You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/operate/kubernetes/active-active/global-config.md
+70-3Lines changed: 70 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -48,7 +48,6 @@ The [REAADB API reference]({{<relref "/operate/kubernetes/reference/redis_enterp
48
48
49
49
This section edits the secrets under the REAADB `.spec.globalConfigurations` section. For more information and all available fields, see the [REAADB API reference]({{<relref "/operate/kubernetes/reference/redis_enterprise_active_active_database_api">}}).
50
50
51
-
52
51
1. On an existing participating cluster, generate a YAML file containing the database secret with the relevant data.
53
52
54
53
This example shoes a secret named `my-db-secret` with the password `my-password` encoded in base 64.
@@ -87,7 +86,7 @@ This section edits the secrets under the REAADB `.spec.globalConfigurations` sec
87
86
88
87
1. On each other participating cluster, check the secret status.
89
88
90
-
``sh
89
+
```sh
91
90
kubectl get reaadb <reaadb-name> -o=jsonpath='{.status.secretsStatus}'
92
91
```
93
92
@@ -103,4 +102,72 @@ This section edits the secrets under the REAADB `.spec.globalConfigurations` sec
103
102
kubectl apply -f <db-secret-file>
104
103
```
105
104
106
-
1. Repeat the previous two steps on every participating cluster.
105
+
1. Repeat the previous two steps on every participating cluster.
106
+
107
+
## Configure role permissions
108
+
109
+
You can configure role-based access control (RBAC) permissions forActive-Active databases using the `rolesPermissions` fieldin the REAADB `.spec.globalConfigurations` section. The role permissions configuration is propagated across all participating clusters, but the underlying roles and Redis ACLs must be manually created on each cluster.
110
+
111
+
{{<note>}}You must manually create the specified roles and Redis ACLs on all participating clusters before configuring role permissions. The operator only propagates the role permissions configuration—it does not create the underlying roles and ACLs. If roles or ACLs are missing on any cluster, the operator will log errors and dispatch an Event associated with the REAADB object until they are manually created.{{</note>}}
112
+
113
+
### Prerequisites
114
+
115
+
Before configuring role permissions:
116
+
117
+
1. Manually create the required roles and Redis ACLs on all participating clusters using the Redis Enterprise admin console or REST API.
118
+
2. Ensure role and ACL names match exactly across all clusters (names are case-sensitive).
119
+
3. Verify that roles and ACLs are properly configured on each cluster.
120
+
121
+
{{<warning>}}The operator does not automatically create or synchronize roles and ACLs across clusters. You are responsible for manually creating identical roles and ACLs on each participating cluster.{{</warning>}}
122
+
123
+
### Add role permissions to REAADB
124
+
125
+
1. Create or update your REAADB custom resource to include `rolesPermissions`in the global configurations.
126
+
127
+
Example REAADB with role permissions:
128
+
129
+
```yaml
130
+
apiVersion: app.redislabs.com/v1alpha1
131
+
kind: RedisEnterpriseActiveActiveDatabase
132
+
metadata:
133
+
name: reaadb-boeing
134
+
spec:
135
+
globalConfigurations:
136
+
databaseSecretName: <my-secret>
137
+
memorySize: 200MB
138
+
shardCount: 3
139
+
rolesPermissions:
140
+
- role: <role-name>
141
+
acl: <acl-name>
142
+
type: redis-enterprise
143
+
participatingClusters:
144
+
- name: rerc-ohare
145
+
- name: rerc-reagan
146
+
```
147
+
148
+
Replace `<role-name>` and `<acl-name>` with the exact names of your Redis Enterprise role and ACL.
149
+
150
+
2. Apply the REAADB custom resource:
151
+
152
+
```sh
153
+
kubectl apply -f <reaadb-file>
154
+
```
155
+
156
+
Alternatively, patch an existing REAADB to add role permissions:
3. After the REAADB is active and its replication status is "Up", verify role permissions are applied to the local database using the Redis Enterprise REST API. See [Database requests]({{<relref "/operate/rs/references/rest-api/requests/bdbs#get-bdbs">}}) for details.
164
+
165
+
### Troubleshooting role permissions
166
+
167
+
If you encounter issues with role permissions:
168
+
169
+
- **Missing role or ACL errors**: Manually create the specified roles and ACLs on all participating clusters with exact name matches. The operator cannot create these automatically.
170
+
- **Permission propagation failures**: Verify that the roles and ACLs are properly configured and accessible on each cluster. Remember that you must manually create identical roles and ACLs on every participating cluster.
171
+
- **Case sensitivity issues**: Verify that role and ACL names match exactly, including capitalization, across all clusters.
172
+
173
+
For more details on the `rolesPermissions` field structure, see the [REAADB API reference]({{<relref "/operate/kubernetes/reference/redis_enterprise_active_active_database_api#specglobalconfigurationsrolespermissions">}}).
Copy file name to clipboardExpand all lines: content/operate/kubernetes/deployment/helm.md
+65-15Lines changed: 65 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,14 +11,13 @@ weight: 11
11
11
---
12
12
Helm charts provide a simple way to install the Redis Enterprise for Kubernetes operator in just a few steps. For more information about Helm, go to [https://helm.sh/docs/](https://helm.sh/docs/).
13
13
14
-
{{<note>}} This feature is currently in public preview and is not supported on production workloads. Only new installations of the Redis operator are supported at this time. The steps for [creating the RedisEnterpriseCluster (REC)]({{<relref "operate/kubernetes/deployment/quick-start#create-a-redis-enterprise-cluster-rec">}}) and other custom resources remain the same.{{</note>}}
15
-
16
14
## Prerequisites
17
15
18
16
- A [supported distribution]({{< relref "/operate/kubernetes/reference/supported_k8s_distributions" >}}) of Kubernetes.
-[Helm 3.10 or later](https://helm.sh/docs/intro/install/).
19
+
-[Helm 3.10 or later](https://helm.sh/docs/intro/install/)
20
+
or 3.18 for migrating from a non-Helm installation.
22
21
23
22
If you suspect your file descriptor limits are below 100,000, you must either manually increase limits or [Allow automatic resource adjustment]({{< relref "/operate/kubernetes/security/allow-resource-adjustment" >}}). Most major cloud providers and standard container runtime configurations set default file descriptor limits well above the minimum required by Redis Enterprise. In these environments, you can safely run without enabling automatic resource adjustment.
24
23
@@ -36,14 +35,14 @@ The steps below use the following placeholders to indicate command line paramete
To migrate an existing non-Helm installation of the Redis Enterprise operator to a Helm-based installation:
105
+
106
+
1.[Upgrade]({{<relref "operate/kubernetes/upgrade">}}) your existing Redis Enterprise operator to match the version of the Helm chart you want to install. Use the same non-Helm method you used for the original installation.
107
+
108
+
2.[Install](#install) the Helm chart adding the `--take-ownership` flag:
This step is only needed when the `admission.limitToNamespace` chart value is set to `true` (the default). In this case, the webhook object installed by the chart is named `redis-enterprise-admission-<namespace>`, and the original webhook object, named `redis-enterprise-admission`, becomes redundant. If `admission.limitToNamespace` is set to `false`, the webhook installed by the chart is named `redis-enterprise-admission`, and the existing webhook object is reused.
For example, to upgrade a chart with the release name `my-redis-enterprise` from the chart's root directory:
141
+
142
+
```sh
143
+
helm upgrade my-redis-enterprise .
144
+
```
145
+
146
+
To upgrade with OpenShift, add `--set openshift.mode=true`.
147
+
148
+
The upgrade process automatically updates the operator and its components, including the Custom Resource Definitions (CRDs). The CRDs are versioned and update only if the new version is higher than the existing version.
149
+
150
+
After you upgrade the operator, you might need to upgrade your Redis Enterprise clusters, depending on the Redis software version bundled with the operator. For detailed information about the upgrade process, see [Redis Enterprise for Kubernetes upgrade documentation](https://redis.io/docs/latest/operate/kubernetes/upgrade/).
151
+
152
+
For more information and options when upgrading charts, see [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/).
153
+
103
154
## Uninstall
104
155
105
156
1. Delete any custom resources managed by the operator. See [Delete custom resources]({{<relref "operate/kubernetes/re-clusters/delete-custom-resources">}}) for detailed steps. You must delete custom resources in the correct order to avoid errors.
@@ -116,7 +167,6 @@ This removes all Kubernetes resources associated with the chart and deletes the
116
167
117
168
## Known limitations
118
169
119
-
- Only new installations of the Redis operator are supported at this time. The steps for [creating the RedisEnterpriseCluster (REC)]({{<relref "operate/kubernetes/deployment/quick-start#create-a-redis-enterprise-cluster-rec">}}) and other custom resources remain the same.
120
-
- Upgrades and migrations are not supported.
170
+
- The steps for [creating the RedisEnterpriseCluster (REC)]({{<relref "operate/kubernetes/deployment/quick-start#create-a-redis-enterprise-cluster-rec">}}) and other custom resources remain the same.
121
171
- The chart doesn't include configuration options for multiple namespaces, rack-awareness, and Vault integration. The steps for configuring these options remain the same.
122
172
- The chart has had limited testing in advanced setups, including Active-Active configurations, air-gapped deployments, and IPv6/dual-stack environments.
0 commit comments