for more info.
    +     		false
    rofRamSizestring + The size of the RAM portion of an RoF database. Similarly to "memorySize" use formats like 100MB, 0.1GB It must be at least 10% of combined memory size (RAM+Flash), as specified by "memorySize".
    +     		false
    rolesPermissions[]object + List of Redis Enteprise ACL and Role bindings to apply
    +     		false
    shardCountinteger + Number of database server-side shards
    +     		false
    shardingEnabledboolean + Toggles database sharding for REAADBs (Active Active databases) and enabled by default. This field is blocked for REDB (non-Active Active databases) and sharding is toggled via the shardCount field - when shardCount is 1 this is disabled otherwise enabled.
    +     		false
    shardsPlacementstring + Control the density of shards - should they reside on as few or as many nodes as possible. Available options are "dense" or "sparse". If left unset, defaults to "dense".
    +     		false
    tlsModeenum + Require SSL authenticated and encrypted connections to the database. enabled - all incoming connections to the Database must use SSL. disabled - no incoming connection to the Database should use SSL. replica_ssl - databases that replicate from this one need to use SSL.
    +
    + Enum: disabled, enabled, replica_ssl
    +     		false
    typeenum + The type of the database.
    +
    + Enum: redis, memcached
    +     		false
    upgradeSpecobject + Specifications for DB upgrade.
    +     		false
    + + +### spec.globalConfigurations.activeActive +[↩ Parent](#specglobalconfigurations) + +Connection/ association to the Active-Active database. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + The the corresponding Active-Active database name, Redis Enterprise Active Active Database custom resource name, this Resource is associated with. In case this resource is created manually at the active active database creation this field must be filled via the user, otherwise, the operator will assign this field automatically. Note: this feature is currently unsupported.
    +     		true
    participatingClusterNamestring + The corresponding participating cluster name, Redis Enterprise Remote Cluster custom resource name, in the Active-Active database, In case this resource is created manually at the active active database creation this field must be filled via the user, otherwise, the operator will assign this field automatically. Note: this feature is currently unsupported.
    +     		true
    + + +### spec.globalConfigurations.alertSettings +[↩ Parent](#specglobalconfigurations) + +Settings for database alerts. Note - Alert settings are not supported for Active-Active database. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    bdb_backup_delayedobject + Periodic backup has been delayed for longer than specified threshold value [minutes]
    +     		false
    bdb_crdt_src_high_syncer_lagobject + Active-active source - sync lag is higher than specified threshold value [seconds]
    +     		false
    bdb_crdt_src_syncer_connection_errorobject + Active-active source - sync has connection error while trying to connect replica source
    +     		false
    bdb_crdt_src_syncer_general_errorobject + Active-active source - sync encountered in general error
    +     		false
    bdb_high_latencyobject + Latency is higher than specified threshold value [micro-sec]
    +     		false
    bdb_high_throughputobject + Throughput is higher than specified threshold value [requests / sec.]
    +     		false
    bdb_long_running_actionobject + An alert for state-machines that are running for too long
    +     		false
    bdb_low_throughputobject + Throughput is lower than specified threshold value [requests / sec.]
    +     		false
    bdb_ram_dataset_overheadobject + Dataset RAM overhead of a shard has reached the threshold value [% of its RAM limit]
    +     		false
    bdb_ram_valuesobject + Percent of values kept in a shard's RAM is lower than [% of its key count]
    +     		false
    bdb_replica_src_high_syncer_lagobject + Replica-of source - sync lag is higher than specified threshold value [seconds]
    +     		false
    bdb_replica_src_syncer_connection_errorobject + Replica-of source - sync has connection error while trying to connect replica source
    +     		false
    bdb_shard_num_ram_valuesobject + Number of values kept in a shard's RAM is lower than [values]
    +     		false
    bdb_sizeobject + Dataset size has reached the threshold value [% of the memory limit]
    +     		false
    + + +### spec.globalConfigurations.alertSettings.bdb_backup_delayed +[↩ Parent](#specglobalconfigurationsalertsettings) + +Periodic backup has been delayed for longer than specified threshold value [minutes] + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		true
    thresholdstring + Threshold for alert going on/off
    +     		true
    + + +### spec.globalConfigurations.alertSettings.bdb_crdt_src_high_syncer_lag +[↩ Parent](#specglobalconfigurationsalertsettings) + +Active-active source - sync lag is higher than specified threshold value [seconds] + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		true
    thresholdstring + Threshold for alert going on/off
    +     		true
    + + +### spec.globalConfigurations.alertSettings.bdb_crdt_src_syncer_connection_error +[↩ Parent](#specglobalconfigurationsalertsettings) + +Active-active source - sync has connection error while trying to connect replica source + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		true
    thresholdstring + Threshold for alert going on/off
    +     		true
    + + +### spec.globalConfigurations.alertSettings.bdb_crdt_src_syncer_general_error +[↩ Parent](#specglobalconfigurationsalertsettings) + +Active-active source - sync encountered in general error + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		true
    thresholdstring + Threshold for alert going on/off
    +     		true
    + + +### spec.globalConfigurations.alertSettings.bdb_high_latency +[↩ Parent](#specglobalconfigurationsalertsettings) + +Latency is higher than specified threshold value [micro-sec] + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		true
    thresholdstring + Threshold for alert going on/off
    +     		true
    + + +### spec.globalConfigurations.alertSettings.bdb_high_throughput +[↩ Parent](#specglobalconfigurationsalertsettings) + +Throughput is higher than specified threshold value [requests / sec.] + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		true
    thresholdstring + Threshold for alert going on/off
    +     		true
    + + +### spec.globalConfigurations.alertSettings.bdb_long_running_action +[↩ Parent](#specglobalconfigurationsalertsettings) + +An alert for state-machines that are running for too long + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		true
    thresholdstring + Threshold for alert going on/off
    +     		true
    + + +### spec.globalConfigurations.alertSettings.bdb_low_throughput +[↩ Parent](#specglobalconfigurationsalertsettings) + +Throughput is lower than specified threshold value [requests / sec.] + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		true
    thresholdstring + Threshold for alert going on/off
    +     		true
    + + +### spec.globalConfigurations.alertSettings.bdb_ram_dataset_overhead +[↩ Parent](#specglobalconfigurationsalertsettings) + +Dataset RAM overhead of a shard has reached the threshold value [% of its RAM limit] + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		true
    thresholdstring + Threshold for alert going on/off
    +     		true
    + + +### spec.globalConfigurations.alertSettings.bdb_ram_values +[↩ Parent](#specglobalconfigurationsalertsettings) + +Percent of values kept in a shard's RAM is lower than [% of its key count] + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		true
    thresholdstring + Threshold for alert going on/off
    +     		true
    + + +### spec.globalConfigurations.alertSettings.bdb_replica_src_high_syncer_lag +[↩ Parent](#specglobalconfigurationsalertsettings) + +Replica-of source - sync lag is higher than specified threshold value [seconds] + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		true
    thresholdstring + Threshold for alert going on/off
    +     		true
    + + +### spec.globalConfigurations.alertSettings.bdb_replica_src_syncer_connection_error +[↩ Parent](#specglobalconfigurationsalertsettings) + +Replica-of source - sync has connection error while trying to connect replica source + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		true
    thresholdstring + Threshold for alert going on/off
    +     		true
    + + +### spec.globalConfigurations.alertSettings.bdb_shard_num_ram_values +[↩ Parent](#specglobalconfigurationsalertsettings) + +Number of values kept in a shard's RAM is lower than [values] + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		true
    thresholdstring + Threshold for alert going on/off
    +     		true
    + + +### spec.globalConfigurations.alertSettings.bdb_size +[↩ Parent](#specglobalconfigurationsalertsettings) + +Dataset size has reached the threshold value [% of the memory limit] + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		true
    thresholdstring + Threshold for alert going on/off
    +     		true
    + + +### spec.globalConfigurations.backup +[↩ Parent](#specglobalconfigurations) + +Target for automatic database backups. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    absobject +
    +     		false
    ftpobject +
    +     		false
    gcsobject + GoogleStorage
    +     		false
    intervalinteger + Backup Interval in seconds
    +     		false
    mountobject + MountPointStorage
    +     		false
    s3object +
    +     		false
    sftpobject +
    +     		false
    swiftobject +
    +     		false
    + + +### spec.globalConfigurations.backup.abs +[↩ Parent](#specglobalconfigurationsbackup) + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    absSecretNamestring + The name of the secret that holds ABS credentials. The secret must contain the keys "AccountName" and "AccountKey", and these must hold the corresponding credentials
    +     		true
    containerstring + Azure Blob Storage container name.
    +     		true
    subdirstring + Optional. Azure Blob Storage subdir under container.
    +     		false
    + + +### spec.globalConfigurations.backup.ftp +[↩ Parent](#specglobalconfigurationsbackup) + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    urlstring + a URI of the "ftps://[USER[:PASSWORD]@]HOST[:PORT]/PATH[/]" format
    +     		true
    + + +### spec.globalConfigurations.backup.gcs +[↩ Parent](#specglobalconfigurationsbackup) + +GoogleStorage + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    bucketNamestring + Google Storage bucket name.
    +     		true
    gcsSecretNamestring + The name of the secret that holds the Google Cloud Storage credentials. The secret must contain the keys "CLIENT_ID", "PRIVATE_KEY", "PRIVATE_KEY_ID", "CLIENT_EMAIL" and these must hold the corresponding credentials. The keys should correspond to the values in the key JSON.
    +     		true
    subdirstring + Optional. Google Storage subdir under bucket.
    +     		false
    + + +### spec.globalConfigurations.backup.mount +[↩ Parent](#specglobalconfigurationsbackup) + +MountPointStorage + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    pathstring + Path to the local mount point. You must create the mount point on all nodes, and the redislabs:redislabs user must have read and write permissions on the local mount point.
    +     		true
    + + +### spec.globalConfigurations.backup.s3 +[↩ Parent](#specglobalconfigurationsbackup) + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    awsSecretNamestring + The name of the secret that holds the AWS credentials. The secret must contain the keys "AWS_ACCESS_KEY_ID" and "AWS_SECRET_ACCESS_KEY", and these must hold the corresponding credentials.
    +     		true
    bucketNamestring + Amazon S3 bucket name.
    +     		true
    subdirstring + Optional. Amazon S3 subdir under bucket.
    +     		false
    + + +### spec.globalConfigurations.backup.sftp +[↩ Parent](#specglobalconfigurationsbackup) + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    sftpSecretNamestring + The name of the secret that holds SFTP credentials. The secret must contain the "Key" key, which is the SSH private key for connecting to the sftp server.
    +     		true
    sftp_urlstring + SFTP url
    +     		true
    + + +### spec.globalConfigurations.backup.swift +[↩ Parent](#specglobalconfigurationsbackup) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    auth_urlstring + Swift service authentication URL.
    +     		true
    containerstring + Swift object store container for storing the backup files.
    +     		true
    swiftSecretNamestring + The name of the secret that holds Swift credentials. The secret must contain the keys "Key" and "User", and these must hold the corresponding credentials: service access key and service user name (pattern for the latter does not allow special characters &,<,>,")
    +     		true
    prefixstring + Optional. Prefix (path) of backup files in the swift container.
    +     		false
    + + +### spec.globalConfigurations.modulesList[] +[↩ Parent](#specglobalconfigurations) + +Redis Enterprise module (see https://redis.io/docs/latest/develop/reference/modules/) + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + The name of the module, e.g. "search" or "ReJSON". The complete list of modules available in the cluster can be retrieved from the '.status.modules' field in the REC.
    +     		true
    configstring + Module command line arguments e.g. VKEY_MAX_ENTITY_COUNT 30 30
    +     		false
    versionstring + The semantic version of the module, e.g. '1.6.12'. Optional for REDB, must be set for REAADB. Note that this field is deprecated, and will be removed in future releases.
    +     		false
    + + +### spec.globalConfigurations.redisEnterpriseCluster +[↩ Parent](#specglobalconfigurations) + +Connection to Redis Enterprise Cluster + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + The name of the Redis Enterprise Cluster where the database should be stored.
    +     		true
    + + +### spec.globalConfigurations.replicaSources[] +[↩ Parent](#specglobalconfigurations) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    replicaSourceNamestring + The name of the resource from which the source database URI is derived. The type of resource must match the type specified in the ReplicaSourceType field.
    +     		true
    replicaSourceTypestring + The type of resource from which the source database URI is derived. If set to 'SECRET', the source database URI is derived from the secret named in the ReplicaSourceName field. The secret must have a key named 'uri' that defines the URI of the source database in the form of 'redis://...'. The type of secret (kubernetes, vault, ...) is determined by the secret mechanism used by the underlying REC object. If set to 'REDB', the source database URI is derived from the RedisEnterpriseDatabase resource named in the ReplicaSourceName field.
    +     		true
    clientKeySecretstring + Secret that defines the client certificate and key used by the syncer in the target database cluster. The secret must have 2 keys in its map: "cert" which is the PEM encoded certificate, and "key" which is the PEM encoded private key.
    +     		false
    compressioninteger + GZIP compression level (0-6) to use for replication.
    +     		false
    serverCertSecretstring + Secret that defines the server certificate used by the proxy in the source database cluster. The secret must have 1 key in its map: "cert" which is the PEM encoded certificate.
    +     		false
    tlsSniNamestring + TLS SNI name to use for the replication link.
    +     		false
    + + +### spec.globalConfigurations.rolesPermissions[] +[↩ Parent](#specglobalconfigurations) + +Redis Enterprise Role and ACL Binding + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    aclstring + Acl Name of RolePermissionType (note: use exact name of the ACL from the Redis Enterprise ACL list, case sensitive)
    +     		true
    rolestring + Role Name of RolePermissionType (note: use exact name of the role from the Redis Enterprise role list, case sensitive)
    +     		true
    typestring + Type of Redis Enterprise Database Role Permission
    +     		true
    + + +### spec.globalConfigurations.upgradeSpec +[↩ Parent](#specglobalconfigurations) + +Specifications for DB upgrade. + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    upgradeModulesToLatestboolean + Upgrades the modules to the latest version that supports the DB version during a DB upgrade action, to upgrade the DB version view the 'redisVersion' field. Note - This field is currently not supported for Active-Active databases.
    +     		true
    + + +### spec.redisEnterpriseCluster +[↩ Parent](#spec) + +Connection to Redis Enterprise Cluster + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + The name of the Redis Enterprise Cluster where the database should be stored.
    +     		true
    + + +### status +[↩ Parent](#) + +RedisEnterpriseActiveActiveDatabaseStatus defines the observed state of RedisEnterpriseActiveActiveDatabase + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    clusterCertificatesGenerationinteger + Versions of the cluster's Proxy and Syncer certificates. In Active-Active databases, these are used to detect updates to the certificates, and trigger synchronization across the participating clusters. .
    +
    + Format: int64
    +     		false
    guidstring + The active-active database corresponding GUID.
    +     		false
    lastTaskUidstring + The last active-active database task UID.
    +     		false
    linkedRedbs[]string + The linked REDBs.
    +     		false
    participatingClusters[]object + The list of instances/ clusters statuses.
    +     		false
    redisEnterpriseClusterstring + The Redis Enterprise Cluster Object this Resource is associated with
    +     		false
    replicationStatusenum + The overall replication status
    +
    + Enum: up, down
    +     		false
    secretsStatus[]object + The status of the secrets
    +     		false
    specStatusstring + Whether the desired specification is valid
    +     		false
    statusstring + The status of the active active database.
    +     		false
    + + +### status.participatingClusters[] +[↩ Parent](#status) + +Status of participating cluster. + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + The name of the remote cluster CR that is linked.
    +     		true
    idinteger + The corresponding ID of the instance in the active-active database.
    +
    + Format: int64
    +     		false
    replicationStatusenum + The replication status of the participating cluster
    +
    + Enum: up, down
    +     		false
    + + +### status.secretsStatus[] +[↩ Parent](#status) + +Status of secrets. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + The name of the secret.
    +     		true
    statusenum + The status of the secret.
    +
    + Enum: Valid, Invalid
    +     		false
    diff --git a/content/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api.md b/content/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api.md new file mode 100644 index 0000000000..f1fb8cc87f --- /dev/null +++ b/content/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api.md @@ -0,0 +1,4096 @@ +--- +title: RedisEnterpriseCluster API Reference +alwaysopen: false +categories: +- docs +- operate +- kubernetes +aliases: [/operate/kubernetes/reference/redis_enterprise_cluster_api, /operate/kubernetes/reference/cluster-options] +linkTitle: REC API +weight: 30 +url: '/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api/' +--- + +apiVersion: + + +- [app.redislabs.com/v1](#appredislabscomv1) + + + + +# app.redislabs.com/v1 + + + + +RedisEnterpriseCluster is the Schema for the redisenterpriseclusters API + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    apiVersionstringapp.redislabs.com/v1true
    kindstringRedisEnterpriseClustertrue
    metadataobjectRefer to the Kubernetes API documentation for the fields of the `metadata` field.true
    specobject + RedisEnterpriseClusterSpec defines the desired state of RedisEnterpriseCluster
    +     		false
    statusobject +
    +     		false
    + + +### spec +[↩ Parent](#) + +RedisEnterpriseClusterSpec defines the desired state of RedisEnterpriseCluster + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    activeActiveobject + Specification for ActiveActive setup. At most one of ingressOrRouteSpec or activeActive fields can be set at the same time.
    +     		false
    antiAffinityAdditionalTopologyKeys[]string + Additional antiAffinity terms in order to support installation on different zones/vcenters
    +     		false
    backupobject + Cluster-wide backup configurations
    +     		false
    bootstrapperImageSpecobject + Specification for Bootstrapper container image
    +     		false
    bootstrapperResourcesobject + Compute resource requirements for bootstrapper containers
    +     		false
    certificatesobject + RS Cluster Certificates. Used to modify the certificates used by the cluster. See the "RSClusterCertificates" struct described above to see the supported certificates.
    +     		false
    clusterCredentialSecretNamestring + Secret Name/Path to use for Cluster Credentials. To be used only if ClusterCredentialSecretType is vault. If left blank, will use cluster name.
    +     		false
    clusterCredentialSecretRolestring + Used only if ClusterCredentialSecretType is vault, to define vault role to be used. If blank, defaults to "redis-enterprise-operator"
    +     		false
    clusterCredentialSecretTypeenum + Type of Secret to use for ClusterCredential, Vault, Kuberetes,... If left blank, will default ot kubernetes secrets
    +
    + Enum: vault, kubernetes
    +     		false
    clusterRecoveryboolean + ClusterRecovery initiates cluster recovery when set to true. Note that this field is cleared automatically after the cluster is recovered
    +     		false
    containerTimezoneobject + Container timezone configuration. While the default timezone on all containers is UTC, this setting can be used to set the timezone on services rigger/bootstrapper/RS containers. You can either propagate the hosts timezone to RS pods or set it manually via timezoneName.
    +     		false
    createServiceAccountboolean + Whether to create service account
    +     		false
    dataInternodeEncryptionboolean + Internode encryption (INE) cluster wide policy. An optional boolean setting. Specifies if INE should be on/off for new created REDBs. May be overridden for specific REDB via similar setting, please view the similar setting for REDB for more info.
    +     		false
    encryptPkeysboolean + Private key encryption Possible values: true/false
    +     		false
    enforceIPv4boolean + Sets ENFORCE_IPV4 environment variable
    +     		false
    extraEnvVars[]object + ADVANCED USAGE: use carefully. Add environment variables to RS StatefulSet's containers.
    +     		false
    extraLabelsmap[string]string + Labels that the user defines for their convenience
    +     		false
    hostAliases[]object + Adds hostAliases entries to the Redis Enterprise pods
    +     		false
    ingressOrRouteSpecobject + Access configurations for the Redis Enterprise Cluster and Databases. At most one of ingressOrRouteSpec or activeActive fields can be set at the same time.
    +     		false
    ldapobject + Cluster-level LDAP configuration, such as server addresses, protocol, authentication and query settings.
    +     		false
    licensestring + Redis Enterprise License
    +     		false
    licenseSecretNamestring + K8s secret or Vault Secret Name/Path to use for Cluster License. When left blank, the license is read from the "license" field. Note that you can't specify non-empty values in both "license" and "licenseSecretName", only one of these fields can be used to pass the license string. The license needs to be stored under the key "license".
    +     		false
    nodeSelectormap[string]string + Selector for nodes that could fit Redis Enterprise pod
    +     		false
    nodesinteger + Number of Redis Enterprise nodes (pods)
    +
    + Format: int32
    +     		false
    ocspConfigurationobject + An API object that represents the cluster's OCSP configuration. To enable OCSP, the cluster's proxy certificate should contain the OCSP responder URL.
    +     		false
    persistentSpecobject + Specification for Redis Enterprise Cluster persistence
    +     		false
    podAnnotationsmap[string]string + annotations for the service rigger and redis enterprise pods
    +     		false
    podAntiAffinityobject + Override for the default anti-affinity rules of the Redis Enterprise pods. More info: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#an-example-of-a-pod-that-uses-pod-affinity
    +     		false
    podStartingPolicyobject + Mitigation setting for STS pods stuck in "ContainerCreating"
    +     		false
    podTolerations[]object + Tolerations that are added to all managed pods. More information: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
    +     		false
    priorityClassNamestring + Adds the priority class to pods managed by the operator
    +     		false
    pullSecrets[]object + PullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images. If specified, these secrets will be passed to individual puller implementations for them to use. More info: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
    +     		false
    rackAwarenessNodeLabelstring + Node label that specifies rack ID - if specified, will create rack aware cluster. Rack awareness requires node label must exist on all nodes. Additionally, operator needs a special cluster role with permission to list nodes.
    +     		false
    redisEnterpriseAdditionalPodSpecAttributesobject + ADVANCED USAGE USE AT YOUR OWN RISK - specify pod attributes that are required for the statefulset - Redis Enterprise pods. Pod attributes managed by the operator might override these settings. Also make sure the attributes are supported by the K8s version running on the cluster - the operator does not validate that.
    +     		false
    redisEnterpriseIPFamilyenum + Reserved, future use, only for use if instructed by Redis. IPFamily dictates what IP family to choose for pods' internal and external communication.
    +
    + Enum: IPv4, IPv6
    +     		false
    redisEnterpriseImageSpecobject + Specification for Redis Enterprise container image
    +     		false
    redisEnterpriseNodeResourcesobject + Compute resource requirements for Redis Enterprise containers
    +     		false
    redisEnterprisePodAnnotationsmap[string]string + annotations for redis enterprise pod
    +     		false
    redisEnterpriseServicesConfigurationobject + RS Cluster optional services settings
    +     		false
    redisEnterpriseServicesRiggerImageSpecobject + Specification for Services Rigger container image
    +     		false
    redisEnterpriseServicesRiggerResourcesobject + Compute resource requirements for Services Rigger pod
    +     		false
    redisEnterpriseTerminationGracePeriodSecondsinteger + The TerminationGracePeriodSeconds value for the (STS created) REC pods
    +
    + Format: int64
    +     		false
    redisEnterpriseVolumeMounts[]object + additional volume mounts within the redis enterprise containers. More info: https://kubernetes.io/docs/concepts/storage/volumes/
    +     		false
    redisOnFlashSpecobject + Stores configurations specific to redis on flash. If provided, the cluster will be capable of creating redis on flash databases.
    +     		false
    redisUpgradePolicyenum + Redis upgrade policy to be set on the Redis Enterprise Cluster. Possible values: major/latest This value is used by the cluster to choose the Redis version of the database when an upgrade is performed. The Redis Enterprise Cluster includes multiple versions of OSS Redis that can be used for databases.
    +
    + Enum: major, latest
    +     		false
    resp3Defaultboolean + Whether databases will turn on RESP3 compatibility upon database upgrade. Note - Deleting this property after explicitly setting its value shall have no effect. Please view the corresponding field in RS doc for more info.
    +     		false
    securityContextobject + The security configuration that will be applied to RS pods.
    +     		false
    serviceAccountNamestring + Name of the service account to use
    +     		false
    servicesobject + Customization options for operator-managed service resources created for Redis Enterprise clusters and databases
    +     		false
    servicesRiggerSpecobject + Specification for service rigger
    +     		false
    sideContainersSpec[]object +
    +     		false
    slaveHAobject + Slave high availability mechanism configuration.
    +     		false
    uiAnnotationsmap[string]string + Annotations for Redis Enterprise UI service. This annotations will override the overlapping global annotations set under spec.services.servicesAnnotations The specified annotations will not override annotations that already exist and didn't originate from the operator, except for the 'redis.io/last-keys' annotation which is reserved.
    +     		false
    uiServiceTypeenum + Type of service used to expose Redis Enterprise UI (https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types)
    +
    + Enum: ClusterIP, NodePort, LoadBalancer, ExternalName
    +     		false
    upgradeSpecobject + Specification for upgrades of Redis Enterprise
    +     		false
    usageMeterobject + The configuration of the usage meter.
    +     		false
    usernamestring + Username for the admin user of Redis Enterprise
    +     		false
    vaultCASecretstring + K8s secret name containing Vault's CA cert - defaults to "vault-ca-cert"
    +     		false
    volumes[]object + additional volumes
    +     		false
    + + +### spec.activeActive +[↩ Parent](#spec) + +Specification for ActiveActive setup. At most one of ingressOrRouteSpec or activeActive fields can be set at the same time. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    apiIngressUrlstring + RS API URL
    +     		true
    dbIngressSuffixstring + DB ENDPOINT SUFFIX - will be used to set the db host. ingress Creates a host name so it should be unique if more than one db is created on the cluster with the same name
    +     		true
    methodenum + Used to distinguish between different platforms implementation
    +
    + Enum: openShiftRoute, ingress
    +     		true
    ingressAnnotationsmap[string]string + Used for ingress controllers such as ha-proxy or nginx in GKE
    +     		false
    + + +### spec.backup +[↩ Parent](#spec) + +Cluster-wide backup configurations + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    s3object + Configurations for backups to s3 and s3-compatible storage
    +     		false
    + + +### spec.backup.s3 +[↩ Parent](#specbackup) + +Configurations for backups to s3 and s3-compatible storage + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    caCertificateSecretNamestring + Secret name that holds the S3 CA certificate, which contains the TLS certificate mapped to the key in the secret 'cert'
    +     		false
    urlstring + Specifies the URL for S3 export and import
    +     		false
    + + +### spec.bootstrapperImageSpec +[↩ Parent](#spec) + +Specification for Bootstrapper container image + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    digestHashstring + The digest hash of the container image to pull. When specified, the container image is pulled according to the digest hash instead of the image tag. The versionTag field must also be specified with the image tag matching this digest hash. Note: This field is only supported for OLM deployments.
    +     		false
    imagePullPolicystring + The image pull policy to be applied to the container image. One of Always, Never, IfNotPresent.
    +     		false
    repositorystring + The repository (name) of the container image to be deployed.
    +     		false
    versionTagstring + The tag of the container image to be deployed.
    +     		false
    + + +### spec.bootstrapperResources +[↩ Parent](#spec) + +Compute resource requirements for bootstrapper containers + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    claims[]object +
    +     		false
    limitsmap[string]int or string + Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
    +     		false
    requestsmap[string]int or string + Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
    +     		false
    + + +### spec.bootstrapperResources.claims[] +[↩ Parent](#specbootstrapperresources) + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring +
    +     		true
    + + +### spec.certificates +[↩ Parent](#spec) + +RS Cluster Certificates. Used to modify the certificates used by the cluster. See the "RSClusterCertificates" struct described above to see the supported certificates. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    apiCertificateSecretNamestring + Secret name to use for cluster's API certificate. If left blank, a cluster-provided certificate will be used.
    +     		false
    cmCertificateSecretNamestring + Secret name to use for cluster's CM (Cluster Manager) certificate. If left blank, a cluster-provided certificate will be used.
    +     		false
    ldapClientCertificateSecretNamestring + Secret name to use for cluster's LDAP client certificate. If left blank, LDAP client certificate authentication will be disabled.
    +     		false
    metricsExporterCertificateSecretNamestring + Secret name to use for cluster's Metrics Exporter certificate. If left blank, a cluster-provided certificate will be used.
    +     		false
    proxyCertificateSecretNamestring + Secret name to use for cluster's Proxy certificate. If left blank, a cluster-provided certificate will be used.
    +     		false
    syncerCertificateSecretNamestring + Secret name to use for cluster's Syncer certificate. If left blank, a cluster-provided certificate will be used.
    +     		false
    + + +### spec.containerTimezone +[↩ Parent](#spec) + +Container timezone configuration. While the default timezone on all containers is UTC, this setting can be used to set the timezone on services rigger/bootstrapper/RS containers. You can either propagate the hosts timezone to RS pods or set it manually via timezoneName. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    propagateHostobject + Identifies that container timezone should be in sync with the host, this option mounts a hostPath volume onto RS pods that could be restricted in some systems.
    +     		false
    timezoneNamestring + POSIX-style timezone name as a string to be passed as EnvVar to RE pods, e.g. "Europe/London".
    +     		false
    + + +### spec.extraEnvVars[] +[↩ Parent](#spec) + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring +
    +     		true
    valuestring +
    +     		false
    valueFromobject +
    +     		false
    + + +### spec.hostAliases[] +[↩ Parent](#spec) + +HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the pod's hosts file. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    hostnames[]string + Hostnames for the above IP address.
    +     		false
    ipstring + IP address of the host file entry.
    +     		false
    + + +### spec.ingressOrRouteSpec +[↩ Parent](#spec) + +Access configurations for the Redis Enterprise Cluster and Databases. At most one of ingressOrRouteSpec or activeActive fields can be set at the same time. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    apiFqdnUrlstring + RS API URL
    +     		true
    dbFqdnSuffixstring + DB ENDPOINT SUFFIX - will be used to set the db host ingress . Creates a host name so it should be unique if more than one db is created on the cluster with the same name
    +     		true
    methodenum + Used to distinguish between different platforms implementation.
    +
    + Enum: openShiftRoute, ingress, istio
    +     		true
    ingressAnnotationsmap[string]string + Additional annotations to set on ingress resources created by the operator
    +     		false
    + + +### spec.ldap +[↩ Parent](#spec) + +Cluster-level LDAP configuration, such as server addresses, protocol, authentication and query settings. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    authenticationQueryobject + Configuration of authentication queries, mapping between the username, provided to the cluster for authentication, and the LDAP Distinguished Name.
    +     		true
    authorizationQueryobject + Configuration of authorization queries, mapping between a user's Distinguished Name and its group memberships.
    +     		true
    protocolenum + Specifies the LDAP protocol to use. One of: LDAP, LDAPS, STARTTLS.
    +
    + Enum: LDAP, LDAPS, STARTTLS
    +     		true
    servers[]object + One or more LDAP servers. If multiple servers are specified, they must all share an identical organization tree structure.
    +     		true
    bindCredentialsSecretNamestring + Name of a secret within the same namespace, holding the credentials used to communicate with the LDAP server for authentication queries. The secret must have a key named 'dn' with the Distinguished Name of the user to execute the query, and 'password' with its password. If left blank, credentials-based authentication is disabled.
    +     		false
    caCertificateSecretNamestring + Name of a secret within the same namespace, holding a PEM-encoded CA certificate for validating the TLS connection to the LDAP server. The secret must have a key named 'cert' with the certificate data. This field is applicable only when the protocol is LDAPS or STARTTLS.
    +     		false
    cacheTTLSecondsinteger + The maximum TTL of cached entries.
    +     		false
    directoryTimeoutSecondsinteger + The connection timeout to the LDAP server when authenticating a user, in seconds
    +     		false
    enabledForControlPlaneboolean + Whether to enable LDAP for control plane access. Disabled by default.
    +     		false
    enabledForDataPlaneboolean + Whether to enable LDAP for data plane access. Disabled by default.
    +     		false
    + + +### spec.ldap.authenticationQuery +[↩ Parent](#specldap) + +Configuration of authentication queries, mapping between the username, provided to the cluster for authentication, and the LDAP Distinguished Name. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    queryobject + Configuration for a search query. Mutually exclusive with the 'template' field. The substring '%u' in the query filter will be replaced with the username.
    +     		false
    templatestring + Configuration for a template query. Mutually exclusive with the 'query' field. The substring '%u' will be replaced with the username, e.g., 'cn=%u,ou=dev,dc=example,dc=com'.
    +     		false
    + + +### spec.ldap.authenticationQuery.query +[↩ Parent](#specldapauthenticationquery) + +Configuration for a search query. Mutually exclusive with the 'template' field. The substring '%u' in the query filter will be replaced with the username. + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    basestring + The Distinguished Name of the entry at which to start the search, e.g., 'ou=dev,dc=example,dc=com'.
    +     		true
    filterstring + An RFC-4515 string representation of the filter to apply in the search. For an authentication query, the substring '%u' will be replaced with the username, e.g., '(cn=%u)'. For an authorization query, the substring '%D' will be replaced with the user's Distinguished Name, e.g., '(members=%D)'.
    +     		true
    scopeenum + The search scope for an LDAP query. One of: BaseObject, SingleLevel, WholeSubtree
    +
    + Enum: BaseObject, SingleLevel, WholeSubtree
    +     		true
    + + +### spec.ldap.authorizationQuery +[↩ Parent](#specldap) + +Configuration of authorization queries, mapping between a user's Distinguished Name and its group memberships. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    attributestring + Configuration for an attribute query. Mutually exclusive with the 'query' field. Holds the name of an attribute of the LDAP user entity that contains a list of the groups that the user belongs to, e.g., 'memberOf'.
    +     		false
    queryobject + Configuration for a search query. Mutually exclusive with the 'attribute' field. The substring '%D' in the query filter will be replaced with the user's Distinguished Name.
    +     		false
    + + +### spec.ldap.authorizationQuery.query +[↩ Parent](#specldapauthorizationquery) + +Configuration for a search query. Mutually exclusive with the 'attribute' field. The substring '%D' in the query filter will be replaced with the user's Distinguished Name. + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    basestring + The Distinguished Name of the entry at which to start the search, e.g., 'ou=dev,dc=example,dc=com'.
    +     		true
    filterstring + An RFC-4515 string representation of the filter to apply in the search. For an authentication query, the substring '%u' will be replaced with the username, e.g., '(cn=%u)'. For an authorization query, the substring '%D' will be replaced with the user's Distinguished Name, e.g., '(members=%D)'.
    +     		true
    scopeenum + The search scope for an LDAP query. One of: BaseObject, SingleLevel, WholeSubtree
    +
    + Enum: BaseObject, SingleLevel, WholeSubtree
    +     		true
    + + +### spec.ldap.servers[] +[↩ Parent](#specldap) + +Address of an LDAP server. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    hoststring + Host name of the LDAP server
    +     		true
    portinteger + Port number of the LDAP server. If unspecified, defaults to 389 for LDAP and STARTTLS protocols, and 636 for LDAPS protocol.
    +
    + Format: int32
    +     		false
    + + +### spec.ocspConfiguration +[↩ Parent](#spec) + +An API object that represents the cluster's OCSP configuration. To enable OCSP, the cluster's proxy certificate should contain the OCSP responder URL. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    ocspFunctionalityboolean + Whether to enable/disable OCSP mechanism for the cluster.
    +     		false
    queryFrequencyinteger + Determines the interval (in seconds) in which the control plane will poll the OCSP responder for a new status for the server certificate. Minimum value is 60. Maximum value is 86400.
    +     		false
    recoveryFrequencyinteger + Determines the interval (in seconds) in which the control plane will poll the OCSP responder for a new status for the server certificate when the current staple is invalid. Minimum value is 60. Maximum value is 86400.
    +     		false
    recoveryMaxTriesinteger + Determines the maximum number for the OCSP recovery attempts. After max number of tries passed, the control plane will revert back to the regular frequency. Minimum value is 1. Maximum value is 100.
    +     		false
    responseTimeoutinteger + Determines the time interval (in seconds) for which the request waits for a response from the OCSP responder. Minimum value is 1. Maximum value is 60.
    +     		false
    + + +### spec.persistentSpec +[↩ Parent](#spec) + +Specification for Redis Enterprise Cluster persistence + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enablePersistentVolumeResizeboolean + Whether to enable PersistentVolumes resize. Disabled by default. Read the instruction in pvc_expansion readme carefully before using this feature.
    +     		false
    enabledboolean + Whether to add persistent volume to Redis Enterprise pods
    +     		false
    storageClassNamestring + Storage class for persistent volume in Redis Enterprise pods. Leave empty to use the default. If using the default this way, make sure the Kubernetes Cluster has a default Storage Class configured. This can be done by running a `kubectl get storageclass` and see if one of the Storage Classes' names contains a `(default)` mark.
    +     		false
    volumeSizeint or string + To enable resizing after creating the cluster - please follow the instructions in the pvc_expansion readme
    +     		false
    + + +### spec.podAntiAffinity +[↩ Parent](#spec) + +Override for the default anti-affinity rules of the Redis Enterprise pods. More info: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#an-example-of-a-pod-that-uses-pod-affinity + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    preferredDuringSchedulingIgnoredDuringExecution[]object +
    +     		false
    requiredDuringSchedulingIgnoredDuringExecution[]object +
    +     		false
    + + +### spec.podStartingPolicy +[↩ Parent](#spec) + +Mitigation setting for STS pods stuck in "ContainerCreating" + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Whether to detect and attempt to mitigate pod startup issues
    +     		true
    startingThresholdSecondsinteger + Time in seconds to wait for a pod to be stuck while starting up before action is taken. If set to 0, will be treated as if disabled.
    +
    + Format: int32
    +     		true
    + + +### spec.podTolerations[] +[↩ Parent](#spec) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    effectstring +
    +     		false
    keystring +
    +     		false
    operatorstring +
    +     		false
    tolerationSecondsinteger +
    +
    + Format: int64
    +     		false
    valuestring +
    +     		false
    + + +### spec.pullSecrets[] +[↩ Parent](#spec) + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + Secret name
    +     		false
    + + +### spec.redisEnterpriseAdditionalPodSpecAttributes +[↩ Parent](#spec) + +ADVANCED USAGE USE AT YOUR OWN RISK - specify pod attributes that are required for the statefulset - Redis Enterprise pods. Pod attributes managed by the operator might override these settings. Also make sure the attributes are supported by the K8s version running on the cluster - the operator does not validate that. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    activeDeadlineSecondsinteger +
    +
    + Format: int64
    +     		false
    affinityobject +
    +     		false
    automountServiceAccountTokenboolean +
    +     		false
    dnsConfigobject +
    +     		false
    dnsPolicystring +
    +     		false
    enableServiceLinksboolean +
    +     		false
    ephemeralContainers[]object +
    +     		false
    hostAliases[]object +
    +     		false
    hostIPCboolean +
    +     		false
    hostNetworkboolean +
    +     		false
    hostPIDboolean +
    +     		false
    hostUsersboolean +
    +     		false
    hostnamestring +
    +     		false
    imagePullSecrets[]object +
    +     		false
    initContainers[]object +
    +     		false
    nodeNamestring +
    +     		false
    nodeSelectormap[string]string +
    +     		false
    osobject +
    +     		false
    overheadmap[string]int or string +
    +     		false
    preemptionPolicystring +
    +     		false
    priorityinteger +
    +
    + Format: int32
    +     		false
    priorityClassNamestring +
    +     		false
    readinessGates[]object +
    +     		false
    resourceClaims[]object +
    +     		false
    restartPolicystring +
    +     		false
    runtimeClassNamestring +
    +     		false
    schedulerNamestring +
    +     		false
    schedulingGates[]object +
    +     		false
    securityContextobject +
    +     		false
    serviceAccountstring +
    +     		false
    serviceAccountNamestring +
    +     		false
    setHostnameAsFQDNboolean +
    +     		false
    shareProcessNamespaceboolean +
    +     		false
    subdomainstring +
    +     		false
    terminationGracePeriodSecondsinteger +
    +
    + Format: int64
    +     		false
    tolerations[]object +
    +     		false
    topologySpreadConstraints[]object +
    +     		false
    volumes[]object +
    +     		false
    + + +### spec.redisEnterpriseImageSpec +[↩ Parent](#spec) + +Specification for Redis Enterprise container image + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    digestHashstring + The digest hash of the container image to pull. When specified, the container image is pulled according to the digest hash instead of the image tag. The versionTag field must also be specified with the image tag matching this digest hash. Note: This field is only supported for OLM deployments.
    +     		false
    imagePullPolicystring + The image pull policy to be applied to the container image. One of Always, Never, IfNotPresent.
    +     		false
    repositorystring + The repository (name) of the container image to be deployed.
    +     		false
    versionTagstring + The tag of the container image to be deployed.
    +     		false
    + + +### spec.redisEnterpriseNodeResources +[↩ Parent](#spec) + +Compute resource requirements for Redis Enterprise containers + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    claims[]object +
    +     		false
    limitsmap[string]int or string + Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
    +     		false
    requestsmap[string]int or string + Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
    +     		false
    + + +### spec.redisEnterpriseNodeResources.claims[] +[↩ Parent](#specredisenterprisenoderesources) + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring +
    +     		true
    + + +### spec.redisEnterpriseServicesConfiguration +[↩ Parent](#spec) + +RS Cluster optional services settings + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    cmServerobject +
    +     		false
    crdbCoordinatorobject +
    +     		false
    crdbWorkerobject +
    +     		false
    mdnsServerobject +
    +     		false
    pdnsServerobject +
    +     		false
    saslauthdobject +
    +     		false
    statsArchiverobject +
    +     		false
    + + +### spec.redisEnterpriseServicesConfiguration.cmServer +[↩ Parent](#specredisenterpriseservicesconfiguration) + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    operatingModeenum + Whether to enable/disable the CM server
    +
    + Enum: enabled, disabled
    +     		true
    + + +### spec.redisEnterpriseServicesConfiguration.crdbCoordinator +[↩ Parent](#specredisenterpriseservicesconfiguration) + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    operatingModeenum + Whether to enable/disable the crdb coordinator process
    +
    + Enum: enabled, disabled
    +     		true
    + + +### spec.redisEnterpriseServicesConfiguration.crdbWorker +[↩ Parent](#specredisenterpriseservicesconfiguration) + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    operatingModeenum + Whether to enable/disable the crdb worker processes
    +
    + Enum: enabled, disabled
    +     		true
    + + +### spec.redisEnterpriseServicesConfiguration.mdnsServer +[↩ Parent](#specredisenterpriseservicesconfiguration) + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    operatingModeenum + Whether to enable/disable the Multicast DNS server
    +
    + Enum: enabled, disabled
    +     		true
    + + +### spec.redisEnterpriseServicesConfiguration.pdnsServer +[↩ Parent](#specredisenterpriseservicesconfiguration) + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    operatingModeenum + Deprecated: The PDNS Server is now disabled by the operator. This field will be ignored.
    +
    + Enum: enabled, disabled
    +     		true
    + + +### spec.redisEnterpriseServicesConfiguration.saslauthd +[↩ Parent](#specredisenterpriseservicesconfiguration) + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    operatingModeenum + Whether to enable/disable the saslauthd service
    +
    + Enum: enabled, disabled
    +     		true
    + + +### spec.redisEnterpriseServicesConfiguration.statsArchiver +[↩ Parent](#specredisenterpriseservicesconfiguration) + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    operatingModeenum + Whether to enable/disable the stats archiver service
    +
    + Enum: enabled, disabled
    +     		true
    + + +### spec.redisEnterpriseServicesRiggerImageSpec +[↩ Parent](#spec) + +Specification for Services Rigger container image + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    digestHashstring + The digest hash of the container image to pull. When specified, the container image is pulled according to the digest hash instead of the image tag. The versionTag field must also be specified with the image tag matching this digest hash. Note: This field is only supported for OLM deployments.
    +     		false
    imagePullPolicystring + The image pull policy to be applied to the container image. One of Always, Never, IfNotPresent.
    +     		false
    repositorystring + The repository (name) of the container image to be deployed.
    +     		false
    versionTagstring + The tag of the container image to be deployed.
    +     		false
    + + +### spec.redisEnterpriseServicesRiggerResources +[↩ Parent](#spec) + +Compute resource requirements for Services Rigger pod + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    claims[]object +
    +     		false
    limitsmap[string]int or string + Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
    +     		false
    requestsmap[string]int or string + Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
    +     		false
    + + +### spec.redisEnterpriseVolumeMounts[] +[↩ Parent](#spec) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    mountPathstring +
    +     		true
    namestring +
    +     		true
    mountPropagationstring +
    +     		false
    readOnlyboolean +
    +     		false
    subPathstring +
    +     		false
    subPathExprstring +
    +     		false
    + + +### spec.redisOnFlashSpec +[↩ Parent](#spec) + +Stores configurations specific to redis on flash. If provided, the cluster will be capable of creating redis on flash databases. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean +
    +     		true
    storageClassNamestring +
    +     		true
    bigStoreDriverenum +
    +
    + Enum: rocksdb, speedb
    +     		false
    flashDiskSizeint or string +
    +     		false
    flashStorageEngineenum +
    +
    + Enum: rocksdb
    +     		false
    + + +### spec.securityContext +[↩ Parent](#spec) + +The security configuration that will be applied to RS pods. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    readOnlyRootFilesystemPolicyobject + Policy controlling whether to enable read-only root filesystem for the Redis Enterprise software containers. Note that certain filesystem paths remain writable through mounted volumes to ensure proper functionality.
    +     		false
    resourceLimitsobject + Settings pertaining to resource limits management by the Redis Enterprise Node container.
    +     		false
    + + +### spec.securityContext.readOnlyRootFilesystemPolicy +[↩ Parent](#specsecuritycontext) + +Policy controlling whether to enable read-only root filesystem for the Redis Enterprise software containers. Note that certain filesystem paths remain writable through mounted volumes to ensure proper functionality. + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Whether to enable read-only root filesystem for the Redis Enterprise software containers. Default is false.
    +     		true
    + + +### spec.securityContext.resourceLimits +[↩ Parent](#specsecuritycontext) + +Settings pertaining to resource limits management by the Redis Enterprise Node container. + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    allowAutoAdjustmentboolean + Allow Redis Enterprise to adjust resource limits, like max open file descriptors, of its data plane processes. When this option is enabled, the SYS_RESOURCE capability is added to the Redis Enterprise pods, and their allowPrivilegeEscalation field is set. Turned off by default.
    +     		false
    + + +### spec.services +[↩ Parent](#spec) + +Customization options for operator-managed service resources created for Redis Enterprise clusters and databases + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    apiServiceobject + Customization options for the REC API service.
    +     		false
    servicesAnnotationsmap[string]string + Global additional annotations to set on service resources created by the operator. The specified annotations will not override annotations that already exist and didn't originate from the operator.
    +     		false
    + + +### spec.services.apiService +[↩ Parent](#specservices) + +Customization options for the REC API service. + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    typeenum + Type of service to create for the REC API service. Defaults to ClusterIP service, if not specified otherwise.
    +
    + Enum: ClusterIP, NodePort, LoadBalancer
    +     		false
    + + +### spec.servicesRiggerSpec +[↩ Parent](#spec) + +Specification for service rigger + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    databaseServicePortPolicyenum + databaseServicePortPolicy instructs how to determine the service ports for REDB services. Defaults to DatabasePortForward, if not specified otherwise. Note - Regardless whether this flag is set or not, if an REDB/REAADB configured with databaseServicePort that would be the port exposed by the Service. DatabasePortForward - The service port will be the same as the database port. RedisDefaultPort - The service port will be the default Redis port (6379).
    +
    + Enum: DatabasePortForward, RedisDefaultPort
    +     		false
    databaseServiceTypestring + Service types for access to databases. should be a comma separated list. The possible values are cluster_ip, headless and load_balancer.
    +     		false
    extraEnvVars[]object +
    +     		false
    podAnnotationsmap[string]string + annotations for the service rigger pod
    +     		false
    serviceNamingenum + Used to determine how to name the services created automatically when a database is created. When bdb_name is used, the database name will be also used for the service name. When redis-port is used, the service will be named redis-.
    +
    + Enum: bdb_name, redis-port
    +     		false
    servicesRiggerAdditionalPodSpecAttributesobject + ADVANCED USAGE USE AT YOUR OWN RISK - specify pod attributes that are required for the rigger deployment pod. Pod attributes managed by the operator might override these settings (Containers, serviceAccountName, podTolerations, ImagePullSecrets, nodeSelector, PriorityClassName, PodSecurityContext). Also make sure the attributes are supported by the K8s version running on the cluster - the operator does not validate that.
    +     		false
    + + +### spec.servicesRiggerSpec.extraEnvVars[] +[↩ Parent](#specservicesriggerspec) + +EnvVar represents an environment variable present in a Container. More info: https://kubernetes.io/docs/tasks/inject-data-application/environment-variable-expose-pod-information/ + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + Name of the environment variable.
    +     		true
    valuestring +
    +     		false
    valueFromobject + Source for the environment variable's value. Cannot be used if value is not empty.
    +     		false
    + + +### spec.servicesRiggerSpec.extraEnvVars[].valueFrom +[↩ Parent](#specservicesriggerspecextraenvvars) + +Source for the environment variable's value. Cannot be used if value is not empty. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    configMapKeyRefobject + Selects a key of a ConfigMap.
    +     		false
    fieldRefobject + Selects a field of the pod
    +     		false
    resourceFieldRefobject + Selects a resource of the container: only resources limits and requests are currently supported.
    +     		false
    secretKeyRefobject + Selects a key of a secret in the pod's namespace
    +     		false
    + + +### spec.servicesRiggerSpec.extraEnvVars[].valueFrom.configMapKeyRef +[↩ Parent](#specservicesriggerspecextraenvvarsvaluefrom) + +Selects a key of a ConfigMap. + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    keystring + The key to select.
    +     		true
    namestring + Name of the referent
    +     		false
    optionalboolean + Specify whether the ConfigMap or its key must be defined
    +     		false
    + + +### spec.servicesRiggerSpec.extraEnvVars[].valueFrom.fieldRef +[↩ Parent](#specservicesriggerspecextraenvvarsvaluefrom) + +Selects a field of the pod + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    fieldPathstring + Path of the field to select in the specified API version.
    +     		true
    apiVersionstring + Version of the schema the FieldPath is written in terms of, defaults to "v1".
    +     		false
    + + +### spec.servicesRiggerSpec.extraEnvVars[].valueFrom.resourceFieldRef +[↩ Parent](#specservicesriggerspecextraenvvarsvaluefrom) + +Selects a resource of the container: only resources limits and requests are currently supported. + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    resourcestring + Required: resource to select
    +     		true
    containerNamestring + Container name: required for volumes, optional for env vars
    +     		false
    divisorint or string + Specifies the output format of the exposed resources, defaults to "1"
    +     		false
    + + +### spec.servicesRiggerSpec.extraEnvVars[].valueFrom.secretKeyRef +[↩ Parent](#specservicesriggerspecextraenvvarsvaluefrom) + +Selects a key of a secret in the pod's namespace + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    keystring + The key of the secret to select from. Must be a valid secret key.
    +     		true
    namestring + Name of the referent
    +     		false
    optionalboolean + Specify whether the Secret or its key must be defined
    +     		false
    + + +### spec.servicesRiggerSpec.servicesRiggerAdditionalPodSpecAttributes +[↩ Parent](#specservicesriggerspec) + +ADVANCED USAGE USE AT YOUR OWN RISK - specify pod attributes that are required for the rigger deployment pod. Pod attributes managed by the operator might override these settings (Containers, serviceAccountName, podTolerations, ImagePullSecrets, nodeSelector, PriorityClassName, PodSecurityContext). Also make sure the attributes are supported by the K8s version running on the cluster - the operator does not validate that. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    activeDeadlineSecondsinteger +
    +
    + Format: int64
    +     		false
    affinityobject +
    +     		false
    automountServiceAccountTokenboolean +
    +     		false
    dnsConfigobject +
    +     		false
    dnsPolicystring +
    +     		false
    enableServiceLinksboolean +
    +     		false
    ephemeralContainers[]object +
    +     		false
    hostAliases[]object +
    +     		false
    hostIPCboolean +
    +     		false
    hostNetworkboolean +
    +     		false
    hostPIDboolean +
    +     		false
    hostUsersboolean +
    +     		false
    hostnamestring +
    +     		false
    imagePullSecrets[]object +
    +     		false
    initContainers[]object +
    +     		false
    nodeNamestring +
    +     		false
    nodeSelectormap[string]string +
    +     		false
    osobject +
    +     		false
    overheadmap[string]int or string +
    +     		false
    preemptionPolicystring +
    +     		false
    priorityinteger +
    +
    + Format: int32
    +     		false
    priorityClassNamestring +
    +     		false
    readinessGates[]object +
    +     		false
    resourceClaims[]object +
    +     		false
    restartPolicystring +
    +     		false
    runtimeClassNamestring +
    +     		false
    schedulerNamestring +
    +     		false
    schedulingGates[]object +
    +     		false
    securityContextobject +
    +     		false
    serviceAccountstring +
    +     		false
    serviceAccountNamestring +
    +     		false
    setHostnameAsFQDNboolean +
    +     		false
    shareProcessNamespaceboolean +
    +     		false
    subdomainstring +
    +     		false
    terminationGracePeriodSecondsinteger +
    +
    + Format: int64
    +     		false
    tolerations[]object +
    +     		false
    topologySpreadConstraints[]object +
    +     		false
    volumes[]object +
    +     		false
    + + +### spec.sideContainersSpec[] +[↩ Parent](#spec) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring +
    +     		true
    args[]string +
    +     		false
    command[]string +
    +     		false
    env[]object +
    +     		false
    envFrom[]object +
    +     		false
    imagestring +
    +     		false
    imagePullPolicystring +
    +     		false
    lifecycleobject +
    +     		false
    livenessProbeobject +
    +     		false
    ports[]object +
    +     		false
    readinessProbeobject +
    +     		false
    resourcesobject +
    +     		false
    securityContextobject +
    +     		false
    startupProbeobject +
    +     		false
    stdinboolean +
    +     		false
    stdinOnceboolean +
    +     		false
    terminationMessagePathstring +
    +     		false
    terminationMessagePolicystring +
    +     		false
    ttyboolean +
    +     		false
    volumeDevices[]object +
    +     		false
    volumeMounts[]object +
    +     		false
    workingDirstring +
    +     		false
    + + +### spec.slaveHA +[↩ Parent](#spec) + +Slave high availability mechanism configuration. + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    slaveHAGracePeriodinteger + Time in seconds between when a node fails, and when slave high availability mechanism starts relocating shards. If set to 0, will not affect cluster configuration.
    +
    + Format: int32
    +     		true
    + + +### spec.upgradeSpec +[↩ Parent](#spec) + +Specification for upgrades of Redis Enterprise + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    autoUpgradeRedisEnterpriseboolean + Whether to upgrade Redis Enterprise automatically when operator is upgraded
    +     		true
    + + +### spec.usageMeter +[↩ Parent](#spec) + +The configuration of the usage meter. + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    callHomeClientobject +
    +     		false
    + + +### spec.usageMeter.callHomeClient +[↩ Parent](#specusagemeter) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    disabledboolean + Whether to disable the call home client. Enabled by default.
    +     		false
    imageSpecobject + Image specification
    +     		false
    proxySecretNamestring + if needed, add proxy details in secret. the name of the proxy secret in the secret, can send the following keys: proxy-url, proxy-username, proxy-password (the url includes the proxy port).
    +     		false
    resourcesobject + Compute resource requirements for Call Home Client pod
    +     		false
    + + +### spec.usageMeter.callHomeClient.imageSpec +[↩ Parent](#specusagemetercallhomeclient) + +Image specification + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    digestHashstring + The digest hash of the container image to pull. When specified, the container image is pulled according to the digest hash instead of the image tag. The versionTag field must also be specified with the image tag matching this digest hash. Note: This field is only supported for OLM deployments.
    +     		false
    imagePullPolicystring + The image pull policy to be applied to the container image. One of Always, Never, IfNotPresent.
    +     		false
    repositorystring + The repository (name) of the container image to be deployed.
    +     		false
    versionTagstring + The tag of the container image to be deployed.
    +     		false
    + + +### spec.usageMeter.callHomeClient.resources +[↩ Parent](#specusagemetercallhomeclient) + +Compute resource requirements for Call Home Client pod + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    claims[]object + Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. + This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. + This field is immutable. It can only be set for containers.
    +     		false
    limitsmap[string]int or string + Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
    +     		false
    requestsmap[string]int or string + Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
    +     		false
    + + +### spec.usageMeter.callHomeClient.resources.claims[] +[↩ Parent](#specusagemetercallhomeclientresources) + +ResourceClaim references one entry in PodSpec.ResourceClaims. + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.
    +     		true
    + + +### spec.volumes[] +[↩ Parent](#spec) + +Volume represents a named volume in a pod that may be accessed by any container in the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring +
    +     		true
    awsElasticBlockStoreobject +
    +     		false
    azureDiskobject +
    +     		false
    azureFileobject +
    +     		false
    cephfsobject +
    +     		false
    cinderobject +
    +     		false
    configMapobject +
    +     		false
    csiobject +
    +     		false
    downwardAPIobject +
    +     		false
    emptyDirobject +
    +     		false
    fcobject +
    +     		false
    flexVolumeobject +
    +     		false
    flockerobject +
    +     		false
    gcePersistentDiskobject +
    +     		false
    gitRepoobject +
    +     		false
    glusterfsobject +
    +     		false
    hostPathobject +
    +     		false
    iscsiobject +
    +     		false
    nfsobject +
    +     		false
    persistentVolumeClaimobject +
    +     		false
    photonPersistentDiskobject +
    +     		false
    portworxVolumeobject +
    +     		false
    projectedobject +
    +     		false
    quobyteobject +
    +     		false
    rbdobject +
    +     		false
    scaleIOobject +
    +     		false
    secretobject +
    +     		false
    storageosobject +
    +     		false
    vsphereVolumeobject +
    +     		false
    + + +### status +[↩ Parent](#) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    bundledDatabaseVersions[]object + Versions of open source databases bundled by Redis Enterprise Software - please note that in order to use a specific version it should be supported by the ‘upgradePolicy’ - ‘major’ or ‘latest’ according to the desired version (major/minor)
    +     		false
    certificatesStatusobject + Stores information about cluster certificates and their update process. In Active-Active databases, this is used to detect updates to the certificates, and trigger synchronization across the participating clusters.
    +     		false
    ingressOrRouteMethodStatusstring + The ingressOrRouteSpec/ActiveActive spec method that exist
    +     		false
    licenseStatusobject +
    +     		false
    managedAPIsobject + Indicates cluster APIs that are being managed by the operator. This only applies to cluster APIs which are optionally-managed by the operator, such as cluster LDAP configuration. Most other APIs are automatically managed by the operator, and are not listed here.
    +     		false
    modules[]object +
    +     		false
    ocspStatusobject + An API object that represents the cluster's OCSP status
    +     		false
    persistenceStatusobject + The status of the Persistent Volume Claims that are used for Redis Enterprise Cluster persistence. The status will correspond to the status of one or more of the PVCs (failed/resizing if one of them is in resize or failed to resize)
    +     		false
    redisEnterpriseIPFamilystring +
    +     		false
    specStatusstring +
    +     		false
    statestring +
    +     		false
    + + +### status.bundledDatabaseVersions[] +[↩ Parent](#status) + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    dbTypestring +
    +     		true
    versionstring +
    +     		true
    majorboolean +
    +     		false
    + + +### status.certificatesStatus +[↩ Parent](#status) + +Stores information about cluster certificates and their update process. In Active-Active databases, this is used to detect updates to the certificates, and trigger synchronization across the participating clusters. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    generationinteger + Generation stores the version of the cluster's Proxy and Syncer certificate secrets. In Active-Active databases, when a user updates the proxy or syncer certificate, a crdb-update command needs to be triggered to avoid potential sync issues. This helps the REAADB controller detect a change in a certificate and trigger a crdb-update. The version of the cluster's Proxy certificate secret.
    +
    + Format: int64
    +     		false
    updateStatusstring + The status of the cluster's certificates update
    +     		false
    + + +### status.licenseStatus +[↩ Parent](#status) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    activationDatestring +
    +     		false
    expirationDatestring +
    +     		false
    features[]string +
    +     		false
    flashShardsinteger +
    +
    + Format: int32
    +     		false
    flashShardsLimitinteger +
    +
    + Format: int32
    +     		false
    licenseStatestring +
    +     		false
    ownerstring +
    +     		false
    ramShardsinteger +
    +
    + Format: int32
    +     		false
    ramShardsLimitinteger +
    +
    + Format: int32
    +     		false
    shardsLimitinteger +
    +     		false
    shardsUsagestring +
    +     		false
    + + +### status.managedAPIs +[↩ Parent](#status) + +Indicates cluster APIs that are being managed by the operator. This only applies to cluster APIs which are optionally-managed by the operator, such as cluster LDAP configuration. Most other APIs are automatically managed by the operator, and are not listed here. + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    ldapboolean + Indicate whether cluster LDAP configuration is managed by the operator. When this is enabled, the operator will reconcile the cluster LDAP configuration according to the '.spec.ldap' field in the RedisEnterpriseCluster resource.
    +     		false
    + + +### status.modules[] +[↩ Parent](#status) + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    displayNamestring +
    +     		false
    namestring +
    +     		false
    versions[]string +
    +     		false
    + + +### status.ocspStatus +[↩ Parent](#status) + +An API object that represents the cluster's OCSP status + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    certStatusstring + Indicates the proxy certificate status - GOOD/REVOKED/UNKNOWN.
    +     		false
    nextUpdatestring + The time at or before which newer information will be available about the status of the certificate (if available)
    +     		false
    producedAtstring + The time at which the OCSP responder signed this response.
    +     		false
    responderUrlstring + The OCSP responder url from which this status came from.
    +     		false
    revocationTimestring + The time at which the certificate was revoked or placed on hold.
    +     		false
    thisUpdatestring + The most recent time at which the status being indicated is known by the responder to have been correct.
    +     		false
    + + +### status.persistenceStatus +[↩ Parent](#status) + +The status of the Persistent Volume Claims that are used for Redis Enterprise Cluster persistence. The status will correspond to the status of one or more of the PVCs (failed/resizing if one of them is in resize or failed to resize) + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    statusstring + The current status of the PVCs
    +     		false
    succeededstring + The number of PVCs that are provisioned with the expected size
    +     		false
    diff --git a/content/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_empty_fields b/content/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_empty_fields new file mode 100644 index 0000000000..bb7f604a61 --- /dev/null +++ b/content/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_empty_fields @@ -0,0 +1,8 @@ +spec.extraEnvVars +spec.podAntiAffinity +spec.redisEnterpriseAdditionalPodSpecAttributes +spec.redisEnterpriseServicesRiggerResources +spec.redisEnterpriseVolumeMounts +spec.servicesRiggerSpec.servicesRiggerAdditionalPodSpecAttributes +spec.sideContainersSpec +spec.volumes diff --git a/content/operate/kubernetes/7.22/reference/api/redis_enterprise_database_api.md b/content/operate/kubernetes/7.22/reference/api/redis_enterprise_database_api.md new file mode 100644 index 0000000000..859967e964 --- /dev/null +++ b/content/operate/kubernetes/7.22/reference/api/redis_enterprise_database_api.md @@ -0,0 +1,1641 @@ +--- +title: RedisEnterpriseDatabase API Reference +alwaysopen: false +categories: +- docs +- operate +- kubernetes +aliases: [/operate/kubernetes/reference/redis_enterprise_database_api, /operate/kubernetes/reference/db-options] +linkTitle: REDB API +weight: 30 +url: '/operate/kubernetes/7.22/reference/api/redis_enterprise_database_api/' +--- + +apiVersion: + + +- [app.redislabs.com/v1alpha1](#appredislabscomv1alpha1) + + + + +# app.redislabs.com/v1alpha1 + + + + +RedisEnterpriseDatabase is the Schema for the redisenterprisedatabases API + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    apiVersionstringapp.redislabs.com/v1alpha1true
    kindstringRedisEnterpriseDatabasetrue
    metadataobjectRefer to the Kubernetes API documentation for the fields of the `metadata` field.true
    specobject + RedisEnterpriseDatabaseSpec defines the desired state of RedisEnterpriseDatabase
    +     		false
    statusobject + RedisEnterpriseDatabaseStatus defines the observed state of RedisEnterpriseDatabase
    +     		false
    + + +### spec +[↩ Parent](#) + +RedisEnterpriseDatabaseSpec defines the desired state of RedisEnterpriseDatabase + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    activeActiveobject + Connection/ association to the Active-Active database.
    +     		false
    alertSettingsobject + Settings for database alerts
    +     		false
    backupobject + Target for automatic database backups.
    +     		false
    clientAuthenticationCertificates[]string + The Secrets containing TLS Client Certificate to use for Authentication
    +     		false
    dataInternodeEncryptionboolean + Internode encryption (INE) setting. An optional boolean setting, overriding a similar cluster-wide policy. If set to False, INE is guaranteed to be turned off for this DB (regardless of cluster-wide policy). If set to True, INE will be turned on, unless the capability is not supported by the DB ( in such a case we will get an error and database creation will fail). If left unspecified, will be disabled if internode encryption is not supported by the DB (regardless of cluster default). Deleting this property after explicitly setting its value shall have no effect.
    +     		false
    databasePortinteger + TCP port assigned to the database within the Redis Enterprise cluster. Must be unique across all databases in the Redis Enterprise cluster. Will be generated automatically if omitted. can not be changed after creation
    +     		false
    databaseSecretNamestring + Name of the secret containing the database password (Redis databases only). The secret is created automatically if it does not exist. The password is stored under the "password" key in the secret. If creating the secret manually, create an opaque secret with the password under the "password" key. To disable authentication, set the value of the "password" key in the secret to an empty string. Note: For Active-Active databases, this secret is not created automatically. For memcached databases, use memcachedSaslSecretName instead.
    +     		false
    databaseServicePortinteger + A custom port to be exposed by the database Services. Can be modified/added/removed after REDB creation. If set, it'll replace the default service port (namely, databasePort or defaultRedisPort).
    +     		false
    defaultUserboolean + Allows connections with the default user. When disabled, the DatabaseSecret is not created or updated.
    +     		false
    evictionPolicystring + Database eviction policy. See https://redis.io/docs/latest/operate/rs/databases/memory-performance/eviction-policy/
    +     		false
    isRofboolean + Enables Auto Tiering (formerly Redis on Flash) for Redis databases only. Defaults to false.
    +     		false
    memcachedSaslSecretNamestring + Name of the secret containing credentials for memcached database authentication. Store credentials in an opaque secret with "username" and "password" keys. Note: Connections are not encrypted.
    +     		false
    memorySizestring + Memory size for the database using formats like 100MB or 0.1GB. Minimum value is 100MB. For Auto Tiering (formerly Redis on Flash), this value represents RAM+Flash memory and must be at least 1GB.
    +     		false
    modulesList[]object + List of modules associated with the database. The list of valid modules for the specific cluster can be retrieved from the status of the REC object. Use the "name" and "versions" fields for the specific module configuration. If specifying an explicit version for a module, automatic modules versions upgrade must be disabled by setting the '.upgradeSpec.upgradeModulesToLatest' field in the REC to 'false'. Note that the option to specify module versions is deprecated, and will be removed in future releases.
    +     		false
    ossClusterboolean + Enables OSS Cluster mode. Note: Not all client libraries support OSS cluster mode.
    +     		false
    persistenceenum + Database persistence policy for on-disk storage.
    +
    + Enum: disabled, aofEverySecond, aofAlways, snapshotEvery1Hour, snapshotEvery6Hour, snapshotEvery12Hour
    +     		false
    proxyPolicystring + Proxy policy for the database. Supported proxy policies are: single/all-master-shards/all-nodes When left blank, the default value will be chosen according to the value of ossCluster - single if disabled, all-master-shards when enabled
    +     		false
    rackAwareboolean + Enables rack awareness for improved availability. See https://redis.io/docs/latest/operate/rs/clusters/configure/rack-zone-awareness/
    +     		false
    redisEnterpriseClusterobject + Connection to the Redis Enterprise Cluster.
    +     		false
    redisVersionstring + Redis OSS version. Version can be specified via prefix, or via channels - for existing databases - Upgrade Redis OSS version. For new databases - the version which the database will be created with. If set to 'major' - will always upgrade to the most recent major Redis version. If set to 'latest' - will always upgrade to the most recent Redis version. Depends on 'redisUpgradePolicy' - if you want to set the value to 'latest' for some databases, you must set redisUpgradePolicy on the cluster before. Possible values are 'major' or 'latest' When using upgrade - make sure to backup the database before. This value is used only for database type 'redis'
    +     		false
    replicaSources[]object + What databases to replicate from
    +     		false
    replicationboolean + Enables in-memory database replication for higher availability. Creates a replica shard for every master shard. Defaults to false.
    +     		false
    resp3boolean + Whether this database supports RESP3 protocol. Note - Deleting this property after explicitly setting its value shall have no effect. Please view the corresponding field in RS doc for more info.
    +     		false
    rofRamSizestring + The size of the RAM portion of an Auto Tiering (formerly Redis on Flash) database. Similarly to "memorySize" use formats like 100MB, 0.1GB. It must be at least 10% of combined memory size (RAM and Flash), as specified by "memorySize".
    +     		false
    rolesPermissions[]object + List of Redis Enteprise ACL and Role bindings to apply
    +     		false
    shardCountinteger + Number of database server-side shards.
    +     		false
    shardingEnabledboolean + Toggles database sharding for REAADBs (Active Active databases) and enabled by default. This field is blocked for REDB (non-Active Active databases) and sharding is toggled via the shardCount field - when shardCount is 1 this is disabled otherwise enabled.
    +     		false
    shardsPlacementenum + Shard placement strategy: "dense" or "sparse". dense: Shards reside on as few nodes as possible. sparse: Shards are distributed across as many nodes as possible.
    +
    + Enum: dense, sparse
    +     		false
    tlsModeenum + Require TLS authenticated and encrypted connections to the database. enabled - all client and replication connections to the Database must use TLS. disabled - no incoming connection to the Database should use TLS. replica_ssl - databases that replicate from this one need to use TLS.
    +
    + Enum: disabled, enabled, replica_ssl
    +     		false
    typeenum + Database type: redis or memcached.
    +
    + Enum: redis, memcached
    +     		false
    upgradeSpecobject + Specifications for DB upgrade.
    +     		false
    + + +### spec.activeActive +[↩ Parent](#spec) + +Connection/ association to the Active-Active database. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + The the corresponding Active-Active database name, Redis Enterprise Active Active Database custom resource name, this Resource is associated with. In case this resource is created manually at the active active database creation this field must be filled via the user, otherwise, the operator will assign this field automatically. Note: this feature is currently unsupported.
    +     		true
    participatingClusterNamestring + The corresponding participating cluster name, Redis Enterprise Remote Cluster custom resource name, in the Active-Active database, In case this resource is created manually at the active active database creation this field must be filled via the user, otherwise, the operator will assign this field automatically. Note: this feature is currently unsupported.
    +     		true
    + + +### spec.alertSettings +[↩ Parent](#spec) + +Settings for database alerts + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    bdb_backup_delayedobject + Periodic backup has been delayed for longer than specified threshold value [minutes]. -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required
    +     		false
    bdb_crdt_src_high_syncer_lagobject + Active-active source - sync lag is higher than specified threshold value [seconds] -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required
    +     		false
    bdb_crdt_src_syncer_connection_errorobject + Active-active source - sync has connection error while trying to connect replica source -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required
    +     		false
    bdb_crdt_src_syncer_general_errorobject + Active-active source - sync encountered in general error -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required
    +     		false
    bdb_high_latencyobject + Latency is higher than specified threshold value [micro-sec] -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required
    +     		false
    bdb_high_throughputobject + Throughput is higher than specified threshold value [requests / sec.] -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required
    +     		false
    bdb_long_running_actionobject + An alert for state-machines that are running for too long -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required
    +     		false
    bdb_low_throughputobject + Throughput is lower than specified threshold value [requests / sec.] -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required
    +     		false
    bdb_ram_dataset_overheadobject + Dataset RAM overhead of a shard has reached the threshold value [% of its RAM limit] -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required
    +     		false
    bdb_ram_valuesobject + Percent of values kept in a shard's RAM is lower than [% of its key count] -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required
    +     		false
    bdb_replica_src_high_syncer_lagobject + Replica-of source - sync lag is higher than specified threshold value [seconds] -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required
    +     		false
    bdb_replica_src_syncer_connection_errorobject + Replica-of source - sync has connection error while trying to connect replica source -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required
    +     		false
    bdb_shard_num_ram_valuesobject + Number of values kept in a shard's RAM is lower than [values] -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required
    +     		false
    bdb_sizeobject + Dataset size has reached the threshold value [% of the memory limit] expected fields: -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required
    +     		false
    + + +### spec.alertSettings.bdb_backup_delayed +[↩ Parent](#specalertsettings) + +Periodic backup has been delayed for longer than specified threshold value [minutes]. -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		false
    + + +### spec.alertSettings.bdb_crdt_src_high_syncer_lag +[↩ Parent](#specalertsettings) + +Active-active source - sync lag is higher than specified threshold value [seconds] -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		false
    + + +### spec.alertSettings.bdb_crdt_src_syncer_connection_error +[↩ Parent](#specalertsettings) + +Active-active source - sync has connection error while trying to connect replica source -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		false
    + + +### spec.alertSettings.bdb_crdt_src_syncer_general_error +[↩ Parent](#specalertsettings) + +Active-active source - sync encountered in general error -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		false
    + + +### spec.alertSettings.bdb_high_latency +[↩ Parent](#specalertsettings) + +Latency is higher than specified threshold value [micro-sec] -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		false
    + + +### spec.alertSettings.bdb_high_throughput +[↩ Parent](#specalertsettings) + +Throughput is higher than specified threshold value [requests / sec.] -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		false
    + + +### spec.alertSettings.bdb_long_running_action +[↩ Parent](#specalertsettings) + +An alert for state-machines that are running for too long -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		false
    + + +### spec.alertSettings.bdb_low_throughput +[↩ Parent](#specalertsettings) + +Throughput is lower than specified threshold value [requests / sec.] -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		false
    + + +### spec.alertSettings.bdb_ram_dataset_overhead +[↩ Parent](#specalertsettings) + +Dataset RAM overhead of a shard has reached the threshold value [% of its RAM limit] -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		false
    + + +### spec.alertSettings.bdb_ram_values +[↩ Parent](#specalertsettings) + +Percent of values kept in a shard's RAM is lower than [% of its key count] -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		false
    + + +### spec.alertSettings.bdb_replica_src_high_syncer_lag +[↩ Parent](#specalertsettings) + +Replica-of source - sync lag is higher than specified threshold value [seconds] -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		false
    + + +### spec.alertSettings.bdb_replica_src_syncer_connection_error +[↩ Parent](#specalertsettings) + +Replica-of source - sync has connection error while trying to connect replica source -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		false
    + + +### spec.alertSettings.bdb_shard_num_ram_values +[↩ Parent](#specalertsettings) + +Number of values kept in a shard's RAM is lower than [values] -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		false
    + + +### spec.alertSettings.bdb_size +[↩ Parent](#specalertsettings) + +Dataset size has reached the threshold value [% of the memory limit] expected fields: -Note threshold is commented (allow string/int/float and support backwards compatibility) but is required + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Alert enabled or disabled
    +     		false
    + + +### spec.backup +[↩ Parent](#spec) + +Target for automatic database backups. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    absobject +
    +     		false
    ftpobject +
    +     		false
    gcsobject + GoogleStorage
    +     		false
    intervalinteger + Backup Interval in seconds
    +     		false
    mountobject + MountPointStorage
    +     		false
    s3object +
    +     		false
    sftpobject +
    +     		false
    swiftobject +
    +     		false
    + + +### spec.backup.abs +[↩ Parent](#specbackup) + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    absSecretNamestring + The name of the K8s secret that holds ABS credentials. The secret must contain the keys "AccountName" and "AccountKey", and these must hold the corresponding credentials
    +     		true
    containerstring + Azure Blob Storage container name.
    +     		true
    subdirstring + Optional. Azure Blob Storage subdir under container.
    +     		false
    + + +### spec.backup.ftp +[↩ Parent](#specbackup) + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    urlstring + a URI of the ftps://[USER[:PASSWORD]@]HOST[:PORT]/PATH[/]
    +     		true
    + + +### spec.backup.gcs +[↩ Parent](#specbackup) + +GoogleStorage + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    bucketNamestring + Google Storage bucket name.
    +     		true
    gcsSecretNamestring + The name of the K8s secret that holds the Google Cloud Storage credentials. The secret must contain the keys "CLIENT_ID", "PRIVATE_KEY", "PRIVATE_KEY_ID", "CLIENT_EMAIL" and these must hold the corresponding credentials. The keys should correspond to the values in the key JSON.
    +     		true
    subdirstring + Optional. Google Storage subdir under bucket.
    +     		false
    + + +### spec.backup.mount +[↩ Parent](#specbackup) + +MountPointStorage + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    pathstring + Path to the local mount point. You must create the mount point on all nodes, and the redislabs:redislabs user must have read and write permissions on the local mount point.
    +     		true
    + + +### spec.backup.s3 +[↩ Parent](#specbackup) + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    awsSecretNamestring + The name of the K8s secret that holds the AWS credentials. The secret must contain the keys "AWS_ACCESS_KEY_ID" and "AWS_SECRET_ACCESS_KEY", and these must hold the corresponding credentials.
    +     		true
    bucketNamestring + Amazon S3 bucket name.
    +     		true
    subdirstring + Optional. Amazon S3 subdir under bucket.
    +     		false
    + + +### spec.backup.sftp +[↩ Parent](#specbackup) + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    sftpSecretNamestring + The name of the K8s secret that holds SFTP credentials. The secret must contain the "Key" key, which is the SSH private key for connecting to the sftp server.
    +     		true
    sftp_urlstring + SFTP url
    +     		true
    + + +### spec.backup.swift +[↩ Parent](#specbackup) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    auth_urlstring + Swift service authentication URL.
    +     		true
    containerstring + Swift object store container for storing the backup files.
    +     		true
    swiftSecretNamestring + The name of the K8s secret that holds Swift credentials. The secret must contain the keys "Key" and "User", and these must hold the corresponding credentials: service access key and service user name (pattern for the latter does not allow special characters &,<,>,")
    +     		true
    prefixstring + Optional. Prefix (path) of backup files in the swift container.
    +     		false
    + + +### spec.modulesList[] +[↩ Parent](#spec) + +Redis Enterprise module (see https://redis.io/docs/latest/develop/reference/modules/) + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + The name of the module, e.g. "search" or "ReJSON". The complete list of modules available in the cluster can be retrieved from the '.status.modules' field in the REC.
    +     		true
    configstring + Module command line arguments e.g. VKEY_MAX_ENTITY_COUNT 30 30
    +     		false
    versionstring + The semantic version of the module, e.g. '1.6.12'. Optional for REDB, must be set for REAADB. Note that this field is deprecated, and will be removed in future releases.
    +     		false
    + + +### spec.redisEnterpriseCluster +[↩ Parent](#spec) + +Connection to the Redis Enterprise Cluster. + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + The name of the Redis Enterprise Cluster where the database should be stored.
    +     		true
    + + +### spec.replicaSources[] +[↩ Parent](#spec) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    replicaSourceNamestring + The name of the resource from which the source database URI is derived. The type of resource must match the type specified in the ReplicaSourceType field.
    +     		true
    replicaSourceTypestring + The type of resource from which the source database URI is derived. If set to 'SECRET', the source database URI is derived from the secret named in the ReplicaSourceName field. The secret must have a key named 'uri' that defines the URI of the source database in the form of 'redis://...'. The type of secret (kubernetes, vault, ...) is determined by the secret mechanism used by the underlying REC object. If set to 'REDB', the source database URI is derived from the RedisEnterpriseDatabase resource named in the ReplicaSourceName field.
    +     		true
    clientKeySecretstring + Secret that defines the client certificate and key used by the syncer in the target database cluster. The secret must have 2 keys in its map: "cert" which is the PEM encoded certificate, and "key" which is the PEM encoded private key.
    +     		false
    compressioninteger + GZIP compression level (0-6) to use for replication.
    +     		false
    serverCertSecretstring + Secret that defines the server certificate used by the proxy in the source database cluster. The secret must have 1 key in its map: "cert" which is the PEM encoded certificate.
    +     		false
    tlsSniNamestring + TLS SNI name to use for the replication link.
    +     		false
    + + +### spec.rolesPermissions[] +[↩ Parent](#spec) + +Redis Enterprise Role and ACL Binding + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    aclstring + Acl Name of RolePermissionType
    +     		true
    rolestring + Role Name of RolePermissionType
    +     		true
    typestring + Type of Redis Enterprise Database Role Permission
    +     		true
    + + +### spec.upgradeSpec +[↩ Parent](#spec) + +Specifications for DB upgrade. + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    upgradeModulesToLatestboolean + DEPRECATED Upgrades the modules to the latest version that supports the DB version during a DB upgrade action, to upgrade the DB version view the 'redisVersion' field. Notes - All modules must be without specifying the version. in addition, This field is currently not supported for Active-Active databases. The default is true
    +     		true
    + + +### status +[↩ Parent](#) + +RedisEnterpriseDatabaseStatus defines the observed state of RedisEnterpriseDatabase + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    activeActiveobject + Connection/ association to the Active-Active database.
    +     		false
    backupInfoobject + Information on the database's periodic backup
    +     		false
    createdTimestring + Time when the database was created
    +     		false
    databaseUIDstring + Database UID provided by redis enterprise
    +     		false
    internalEndpoints[]object + Endpoints listed internally by the Redis Enterprise Cluster. Can be used to correlate a ReplicaSourceStatus entry.
    +     		false
    lastActionStatusstring + Status of the last action done by operator on this database
    +     		false
    lastActionUidstring + UID of the last action done by operator on this database
    +     		false
    lastUpdatedstring + Time when the database was last updated
    +     		false
    observedGenerationinteger + The generation (built in update counter of K8s) of the REDB resource that was fully acted upon, meaning that all changes were handled and sent as an API call to the Redis Enterprise Cluster (REC). This field value should equal the current generation when the resource changes were handled. Note: the lastActionStatus field tracks actions handled asynchronously by the Redis Enterprise Cluster.
    +
    + Format: int64
    +     		false
    redisEnterpriseClusterstring + The Redis Enterprise Cluster Object this Resource is associated with
    +     		false
    replicaSourceStatuses[]object + ReplicaSource statuses
    +     		false
    shardStatusesmap[string]integer + Aggregated statuses of shards
    +     		false
    specStatusstring + Whether the desired specification is valid
    +     		false
    statusstring + The status of the database
    +     		false
    versionstring + Database compatibility version
    +     		false
    + + +### status.activeActive +[↩ Parent](#status) + +Connection/ association to the Active-Active database. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + The the corresponding Active-Active database name, Redis Enterprise Active Active Database custom resource name, this Resource is associated with. In case this resource is created manually at the active active database creation this field must be filled via the user, otherwise, the operator will assign this field automatically. Note: this feature is currently unsupported.
    +     		true
    participatingClusterNamestring + The corresponding participating cluster name, Redis Enterprise Remote Cluster custom resource name, in the Active-Active database, In case this resource is created manually at the active active database creation this field must be filled via the user, otherwise, the operator will assign this field automatically. Note: this feature is currently unsupported.
    +     		true
    + + +### status.backupInfo +[↩ Parent](#status) + +Information on the database's periodic backup + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    backupFailureReasonstring + Reason of last failed backup process
    +     		false
    backupHistoryinteger + Backup history retention policy (number of days, 0 is forever)
    +     		false
    backupIntervalinteger + Interval in seconds in which automatic backup will be initiated
    +     		false
    backupIntervalOffsetinteger + Offset (in seconds) from round backup interval when automatic backup will be initiated (should be less than backup_interval)
    +     		false
    backupProgressPercentageinteger + Database scheduled periodic backup progress (percentage)
    +     		false
    backupStatusstring + Status of scheduled periodic backup process
    +     		false
    lastBackupTimestring + Time of last successful backup
    +     		false
    + + +### status.internalEndpoints[] +[↩ Parent](#status) + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    hoststring + Hostname assigned to the database
    +     		false
    portinteger + Database port name
    +     		false
    + + +### status.replicaSourceStatuses[] +[↩ Parent](#status) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    endpointHoststring + The internal host name of the replica source database. Can be used as an identifier. See the internalEndpoints list on the REDB status.
    +     		true
    laginteger + Lag in millisec between source and destination (while synced).
    +     		false
    lastErrorstring + Last error encountered when syncing from the source.
    +     		false
    lastUpdatestring + Time when we last receive an update from the source.
    +     		false
    rdbSizeinteger + The source’s RDB size to be transferred during the syncing phase.
    +     		false
    rdbTransferredinteger + Number of bytes transferred from the source’s RDB during the syncing phase.
    +     		false
    statusstring + Sync status of this source
    +     		false
    diff --git a/content/operate/kubernetes/7.22/reference/api/redis_enterprise_remote_cluster_api.md b/content/operate/kubernetes/7.22/reference/api/redis_enterprise_remote_cluster_api.md new file mode 100644 index 0000000000..670c637eaa --- /dev/null +++ b/content/operate/kubernetes/7.22/reference/api/redis_enterprise_remote_cluster_api.md @@ -0,0 +1,183 @@ +--- +title: RedisEnterpriseRemoteCluster API Reference +alwaysopen: false +categories: +- docs +- operate +- kubernetes +aliases: [/operate/kubernetes/reference/redis_enterprise_remote_cluster_api] +linkTitle: RERC API +weight: 30 +url: '/operate/kubernetes/7.22/reference/api/redis_enterprise_remote_cluster_api/' +--- + +apiVersion: + + +- [app.redislabs.com/v1alpha1](#appredislabscomv1alpha1) + + + + +# app.redislabs.com/v1alpha1 + + + + +RedisEntepriseRemoteCluster represents a remote participating cluster. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    apiVersionstringapp.redislabs.com/v1alpha1true
    kindstringRedisEnterpriseRemoteClustertrue
    metadataobjectRefer to the Kubernetes API documentation for the fields of the `metadata` field.true
    specobject +
    +     		false
    statusobject +
    +     		false
    + + +### spec +[↩ Parent](#) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    apiFqdnUrlstring + The URL of the cluster, will be used for the active-active database URL.
    +     		true
    recNamestring + The name of the REC that the RERC is pointing at
    +     		true
    recNamespacestring + The namespace of the REC that the RERC is pointing at
    +     		true
    apiPortinteger + The port number of the cluster's URL used for connectivity/sync
    +     		false
    dbFqdnSuffixstring + The database URL suffix, will be used for the active-active database replication endpoint and replication endpoint SNI.
    +     		false
    secretNamestring + The name of the secret containing cluster credentials. Must be of the following format: "redis-enterprise-"
    +     		false
    + + +### status +[↩ Parent](#) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    internalObservedSecretResourceVersionstring + The observed secret resource version. Used for internal purposes only.
    +     		false
    localboolean + Indicates whether this object represents a local or a remote cluster.
    +     		false
    observedGenerationinteger + The most recent generation observed for this RERC. It corresponds to the RERC's generation, which is updated by the API Server.
    +     		false
    specStatusstring + Whether the desired specification is valid.
    +     		false
    statusstring + The status of the remote cluster.
    +     		false
    diff --git a/content/operate/kubernetes/7.22/reference/supported_k8s_distributions.md b/content/operate/kubernetes/7.22/reference/supported_k8s_distributions.md new file mode 100644 index 0000000000..e26e948230 --- /dev/null +++ b/content/operate/kubernetes/7.22/reference/supported_k8s_distributions.md @@ -0,0 +1,270 @@ +--- +Title: Supported Kubernetes distributions +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Support matrix for the current Redis Enterprise K8s operator +linkTitle: Supported distributions +weight: 10 +url: '/operate/kubernetes/7.22/reference/supported_k8s_distributions/' +--- + +We thoroughly test each release of Redis Enterprise for Kubernetes against a set of Kubernetes distributions. The table below lists Redis Enterprise for Kubernetes versions and the Kubernetes distributions they support. + +{{}}x86 is currently the only computer architecture supported by Redis Enterprise for Kubernetes. Support for ARM architecture is coming in future releases.{{}} + +✅ Supported – This distribution is supported for this version of Redis Enterprise Software for Kubernetes. + +:warning: Deprecated – This distribution is still supported for this version of Redis Enterprise Software for Kubernetes, but support will be removed in a future release. + +❌ End of life – Support for this distribution ended. + +Any distribution not listed below is not supported for production workloads. + +{{}}Each platform is tested with its default configuration, including storage, network, security, and container runtime components.{{}} + +## Community Kubernetes + +For details on this platform, see the Kubernetes [documentation](https://kubernetes.io/docs/home/supported-doc-versions/). + +{{}} +| Redis operator | **7.22.0-15** | **7.22.0-7** | **7.8.6-1** | **7.8.4-9** | **7.8.4-8** | **7.8.2-6** | **7.4.6-2** | **7.4.2-12** | **7.4.2-2** | **7.2.4-12** | **7.2.4-7** | **7.2.4-2** | **6.4.2-8** | **6.4.2-6** | **6.4.2-5** | **6.4.2-4** | **6.2.18-41** | **6.2.18-3** | **6.2.12-1** | **6.2.10-45** | **6.2.10-34** | **6.2.10-4** | **6.2.8-15** | **6.2.8-11** | **6.2.8-2** | **6.2.4-1** | +|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| +| | July 2025 | April 2025 | March 2025 | March 2025 | Feb 2025 | Nov 2024 | July 2024 | May 2024 | March 2024 | Dec 2023 | Oct 2023 | Aug 2023 | July 2023 | June 2023 | April 2023 | March 2023 | Jan 2023 | Nov 2022 | Sept 2022 | July 2022 | May 2022 | March 2022 | Jan 2022 | Jan 2022 | Nov 2021 | Sept 2021 | +| **Community K8s** | | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.33 | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.32 | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | +| 1.31 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | +| 1.30 | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | +| 1.29 | ❌ | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | +| 1.28 | ❌ | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | +| 1.27 | | | | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | +| 1.26 | | | | | | | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | +| 1.25 | | | | | | | | | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | +| 1.24 | | | | | | | | | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | +| 1.23 | | | | | | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | +| 1.22 | | | | | | | | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | +| 1.21 | | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | +| 1.20 | | | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | +| 1.19 | | | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | +| 1.18 | | | | | | | | | | | | | | | | | | | | | | ✅ | ✅ | ✅ | ✅ | ✅ | +| 1.17 | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | :warning: | +| 1.16 | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | :warning: | + +{{}} + +## OpenShift Container Platform + +For details on this platform, see the [OpenShift documentation](https://docs.openshift.com/container-platform/4.13/welcome/index.html). + +{{}} +| Redis operator | **7.22.0-15** | **7.22.0-7** | **7.8.6-1** | **7.8.4-9** | **7.8.4-8** | **7.8.2-6** | **7.4.6-2** | **7.4.2-12** | **7.4.2-2** | **7.2.4-12** | **7.2.4-7** | **7.2.4-2** | **6.4.2-8** | **6.4.2-6** | **6.4.2-5** | **6.4.2-4** | **6.2.18-41** | **6.2.18-3** | **6.2.12-1** | **6.2.10-45** | **6.2.10-34** | **6.2.10-4** | **6.2.8-15** | **6.2.8-11** | **6.2.8-2** | **6.2.4-1** | +|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| +| | July 2025 | April 2025 | March 2025 | March 2025 | Feb 2025 | Nov 2024 | July 2024 | May 2024 | March 2024 | Dec 2023 | Oct 2023 | Aug 2023 | July 2023 | June 2023 | April 2023 | March 2023 | Jan 2023 | Nov 2022 | Sept 2022 | July 2022 | May 2022 | March 2022 | Jan 2022 | Jan 2022 | Nov 2021 | Sept 2021 | +| **OpenShift** | | | | | | | | | | | | | | | | | | | | | | | | | | | +| 4.19 | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | +| 4.18 | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | +| 4.17 | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | +| 4.16 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | +| 4.15 | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | +| 4.14 | ❌ | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | +| 4.13 | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | +| 4.12 | | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | +| 4.11 | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | +| 4.10 | | | | | | | | | ❌ | :warning: | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | +| 4.9 | | | | | | | | | | | | ❌ | :warning: | :warning: | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | +| 4.8 | | | | | | | | | | | | | ❌ | :warning: | :warning: | :warning: | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | +| 4.7 | | | | | | | | | | | | | | | | | | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | +| 4.6 | | | | | | | | | | | | | | | | | | | | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | +| 4.5 | | | | | | | | | | | | | | | | | | | | | ✅ | ✅ | ✅ | ✅ | ✅ | +| 3.11 | | | | | | | | | | | | | | | | | | | | ❌ | :warning: | :warning: | :warning: | :warning: | :warning: | + +{{}} + +## Amazon Elastic Kubernetes Service (EKS) + +For details on this platform, see the [EKS documentation](https://docs.aws.amazon.com/eks/?icmpid=docs_homepage_containers). + +{{}} +| Redis operator | **7.22.0-15** | **7.22.0-7** | **7.8.6-1** | **7.8.4-9** | **7.8.4-8** | **7.8.2-6** | **7.4.6-2** | **7.4.2-12** | **7.4.2-2** | **7.2.4-12** | **7.2.4-7** | **7.2.4-2** | **6.4.2-8** | **6.4.2-6** | **6.4.2-5** | **6.4.2-4** | **6.2.18-41** | **6.2.18-3** | **6.2.12-1** | **6.2.10-45** | **6.2.10-34** | **6.2.10-4** | **6.2.8-15** | **6.2.8-11** | **6.2.8-2** | **6.2.4-1** | +|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| +| | July 2025 | April 2025 | March 2025 | March 2025 | Feb 2025 | Nov 2024 | July 2024 | May 2024 | March 2024 | Dec 2023 | Oct 2023 | Aug 2023 | July 2023 | June 2023 | April 2023 | March 2023 | Jan 2023 | Nov 2022 | Sept 2022 | July 2022 | May 2022 | March 2022 | Jan 2022 | Jan 2022 | Nov 2021 | Sept 2021 | +| **Amazon EKS** | | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.33 | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.32 | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | +| 1.31 | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | +| 1.30 | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | +| 1.29 | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | +| 1.28 | ❌ | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | +| 1.27 | | ❌ | :warning: | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | +| 1.26 | | | ❌ | ❌ | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | +| 1.25 | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | +| 1.24 | | | | | | | | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | +| 1.23 | | | | | | | | ❌ | :warning: | :warning: | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | +| 1.22 | | | | | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | +| 1.21 | | | | | | | | | | | | | | | ❌ | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | +| 1.20 | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | +| 1.19 | | | | | | | | | | | | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | +| 1.18 | | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | + +{{}} + +## Azure Kubernetes Service (AKS) + +For details on this platform, see the [AKS documentation](https://learn.microsoft.com/en-us/azure/aks/). + +{{}} +| Redis operator | **7.22.0-15** | **7.22.0-7** | **7.8.6-1** | **7.8.4-9** | **7.8.4-8** | **7.8.2-6** | **7.4.6-2** | **7.4.2-12** | **7.4.2-2** | **7.2.4-12** | **7.2.4-7** | **7.2.4-2** | **6.4.2-8** | **6.4.2-6** | **6.4.2-5** | **6.4.2-4** | **6.2.18-41** | **6.2.18-3** | **6.2.12-1** | **6.2.10-45** | **6.2.10-34** | **6.2.10-4** | **6.2.8-15** | **6.2.8-11** | **6.2.8-2** | **6.2.4-1** | +|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| +| | July 2025 | April 2025 | March 2025 | March 2025 | Feb 2025 | Nov 2024 | July 2024 | May 2024 | March 2024 | Dec 2023 | Oct 2023 | Aug 2023 | July 2023 | June 2023 | April 2023 | March 2023 | Jan 2023 | Nov 2022 | Sept 2022 | July 2022 | May 2022 | March 2022 | Jan 2022 | Jan 2022 | Nov 2021 | Sept 2021 | +| **Azure AKS** | | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.33 | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.32 | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | +| 1.31 | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | +| 1.30 | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | +| 1.29 | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | +| 1.28 | ❌ | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | +| 1.27 | | | ❌ | :warning: | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | +| 1.26 | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | +| 1.25 | | | | | | | | | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | +| 1.24 | | | | | | | | | | | | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | +| 1.23 | | | | | | | | | | | | ❌ | :warning: | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | +| 1.22 | | | | | | | | | | | | | | | | | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | +| 1.21 | | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | +| 1.20 | | | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | | +| 1.19 | | | | | | | | | | | | | | | | | | | | ❌ | :warning: | | ✅ | ✅ | ✅ | ✅ | +| 1.18 | | | | | | | | | | | | | | | | | | | | | | | | | | ✅ | + +{{}} + +## Google Kubernetes Engine (GKE) + +For details on this platform, see the [GKE documentation](https://cloud.google.com/kubernetes-engine/docs). + +{{}} +| Redis operator | **7.22.0-15** | **7.22.0-7** | **7.8.6-1** | **7.8.4-9** | **7.8.4-8** | **7.8.2-6** | **7.4.6-2** | **7.4.2-12** | **7.4.2-2** | **7.2.4-12** | **7.2.4-7** | **7.2.4-2** | **6.4.2-8** | **6.4.2-6** | **6.4.2-5** | **6.4.2-4** | **6.2.18-41** | **6.2.18-3** | **6.2.12-1** | **6.2.10-45** | **6.2.10-34** | **6.2.10-4** | **6.2.8-15** | **6.2.8-11** | **6.2.8-2** | **6.2.4-1** | +|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| +| | July 2025 | April 2025 | March 2025 | March 2025 | Feb 2025 | Nov 2024 | July 2024 | May 2024 | March 2024 | Dec 2023 | Oct 2023 | Aug 2023 | July 2023 | June 2023 | April 2023 | March 2023 | Jan 2023 | Nov 2022 | Sept 2022 | July 2022 | May 2022 | March 2022 | Jan 2022 | Jan 2022 | Nov 2021 | Sept 2021 | +| **Google GKE** | | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.33 | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.32 | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | +| 1.31 | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | +| 1.30 | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | +| 1.29 | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | +| 1.28 | ❌ | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | +| 1.27 | | | | ❌ | ❌ | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | +| 1.26 | | | | | | | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | +| 1.25 | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | +| 1.24 | | | | | | | | | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | +| 1.23 | | | | | | | | | | ❌ | :warning: | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | +| 1.22 | | | | | | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | +| 1.21 | | | | | | | | | | | | | | | | ❌ | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | +| 1.20 | | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | +| 1.19 | | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | | ✅ | ✅ | ✅ | ✅ | +| 1.18 | | | | | | | | | | | | | | | | | | | | | | | | | | ✅ | + +{{}} + +## Rancher + +For details on this platform, see the [Rancher documentation](https://ranchermanager.docs.rancher.com/). + +{{}} +| Redis operator | **7.22.0-15** | **7.22.0-7** | **7.8.6-1** | **7.8.4-9** | **7.8.4-8** | **7.8.2-6** | **7.4.6-2** | **7.4.2-12** | **7.4.2-2** | **7.2.4-12** | **7.2.4-7** | **7.2.4-2** | **6.4.2-8** | **6.4.2-6** | **6.4.2-5** | **6.4.2-4** | **6.2.18-41** | **6.2.18-3** | **6.2.12-1** | **6.2.10-45** | **6.2.10-34** | **6.2.10-4** | **6.2.8-15** | **6.2.8-11** | **6.2.8-2** | **6.2.4-1** | +|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| +| | July 2025 | April 2025 | March 2025 | March 2025 | Feb 2025 | Nov 2024 | July 2024 | May 2024 | March 2024 | Dec 2023 | Oct 2023 | Aug 2023 | July 2023 | June 2023 | April 2023 | March 2023 | Jan 2023 | Nov 2022 | Sept 2022 | July 2022 | May 2022 | March 2022 | Jan 2022 | Jan 2022 | Nov 2021 | Sept 2021 | +| **Rancher 2.10** | | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.30 | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.29 | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | +| **Rancher 2.9** | | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.31 | | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | +| 1.30 | | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | +| 1.29 | | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | +| **Rancher 2.8** | | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.30 | | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.29 | | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.28 | | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | +| 1.27 | | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | +| 1.26 | | ❌ | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | +| **Rancher 2.7** | | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.25 | | | | | | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | +| 1.24 | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | +| 1.23 | | | | | | | | ❌ | :warning: | :warning: | :warning: | :warning: | :warning: | ✅ | ✅ | | | | | | | | | | | +| **Rancher 2.6** | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.24 | | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | +| 1.23 | | | | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | +| 1.22 | | | | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | +| 1.21 | | | | | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | +| 1.20 | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | | | | | | | +| 1.19 | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | | | | | | | +| 1.18 | | | | | | | | | | | | | | | | | | | :warning: | | | | | | | +| **Rancher 2.5** | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.20 | | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | +| 1.19 | | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | +| 1.18 | | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | +| 1.17 | | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | +| **Rancher 2.4** | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.18 | | | | | | | | | | | | | | | | | | | | | | | :warning: | ✅ | +| 1.17 | | | | | | | | | | | | | | | | | | | | | | | :warning: | ✅ | + +{{}} + +## VMware Tanzu Kubernetes Grid Integrated Edition (TKGI) + +For details on this platform, see the [TKGI documentation](https://docs.vmware.com/en/VMware-Tanzu-Kubernetes-Grid-Integrated-Edition/index.html). + +{{}} +| Redis operator | **7.22.0-15** | **7.22.0-7** | **7.8.6-1** | **7.8.4-9** | **7.8.4-8** | **7.8.2-6** | **7.4.6-2** | **7.4.2-12** | **7.4.2-2** | **7.2.4-12** | **7.2.4-7** | **7.2.4-2** | **6.4.2-8** | **6.4.2-6** | **6.4.2-5** | **6.4.2-4** | **6.2.18-41** | **6.2.18-3** | **6.2.12-1** | **6.2.10-45** | **6.2.10-34** | **6.2.10-4** | **6.2.8-15** | **6.2.8-11** | **6.2.8-2** | **6.2.4-1** | +|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| +| | July 2025 | April 2025 | March 2025 | March 2025 | Feb 2025 | Nov 2024 | July 2024 | May 2024 | March 2024 | Dec 2023 | Oct 2023 | Aug 2023 | July 2023 | June 2023 | April 2023 | March 2023 | Jan 2023 | Nov 2022 | Sept 2022 | July 2022 | May 2022 | March 2022 | Jan 2022 | Jan 2022 | Nov 2021 | Sept 2021 | +| **VMware TKGI** | | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.21 | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.20 | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | +| 1.19 | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | +| 1.18 | ❌ | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | +| 1.17 | ❌ | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | +| 1.16 | | | | ❌ | ❌ | ❌ | :warning: | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | +| 1.15 | | | | | | | | | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | +| 1.14 | | | | | | | | | ❌ | :warning: | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | +| 1.13 | | | | | | | | | | | ❌ | :warning: | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | | | | | | | +| 1.12 | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | | | | | | +| 1.11 | | | | | | | | | | | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | | | | | +| 1.10 | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | +| 1.09 | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.08 | | | | | | | | | | | | | | | | | | | | | | | | ❌ | :warning: | +| 1.07 | | | | | | | | | | | | | | | | | | | | | | | | ❌ | :warning: | + +{{}} + +## VMware Tanzu Kubernetes Grid (TKG) + +For details on this platform, see the [TKG documentation](https://docs.vmware.com/en/VMware-Tanzu-Kubernetes-Grid/index.html). + +{{}} +| Redis operator | **7.22.0-15** | **7.22.0-7** | **7.8.6-1** | **7.8.4-9** | **7.8.4-8** | **7.8.2-6** | **7.4.6-2** | **7.4.2-12** | **7.4.2-2** | **7.2.4-12** | **7.2.4-7** | **7.2.4-2** | **6.4.2-8** | **6.4.2-6** | **6.4.2-5** | **6.4.2-4** | **6.2.18-41** | +|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| +| | July 2025 | April 2025 | March 2025 | March 2025 | Feb 2025 | Nov 2024 | July 2024 | May 2024 | March 2024 | Dec 2023 | Oct 2023 | Aug 2023 | July 2023 | June 2023 | April 2023 | March 2023 | Jan 2023 | +| **VMWare TKG 2.4** | | | | | | | | | | | | | | | | | | +| 1.27 | | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | +| 1.26 | | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | +| 1.25 | | | | | | | | ✅ | ✅ | | | | | | | | | +| **VMware TKG 2.3** | | | | | | | | | | | | | | | | | +| 1.26 | | ❌ | :warning: | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | | | | | | | | +| 1.25 | | | | | | ❌ | ✅ | ✅ | ✅ | | | | | | | | +| 1.24 | | | | | | ❌ | ✅ | ✅ | ✅ | | | | | | | | +| **VMware TKG 2.2** | | | | | | | | | | | | | | | | | +| 1.25 | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | | | | | | +| 1.24 | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | | | | | | +| 1.23 | | | | | | | | ❌ | ✅ | ✅ | ✅ | | | | | | +| **VMware TKG 2.1** | | | | | | | | | | | | | | | | | +| 1.24 | | | | | | | | ❌ | ✅ | ✅ | ✅ | | | | | | +| 1.23 | | | | | | | | ❌ | :warning: | :warning: | :warning: | | | | | | +| 1.22 | | | | | | | | | ❌ | :warning: | :warning: | | | | | | +| **VMware TKG 1.6** | | | | | | | | | | | | | | | | | +| 1.24 | | | | | | | | | | :warning: | :warning: | | | | | | +| 1.23 | | | | | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | +| 1.22 | | | | | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | + +{{}} diff --git a/content/operate/kubernetes/7.22/reference/yaml/_index.md b/content/operate/kubernetes/7.22/reference/yaml/_index.md new file mode 100644 index 0000000000..4abbf2bb59 --- /dev/null +++ b/content/operate/kubernetes/7.22/reference/yaml/_index.md @@ -0,0 +1,89 @@ +--- +Title: YAML examples +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Example YAML files for deploying Redis Enterprise on Kubernetes with different configurations. +hideListLinks: true +linkTitle: YAML examples +weight: 85 +url: '/operate/kubernetes/7.22/reference/yaml/' +--- + +This section provides complete YAML examples that cover common Redis Enterprise for Kubernetes deployment scenarios. Each example includes the necessary configuration files and step-by-step instructions for editing and applying them. + +## How to use these examples + +### Download and customize + +1. Copy the YAML content from the examples below +2. Save each YAML block to a separate file with a descriptive name +3. Edit the configuration values to match your environment +4. Apply the files in the correct order using `kubectl apply` + +### Configuration storage + +Redis Enterprise for Kubernetes stores configuration in several places: + +- Custom resources: Cluster and database specifications are stored as Kubernetes custom resources (REC, REDB, REAADB, RERC) +- Secrets: Sensitive data like passwords and certificates are stored in Kubernetes secrets +- ConfigMaps: Non-sensitive configuration data is stored in ConfigMaps +- RBAC resources: Permissions are defined through Roles, ClusterRoles, and their bindings + +### Applying YAML files + +Apply YAML files using `kubectl apply`: + +```bash +# Apply a single file +kubectl apply -f my-config.yaml + +# Apply multiple files +kubectl apply -f rbac/ -f cluster/ -f database/ + +# Validate files without applying +kubectl apply --dry-run=client -f my-config.yaml +``` + +### Monitoring deployment + +Check the status of your resources after applying: + +```bash +# Check operator deployment +kubectl get deployment redis-enterprise-operator + +# Check cluster status +kubectl get rec +kubectl describe rec + +# Check database status +kubectl get redb +kubectl describe redb + +# View events for troubleshooting +kubectl get events --sort-by=.metadata.creationTimestamp +``` + +## Example categories + +- [Basic deployment examples]({{< relref "/operate/kubernetes/7.22/reference/yaml/basic-deployment" >}}) - Service account, RBAC, cluster, and database configurations +- [Rack awareness examples]({{< relref "/operate/kubernetes/7.22/reference/yaml/rack-awareness" >}}) - Rack-aware cluster configuration and required RBAC +- [Active-Active examples]({{< relref "/operate/kubernetes/7.22/reference/yaml/active-active" >}}) - Multi-cluster Active-Active database setup +- [Multi-namespace examples]({{< relref "/operate/kubernetes/7.22/reference/yaml/multi-namespace" >}}) - Cross-namespace operator and cluster configurations +- [Log collector RBAC examples]({{< relref "/operate/kubernetes/7.22/reference/yaml/log-collector-rbac" >}}) - RBAC permissions for log collection in restricted and all modes + +## Best practices + +- Validate configuration: Use `kubectl apply --dry-run=client` to validate YAML syntax and object schemas before applying +- Version control: Store your customized YAML files in version control +- Resource naming: Use consistent, descriptive names for all resources + +## Related documentation + +- [Reference]({{< relref "/operate/kubernetes/7.22/reference" >}}) - Complete API specifications for all custom resources +- [Deploy Redis Enterprise Software for Kubernetes]({{< relref "/operate/kubernetes/7.22/deployment/quick-start" >}}) - Step-by-step deployment instructions +- [Manage databases in multiple namespaces]({{< relref "/operate/kubernetes/7.22/re-clusters/multi-namespace" >}}) - Detailed multi-namespace setup instructions +- [Active-Active databases]({{< relref "/operate/kubernetes/7.22/active-active" >}}) - Active-Active configuration and management diff --git a/content/operate/kubernetes/7.22/reference/yaml/active-active.md b/content/operate/kubernetes/7.22/reference/yaml/active-active.md new file mode 100644 index 0000000000..5c4461d6ca --- /dev/null +++ b/content/operate/kubernetes/7.22/reference/yaml/active-active.md @@ -0,0 +1,94 @@ +--- +Title: Active-Active examples +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: YAML examples for Active-Active Redis Enterprise databases across multiple Kubernetes clusters. +linkTitle: Active-Active +weight: 30 +url: '/operate/kubernetes/7.22/reference/yaml/active-active/' +--- + +This page provides YAML examples for deploying Active-Active Redis Enterprise databases across multiple Kubernetes clusters. Active-Active databases provide multi-master replication with conflict resolution, enabling global distribution and local read/write access. + +For complete deployment instructions, see [Active-Active databases]({{< relref "/operate/kubernetes/7.22/active-active" >}}). + +## Applying the configuration + +To deploy Active-Active databases using these YAML files, follow [Create Active-Active database (REAADB)]({{< relref "/operate/kubernetes/7.22/active-active/create-reaadb" >}}), which provides detailed instructions for preparing clusters, creating RERC resources, and deploying REAADB configurations. + +## Namespace examples + +A namespace is an abstraction used by Kubernetes to support multiple virtual clusters on the same physical cluster. + +`ns-illinois.yaml` is used in [Create Active-Active database]({{< relref "/operate/kubernetes/7.22/active-active/create-reaadb#example-values" >}}). + +{{}} + +`ns-virginia.yaml` is used in [Create Active-Active database]({{< relref "/operate/kubernetes/7.22/active-active/create-reaadb#example-values" >}}). + +{{}} + +## REC examples + +A Redis Enterprise cluster is a collection of Redis Enterprise nodes that pools system resources across nodes and supports multi-tenant database instances. + +`rec-chicago.yaml` is used in [Create Active-Active database]({{< relref "/operate/kubernetes/7.22/active-active/create-reaadb#prerequisites" >}}) and [Create RERC]({{< relref "/operate/kubernetes/7.22/active-active/create-reaadb#create-rerc" >}}). + +{{}} + +`rec-arlington.yaml` is used in [Create Active-Active database]({{< relref "/operate/kubernetes/7.22/active-active/create-reaadb#prerequisites" >}}) and [Create RERC]({{< relref "/operate/kubernetes/7.22/active-active/create-reaadb#create-rerc" >}}). + +{{}} + +## RERC examples + +RedisEnterpriseRemoteCluster represents a remote participating cluster. + +`rerc-ohare.yaml` is used in the [Create RERC]({{< relref "/operate/kubernetes/7.22/active-active/create-reaadb#create-rerc" >}}) section. + +{{}} + +`rerc-raegan.yaml` is used in the [Create RERC]({{< relref "/operate/kubernetes/7.22/active-active/create-reaadb#create-rerc" >}}) section. + +{{}} + +### RERC configuration + +- [metadata.name]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_remote_cluster_api#appredislabscomv1alpha1" >}}): Unique name for this remote cluster reference +- [spec.recName]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_remote_cluster_api#spec" >}}): Name of the remote REC +- [spec.recNamespace]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_remote_cluster_api#spec" >}}): Namespace of the remote REC +- [spec.apiFqdnUrl]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_remote_cluster_api#spec" >}}): API endpoint URL for the remote cluster +- [spec.dbFqdnSuffix]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_remote_cluster_api#spec" >}}): Database hostname suffix for the remote cluster +- [spec.secretName]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_remote_cluster_api#spec" >}}): Secret containing authentication credentials + +Edit the values in the downloaded YAML file for your specific setup, updating the remote cluster details, API endpoints, and secret names to match your actual environment. + +## Active-Active database examples + +Active-Active databases are geo-distributed databases that span multiple Redis Enterprise clusters and use multi-primary replication and conflict-free replicated data types (CRDTs). + +`reaadb-boeing.yaml` is used in the [Create Active-Active database]({{< relref "/operate/kubernetes/7.22/active-active/create-reaadb#create-reaadb" >}}) section. + +{{}} + +### REAADB configuration + +- [metadata.name]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_active_active_database_api#appredislabscomv1alpha1" >}}): Active-Active database name +- [spec.participatingClusters]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_active_active_database_api#specparticipatingclusters" >}}): List of RERC names that participate in this database +- [spec.globalConfigurations]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_active_active_database_api#specglobalconfigurations" >}}): Database settings applied to all participating clusters + +Edit the downloaded YAML file to add global database settings such as memory allocation, shard count, replication settings, database secrets, Redis modules, and database-specific Redis configuration. + +## Related documentation + +- [Active-Active databases (index)]({{< relref "/operate/kubernetes/7.22/active-active" >}}) +- [Prepare participating clusters]({{< relref "/operate/kubernetes/7.22/active-active/prepare-clusters" >}}) +- [Create Active-Active database (REAADB)]({{< relref "/operate/kubernetes/7.22/active-active/create-reaadb" >}}) +- [Edit global configuration]({{< relref "/operate/kubernetes/7.22/active-active/global-config" >}}) +- [Sync global database secret]({{< relref "/operate/kubernetes/7.22/active-active/global-db-secret" >}}) +- [RERC API reference]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_remote_cluster_api" >}}) +- [REAADB API reference]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_active_active_database_api" >}}) +- [Networking configuration]({{< relref "/operate/kubernetes/7.22/networking" >}}) diff --git a/content/operate/kubernetes/7.22/reference/yaml/basic-deployment.md b/content/operate/kubernetes/7.22/reference/yaml/basic-deployment.md new file mode 100644 index 0000000000..c9181f228e --- /dev/null +++ b/content/operate/kubernetes/7.22/reference/yaml/basic-deployment.md @@ -0,0 +1,93 @@ +--- +Title: Basic deployment examples +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: YAML examples for basic Redis Enterprise deployment including RBAC, cluster, and database configurations. +linkTitle: Basic deployment +weight: 10 +url: '/operate/kubernetes/7.22/reference/yaml/basic-deployment/' +--- + +This page provides complete YAML examples for a basic Redis Enterprise deployment on Kubernetes. These examples include all the essential components you need to deploy a Redis Enterprise cluster and create a database. + +For complete deployment instructions, see [Deploy on Kubernetes]({{< relref "/operate/kubernetes/7.22/deployment/quick-start" >}}). + +## Service account + +The service account provides an identity for the Redis Enterprise operator. + +{{}} + +Service account configuration: +- `name`: The service account name used by the operator +- `labels`: Standard labels for Redis Enterprise resources + +## Role + +The Role defines the permissions needed by the Redis Enterprise operator within the namespace. + +{{}} + +Role configuration: +- `name`: Must match the role name referenced in the role binding +- `rules`: Comprehensive permissions for managing Redis Enterprise resources +- `apiGroups`: Includes core Kubernetes APIs and Redis Enterprise custom resources + +Key permissions: +- `app.redislabs.com`: Full access to Redis Enterprise custom resources +- `secrets`: Manage TLS certificates and database credentials +- `services`: Create and manage service endpoints +- `pods`: Monitor and manage Redis Enterprise pods +- `persistentvolumeclaims`: Manage persistent storage + +## Role binding + +The RoleBinding connects the service account to the role, granting the necessary permissions. + +{{}} + +Role binding configuration: +- `subjects.name`: Must match the service account name +- `roleRef.name`: Must match the role name +- `namespace`: Apply in the same namespace as other resources + +## Redis Enterprise cluster + +The RedisEnterpriseCluster (REC) custom resource defines the cluster specification. + +{{}} + +Cluster configuration: +- `metadata.name`: Cluster name (cannot be changed after creation) +- `spec.nodes`: Number of Redis Enterprise nodes (minimum 3) +- `persistentSpec.volumeSize`: Storage size per node +- `redisEnterpriseNodeResources`: CPU and memory allocation per node + +Edit the values in the downloaded YAML file based on your requirements, such as increasing the number of nodes, adjusting storage size, or modifying resource allocation. + +## Redis Enterprise database + +The RedisEnterpriseDatabase (REDB) custom resource defines the database specification. + +{{}} + +Database configuration: +- `metadata.name`: Database name +- `spec.memorySize`: Memory allocation for the database +- `spec.shardCount`: Number of shards (affects performance and scalability) +- `spec.replication`: Enable/disable database replication + +Edit the values in the downloaded YAML file based on your requirements, such as increasing memory for larger datasets, adding more shards for better performance, enabling replication for high availability, or adding Redis modules. + +## Apply the configuration + +To deploy these YAML files, follow [Deploy on Kubernetes]({{< relref "/operate/kubernetes/7.22/deployment/quick-start" >}}), which provides step-by-step instructions for creating namespaces, deploying the operator, and applying these configuration files. + +## Related documentation + +- [Deploy on Kubernetes]({{< relref "/operate/kubernetes/7.22/deployment/quick-start" >}}) +- [REC API reference]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api" >}}) +- [REDB API reference]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_database_api" >}}) diff --git a/content/operate/kubernetes/7.22/reference/yaml/log-collector-rbac.md b/content/operate/kubernetes/7.22/reference/yaml/log-collector-rbac.md new file mode 100644 index 0000000000..077bcdc487 --- /dev/null +++ b/content/operate/kubernetes/7.22/reference/yaml/log-collector-rbac.md @@ -0,0 +1,155 @@ +--- +Title: Log collector RBAC examples +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: YAML examples for configuring RBAC permissions for the Redis Enterprise log collector tool in `restricted` and `all` modes. +linkTitle: Log collector RBAC +weight: 50 +url: '/operate/kubernetes/7.22/reference/yaml/log-collector-rbac/' +--- + +This page provides YAML examples for configuring RBAC permissions for the Redis Enterprise log collector tool. The log collector requires different permission levels depending on the collection mode you choose. + +For complete log collection instructions, see [Collect logs]({{< relref "/operate/kubernetes/7.22/logs/collect-logs" >}}). + +## Prerequisites + +- Install the [Redis Enterprise operator]({{< relref "/operate/kubernetes/7.22/deployment" >}}) +- Appropriate permissions to create RBAC resources in target namespaces +- Understanding of your deployment model (single namespace, multi-namespace, etc.) + +## Collection modes + +The log collector has two collection modes that require different RBAC permissions: + +- **`restricted` mode** (recommended): Collects only Redis Enterprise resources with minimal security exposure. Default for versions 6.2.18-3+. +- **`all` mode**: Collects comprehensive cluster information including nodes, storage classes, and operator resources. Use when specifically requested by Redis Support. + +## `restricted` mode RBAC + +The `restricted` mode configuration provides minimal permissions for collecting Redis Enterprise resources only. + +{{}} + +`restricted` mode configuration: + +- `Role`: Namespace-scoped permissions for Redis Enterprise resources +- `ClusterRole`: Cluster-wide permissions for CRDs and basic cluster resources +- `rules`: Minimal permissions for Redis Enterprise diagnostics + +Key permissions: + +- `pods, pods/log, pods/exec`: Access to pod information and logs +- `app.redislabs.com/*`: All Redis Enterprise custom resources +- `persistentvolumes`: Storage information for troubleshooting + +## `all` mode RBAC + +The `all` mode configuration provides comprehensive permissions for collecting detailed cluster information. + +{{}} + +`all` mode configuration: + +- `Role`: Extended namespace permissions including operator resources +- `ClusterRole`: Additional cluster-wide permissions for nodes and storage +- `rules`: Comprehensive permissions for full cluster diagnostics + +Additional permissions in `all` mode: + +- `nodes`: Node information and status +- `storageclasses, volumeattachments`: Storage system details +- `operators.coreos.com/*`: OpenShift operator information +- `networking.istio.io/*`: Istio service mesh resources + +## Apply the configuration + +### Namespace requirements + +Create the Role and RoleBinding in every namespace where you need to collect logs: + +- Single namespace: Apply to the namespace where Redis Enterprise runs +- Multi-namespace with single REC: Apply to the REC namespace plus each REDB namespace +- Multi-namespace with multiple RECs: Apply to each REC namespace + +The ClusterRole and ClusterRoleBinding need to be created only once per cluster. + +Edit the values in the downloaded YAML file for your specific setup, updating the namespace references and role binding subjects to match your environment. + +### Role binding configuration + +The RBAC configurations include both roles and role bindings. The role bindings must reference the user or service account that will execute the log collector: + +- User subject: If running the log collector as a specific user, update the `subjects` section in the RoleBinding and ClusterRoleBinding to reference your username +- Service account: If using a service account, create or reference the appropriate service account in the role bindings + +### Manual deployment + +To apply the RBAC configurations manually: + +```bash +# Apply restricted mode RBAC +kubectl apply -f log-collector-restricted-rbac.yaml --namespace + +# Apply all mode RBAC +kubectl apply -f log-collector-all-rbac.yaml --namespace +``` + +## Usage + +After applying the RBAC configuration, run the log collector: + +```bash +# Restricted mode (default for 6.2.18-3+) +python log_collector.py -m restricted -n + +# All mode +python log_collector.py -m all -n +``` + +## Security considerations + +### Best practices + +- Use `restricted` mode unless you specifically need additional cluster information +- Limit namespace access to only where log collection is needed +- Handle collected data according to your organization's security policies + +### Secrets permission explanation + +The RBAC configurations request read access to secrets in the collected namespaces. **Secrets are not collected or included in the log package sent to Redis Support.** This permission is required because: + +- The log collector uses Helm commands (`helm list`, `helm get all`) to gather Redis Enterprise Helm chart deployment information +- Helm stores its deployment metadata in Kubernetes secrets +- This metadata contains only deployment configuration (not sensitive data) + +If your security policies prohibit secrets access, you can remove the secrets permission from the Role, but this will limit the log collector's ability to gather Helm deployment information. + +## Troubleshooting + +### Permission errors + +- Verify that roles and bindings are applied correctly in the target namespaces +- Check that the ClusterRole is applied cluster-wide +- Ensure the service account has proper role bindings + +### Missing resources + +- Consider switching to `all` mode if additional cluster resources are needed +- Verify that custom resource definitions are installed +- Check that the operator has proper permissions + +## Next steps + +- [Collect logs guide]({{< relref "/operate/kubernetes/7.22/logs/collect-logs" >}}) +- [Basic deployment examples]({{< relref "/operate/kubernetes/7.22/reference/yaml/basic-deployment" >}}) +- [Multi-namespace deployment]({{< relref "/operate/kubernetes/7.22/reference/yaml/multi-namespace" >}}) + +## Related documentation + +- [Kubernetes RBAC documentation](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) +- [Redis Enterprise troubleshooting]({{< relref "/operate/kubernetes/7.22/logs" >}}) +- [Operator deployment guide]({{< relref "/operate/kubernetes/7.22/deployment" >}}) diff --git a/content/operate/kubernetes/7.22/reference/yaml/multi-namespace.md b/content/operate/kubernetes/7.22/reference/yaml/multi-namespace.md new file mode 100644 index 0000000000..7d24a4c0b7 --- /dev/null +++ b/content/operate/kubernetes/7.22/reference/yaml/multi-namespace.md @@ -0,0 +1,68 @@ +--- +Title: Multi-namespace examples +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: YAML examples for deploying Redis Enterprise across multiple Kubernetes namespaces. +linkTitle: Multi-namespace +weight: 40 +url: '/operate/kubernetes/7.22/reference/yaml/multi-namespace/' +--- + +Multi-namespace deployment lets a single Redis Enterprise operator manage clusters and databases in different namespaces, providing better resource isolation and organization. + +Multi-namespace deployment enables: +- Namespace isolation: Separate Redis Enterprise resources by team, environment, or application +- Centralized management: Single operator manages multiple namespaces +- Resource sharing: Efficient use of cluster resources across namespaces +- Flexible RBAC: Fine-grained permissions per namespace + +This example shows: +- Operator namespace: `redis-enterprise-operator` (where the operator and REC run) +- Consumer namespaces: `app-production`, `app-staging` (where REDB resources are created) + +For complete deployment instructions, see [Manage databases in multiple namespaces]({{< relref "/operate/kubernetes/7.22/re-clusters/multi-namespace" >}}). + +## Operator service account + +Deploy these resources in the namespace where the Redis Enterprise operator runs. + +{{}} + +## Operator cluster role + +Grant the operator cluster-wide permissions to manage resources across namespaces. + +{{}} + +## Operator cluster role binding + +{{}} + +## Consumer role + +{{}} + +## Consumer role binding + +{{}} + +Consumer namespace configuration: + +- `subjects.name`: Must match the operator service account name +- `subjects.namespace`: Must be the operator namespace, not the consumer namespace +- `roleRef.name`: Must match the consumer role name + +## Next steps + +- [Configure networking across namespaces]({{< relref "/operate/kubernetes/7.22/networking" >}}) +- [Set up monitoring for multi-namespace deployment]({{< relref "/operate/kubernetes/7.22/re-clusters/connect-prometheus-operator" >}}) +- [Learn about resource management]({{< relref "/operate/kubernetes/7.22/recommendations" >}}) + +## Related documentation + +- [Manage databases in multiple namespaces]({{< relref "/operate/kubernetes/7.22/re-clusters/multi-namespace" >}}) +- [RBAC configuration]({{< relref "/operate/kubernetes/7.22/security" >}}) +- [Kubernetes namespaces](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/) diff --git a/content/operate/kubernetes/7.22/reference/yaml/rack-awareness.md b/content/operate/kubernetes/7.22/reference/yaml/rack-awareness.md new file mode 100644 index 0000000000..a23df18224 --- /dev/null +++ b/content/operate/kubernetes/7.22/reference/yaml/rack-awareness.md @@ -0,0 +1,132 @@ +--- +Title: Rack awareness examples +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: YAML examples for rack-aware Redis Enterprise deployments that distribute nodes across availability zones. +linkTitle: Rack awareness +weight: 20 +url: '/operate/kubernetes/7.22/reference/yaml/rack-awareness/' +--- + +This page provides YAML examples for deploying Redis Enterprise with [rack awareness]({{< relref "/operate/kubernetes/7.22/recommendations/node-selection#using-rack-awareness" >}}). Rack awareness distributes Redis Enterprise nodes and database shards across different availability zones or failure domains to improve high availability and fault tolerance. + +## Prerequisites + +- Label [Kubernetes nodes](https://kubernetes.io/docs/concepts/architecture/nodes/) with zone information +- Typically uses the standard label `topology.kubernetes.io/zone` +- Verify node labels: `kubectl get nodes -o custom-columns="name:metadata.name","rack\\zone:metadata.labels.topology\.kubernetes\.io/zone"` +- Install the [Redis Enterprise operator]({{< relref "/operate/kubernetes/7.22/deployment" >}}) + +For complete deployment instructions, see [Deploy on Kubernetes]({{< relref "/operate/kubernetes/7.22/deployment" >}}). + +## Service account + +The service account for rack-aware deployments is the same as [basic deployments]({{< relref "/operate/kubernetes/7.22/reference/yaml/basic-deployment#service-account" >}}). + +{{}} + +## Cluster role + +Rack awareness requires additional permissions to read [node labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) across the cluster. + +{{}} + +Cluster role configuration: + +- `name`: ClusterRole name for rack awareness permissions +- `rules`: Permissions to read nodes and their labels cluster-wide +- `resources`: Access to `nodes` resource for zone label discovery + +Key permissions: + +- `nodes`: Read access to discover node zone labels +- `get, list, watch`: Monitor node changes and zone assignments + +## Cluster role binding + +The [ClusterRoleBinding](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding) grants cluster-wide permissions to the service account. + +{{}} + +Cluster role binding configuration: + +- `subjects.name`: Must match the service account name +- `subjects.namespace`: Namespace where the operator is deployed +- `roleRef.name`: Must match the cluster role name + +## Rack-aware Redis Enterprise cluster + +The rack-aware [REC configuration]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api" >}}) includes the `rackAwarenessNodeLabel` field. + +{{}} + +Rack-aware cluster configuration: + +- `metadata.name`: Cluster name (cannot be changed after creation) +- `spec.rackAwarenessNodeLabel`: Node label used for zone identification +- `spec.nodes`: Minimum 3 nodes, ideally distributed across zones + +Edit the values in the downloaded YAML file based on your environment, such as increasing nodes for better zone distribution, using custom zone labels, adding resource specifications, or enabling persistent storage. + +### Common zone labels + +Different Kubernetes distributions use different zone labels: + +- `Standard`: `topology.kubernetes.io/zone` +- `Legacy`: `failure-domain.beta.kubernetes.io/zone` +- `Custom`: Your organization's specific labeling scheme + +Verify the correct label on your nodes: + +```bash +kubectl get nodes -o custom-columns="name:metadata.name","rack\\zone:metadata.labels.topology\.kubernetes\.io/zone" +``` + +## Redis Enterprise database + +Database configuration for rack-aware clusters is the same as [basic deployments]({{< relref "/operate/kubernetes/7.22/reference/yaml/basic-deployment#redis-enterprise-database" >}}). + +**Important**: For rack awareness to be effective, ensure your database has replication enabled. Rack awareness distributes primary and replica shards across zones, so databases without replication will not benefit from zone distribution. + +{{}} + +## Apply the configuration + +To deploy rack-aware Redis Enterprise clusters, follow [Deploy on Kubernetes]({{< relref "/operate/kubernetes/7.22/deployment" >}}) and ensure your Kubernetes nodes have proper zone labels. For detailed rack awareness configuration, see the [node selection recommendations]({{< relref "/operate/kubernetes/7.22/recommendations/node-selection" >}}). + +## Troubleshooting + +### Nodes not distributed across zones + +- Verify node labels are correct +- Check that sufficient nodes exist in each zone +- Ensure the `rackAwarenessNodeLabel` matches actual node labels + +### Cluster role permissions denied + +- Verify the ClusterRole and ClusterRoleBinding are applied +- Check that the service account name matches in all resources + +### Database shards not distributed + +- Confirm the cluster has rack awareness enabled +- **Check that the database has replication enabled** - rack awareness distributes primary/replica pairs across zones +- Verify the database has multiple shards +- Ensure sufficient nodes exist across zones + +## Next steps + +- [Configure Active-Active databases]({{< relref "/operate/kubernetes/7.22/reference/yaml/active-active" >}}) +- [Set up multi-namespace deployment]({{< relref "/operate/kubernetes/7.22/reference/yaml/multi-namespace" >}}) +- [Learn about database replication]({{< relref "/operate/kubernetes/7.22/re-databases/replica-redb" >}}) + +## Related documentation + +- [Node selection recommendations]({{< relref "/operate/kubernetes/7.22/recommendations/node-selection" >}}) +- [REC API reference]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api" >}}) +- [REDB API reference]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_database_api" >}}) +- [Kubernetes node affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) +- [Redis Enterprise cluster architecture]({{< relref "/operate/kubernetes/7.22/architecture" >}}) diff --git a/content/operate/kubernetes/7.22/security/_index.md b/content/operate/kubernetes/7.22/security/_index.md new file mode 100644 index 0000000000..15dca1ac31 --- /dev/null +++ b/content/operate/kubernetes/7.22/security/_index.md @@ -0,0 +1,36 @@ +--- +Title: Security +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Configure security settings for Redis Enterprise clusters and databases on Kubernetes. +hideListLinks: true +linkTitle: Security +weight: 50 +url: '/operate/kubernetes/7.22/security/' +--- + +Configure security settings for your Redis Enterprise deployment on Kubernetes. Redis Enterprise for Kubernetes provides comprehensive security features including TLS encryption, authentication, access control, and certificate management. + +## Credentials and authentication + +Manage cluster credentials and authentication settings: + +- [Manage REC credentials]({{< relref "/operate/kubernetes/7.22/security/manage-rec-credentials" >}}) - Configure and manage Redis Enterprise cluster credentials +- [LDAP authentication]({{< relref "/operate/kubernetes/7.22/security/ldap" >}}) - Integrate with LDAP for centralized authentication + +## Certificates and encryption + +Configure TLS certificates and encryption for secure communications: + +- [Manage REC certificates]({{< relref "/operate/kubernetes/7.22/security/manage-rec-certificates" >}}) - Configure cluster certificates for TLS encryption +- [Add client certificates]({{< relref "/operate/kubernetes/7.22/security/add-client-certificates" >}}) - Set up client certificate authentication for databases +- [Internode encryption]({{< relref "/operate/kubernetes/7.22/security/internode-encryption" >}}) - Enable encryption between cluster nodes + +## Resource management + +Configure security-related resource settings: + +- [Allow resource adjustment]({{< relref "/operate/kubernetes/7.22/security/allow-resource-adjustment" >}}) - Enable automatic adjustment of system resources for security compliance diff --git a/content/operate/kubernetes/7.22/security/add-client-certificates.md b/content/operate/kubernetes/7.22/security/add-client-certificates.md new file mode 100644 index 0000000000..fc928e0d3a --- /dev/null +++ b/content/operate/kubernetes/7.22/security/add-client-certificates.md @@ -0,0 +1,44 @@ +--- +categories: +- docs +- operate +- kubernetes +description: Add client certificates to your REDB custom resource. +linkTitle: Add client certificates +title: Add client certificates +weight: 95 +url: '/operate/kubernetes/7.22/security/add-client-certificates/' +--- + +For each client certificate you want to use with your database, you need to create a Kubernetes secret to hold it. You can then reference that secret in your Redis Enterprise database (REDB) custom resource spec. + +## Create a secret to hold the new certificate + +1. [Create the secret config file](https://kubernetes.io/docs/tasks/configmap-secret/managing-secret-using-config-file/) with the required fields shown below. + + ```yaml + apiVersion: v1 + kind: Secret + type: Opaque + metadata: + name: + namespace: + data: + cert: + ``` + +1. Apply the file to create the secret resource. + + ```bash + kubectl apply -f .yaml + ``` + +## Edit the REDB resource + +1. Add the secret name to the REDB custom resource (`redb.yaml`) with the `clientAuthenticationCertificates` property in the `spec` section. + + ```yaml + spec: + clientAuthenticationCertificates: + - + ``` \ No newline at end of file diff --git a/content/operate/kubernetes/7.22/security/allow-resource-adjustment.md b/content/operate/kubernetes/7.22/security/allow-resource-adjustment.md new file mode 100644 index 0000000000..4ab0b7506f --- /dev/null +++ b/content/operate/kubernetes/7.22/security/allow-resource-adjustment.md @@ -0,0 +1,129 @@ +--- +categories: +- docs +- operate +- kubernetes +description: Enable automatic system resource adjustments for Redis Enterprise to increase file descriptor limits. +linkTitle: Auto resource adjustment +title: Allow automatic resource adjustment +weight: 98 +url: '/operate/kubernetes/7.22/security/allow-resource-adjustment/' +--- + +Redis Enterprise for Kubernetes 7.22.0-6 introduces the ability to run with automatic resource adjustment disabled, which drops all capabilities from the Redis Enterprise container and sets `allowPrivilegeEscalation` to `false`. All other security-related settings remain the same as in automatic resource adjustment enabled. Automatic resource adjustment disabled is the default for installations and upgrades of the Redis Enterprise operator for versions 7.22.0-6 and later. + +## Default behavior + +Automatic resource adjustment is disabled by default for installations and upgrades of the Redis Enterprise operator for versions 7.22.0-6 and later. This default behavior is in effect if REC spec has `allowAutoAdjustment` set to `false` or removed. + +If automatic resource adjustment is disabled, the REC security context looks like this: + +```yaml +securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + readOnlyRootFilesystem: false +``` + +## Enable automatic resource adjustment + +To allow the Redis Enterprise container to adjust system resource limits automatically, set `allowAutoAdjustment` to `true`. This will grant the container elevated capabilities such as `SYS_RESOURCE`. Note that changing this value on a running cluster will trigger a rolling update. + +```yaml +spec: + securityContext: + resourceLimits: + allowAutoAdjustment: true +``` + +Enabling automatic resource adjustment results in the following security context: + +**Note:** Enabling `allowAutoAdjustment` grants the container the `SYS_RESOURCE` capability and permits privilege escalation. + +```yaml +securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - SYS_RESOURCE + drop: + - ALL + privileged: false + readOnlyRootFilesystem: false +``` + +## OpenShift upgrades + +If you're upgrading OpenShift to 7.22.0-6, update your existing SCC (security context constraint). + +If running with automatic resource adjustment disabled, remove the custom `redis-enterprise-scc-v2` SCC and unbind it from the REC service account after you complete the upgrade. + +```sh +oc delete scc/redis-enterprise-scc-v2 +``` + +```sh +oc adm policy remove-scc-from-user redis-enterprise-scc-v2 -z +``` + +If running with automatic resource adjustment enabled, manually reapply the [security context constraints (SCC)](https://docs.openshift.com/container-platform/4.8/authentication/managing-security-context-constraints.html) file ([`scc.yaml`]({{< relref "/operate/kubernetes/7.22/deployment/openshift/openshift-cli#deploy-the-operator" >}})). + +```sh +oc apply -f openshift/scc.yaml +``` + +```sh +oc adm policy add-scc-to-user redis-enterprise-scc-v2 \ + system:serviceaccount:: +``` + +## New OpenShift installations + +New installations of Redis Enterprise for Kubernetes 7.22.0-6 and later automatically run with automatic resource adjustment disabled, using a built-in `nonroot-v2` which is more secure and less permissive. + +To enable automatic resource adjustment after installation, apply and grant permissions to the `redis-enterprise-scc-v2` SCC. + +1. Apply the `scc.yaml` file. + + {{}} +Do not edit this file. + {{}} + + ```sh + oc apply -f openshift/scc.yaml + ``` + + You should see the following output: + + ```sh + securitycontextconstraints.security.openshift.io "redis-enterprise-scc-v2" configured + ``` + +1. Provide the operator permissions for the pods. + + ```sh + oc adm policy add-scc-to-user redis-enterprise-scc-v2 \ + system:serviceaccount:: + ``` + +## SYS_RESOURCE + +Some Redis Enterprise processes may require the `SYS_RESOURCE` capability to raise resource limits, such as the maximum number of open file descriptors. + +Some Redis Enterprise processes require the ability to open at least 100,000 file descriptors. If the default is lower and `SYS_RESOURCE` is not enabled, these processes may fail. + +## Choose whether to enable automatic resource adjustment + +Use the following guidance to decide whether to enable automatic resource adjustment: + +- If you're running on a major cloud provider such as AWS, GKE, or AKS, automatic resource adjustment disabled is likely sufficient. +- If you're running on-prem or using Kubespray, verify your file descriptor limits. You can: + - Configure limits manually and use automatic resource adjustment disabled. + - Enable automatic resource adjustment to allow Redis Enterprise to increase limits, which requires privilege escalation. + +If you are already running a Redis Enterprise cluster on Kubernetes, your worker nodes are likely configured correctly. In this case, it is safe to upgrade the operator and use automatic resource adjustment disabled. + +Based on our testing, all major cloud providers configure Kubernetes worker nodes with file descriptor limits well above the required minimum. These environments typically work without enabling automatic resource adjustment. The only known exception is clusters created with [Kubespray](https://kubespray.io/#/), which sets default file descriptor limits below the required 100,000. If you use Kubespray with default settings, you must run the operator with automatic resource adjustment enabled. diff --git a/content/operate/kubernetes/7.22/security/configuration-secrets.md b/content/operate/kubernetes/7.22/security/configuration-secrets.md new file mode 100644 index 0000000000..5922b10abf --- /dev/null +++ b/content/operate/kubernetes/7.22/security/configuration-secrets.md @@ -0,0 +1,96 @@ +--- +categories: +- docs +- operate +- kubernetes +description: Store Redis Enterprise configuration items in Kubernetes Secrets for automatic updates and secure management. +linkTitle: Configuration secrets +title: Store configuration in Kubernetes Secrets +weight: 96 +url: '/operate/kubernetes/7.22/security/configuration-secrets/' +--- + +You can store Redis Enterprise configuration items in Kubernetes Secrets for automatic updates and secure management. When you update these Secrets, the operator immediately reads the changes and propagates them to the Redis Enterprise Cluster (REC). + +## License configuration + +Redis Enterprise clusters require a valid license. You can apply licenses using Kubernetes Secrets (recommended) or embed them directly in the cluster specification. + +### Determine your cluster FQDN + +To configure licensing, you need your Redis Enterprise cluster's fully qualified domain name (FQDN). Use this format: `..svc.cluster.local` + +For example: `my-rec.my-ns.svc.cluster.local` + +### Use a Kubernetes Secret (recommended) + +1. Create a secret from your license file: + + ```sh + kubectl -n create secret generic rec-license --from-file=license=./license.txt + ``` + +2. Add the secret reference to your REC specification: + + ```yaml + spec: + licenseSecretName: rec-license + ``` + +### Embed license directly in REC specification + +Alternatively, you can embed the license directly in the REC YAML: + +```yaml +spec: + nodes: 3 + license: | + ----- LICENSE START ----- + eai14c/y6XNVykffDQSPUsHKcmpgOFUlmyTBDUEZEz+GLbXAgQFOmxcdbR9J + ...remaining license key content... + ----- LICENSE END ----- +``` + +{{}} +You must include the pipe symbol (`|`) after `license:` and maintain proper indentation. +{{}} + +## TLS certificate configuration + +You can store TLS certificates in Kubernetes Secrets to secure communication between clients and Redis Enterprise databases. + +### Client certificates for mTLS + +1. Create a secret with your client certificate: + + ```sh + kubectl -n create secret generic client-cert-secret --from-file=cert= + ``` + +2. Add the secret to your REDB using the `clientAuthenticationCertificates` property. See [Add client certificates]({{< relref "/operate/kubernetes/7.22/security/add-client-certificates" >}}) for details. + +### Service certificates + +To configure certificates for proxy, API, or other services, create secrets with certificate and key files: + +```sh +kubectl create secret generic \ + --from-file=certificate= \ + --from-file=key= \ + --from-literal=name= +``` + +## Best practices + +- Store sensitive configuration in Secrets rather than directly in YAML files. +- Use `--from-file` to avoid manual base64 encoding. +- Create secrets in the same namespace as your REC or REDB resources. +- Use descriptive secret names for easy identification. +- Regularly rotate certificates and update secrets. + +## See also + +- [Manage REC credentials]({{< relref "/operate/kubernetes/7.22/security/manage-rec-credentials" >}}) +- [Manage REC certificates]({{< relref "/operate/kubernetes/7.22/security/manage-rec-certificates" >}}) +- [Add client certificates]({{< relref "/operate/kubernetes/7.22/security/add-client-certificates" >}}) +- [Redis Enterprise Cluster API reference]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api" >}}) diff --git a/content/operate/kubernetes/7.22/security/internode-encryption.md b/content/operate/kubernetes/7.22/security/internode-encryption.md new file mode 100644 index 0000000000..4e4044b2d1 --- /dev/null +++ b/content/operate/kubernetes/7.22/security/internode-encryption.md @@ -0,0 +1,31 @@ +--- +Title: Enable internode encryption +categories: +- docs +- operate +- kubernetes +description: Enable encryption for communication between REC nodes in your K8s cluster. +linkTitle: Internode encryption +weight: 99 +url: '/operate/kubernetes/7.22/security/internode-encryption/' +--- + +Internode encryption provides added security by encrypting communication between nodes in your Redis Enterprise cluster (REC). + +Enable internode encryption in the `spec` section of your REC custom resource file. + +```yaml +spec: + dataInternodeEncryption: true +``` + +This change will apply to all databases created in the REC. You can override the cluster-wide setting for individual databases. + +Edit your Redis Enterprise database (REDB) custom resource file to disable internode encryption for only that database. + +```yaml +spec: + dataInternodeEncryption: false +``` + +To learn more about internode encryption, see [Internode encryption for Redis Enterprise Software]({{< relref "/operate/rs/security/encryption/internode-encryption.md" >}}). diff --git a/content/operate/kubernetes/7.22/security/ldap.md b/content/operate/kubernetes/7.22/security/ldap.md new file mode 100644 index 0000000000..55c76d80dc --- /dev/null +++ b/content/operate/kubernetes/7.22/security/ldap.md @@ -0,0 +1,168 @@ +--- +Title: Enable LDAP authentication +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Enable LDAP authentication for Redis Enterprise for Kubernetes. +linkTitle: Enable LDAP +weight: 95 +url: '/operate/kubernetes/7.22/security/ldap/' +--- + +## LDAP support for Redis Enterprise Software + +Redis Enterprise Software supports LDAP authentication and authorization through [role-based access controls]({{< relref "/operate/rs/security/access-control/" >}}) (RBAC). You can map LDAP groups to [Redis Enterprise roles]({{< relref "/operate/rs/security/access-control" >}}) to control access to your database and the Cluster Manager UI. For more details on how LDAP works with Redis Enterprise, see [LDAP authentication]({{< relref "/operate/rs/security/access-control/ldap/" >}}). + +Redis Enterprise for Kubernetes supports enabling and configuring LDAP authentication using the `RedisEnterpriseCluster` (REC) custom resource. Currently, the Redis Enterprise cluster (REC) only supports configuration related to the LDAP server, such as server addresses, connection details, credentials, and query configuration. + +To [map LDAP groups to Redis Enterprise access control roles]({{< relref "/operate/rs/security/access-control/ldap/enable-role-based-ldap.md" >}}), you'll need to use the Redis Enterprise [API]({{< relref "/operate/rs/references/rest-api/requests/ldap_mappings/" >}}) or [admin console]({{< relref "/operate/rs/security/access-control/ldap/enable-role-based-ldap.md" >}}). + +## Enable LDAP + +To enable LDAP for your REC, use the `.spec.ldap` field in the `RedisEnterpriseCluster` custom resource. + +The following `RedisEnterpriseCluster` example resource enables a basic LDAP configuration: + +```yaml +apiVersion: app.redislabs.com/v1 +kind: RedisEnterpriseCluster +metadata: + name: rec +spec: + nodes: 3 + ldap: + protocol: LDAP + servers: + - host: openldap.openldap.svc + port: 389 + bindCredentialsSecretName: ldap-bind-credentials + cacheTTLSeconds: 600 + enabledForControlPlane: true + enabledForDataPlane: true + authenticationQuery: + template: cn=%u,ou=default,dc=example,dc=org + authorizationQuery: + attribute: memberOf +``` + +Refer to the `RedisEnterpriseCluster` [API reference](https://github.com/RedisLabs/redis-enterprise-k8s-docs/blob/master/redis_enterprise_cluster_api.md#ldapspec) for full details on the available fields. + +### Bind credentials + +For LDAP servers that require authentication for client queries, store the bind credentials in a secret and reference them in the `RedisEnterpriseCluster` custom resource. + +1. Create a secret to store the bind credentials. + + ```sh + kubectl -n create secret generic \ + --from-literal=dn='' \ + --from-literal=password= + ``` + The secret must: + - Reside within the same namespace as the `RedisEnterpriseCluster` custom resource. + - Include a `dn` key with the distinguished name for the user performing the query (such as `cn=admin,dc=example,dc=org`). + - Include a `password` key with the bind password. + + Replace the `` in the command above with your own values. + +1. Reference the secret name in the `.spec.ldap.bindCredentialsSecretName` field of the `RedisEnterpriseCluster` custom resource. + + ```yaml + spec: + ldap: + bindCredentialsSecretName: + ``` + +### LDAPS or STARTTLS protocols + +In addition to plain LDAP protocol, Redis Enterprise Software also supports LDAPS and STARTTLS protocols for secure communication with the LDAP server. + +To enable one of these protocols, edit the `spec.ldap.protocol` field in the `RedisEnterpriseCluster` custom resource: + +#### Enable `LDAPS` + + ```yaml + spec: + ldap: + protocol: LDAPS + ``` + + Default port: 636 + +#### Enable `STARTTLS` + + ```yaml + spec: + ldap: + protocol: STARTTLS + ``` + + Default port: 389 + +### CA certificate + +To use a custom CA certificate for validating the LDAP server certificate, store the CA certificate in a secret and reference the secret in the `RedisEnterpriseCluster` custom resource. + +1. Create a secret to hold the CA certificate. + + ```sh + kubectl -n create secret generic \ + --from-file=cert=.pem + ``` + + The secret must: + - Reside within the same namespace as the `RedisEnterpriseCluster` custom resource. + - Include a `cert` key with a PEM-encoded CA certificate (such as `cacert.pem`). + + Replace the `` in the command above with your own values. + +1. Reference the secret name in the `spec.ldap.caCertificateSecretName` field of the `RedisEnterpriseCluster` custom resource. + + ```yaml + spec: + ldap: + caCertificateSecretName: + ``` + +### Client certificates + +To use an LDAP client certificate, store the certificate in a secret and reference the secret in the `RedisEnterpriseCluster` custom resource. + +1. Create a secret to hold the client certificate. + + ```sh + kubectl -n create secret generic \ + --from-literal=name=ldap_client \ + --from-file=certificate= \ + --from-file=key= + ``` + + The secret must: + - Reside within the same namespace as the `RedisEnterpriseCluster` custom resource. + - Include a `name` key explicitly set to `ldap_client`. + - Include a `certificate` key for the public key (such as `cert.pem`). + - Include a `key` key for the private key (such as `key.pem`). + + + Replace the `` in the command above with your own values. + +1. Reference the secret name in the `.spec.certificates.ldapClientCertificateSecretName` field of the `RedisEnterpriseCluster` custom resource, substituting your own values for ``. + + ```yaml + spec: + certificates: + ldapClientCertificateSecretName: + ``` + +## Known limitations + +Redis Enterprise Software can't resolve DNS names with a `.local` suffix. + If your LDAP server is in the same Kubernetes cluster and exposed via a Service object, *avoid* addresses such as `openldap.openldap.svc.cluster.local`. Instead, *use short-form addresses* such as `openldap.openldap.svc`. + +## Next steps + +To [map LDAP groups to Redis Enterprise access control roles]({{< relref "/operate/rs/security/access-control/ldap/enable-role-based-ldap.md" >}}), you'll need to use the Redis Enterprise [API]({{< relref "/operate/rs/references/rest-api/requests/ldap_mappings/" >}}) or [admin console]({{< relref "/operate/rs/security/access-control/ldap/enable-role-based-ldap.md" >}}). + +For more details on how LDAP works with Redis Enterprise, see [LDAP authentication]({{< relref "/operate/rs/security/access-control/ldap/" >}}). diff --git a/content/operate/kubernetes/7.22/security/manage-rec-certificates.md b/content/operate/kubernetes/7.22/security/manage-rec-certificates.md new file mode 100644 index 0000000000..8fecc00876 --- /dev/null +++ b/content/operate/kubernetes/7.22/security/manage-rec-certificates.md @@ -0,0 +1,69 @@ +--- +Title: Manage Redis Enterprise cluster (REC) certificates +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Install your own certificates to be used by the Redis Enterprise cluster's + operator. +linkTitle: Manage REC certificates +weight: 94 +url: '/operate/kubernetes/7.22/security/manage-rec-certificates/' +--- + +By default, Redis Enterprise Software for Kubernetes generates TLS certificates for the cluster during creation. These self-signed certificates are generated on the first node of each Redis Enterprise cluster (REC) and are copied to all other nodes added to the cluster. For the list of of certificates used by Redis Enterprise Software and the traffic they encrypt, see the [certificates table]({{< relref "/operate/rs/security/certificates" >}}). + +To install and use your own certificates with Kubernetes on your Redis Enterprise cluster, they need to be stored in [secrets](https://kubernetes.io/docs/concepts/configuration/secret/). The REC custom resource also needs to be configured with those secret names to read and use the certificates. + +## Create a secret to hold the new certificate + +Create the [secret](https://kubernetes.io/docs/tasks/configmap-secret/managing-secret-using-kubectl/) with the required fields shown below. + + ```sh + kubectl create secret generic \ + --from-file=certificate= \ + --from-file=key= \ + --from-literal=name= + ``` + +## Update certificates in the REC custom resource + +Edit the Redis Enterprise cluster (REC) custom resource to add a `certificates` subsection under the `spec` section. You are only required to add the fields for the certificates you are installing. + +```yaml +spec: + certificates: + apiCertificateSecretName: + cmCertificateSecretName: + syncerCertificateSecretName: + metricsExporterCertificateSecretName: + proxyCertificateSecretName: +``` + +### Update certificates through the API + +Alternatively, you can also update the REC certificates via the API: + +```API +PUT /v1/cluster/update_cert +{ + "certificate": , + "key": , + "name": +} +``` + +### Verify the certificate was updated + +Check the operator logs and use the API to verify the certificate has been updated. + + ```api + GET /v1/cluster/certificates + ``` + +## More info + +- [Update certificates]({{< relref "/operate/rs/security/certificates/updating-certificates" >}}) +- [Install your own certificates]({{< relref "/operate/rs/security/certificates/create-certificates" >}}) +- [Glossary/Transport Layer Security (TLS)]({{< relref "/glossary#letter-t" >}}) diff --git a/content/operate/kubernetes/7.22/security/manage-rec-credentials.md b/content/operate/kubernetes/7.22/security/manage-rec-credentials.md new file mode 100644 index 0000000000..59c4e718b9 --- /dev/null +++ b/content/operate/kubernetes/7.22/security/manage-rec-credentials.md @@ -0,0 +1,137 @@ +--- +Title: Manage Redis Enterprise cluster (REC) credentials +alwaysopen: false +categories: +- docs +- operate +- kubernetes +linkTitle: Manage REC credentials +weight: 93 +url: '/operate/kubernetes/7.22/security/manage-rec-credentials/' +--- +Redis Enterprise for Kubernetes uses a custom resource called [`RedisEnterpriseCluster`]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_cluster_api" >}}) to create a Redis Enterprise cluster (REC). During creation it generates random credentials for the operator to use. The credentials are saved in a Kubernetes (K8s) [secret](https://kubernetes.io/docs/concepts/configuration/secret/). The secret name defaults to the name of the cluster. + +{{}} +This procedure is only supported for operator versions 6.0.20-12 and above. +{{}} + +## Retrieve the current username and password + +The credentials can be used to access the Redis Enterprise admin console or the API. Connectivity must be configured to the REC [pods](https://kubernetes.io/docs/concepts/workloads/pods/) using an appropriate service (or port forwarding). + +1. Inspect the random username and password created by the operator during creation with the `kubectl get secret` command. + + ```sh + kubectl get secret rec -o jsonpath='{.data}' + ``` + + The command outputs the encoded password and username, similar to the example below. + + ```sh + map[password:MTIzNDU2NzgK username:ZGVtb0BleGFtcGxlLmNvbQo=] + ``` + +1. Decode the password and username with the `echo` command and the password from the previous step. + + ```bash + echo MTIzNDU2NzgK | base64 --decode + ``` + + This outputs the password and username in plain text. In this example, the plain text password is `12345678` and the username is `demo@example.com`. + +## Change the Redis Enterprise cluster (REC) credentials + +### Change the REC password for the current username + +1. Access a [pod](https://kubernetes.io/docs/concepts/workloads/pods/) running a Redis Enterprise cluster. + +```sh +kubectl exec -it -0 -c redis-enterprise-node -- /bin/bash +``` + +2. Add a new password for the existing user. + +```bash +REC_USER="`cat /opt/redislabs/credentials/username`" \ +REC_PASSWORD="`cat /opt/redislabs/credentials/password`" \ +curl -k --request POST \ + --url https://localhost:9443/v1/users/password \ + -u "$REC_USER:$REC_PASSWORD" \ + --header 'Content-Type: application/json' \ + --data "{\"username\":\"$REC_USER\", \ + \"old_password\":\"$REC_PASSWORD\", \ + \"new_password\":\"\"}" +``` + +3. From outside the pod, update the REC credential secret. + +```sh +kubectl create secret generic \ + --save-config \ + --dry-run=client \ + --from-literal=username= \ + --from-literal=password= \ + -o yaml | \ +kubectl apply -f - +``` + +4. Wait five minutes for all the components to read the new password from the updated secret. If you proceed to the next step too soon, the account could get locked. + +5. Access a pod running a Redis Enterprise cluster again. + +```sh +kubectl exec -it -0 -c redis-enterprise-node -- /bin/bash +``` + +6. Remove the previous password to ensure only the new one applies. + +```sh +REC_USER="`cat /opt/redislabs/credentials/username`"; \ +REC_PASSWORD="`cat /opt/redislabs/credentials/password`"; \ +curl -k --request DELETE \ + --url https://localhost:9443/v1/users/password \ + -u "$REC_USER:$REC_PASSWORD" \ + --header 'Content-Type: application/json' \ + --data "{\"username\":\"$REC_USER\", \ + \"old_password\":\"}} The username for the K8s secret is the email displayed on the Redis Enterprise admin console. {{}} + +### Change both the REC username and password + +1. [Connect to the admin console]({{< relref "/operate/kubernetes/7.22/re-clusters/connect-to-admin-console.md" >}}) + +2. [Add another admin user]({{< relref "/operate/rs/security/access-control/create-users" >}}) and choose a new password. + +3. Specify the new username in the `username` field of your REC custom resource spec. + +4. Update the REC credential secret: + +```sh +kubectl create secret generic \ + --save-config \ + --dry-run=client \ + --from-literal=username= \ + --from-literal=password= \ + -o yaml | \ +kubectl apply -f - +``` + +5. Wait five minutes for all the components to read the new password from the updated secret. If you proceed to the next step too soon, the account could get locked. + +6. Delete the previous admin user from the cluster. + +{{}} +The operator may log errors in the time between updating the username in the REC spec and the secret update. +{{}} + +### Update the credentials secret in Vault + +If you store your secrets with Hashicorp Vault, update the secret for the REC credentials with the following key-value pairs: + +```sh +username:, password: +``` + +For more information about Vault integration with the Redis Enterprise Cluster see [Integrating Redis Enterprise for Kubernetes with Hashicorp Vault](https://github.com/RedisLabs/redis-enterprise-k8s-docs/blob/master/vault/README.md). diff --git a/content/operate/kubernetes/7.22/upgrade/_index.md b/content/operate/kubernetes/7.22/upgrade/_index.md new file mode 100644 index 0000000000..3f6ffb980e --- /dev/null +++ b/content/operate/kubernetes/7.22/upgrade/_index.md @@ -0,0 +1,52 @@ +--- +Title: Upgrade Redis Enterprise for Kubernetes +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Upgrade Redis Enterprise operator, clusters, and databases on Kubernetes. +hideListLinks: false +linkTitle: Upgrade +weight: 15 +url: '/operate/kubernetes/7.22/upgrade/' +--- + +Keep your Redis Enterprise deployment up to date with the latest features, security patches, and bug fixes. The upgrade process involves updating three main components in sequence: the Redis Enterprise operator, Redis Enterprise clusters (REC), and Redis Enterprise databases (REDB). + +## Upgrade methods + +Choose the appropriate upgrade method for your deployment: + +- [Upgrade Redis Enterprise for Kubernetes]({{}}) - Standard upgrade process for most Kubernetes distributions +- [Upgrade with OpenShift CLI]({{}}) - OpenShift-specific upgrade using CLI tools +- [Upgrade with OpenShift OperatorHub]({{}}) - Upgrade using OpenShift OperatorHub and OLM +- [Upgrade with Helm]({{}}) - Helm-specific upgrade instructions for chart-based deployments + +## Upgrade process + +The upgrade process includes updating three components in order: + +1. **Upgrade the Redis Enterprise operator** - Update the operator to the latest version +2. **Upgrade the Redis Enterprise cluster (REC)** - Update cluster nodes and infrastructure +3. **Upgrade Redis Enterprise databases (REDB)** - Update database versions and configurations + +## Upgrade compatibility + +When upgrading, both your Kubernetes version and Redis operator version need to be supported at all times. + +{{}}If your current Kubernetes distribution is not [supported]({{}}), upgrade to a supported distribution before upgrading. {{}} + +## RHEL9-based image + +Redis Enterprise images are now based on Red Hat Enterprise Linux 9 (RHEL9). This means upgrades require: + +- [Cluster version of 7.4.2-2 or later](https://redis.io/docs/latest/operate/kubernetes/7.4.6/upgrade/). +- Database version 7.2 or later. +- RHEL9 compatible binaries for any modules you need. + +For detailed steps, see the relevant upgrade page: + +- [OpenShift CLI]({{}}) +- [OpenShift OperatorHub]({{}}) +- [Kubernetes]({{}}) \ No newline at end of file diff --git a/content/operate/kubernetes/7.22/upgrade/openshift-cli.md b/content/operate/kubernetes/7.22/upgrade/openshift-cli.md new file mode 100644 index 0000000000..87d2991901 --- /dev/null +++ b/content/operate/kubernetes/7.22/upgrade/openshift-cli.md @@ -0,0 +1,250 @@ +--- +Title: Upgrade Redis Enterprise with OpenShift CLI +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: This task describes how to upgrade a Redis Enterprise cluster via OpenShift + CLI. +linkTitle: OpenShift CLI +weight: 20 +url: '/operate/kubernetes/7.22/upgrade/openshift-cli/' +--- + +Redis implements rolling updates for software upgrades in Kubernetes deployments. The upgrade process includes updating three components: + + 1. [Upgrade the Redis Enterprise operator](#upgrade-the-operator) + 1. [Upgrade the Redis Enterprise cluster (REC)](#upgrade-the-redis-enterprise-cluster) + 1. [Upgrade Redis Enterprise databases (REDB)](#upgrade-databases) + +## Prerequisites + +The following steps ensure you have the minimum versions of all components necessary to upgrade to 7.8.2-6 or later. **Without these minimum versions, the upgrade will freeze and require manual recovery.** + +See the [troubleshooting](#troubleshooting) section for details on recovering a failed upgrade. + +#### Kubernetes version + +Check [Supported Kubernetes distributions]({{}}) to make sure your Kubernetes distribution is supported. If not, upgrade your Kubernetes distribution before upgrading the Redis operator. + +#### Redis operator version + +Your Redis Enterprise clusters must be running version 7.4.2-2 or later before upgrading to 7.8.2-6 or later. See the [7.4 upgrade](https://redis.io/docs/latest/operate/kubernetes/7.4.6/upgrade/openshift-cli/) for detailed steps. + +#### Redis database version + +Your Redis databases must be running version 7.2 or later before upgrading your cluster version. See [upgrade databases](#upgrade-databases) for detailed steps. You can find your database version in the [REDB `spec.redisVersion` field]({{}}). + +#### RHEL9-compatible modules + +Upgrading to Redis operator versions 7.8.2-6 and later involves migrating your Redis Enterprise nodes to RHEL9 from either Ubuntu 18 or RHEL8. If your databases use modules, you need to manually install modules compatible with RHEL9. + +To see which modules you have installed, run: + +```sh +curl -k -u : -X GET https://localhost:9443/v1/modules | jq -r 'map([.module_name, .semantic_version, (.platforms | keys)]) | .[] | .[0] as $name | .[1] as $version | .[2][] | $name + "-" + $version + "-" + .' | sort +``` + +To see which modules are currently in use, run: + +```sh +curl -k -u : -X GET https://localhost:9443/v1/bdbs | jq -r '.[].module_list | map(.module_name + "-" + .semantic_version) | .[]' +``` + +See [Upgrade modules]({{}}) for details on how to upgrade modules with the `rladmin` tool. + +#### Valid license + +Use `kubectl get rec` and verify the `LICENSE STATE` is valid on your REC before you start the upgrade process. + +## Upgrade with Helm charts + +If you installed the Redis Enterprise operator using Helm charts on OpenShift, you can upgrade using Helm commands. This method automatically handles the operator upgrade and Custom Resource Definition (CRD) updates. + +To upgrade using Helm on OpenShift: + +```sh +helm upgrade /redis-enterprise-operator --version \ + --set openshift.mode=true +``` + +For example: + +```sh +helm upgrade my-redis-enterprise /redis-enterprise-operator --version 7.8.2-2 \ + --set openshift.mode=true +``` + +After the Helm upgrade completes, continue with [upgrading the Redis Enterprise cluster](#upgrade-the-redis-enterprise-cluster) and [upgrading databases](#upgrade-databases). + +For detailed Helm upgrade instructions, see [Upgrade the chart]({{}}). + +## Upgrade the operator + +### Download the bundle + +Make sure you pull the correct version of the bundle. You can find the version tags +by checking the [operator releases on GitHub](https://github.com/RedisLabs/redis-enterprise-k8s-docs/releases) +or by [using the GitHub API](https://docs.github.com/en/rest/reference/repos#releases). + +For OpenShift environments, the name of the bundle is `openshift.bundle.yaml`, and so the `curl` command to run is: + +```sh +curl --silent -O https://raw.githubusercontent.com/RedisLabs/redis-enterprise-k8s-docs/$VERSION/openshift.bundle.yaml +``` + +If you need a different release, replace `VERSION` in the above with a specific release tag. + +### Apply the bundle + +Apply the bundle to deploy the new operator binary. This will also apply any changes in the new release to custom resource definitions, roles, role binding, or operator service accounts. + +{{< note >}} +If you are not pulling images from Docker Hub, update the operator image spec to point to your private repository. +If you have made changes to the role, role binding, RBAC, or custom resource definition (CRD) in the previous version, merge them with the updated declarations in the new version files. +{{< /note >}} + +If you are using OpenShift, run this instead: + +```sh +oc apply -f openshift.bundle.yaml +``` + +After running this command, you should see a result similar to this: + +```sh +role.rbac.authorization.k8s.io/redis-enterprise-operator configured +serviceaccount/redis-enterprise-operator configured +rolebinding.rbac.authorization.k8s.io/redis-enterprise-operator configured +customresourcedefinition.apiextensions.k8s.io/redisenterpriseclusters.app.redislabs.com configured +customresourcedefinition.apiextensions.k8s.io/redisenterprisedatabases.app.redislabs.com configured +deployment.apps/redis-enterprise-operator configured +``` + +### Reapply the admission controller webhook {#reapply-webhook} + +If you have the admission controller enabled, you need to manually reapply the `ValidatingWebhookConfiguration`. + +{{}} +{{< embed-md "k8s-642-redb-admission-webhook-name-change.md" >}} +{{}} + +{{< embed-md "k8s-admission-webhook-cert.md" >}} + +### Verify the operator is running + +You can check your deployment to verify the operator is running in your namespace. + +```sh +oc get deployment/redis-enterprise-operator +``` + +You should see a result similar to this: + +```sh +NAME READY UP-TO-DATE AVAILABLE AGE +redis-enterprise-operator 1/1 1 1 0m36s +``` + +{{< warning >}} + We recommend upgrading the REC as soon as possible after updating the operator. After the operator upgrade completes, the operator suspends the management of the REC and its associated REDBs, until the REC upgrade completes. + {{< /warning >}} + +## Security context constraints + +Upgrades to versions 7.22.0-6 and later run in **unprivileged mode** without any additional permissions or capabilities. If you don't specifally require additional capabilities, we recommend you maintain the default unprivileged mode, as its more secure. After upgrading, remove the existing `redis-enterprise-scc-v2` SCC and unbind it from the REC service account. + +To enable automatic resource adjustment, see [Allow automatic resource adjustment > OpenShift upgrades]({{< relref "/operate/kubernetes/7.22/security/allow-resource-adjustment#openshift-upgrades" >}}). + +## Upgrade the Redis Enterprise cluster + +{{}} +Verify your license is valid before upgrading. Invalid licenses will cause the upgrade to fail. + +Use `oc get rec` and verify the `LICENSE STATE` is valid on your REC before you start the upgrade process. +{{}} + +The Redis Enterprise cluster (REC) can be updated automatically or manually. To trigger automatic upgrade of the REC after the operator upgrade completes, specify `autoUpgradeRedisEnterprise: true` in your REC spec. If you don't have automatic upgrade enabled, follow the below steps for the manual upgrade. + +Before beginning the upgrade of the Redis Enterprise cluster, check the K8s operator [release notes]({{}}) to find the Redis Enterprise image tag. + +After the operator upgrade is complete, you can upgrade Redis Enterprise cluster (REC). + +### Edit `redisEnterpriseImageSpec` + +1. Edit the REC custom resource YAML file. + + ```sh + oc edit rec + ``` + +1. Replace the `versionTag:` declaration under `redisEnterpriseImageSpec` with the new version tag. + + ```YAML + spec: + redisEnterpriseImageSpec: + imagePullPolicy: IfNotPresent + repository: redislabs/redis + versionTag: + ``` + +1. Save the changes to apply. + +### Reapply roles and role bindings + +If your operator is monitoring multiple namespaces, you'll need to [reapply your role and role bindings]({{< relref "/operate/kubernetes/7.22/re-clusters/multi-namespace#create-role-and-role-binding-for-managed-namespaces" >}}) for each managed namespace. See [Manage databases in multiple namespaces]({{< relref "/operate/kubernetes/7.22/re-clusters/multi-namespace" >}}) for more details. + +### Monitor the upgrade + +You can view the state of the REC with `oc get rec`. + + During the upgrade, the state should be `Upgrade`. + When the upgrade is complete and the cluster is ready to use, the state will change to `Running`. + If the state is `InvalidUpgrade`, there is an error (usually relating to configuration) in the upgrade. + +```sh +$ oc get rec +NAME NODES VERSION STATE SPEC STATUS LICENSE STATE SHARDS LIMIT LICENSE EXPIRATION DATE AGE +rec 3 6.2.10-107 Upgrade Valid Valid 4 2022-07-16T13:59:00Z 92m +``` + +To see the status of the current rolling upgrade, run: + +```sh +oc rollout status sts +``` + +### Upgrade databases + +After the cluster is upgraded, you can upgrade your databases. To upgrade your REDB, specify your new database version in the `spec.redisVersion` field in the REDB custom resources. Supported database versions for operator versions include `"7.2"` and `"7.4"` (note this value is a string). + +To upgrade your REAADB, see [Upgrade an Active-Active database]({{}}) for details on the `rladmin` and `crdb-cli` commands required. Reach out to Redis support if you have additional questions. + +Note that if your cluster [`redisUpgradePolicy`]({{}}) or your database [`redisVersion`]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_database_api#redisversion" >}}) are set to `major`, you won't be able to upgrade those databases to minor versions. See [Redis upgrade policy]({{< relref "/operate/rs/installing-upgrading/upgrading#redis-upgrade-policy" >}}) for more details. + +## Troubleshooting + +If you start an upgrade without meeting the [prerequisites](#prerequisites), the operator will freeze the upgrade. Check the operator logs for the source of the error. The REDB reconsilliation doesn't work during an upgrade, so you need to apply a manual fix with the Redis Software API (examples below). The updates will also need to be added to the REDB custom resource. + +### Invalid module version + +If the operator logs show an event related to an unsupported module, download the updated module locally, and install it using the `v2/modules` API endpoint. + +```sh +curl -sfk -u : -X POST -F 'module=@' https://localhost:9443/v2/modules +``` + +After updating the modules with the Redis Software API, update the REDB custom resource to reflect the change. + +### Invalid database version + +If the operator logs show an event related to an incompatible database version, upgrade the database using the Redis Software API. + +```sh +curl -sfk -u : -X POST -H "Content-Type: application/json" -d '{"redis_version": }' https://localhost:9443/v1/bdbs//upgrade +``` + +After updating the database with the Redis Software API, update the REDB custom resource to reflect the change. + + diff --git a/content/operate/kubernetes/7.22/upgrade/upgrade-olm.md b/content/operate/kubernetes/7.22/upgrade/upgrade-olm.md new file mode 100644 index 0000000000..d89d4627de --- /dev/null +++ b/content/operate/kubernetes/7.22/upgrade/upgrade-olm.md @@ -0,0 +1,173 @@ +--- +Title: Upgrade Redis Enterprise with OpenShift OperatorHub +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: This task describes how to upgrade a Redis Enterprise cluster via OpenShift + OperatorHub. +linkTitle: OpenShift OperatorHub +weight: 40 +url: '/operate/kubernetes/7.22/upgrade/upgrade-olm/' +--- + +Redis implements rolling updates for software upgrades in Kubernetes deployments. The upgrade process includes updating three components: + + 1. [Upgrade the Redis Enterprise operator](#upgrade-the-redis-enterprise-operator) + 1. [Upgrade the Redis Enterprise cluster (REC)](#upgrade-the-redis-enterprise-cluster) + 1. [Upgrade Redis Enterprise databases (REDB)](#upgrade-databases) + +## Prerequisites + +The following steps ensure you have the minimum versions of all components necessary to upgrade. **Without these minimum versions, the upgrade will freeze and require manual recovery.** + +See the [troubleshooting](#troubleshooting) section for details on recovering a failed upgrade. + +#### Kubernetes version + +Check [Supported Kubernetes distributions]({{}}) to make sure your Kubernetes distribution is supported. If not, upgrade your Kubernetes distribution before upgrading the Redis operator. + +#### Redis operator version + +Your Redis Enterprise clusters must be running version 7.4.2-2 or later before upgrading to 7.8.2-6. See the [7.4 upgrade](https://redis.io/docs/latest/operate/kubernetes/7.4.6/upgrade/upgrade-olm/) for detailed steps. + +#### Redis database version + +Your Redis databases must be running version 7.2 or later before upgrading your cluster version to 7.8.2-6. See [upgrade databases](#upgrade-databases) for detailed steps. You can find your database version in the [REDB `spec.redisVersion` field]({{}}). + +#### RHEL9-compatible modules + +Upgrading to Redis operator version 7.8.2-6 or later involves migrating your Redis Enterprise nodes to RHEL9 from either Ubuntu 18 or RHEL8. If your databases use modules, you need to manually install modules compatible with RHEL9. + +To see which modules you have installed, run: + +```sh +curl -k -u : -X GET https://localhost:9443/v1/modules | jq -r 'map([.module_name, .semantic_version, (.platforms | keys)]) | .[] | .[0] as $name | .[1] as $version | .[2][] | $name + "-" + $version + "-" + .' | sort +``` + +To see which modules are currently in use, run: + +```sh +curl -k -u : -X GET https://localhost:9443/v1/bdbs | jq -r '.[].module_list | map(.module_name + "-" + .semantic_version) | .[]' +``` + +See [Upgrade modules]({{}}) for details on how to upgrade modules with the `rladmin` tool. + +### Valid license + +Use `kubectl get rec` and verify the `LICENSE STATE` is valid on your REC before you start the upgrade process. + +## Upgrade the Redis Enterprise operator + +1. Select the **Redis Enterprise Operator** from the **Operators**>**Installed Operators** page. + +2. Select the **Subscription** tab. + +3. Verify your **Update approval** is set to "Manual". + +4. To upgrade to the latest version, set your **Update Channel** to ‘production’. To upgrade to an older version, specify the desired version for your **Update Channel**. + +5. Select **Upgrade available** shown under **Upgrade status**. + +6. When the "Review manual InstallPlan" section appears, select **Preview installPlan** and then **Approve** after reviewing the details. This will start the operator upgrade. + +You can monitor the upgrade from the **Installed Operators** page. A new Redis Enterprise Operator will appear in the list, with the status "Installing". OpenShift will delete the old operator, showing the "Cannot update" status during deletion. + +## Security context constraints + +Upgrades to versions 7.22.0-6 and later run in **unprivileged mode** without any additional permissions or capabilities. If you don't specifally require additional capabilities, we recommend you maintain the default unprivileged mode, as its more secure. After upgrading, remove the existing `redis-enterprise-scc-v2` SCC and unbind it from the REC service account. + +To enable automatic resource adjustment, see [Allow automatic resource adjustment > OpenShift upgrades]({{< relref "/operate/kubernetes/7.22/security/allow-resource-adjustment#openshift-upgrades" >}}). + +## Upgrade the Redis Enterprise cluster + +{{}} +Verify your license is valid before upgrading. Invalid licenses will cause the upgrade to fail. + +Use `oc get rec` and verify the `LICENSE STATE` is valid on your REC before you start the upgrade process. +{{}} + +The Redis Enterprise cluster (REC) can be updated automatically or manually. To trigger automatic upgrade of the REC after the operator upgrade completes, specify `autoUpgradeRedisEnterprise: true` in your REC spec. If you don't have automatic upgrade enabled, follow the below steps for the manual upgrade. + +Before beginning the upgrade of the Redis Enterprise cluster, check the K8s operator [release notes]({{}}) to find the Redis Enterprise image tag. + +After the operator upgrade is complete, you can upgrade Redis Enterprise cluster (REC). + +### Edit `redisEnterpriseImageSpec` + +1. Edit the REC custom resource YAML file. + + ```sh + oc edit rec + ``` + +1. Replace the `versionTag:` declaration under `redisEnterpriseImageSpec` with the new version tag. + + ```YAML + spec: + redisEnterpriseImageSpec: + imagePullPolicy: IfNotPresent + repository: redislabs/redis + versionTag: + ``` + +1. Save the changes to apply. + +### Reapply roles and role bindings + +If your operator is monitoring multiple namespaces, you'll need to [reapply your role and role bindings]({{< relref "/operate/kubernetes/7.22/re-clusters/multi-namespace#create-role-and-role-binding-for-managed-namespaces" >}}) for each managed namespace. See [Manage databases in multiple namespaces]({{< relref "/operate/kubernetes/7.22/re-clusters/multi-namespace" >}}) for more details. + +### Monitor the upgrade + +You can view the state of the REC with `oc get rec`. + + During the upgrade, the state should be `Upgrade`. + When the upgrade is complete and the cluster is ready to use, the state will change to `Running`. + If the state is `InvalidUpgrade`, there is an error (usually relating to configuration) in the upgrade. + +```sh +$ oc get rec +NAME NODES VERSION STATE SPEC STATUS LICENSE STATE SHARDS LIMIT LICENSE EXPIRATION DATE AGE +rec 3 6.2.10-107 Upgrade Valid Valid 4 2022-07-16T13:59:00Z 92m +``` + +To see the status of the current rolling upgrade, run: + +```sh +oc rollout status sts +``` + +## Upgrade databases + +After the cluster is upgraded, you can upgrade your databases. To upgrade your REDB, specify your new database version in the `spec.redisVersion` field in the REDB custom resources. Supported database versions for operator versions include `"7.2"` and `"7.4"` (note this value is a string). + +To upgrade your REAADB, see [Upgrade an Active-Active database]({{}}) for details on the `rladmin` and `crdb-cli` commands required. Reach out to Redis support if you have additional questions. + +Note that if your cluster [`redisUpgradePolicy`]({{}}) or your database [`redisVersion`]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_database_api#redisversion" >}}) are set to `major`, you won't be able to upgrade those databases to minor versions. See [Redis upgrade policy]({{< relref "/operate/rs/installing-upgrading/upgrading#redis-upgrade-policy" >}}) for more details. + +The Redis Enterprise cluster (REC) can be updated automatically or manually. To trigger automatic upgrade of the REC after the operator upgrade completes, specify `autoUpgradeRedisEnterprise: true` in your REC spec. If you don't have automatic upgrade enabled, follow the below steps for the manual upgrade. + +## Troubleshooting + +If you start an upgrade without meeting the [prerequisites](#prerequisites), the operator will freeze the upgrade. Check the operator logs for the source of the error. The REDB reconsilliation doesn't work during an upgrade, so you need to apply a manual fix with the Redis Software API (examples below). The updates will also need to be added to the REDB custom resource. + +### Invalid module version + +If the operator logs show an event related to an unsupported module, download the updated module locally, and install it using the `v2/modules` API endpoint. + +```sh +curl -sfk -u : -X POST -F 'module=@' https://localhost:9443/v2/modules +``` + +After updating the modules with the Redis Software API, update the REDB custom resource to reflect the change. + +### Invalid database version + +If the operator logs show an event related to an incompatible database version, upgrade the database using the Redis Software API. + +```sh +curl -sfk -u : -X POST -H "Content-Type: application/json" -d '{"redis_version": }' https://localhost:9443/v1/bdbs//upgrade +``` + +After updating the database with the Redis Software API, update the REDB custom resource to reflect the change. diff --git a/content/operate/kubernetes/7.22/upgrade/upgrade-redis-cluster.md b/content/operate/kubernetes/7.22/upgrade/upgrade-redis-cluster.md new file mode 100644 index 0000000000..0c6513111e --- /dev/null +++ b/content/operate/kubernetes/7.22/upgrade/upgrade-redis-cluster.md @@ -0,0 +1,248 @@ +--- +Title: Upgrade Redis Enterprise for Kubernetes +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: This task describes how to upgrade a Redis Enterprise cluster via the + operator. +linkTitle: Kubernetes +weight: 10 +url: '/operate/kubernetes/7.22/upgrade/upgrade-redis-cluster/' +--- + +Redis implements rolling updates for software upgrades in Kubernetes deployments. The upgrade process includes updating three components: + + 1. [Upgrade the Redis Enterprise operator](#upgrade-the-operator) + 1. [Upgrade the Redis Enterprise cluster (REC)](#upgrade-the-redis-enterprise-cluster-rec) + 1. [Upgrade Redis Enterprise databases (REDB)](#upgrade-databases) + +## Prerequisites + +Before upgrading, ensure you have the minimum versions of all components necessary for your target version. **Without these minimum versions, the upgrade may freeze and require manual recovery.** + +See the [troubleshooting](#troubleshooting) section for details on recovering a failed upgrade. + +### Kubernetes version + +Check [Supported Kubernetes distributions]({{}}) to make sure your Kubernetes distribution is supported by your target Redis Enterprise operator version. If not, upgrade your Kubernetes distribution before upgrading the Redis operator. + +### Redis operator version + +Check the [Redis Enterprise for Kubernetes release notes]({{}}) for the minimum operator version required for your target upgrade. Some versions may require intermediate upgrades. + +### Redis database version + +Check the release notes for your target version to determine the minimum Redis database version required. See [upgrade databases](#upgrade-databases) for detailed steps. You can find your database version in the [REDB `spec.redisVersion` field]({{}}). + +### Module compatibility + +Some Redis Enterprise operator versions may require specific module versions or involve changes to the underlying operating system. If your databases use modules, check the release notes for your target version to determine if you need to manually install updated modules. + +To see which modules you have installed, run: + +```sh +curl -k -u : -X GET https://localhost:9443/v1/modules | jq -r 'map([.module_name, .semantic_version, (.platforms | keys)]) | .[] | .[0] as $name | .[1] as $version | .[2][] | $name + "-" + $version + "-" + .' | sort +``` + +To see which modules are currently in use, run: + +```sh +curl -k -u : -X GET https://localhost:9443/v1/bdbs | jq -r '.[].module_list | map(.module_name + "-" + .semantic_version) | .[]' +``` + +See [Upgrade modules]({{}}) for details on how to upgrade modules with the `rladmin` tool. + +### Valid license + +Use `kubectl get rec` and verify the `LICENSE STATE` is valid on your REC before you start the upgrade process. + +## Upgrade with Helm charts + +If you installed the Redis Enterprise operator using Helm charts, you can upgrade using Helm commands. This method automatically handles the operator upgrade and Custom Resource Definition (CRD) updates. + +To upgrade using Helm: + +```sh +helm upgrade redis/redis-enterprise-operator --version +``` + +For example: + +```sh +helm upgrade my-redis-enterprise redis/redis-enterprise-operator --version +``` + +For OpenShift installations, include the `openshift.mode=true` parameter: + +```sh +helm upgrade redis/redis-enterprise-operator --version \ + --set openshift.mode=true +``` + +After the Helm upgrade completes, continue with [upgrading the Redis Enterprise cluster (REC)](#upgrade-the-redis-enterprise-cluster-rec) and [upgrading databases](#upgrade-databases). + +For detailed Helm upgrade instructions, see [Upgrade the chart]({{}}). + +## Upgrade the operator + +### Download the bundle + +Make sure you pull the correct version of the bundle. You can find the version tags +by checking the [operator releases on GitHub](https://github.com/RedisLabs/redis-enterprise-k8s-docs/releases) +or by [using the GitHub API](https://docs.github.com/en/rest/reference/repos#releases). + +You can download the bundle for the latest release with the following `curl` command: + +```sh +VERSION=`curl --silent https://api.github.com/repos/RedisLabs/redis-enterprise-k8s-docs/releases/latest | grep tag_name | awk -F'"' '{print $4}'` +curl --silent -O https://raw.githubusercontent.com/RedisLabs/redis-enterprise-k8s-docs/$VERSION/bundle.yaml +``` + +If you need a different release, replace `VERSION` in the above with a specific release tag. + +### Apply the bundle + +Apply the bundle to deploy the new operator binary. This will also apply any changes in the new release to custom resource definitions, roles, role binding, or operator service accounts. + +{{< note >}} +If you are not pulling images from Docker Hub, update the operator image spec to point to your private repository. +If you have made changes to the role, role binding, RBAC, or custom resource definition (CRD) in the previous version, merge them with the updated declarations in the new version files. +{{< /note >}} + +Upgrade the bundle and operator with a single command, passing in the bundle YAML file: + +```sh +kubectl apply -f bundle.yaml +``` + +After running this command, you should see a result similar to this: + +```sh +role.rbac.authorization.k8s.io/redis-enterprise-operator configured +serviceaccount/redis-enterprise-operator configured +rolebinding.rbac.authorization.k8s.io/redis-enterprise-operator configured +customresourcedefinition.apiextensions.k8s.io/redisenterpriseclusters.app.redislabs.com configured +customresourcedefinition.apiextensions.k8s.io/redisenterprisedatabases.app.redislabs.com configured +deployment.apps/redis-enterprise-operator configured +``` + +### Reapply the admission controller webhook {#reapply-webhook} + +If you have the admission controller enabled, you need to manually reapply the `ValidatingWebhookConfiguration`. + +{{}} +{{< embed-md "k8s-642-redb-admission-webhook-name-change.md" >}} +{{}} + +{{< embed-md "k8s-admission-webhook-cert.md" >}} + +### Verify the operator is running + +You can check your deployment to verify the operator is running in your namespace. + +```sh +kubectl get deployment/redis-enterprise-operator +``` + +You should see a result similar to this: + +```sh +NAME READY UP-TO-DATE AVAILABLE AGE +redis-enterprise-operator 1/1 1 1 0m36s +``` + +{{< warning >}} +We recommend upgrading the REC as soon as possible after updating the operator. After the operator upgrade completes, the operator suspends the management of the REC and its associated REDBs, until the REC upgrade completes. +{{< /warning >}} + +## Upgrade the Redis Enterprise cluster (REC) + +The Redis Enterprise cluster (REC) can be updated automatically or manually. To trigger automatic upgrade of the REC after the operator upgrade completes, specify `autoUpgradeRedisEnterprise: true` in your REC spec. If you don't have automatic upgrade enabled, follow the below steps for the manual upgrade. + +Before beginning the upgrade of the Redis Enterprise cluster, check the [Redis Enterprise for Kubernetes release notes]({{}}) to find the Redis Enterprise image tag for your target version. + +After the operator upgrade is complete, you can upgrade Redis Enterprise cluster (REC). + +### Upgrade an REC with an Active-Active database + +We recommend upgrading all participating clusters to the same operator version. + +If you are upgrading from a preview version of the Active-Active controller, you can remove the following environment variables: `ACTIVE_ACTIVE_DATABASE_CONTROLLER_ENABLED`, `REMOTE_CLUSTER_CONTROLLER_ENABLED`, and `ENABLE_ALPHA_FEATURES`. + +### Edit `redisEnterpriseImageSpec` in the REC spec + +1. Edit the REC custom resource YAML file. + + ```sh + kubectl edit rec + ``` + +1. Replace the `versionTag:` declaration under `redisEnterpriseImageSpec` with the new version tag. + + ```YAML + spec: + redisEnterpriseImageSpec: + imagePullPolicy: IfNotPresent + repository: redislabs/redis + versionTag: + ``` + +1. Save the changes to apply. + +### Reapply roles and role bindings + +If your operator is monitoring multiple namespaces, you'll need to [reapply your role and role bindings]({{< relref "/operate/kubernetes/7.22/re-clusters/multi-namespace#create-role-and-role-binding-for-managed-namespaces" >}}) for each managed namespace. See [Manage databases in multiple namespaces]({{< relref "/operate/kubernetes/7.22/re-clusters/multi-namespace" >}}) for more details. + +### Monitor the upgrade + +You can view the state of the REC with `kubectl get rec`. + + During the upgrade, the state should be `Upgrade`. + When the upgrade is complete and the cluster is ready to use, the state will change to `Running`. + If the state is `InvalidUpgrade`, there is an error (usually relating to configuration) in the upgrade. + +```sh +$ kubectl get rec +NAME NODES VERSION STATE SPEC STATUS LICENSE STATE SHARDS LIMIT LICENSE EXPIRATION DATE AGE +rec 3 6.2.10-107 Upgrade Valid Valid 4 2022-07-16T13:59:00Z 92m +``` + +To see the status of the current rolling upgrade, run: + +```sh +kubectl rollout status sts +``` + +### Upgrade databases + +After the cluster is upgraded, you can upgrade your databases. To upgrade your REDB, specify your new database version in the `spec.redisVersion` field in the REDB custom resources. Check the release notes for your operator version to see which database versions are supported (note this value is a string). + +To upgrade your REAADB, see [Upgrade an Active-Active database]({{}}) for details on the `rladmin` and `crdb-cli` commands required. Reach out to Redis support if you have additional questions. + +Note that if your cluster [`redisUpgradePolicy`]({{}}) or your database [`redisVersion`]({{< relref "/operate/kubernetes/7.22/reference/api/redis_enterprise_database_api#redisversion" >}}) are set to `major`, you won't be able to upgrade those databases to minor versions. See [Redis upgrade policy]({{< relref "/operate/rs/installing-upgrading/upgrading#redis-upgrade-policy" >}}) for more details. + +## Troubleshooting + +If you start an upgrade without meeting the [prerequisites](#prerequisites), the operator will freeze the upgrade. Check the operator logs for the source of the error. The REDB reconsilliation doesn't work during an upgrade, so you need to apply a manual fix with the Redis Software API (examples below). The updates will also need to be added to the REDB custom resource. + +### Invalid module version + +If the operator logs show an event related to an unsupported module, download the updated module locally, and install it using the `v2/modules` API endpoint. + +```sh +curl -sfk -u : -X POST -F 'module=@' https://localhost:9443/v2/modules +``` + +After updating the database with the Redis Software API, update the REDB custom resource to reflect the change. + +### Invalid database version + +If the operator logs show an event related to an incompatible database version, upgrade the database using the Redis Software API. + +```sh +curl -sfk -u : -X POST -H "Content-Type: application/json" -d '{"redis_version": }' https://localhost:9443/v1/bdbs//upgrade +``` + +After updating the modules with the Redis Software API, update the REDB custom resource to reflect the change. \ No newline at end of file diff --git a/content/operate/kubernetes/reference/supported_k8s_distributions.md b/content/operate/kubernetes/reference/supported_k8s_distributions.md index 29e489be28..84b2be7a10 100644 --- a/content/operate/kubernetes/reference/supported_k8s_distributions.md +++ b/content/operate/kubernetes/reference/supported_k8s_distributions.md @@ -174,39 +174,23 @@ For details on this platform, see the [Rancher documentation](https://rancherman | Redis operator | **7.22.0-15** | **7.22.0-7** | **7.8.6-1** | **7.8.4-9** | **7.8.4-8** | **7.8.2-6** | **7.4.6-2** | **7.4.2-12** | **7.4.2-2** | **7.2.4-12** | **7.2.4-7** | **7.2.4-2** | **6.4.2-8** | **6.4.2-6** | **6.4.2-5** | **6.4.2-4** | **6.2.18-41** | **6.2.18-3** | **6.2.12-1** | **6.2.10-45** | **6.2.10-34** | **6.2.10-4** | **6.2.8-15** | **6.2.8-11** | **6.2.8-2** | **6.2.4-1** | |---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| | | July 2025 | April 2025 | March 2025 | March 2025 | Feb 2025 | Nov 2024 | July 2024 | May 2024 | March 2024 | Dec 2023 | Oct 2023 | Aug 2023 | July 2023 | June 2023 | April 2023 | March 2023 | Jan 2023 | Nov 2022 | Sept 2022 | July 2022 | May 2022 | March 2022 | Jan 2022 | Jan 2022 | Nov 2021 | Sept 2021 | -| **Rancher 2.10** | | | | | | | | | | | | | | | | | | | | | | | | | | | -| 1.30 | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | -| 1.29 | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | -| **Rancher 2.9** | | | | | | | | | | | | | | | | | | | | | | | | | | | -| 1.31 | | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | -| 1.30 | | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | -| 1.29 | | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | -| **Rancher 2.8** | | | | | | | | | | | | | | | | | | | | | | | | | | | -| 1.30 | | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | -| 1.29 | | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | -| 1.28 | | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | -| 1.27 | | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | -| 1.26 | | ❌ | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | -| **Rancher 2.7** | | | | | | | | | | | | | | | | | | | | | | | | | | | -| 1.25 | | | | | | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | -| 1.24 | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | -| 1.23 | | | | | | | | ❌ | :warning: | :warning: | :warning: | :warning: | :warning: | ✅ | ✅ | | | | | | | | | | | -| **Rancher 2.6** | | | | | | | | | | | | | | | | | | | | | | | | | | -| 1.24 | | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | -| 1.23 | | | | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | -| 1.22 | | | | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | -| 1.21 | | | | | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | -| 1.20 | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | | | | | | | -| 1.19 | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | | | | | | | -| 1.18 | | | | | | | | | | | | | | | | | | | :warning: | | | | | | | -| **Rancher 2.5** | | | | | | | | | | | | | | | | | | | | | | | | | | -| 1.20 | | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | -| 1.19 | | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | -| 1.18 | | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | -| 1.17 | | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | -| **Rancher 2.4** | | | | | | | | | | | | | | | | | | | | | | | | | | -| 1.18 | | | | | | | | | | | | | | | | | | | | | | | :warning: | ✅ | -| 1.17 | | | | | | | | | | | | | | | | | | | | | | | :warning: | ✅ | +| **RKE2** | | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.31 | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | +| 1.30 | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | +| 1.29 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | +| 1.28 | | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | +| 1.27 | | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | +| 1.26 | | ❌ | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | +| 1.25 | | | | | | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | +| 1.24 | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | +| 1.23 | | | | | | | | ❌ | :warning: | :warning: | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | +| **Rancher** | | | | | | | | | | | | | | | | | | | | | | | | | | | +| 1.22 | | | | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | +| 1.21 | | | | | | | | | | | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | +| 1.20 | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | +| 1.19 | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | +| 1.18 | | | | | | | | | | | | | | | | | | | :warning: | :warning: | ✅ | ✅ | :warning: | ✅ | | | +| 1.17 | | | | | | | | | | | | | | | | | | | ❌ | :warning: | ✅ | ✅ | :warning: | ✅ | | | {{}} diff --git a/content/operate/kubernetes/release-notes/6-2-releases/_index.md b/content/operate/kubernetes/release-notes/6-2-releases/_index.md index 74ec83acb2..9910369a71 100644 --- a/content/operate/kubernetes/release-notes/6-2-releases/_index.md +++ b/content/operate/kubernetes/release-notes/6-2-releases/_index.md @@ -9,7 +9,7 @@ description: Release notes for the 6.2.x releases of Redis Enterprise Software f Kubernetes. hideListLinks: true linkTitle: 6.2 releases -weight: 58 +weight: 90 --- ## Before upgrading diff --git a/content/operate/kubernetes/release-notes/6-4-2-releases/_index.md b/content/operate/kubernetes/release-notes/6-4-2-releases/_index.md index 90b4daafab..4a6f38ccfa 100644 --- a/content/operate/kubernetes/release-notes/6-4-2-releases/_index.md +++ b/content/operate/kubernetes/release-notes/6-4-2-releases/_index.md @@ -9,7 +9,7 @@ description: Release notes for the 6.4.2 releases of Redis Enterprise Software f Kubernetes. hideListLinks: true linkTitle: 6.4.2 releases -weight: 57 +weight: 85 --- ## Before upgrading diff --git a/content/operate/kubernetes/release-notes/7-2-4-releases/_index.md b/content/operate/kubernetes/release-notes/7-2-4-releases/_index.md index 0da8335259..0c68991c2a 100644 --- a/content/operate/kubernetes/release-notes/7-2-4-releases/_index.md +++ b/content/operate/kubernetes/release-notes/7-2-4-releases/_index.md @@ -9,7 +9,7 @@ description: Support for Redis Enterprise 7.2.4, platform support updates, and b fixes. hideListLinks: true linkTitle: 7.2.4 releases -weight: 55 +weight: 80 --- ## Highlights diff --git a/content/operate/kubernetes/release-notes/7-22-0-releases/_index.md b/content/operate/kubernetes/release-notes/7-22-0-releases/_index.md index 9708c5a1bd..f76b286a7f 100644 --- a/content/operate/kubernetes/release-notes/7-22-0-releases/_index.md +++ b/content/operate/kubernetes/release-notes/7-22-0-releases/_index.md @@ -9,7 +9,7 @@ description: Releases with support for Redis Enterprise Software 7.22.0 hideListLinks: true linkTitle: 7.22.0 releases title: Redis Enterprise for Kubernetes 7.22.0 release notes -weight: 46 +weight: 20 --- Redis Enterprise for Kubernetes 7.22.0 includes bug fixes, enhancements, and support for Redis Enterprise Software. The latest release is 7.22.0-17 with support for Redis Enterprise Software version 7.22.0-250. diff --git a/content/operate/kubernetes/release-notes/7-22-2-releases/_index.md b/content/operate/kubernetes/release-notes/7-22-2-releases/_index.md index d8db2c315a..d6fd79a5b3 100644 --- a/content/operate/kubernetes/release-notes/7-22-2-releases/_index.md +++ b/content/operate/kubernetes/release-notes/7-22-2-releases/_index.md @@ -8,7 +8,7 @@ description: Releases with support for Redis Enterprise Software 7.22.2 hideListLinks: true linkTitle: 7.22.2 releases title: Redis Enterprise for Kubernetes 7.22.2 release notes -weight: 45 +weight: 10 --- Redis Enterprise for Kubernetes 7.22.2 includes bug fixes, enhancements, and support for Redis Enterprise Software. The latest release is 7.22.2-21 with support for Redis Enterprise Software version 7.22.2-14. diff --git a/content/operate/kubernetes/release-notes/7-4-2-releases/_index.md b/content/operate/kubernetes/release-notes/7-4-2-releases/_index.md index ce645a2995..65a2254b67 100644 --- a/content/operate/kubernetes/release-notes/7-4-2-releases/_index.md +++ b/content/operate/kubernetes/release-notes/7-4-2-releases/_index.md @@ -8,7 +8,7 @@ description: Releases with support for Redis Enterprise Software 7.4.2. hideListLinks: true linkTitle: 7.4.2 releases title: Redis Enterprise for Kubernetes 7.4.2 release notes -weight: 54 +weight: 70 --- ## Detailed release notes diff --git a/content/operate/kubernetes/release-notes/7-4-6-releases/_index.md b/content/operate/kubernetes/release-notes/7-4-6-releases/_index.md index 782a92029a..29abd8f412 100644 --- a/content/operate/kubernetes/release-notes/7-4-6-releases/_index.md +++ b/content/operate/kubernetes/release-notes/7-4-6-releases/_index.md @@ -8,7 +8,7 @@ description: Releases with support for Redis Enterprise Software 7.4.6. hideListLinks: true linkTitle: 7.4.6 releases title: Redis Enterprise for Kubernetes 7.4.6 release notes -weight: 52 +weight: 60 --- ## Detailed release notes diff --git a/content/operate/kubernetes/release-notes/7-8-2-releases/_index.md b/content/operate/kubernetes/release-notes/7-8-2-releases/_index.md index ffb531bd2c..25aea809ac 100644 --- a/content/operate/kubernetes/release-notes/7-8-2-releases/_index.md +++ b/content/operate/kubernetes/release-notes/7-8-2-releases/_index.md @@ -8,7 +8,7 @@ description: Releases with support for Redis Enterprise Software 7.8.2 hideListLinks: true linkTitle: 7.8.2 releases title: Redis Enterprise for Kubernetes 7.8.2-6 release notes -weight: 51 +weight: 50 --- Redis Enterprise for Kubernetes 7.8.2-6 is a feature release including support for Redis Software 7.8.2-2. diff --git a/content/operate/kubernetes/release-notes/7-8-4-releases/_index.md b/content/operate/kubernetes/release-notes/7-8-4-releases/_index.md index 950f743a74..6a490466e3 100644 --- a/content/operate/kubernetes/release-notes/7-8-4-releases/_index.md +++ b/content/operate/kubernetes/release-notes/7-8-4-releases/_index.md @@ -8,7 +8,7 @@ description: Releases with support for Redis Enterprise Software 7.8.4 hideListLinks: true linkTitle: 7.8.4 releases title: Redis Enterprise for Kubernetes 7.8.4 release notes -weight: 49 +weight: 40 --- Redis Enterprise for Kubernetes 7.8.4-8 includes bug fixes, enhancements, and support for [Redis Enterprise Software version 7.8.4]({{}}). diff --git a/content/operate/kubernetes/release-notes/7-8-6-releases/_index.md b/content/operate/kubernetes/release-notes/7-8-6-releases/_index.md index eddbfae1f3..ce64655a66 100644 --- a/content/operate/kubernetes/release-notes/7-8-6-releases/_index.md +++ b/content/operate/kubernetes/release-notes/7-8-6-releases/_index.md @@ -8,7 +8,7 @@ description: Releases with support for Redis Enterprise Software 7.8.6 hideListLinks: true linkTitle: 7.8.6 releases title: Redis Enterprise for Kubernetes 7.8.6 release notes -weight: 48 +weight: 30 --- Redis Enterprise for Kubernetes 7.8.6 includes bug fixes, enhancements, and support for Redis Enterprise Software. The latest release is 7.8.6-8 with support for Redis Enterprise Software version 7.8.6-207. diff --git a/content/operate/kubernetes/release-notes/8-0-2-releases/8-0-2-2-october2025.md b/content/operate/kubernetes/release-notes/8-0-2-releases/8-0-2-2-october2025.md new file mode 100644 index 0000000000..b13102f7b6 --- /dev/null +++ b/content/operate/kubernetes/release-notes/8-0-2-releases/8-0-2-2-october2025.md @@ -0,0 +1,138 @@ +--- +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Feature release including support for Redis Software 8.0.2, enhancements, and bug fixes. +hideListLinks: true +linkTitle: 8.0.2-2 (October 2025) +title: Redis Enterprise for Kubernetes 8.0.2-2 (October 2025) release notes +weight: 1 +--- + +This feature release of Redis Enterprise for Kubernetes supports Redis Software 8.0.2-17 and includes enhancements, platform support changes, and bug fixes. + +{{< warning >}} +**Custom modules not supported**: If you use custom (non-bundled) modules, skip this release. Custom module support will be available in the next release. +{{< /warning >}} + +## New in this release + +This release includes enhancements to the Redis Enterprise for Kubernetes operator, and includes features supported by Redis Software 8.0.2-17, and Redis Open Source 8.0 and 8.2. + +**Redis Enterprise for Kubernetes 8.0.2-2:** +This release includes enhancements to Redis Enterprise for Kubernetes including: + +- Support for RS 8.0.2-17 +- Support for the VKS platform (Broadcom/VMWare) +- Added container probes to Redis Enterprise pods +- Kubernetes 1.34 support (select platforms) +- Unique per release CSV/OperatorHub channels + +**Redis Software 8.0.2-17:** + +- Automatically enabled capabilities (modules) in Redis 8 +- Metrics stream engine +- Module management enhancements +- Lag-aware availability API +- Redis Flex (Redis on Flash version 2) + +For more information about Redis Software 8.0.2-17, see the [Redis Software 8.0.2-17 release notes]({{< relref "/operate/rs/release-notes/rs-8-0-2-releases/rs-8-0-2-17.md" >}}). + +**Redis Open Source 8.0 and 8.2:** + +- Preview of new vector set data type +- Redis query engine improvements +- Performance improvements +- Enhanced ACLs +- New hash and streams commands + +For more details, see [What's new in Redis 8.0]({{< relref "/develop/whats-new/8-0/" >}}) and [Redis Open Source 8.2 release notes]({{< relref "/operate/oss_and_stack/stack-with-enterprise/release-notes/redisce/redisos-8.0-release-notes/" >}}). + +### Resolved issues + +- Fixed operator logs to properly reflect field inconsistencies between REC and statefulset (RED-161426) +- Applied security fixes (RED-162939, RED-163832, RED-165628, RED-168087) +- Fixed database tags being overridden when defined by Redis Software users (RED-170322) + +### API changes + +| **CRD** | **Field** | **Change** | **Description** | +|---|---|---|---| +| REAADB | `spec.alertSettings.bdb_proxy_cert_expiring_soon` | Add | Enables a new alert in alert settings | +| REC | | Change | Changed the storage version of the API to v1 (from v1alpha1) | +| REDB | `spec.alertSettings.bdb_proxy_cert_expiring_soon` | Add | Enables a new alert in alert settings | +| REDB | `spec.moduleList` | Change | For Redis version 8 and later, bundled modules are enabled automatically, so you don't need to specify them | +| REDB | `spec.moduleList.[DbModule].version` | Change | Module versions in regular deployments are automatically selected by the Redis Enterprise cluster. Specified module versions are ignored. In Active-Active setups, you must specify the module version. | + +## Version changes + +### Modules in Redis 8 + +In Redis Enterprise databases created with or upgraded to Redis version 8 or later, bundled modules are enabled automatically, so you don't need to specify them in the `spec.moduleList` field. However, if you want to use a specific version of a bundled module, you can specify it in the `spec.moduleList` field. + +The bundled capabilities (modules) are automatically enabled as follows: + +| Database type | Automatically enabled capabilities | +|---------------|------------------------------------| +| RAM-only | [Search and query]({{}})
    [JSON]({{}})
    [Time series]({{}})
    [Probabilistic]({{}}) | +| Flash-enabled ([Redis Flex]({{}})) | [JSON]({{}})
    [Probabilistic]({{}}) | +| [Active-Active]({{}}) | [Search and query]({{}})
    [JSON]({{}}) | + +For more information, see [Automatically enabled capabilities in Redis 8]({{< relref "/operate/rs/release-notes/rs-8-0-releases/rs-8-0-2-17/#automatically-enabled-capabilities-in-redis-8" >}}). + +### Breaking changes + +- **Non-bundled modules are not supported** with this version. If you use non-bundled modules, don't upgrade to this version. The Redis Enterprise version used with this operator version includes significant changes to modules, including using built-in modules by default on databases. For more details, see the Redis Enterprise core software release notes. + +- **TKG (TKG) is no longer supported**. Broadcom/VMware doesn't plan to support this platform in the near future. We recommend that you migrate to TKGI/VKS. + +For additional breaking changes related to Redis Software 8.0.2-17, see [Redis 8 breaking changes]({{< relref "/operate/rs/release-notes/rs-8-0-releases/rs-8-0-2-17#redis-8-breaking-changes" >}}). + +### Deprecations + +- The RedisEnterpriseCluster (REC) v1alpha1 API version is deprecated. + +## Supported distributions + +The following table shows supported distributions at the time of this release. You can also find this list in [Supported Kubernetes distributions]({{< relref "/operate/kubernetes/reference/supported_k8s_distributions" >}}). + +✅ **Supported** – This distribution is supported for this version of Redis Enterprise Software for Kubernetes. + +:warning: **Deprecated** – This distribution is still supported for this version of Redis Enterprise Software for Kubernetes, but support will be removed in a future release. + +❌ **End of life** – Support for this distribution ended. + +Any distribution not listed in the table is not supported for production workloads. + +| Kubernetes version | **1.28** | **1.29** | **1.30** | **1.31** | **1.32** | **1.33** | **1.34** | +|---|---|---|---|---|---|---|---| +| **Community K8s** | | | ❌ | :warning: | ✅ | ✅ | ✅ | +| **Amazon EKS** | | | ❌ | :warning: | ✅ | ✅ | | +| **Azure EKS** | | | ❌ | :warning: | ✅ | ✅ | ✅ | +| **Google GKE** | | | ❌ | :warning: | ✅ | ✅ | ✅ | +| **Rancher REK2** | ❌ | :warning: | :warning: | ✅ | ✅ | ✅ | | +| **VMware TKG 2.5** | | ❌ | ❌ | | | | | +| **VMware VKS** | | | | | ✅ | | | + +| **OpenShift** | **4.15** | **4.16** | **4.17** | **4.18** | **4.19** | | | +|---|---|---|---|---|---|---|---| +| | ❌ | :warning: | ✅ | ✅ | ✅ | | | + +| **VMware TKGI** | **1.19** | **1.20** | **1.21** | **1.22** | | | | +|---|---|---|---|---|---|---|---| +| | ❌ | :warning: | ✅ | ✅ | | | | + +## Downloads + + +- **Redis Enterprise**: `redislabs/redis:8.0.2-17` +- **Operator**: `redislabs/operator:8.0.2-2` +- **Services Rigger**: `redislabs/k8s-controller:8.0.2-2` +- **Callhome client**: `redislabs/re-call-home-client:8.0.2-2` +- **OLM operator bundle** : `v.` + +## Known limitations + +See [8.0.2 releases]({{}}) for information on known limitations. diff --git a/content/operate/kubernetes/release-notes/8-0-2-releases/_index.md b/content/operate/kubernetes/release-notes/8-0-2-releases/_index.md new file mode 100644 index 0000000000..4c3b1893ad --- /dev/null +++ b/content/operate/kubernetes/release-notes/8-0-2-releases/_index.md @@ -0,0 +1,57 @@ +--- +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Releases with support for Redis Enterprise Software 8.0.2 +hideListLinks: true +linkTitle: 8.0.2 releases +title: Redis Enterprise for Kubernetes 8.0.2 release notes +weight: 1 +--- + + +Redis Enterprise for Kubernetes 8.0.2-2 includes bug fixes, enhancements, and support for [Redis Enterprise Software version 8.0.2]({{}}). + + +## Detailed release notes + + +{{}} + + +## Breaking changes + + +## Known limitations + +- **PVC expansion is not supported when using Redis on Flash (Auto Tiering)** - Do not enable enablePersistentVolumeResize if your REC uses redisOnFlashSpec as this will result in conflicts (RED-165770) +- **Specifying databasePort causes issues with REAADB synchronization** (RED-149374) +- **Only upgrades from 7.4.2-2 and later are supported** - If you are using an earlier version install 7.4.2-2 before upgrading to 7.8.2-6 or later +- **When changing the REDB field spec.modulesList version might be upgraded to latest even if a different version is specified** - To prevent the upgrade to latest, set spec.upgradeSpec.setModuleToLatest to false before upgrading to 7.8.2-6 +- **Missing endpoint for admission endpoint (rare)** - Restart the operator pod (RED-119469) +- **The REDB redisVersion field can't be used for memcached databases** (RED-119152) +- **When modifying the database suffix for an Active-Active database, while the service-rigger is in a terminating state, the services-rigger will delete and create the ingress or route resources in a loop** - Wait until the services rigger pod has finished to terminate it (RED-107687) +- **REAADB changes might fail with "gateway timeout" errors, mostly on OpenShift** - Retry the operation (RED-103048) +- **Installing operator bundle produces warning: "Warning: would violate PodSecurity "restricted:v1.24""** - Ignore the warning (RED-97381) +- **RERC resources must have a unique name** - The string rec-name/rec-namespace must be different from all other participating clusters in the Active-Active database (RED-96302) +- **Admission is not blocking REAADB with shardCount which exceeds license quota** - Fix the problems with the REAADB and reapply (RED-96301) +- **Active-Active controller only supports global database options. Configuration specific to location is not supported** (RED-86490) +- **autoUpgrade set to true can cause unexpected bdb upgrades when redisUpgradePolicy is set to true** - Contact support if your deployment is impacted (RED-72351) +- **Following the previous quick start guide version causes issues with creating an REDB due to unrecognized memory field name** - Use the newer (current) revision of Deploy Redis Enterprise Software for Kubernetes (RED-69515) +- **PVC size issues when using decimal value in spec** - Make sure you use integer values for the PVC size (RED-62132) +- **REC might report error states on initial startup** - There is no workaround at this time except to ignore the errors (RED-61707) +- **Hashicorp Vault integration - no support for Gesher** - There is no workaround for this issue. Gesher support has been deprecated (RED-55080) +- **REC clusters fail to start on Kubernetes clusters with unsynchronized clocks** - When REC clusters are deployed on Kubernetes clusters without synchronized clocks the REC cluster does not start correctly. The fix is to use NTP to synchronize the underlying K8s nodes (RED-47254) +- **Deleting an OpenShift project with an REC deployed may hang** - When an REC cluster is deployed in a project (namespace) and has REDB resources the REDB resources must be deleted first before the REC can be deleted. The fix is to delete the REDB resources first and the REC second (RED-47192) +- **In OLM-deployed operators, the deployment of the cluster will fail if the name is not "rec"** - When the operator is deployed via the OLM, the security context constraints (scc) are bound to a specific service name (i.e., "rec"). Naming the cluster "rec" should resolve the issue (RED-39825) +- **STS Readiness prob doesn't mark a node as "not ready when" rladmin status nodes fails** (RED-39300) +- **DNS conflicts are possible between the cluster mdns_server and the K8s DNS** - Only impacts DNS resolution from within cluster nodes (RED-37462) +- **K8S-based 5.4.10 clusters seem to negatively affect existing 5.4.6 clusters** (RED-37233) +- **In Kubernetes, the node CPU usage we report is the usage of the K8S worker node hosting the REC pod** (RED-36884) +- **When a cluster is in an unreachable state, the cluster is still running instead of being reported as an error** (RED-32805) +- **A cluster name longer than 20 characters will result in a rejected route configuration, as the host part of the domain name exceeds 63 characters** - Limit cluster name to 20 characters or less (RED-25871) +- **A cluster CR specification error is not reported if two or more invalid CR resources are updated in sequence** (RED-25542) +- **Creating two databases with the same name directly on Redis Enterprise software will cause the service to be deleted and the database will not be available** - Avoid duplicating database names. Database creation via K8s has validation in place to prevent this (RED-99997) +- **Active-Active setup removal might keep services or routes undeleted** - Delete services or routes manually if you encounter this problem (RED-77752)