Skip to content

Commit 1e4479d

Browse files
kaitlynmichaelkaitlynmichael
committed
change SCC steps in install and upgrade
1 parent d3d7a60 commit 1e4479d

File tree

4 files changed

+14
-92
lines changed

4 files changed

+14
-92
lines changed

‎content/operate/kubernetes/deployment/openshift/openshift-cli.md‎

Lines changed: 3 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -68,45 +68,11 @@ Changes to the `openshift.bundle.yaml` file can cause unexpected results.
6868
DO NOT modify or delete the StatefulSet created during the deployment process. Doing so could destroy your Redis Enterprise cluster (REC).
6969
{{</warning>}}
7070

71-
## Install security context constraint
71+
## Security context constraints
7272

73-
The Redis Enterprise pods must run in OpenShift with privileges set in a [Security Context Constraint](https://docs.openshift.com/container-platform/4.4/authentication/managing-security-context-constraints.html#security-context-constraints-about_configuring-internal-oauth). This grants the pod various rights, such as the ability to change system limits or run as a particular user.
73+
Upgrades to versions 7.22.0-6 and later run in **unprivileged mode** without any additional permissions or capabilities. If you don't specifally require additional capabilities, we recommend you maintain the default unprivileged mode, as its more secure. After upgrading, remove the existing `redis-enterprise-scc-v2` SCC and unbind it from the REC service account.
7474
75-
1. Apply the file `scc.yaml` file.
76-
77-
{{<warning>}}
78-
Do not edit this file.
79-
{{</warning>}}
80-
81-
```sh
82-
oc apply -f openshift/scc.yaml
83-
```
84-
85-
You should receive the following response:
86-
87-
```sh
88-
securitycontextconstraints.security.openshift.io "redis-enterprise-scc-v2" configured
89-
```
90-
91-
Releases before 6.4.2-6 use the earlier version of the SCC, named `redis-enterprise-scc`.
92-
93-
1. Provide the operator permissions for the pods.
94-
95-
```sh
96-
oc adm policy add-scc-to-user redis-enterprise-scc-v2 \
97-
system:serviceaccount:<my-project>:<rec>
98-
```
99-
100-
{{<note>}}
101-
If you are using version 6.2.18-41 or earlier, add additional permissions for your cluster.
102-
103-
```sh
104-
oc adm policy add-scc-to-user redis-enterprise-scc \
105-
system:serviceaccount:<my-project>:redis-enterprise-operator
106-
```
107-
{{</note>}}
108-
109-
You can check the name of your project using the `oc project` command. To replace the project name, use `oc edit project myproject`. Replace `rec` with the name of your Redis Enterprise cluster, if different.
75+
To enable privileged mode, see [Enable privileged mode > OpenShift upgrades]({{<relref "/operate/kubernetes/security/enable-privileged-mode#new-openshift-installations">}}).
11076
11177
## Create a Redis Enterprise cluster custom resource
11278

‎content/operate/kubernetes/deployment/openshift/openshift-operatorhub.md‎

Lines changed: 3 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -43,39 +43,11 @@ To see which version of Redis Enterprise for Kubernetes supports your OpenShift
4343

4444
{{<warning>}}DO NOT modify or delete the StatefulSet created during the deployment process. Doing so could destroy your Redis Enterprise cluster (REC).{{</warning>}}
4545

46-
## Install security context constraint
46+
## Security context constraints
4747

48-
The Redis Enterprise pods must run in OpenShift with privileges set in a [Security Context Constraint](https://docs.openshift.com/container-platform/4.4/authentication/managing-security-context-constraints.html#security-context-constraints-about_configuring-internal-oauth). This grants the pod various rights, such as the ability to change system limits or run as a particular user.
48+
Upgrades to versions 7.22.0-6 and later run in **unprivileged mode** without any additional permissions or capabilities. If you don't specifally require additional capabilities, we recommend you maintain the default unprivileged mode, as its more secure. After upgrading, remove the existing `redis-enterprise-scc-v2` SCC and unbind it from the REC service account.
4949

50-
{{<warning>}}
51-
Before creating any clusters, install the security context constraint (SCC) for the operator in [scc.yaml](https://github.com/RedisLabs/redis-enterprise-k8s-docs/blob/master/openshift/scc.yaml).
52-
{{</warning>}}
53-
54-
You only need to install the SCC once, but you must not delete it.
55-
56-
1. Select the project you'll be using or create a new project.
57-
58-
1. Download [`scc.yaml`](https://github.com/RedisLabs/redis-enterprise-k8s-docs/blob/master/openshift/scc.yaml).
59-
60-
1. Apply the file to install the security context constraint.
61-
62-
```sh
63-
oc apply -f scc.yaml
64-
```
65-
66-
After the install, the OperatorHub automatically uses the constraint for Redis Enterprise node pods.
67-
68-
{{< note >}}
69-
If you are using the recommended RedisEnterpriseCluster name of `rec`, the SCC is automatically bound to the RedisEnterpriseCluster after install.
70-
71-
If you choose a different name for the RedisEnterpriseCluster, or override the default service account name, you must manually bind the SCC to the RedisEnterpriseCluster’s service account:
72-
73-
```sh
74-
oc adm policy add-scc-to-user redis-enterprise-scc-v2 \
75-
system:serviceaccount:<my-project>:<rec-service-account-name>
76-
```
77-
78-
{{< /note >}}
50+
To enable privileged mode, see [Enable privileged mode > OpenShift upgrades]({{<relref "/operate/kubernetes/security/enable-privileged-mode#new-openshift-installations">}}).
7951

8052
## Create Redis Enterprise custom resources
8153

‎content/operate/kubernetes/upgrade/openshift-cli.md‎

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -128,22 +128,13 @@ redis-enterprise-operator 1/1 1 1 0m36s
128128
We recommend upgrading the REC as soon as possible after updating the operator. After the operator upgrade completes, the operator suspends the management of the REC and its associated REDBs, until the REC upgrade completes.
129129
{{< /warning >}}
130130

131-
### Reapply the SCC
131+
## Security context constraints
132132

133-
If you are using OpenShift, you will also need to manually reapply the [security context constraints](https://docs.openshift.com/container-platform/4.8/authentication/managing-security-context-constraints.html) file ([`scc.yaml`]({{< relref "/operate/kubernetes/deployment/openshift/openshift-cli#deploy-the-operator" >}})) and bind it to your service account.
133+
Upgrades to versions 7.22.0-6 and later run in **unprivileged mode** without any additional permissions or capabilities. If you don't specifally require additional capabilities, we recommend you maintain the default unprivileged mode, as its more secure. After upgrading, remove the existing `redis-enterprise-scc-v2` SCC and unbind it from the REC service account.
134134

135-
```sh
136-
oc apply -f openshift/scc.yaml
137-
```
138-
139-
```sh
140-
oc adm policy add-scc-to-user redis-enterprise-scc-v2 \
141-
system:serviceaccount:<my-project>:<rec-name>
142-
```
143-
144-
If you are upgrading from operator version 6.4.2-6 or before, see the ["after upgrading"](#after-upgrading) section to delete the old SCC and role binding after all clusters are running 6.4.2-6 or later.
135+
To enable privileged mode, see [Enable privileged mode > OpenShift upgrades]({{<relref "/operate/kubernetes/security/enable-privileged-mode#openshift-upgrades">}}).
145136

146-
## Upgrade the Redis Enterprise Cluster
137+
## Upgrade the Redis Enterprise cluster
147138

148139
{{<warning>}}
149140
Verify your license is valid before upgrading. Invalid licenses will cause the upgrade to fail.

‎content/operate/kubernetes/upgrade/upgrade-olm.md‎

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -73,20 +73,13 @@ Use `kubectl get rec` and verify the `LICENSE STATE` is valid on your REC before
7373

7474
You can monitor the upgrade from the **Installed Operators** page. A new Redis Enterprise Operator will appear in the list, with the status "Installing". OpenShift will delete the old operator, showing the "Cannot update" status during deletion.
7575

76-
## Reapply the SCC
76+
## Security context constraints
7777

78-
If you are using OpenShift, you must manually reappply the [security context constraints (SCC)](https://docs.openshift.com/container-platform/4.8/authentication/managing-security-context-constraints.html) file ([`scc.yaml`]({{< relref "/operate/kubernetes/deployment/openshift/openshift-cli#deploy-the-operator" >}})) and bind it to your service account.
78+
Upgrades to versions 7.22.0-6 and later run in **unprivileged mode** without any additional permissions or capabilities. If you don't specifally require additional capabilities, we recommend you maintain the default unprivileged mode, as its more secure. After upgrading, remove the existing `redis-enterprise-scc-v2` SCC and unbind it from the REC service account.
7979

80-
```sh
81-
oc apply -f openshift/scc.yaml
82-
```
83-
84-
```sh
85-
oc adm policy add-scc-to-user redis-enterprise-scc-v2 \
86-
system:serviceaccount:<my-project>:<rec-name>
87-
```
80+
To enable privileged mode, see [Enable privileged mode > OpenShift upgrades]({{<relref "/operate/kubernetes/security/enable-privileged-mode#openshift-upgrades">}}).
8881

89-
## Upgrade the Redis Enterprise Cluster
82+
## Upgrade the Redis Enterprise cluster
9083

9184
{{<warning>}}
9285
Verify your license is valid before upgrading. Invalid licenses will cause the upgrade to fail.

0 commit comments

Comments
 (0)