You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/operate/kubernetes/security/enable-privileged-mode.md
+5-6Lines changed: 5 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -60,11 +60,11 @@ securityContext:
60
60
61
61
OpenShift users upgrading to 7.22.0-6 need to make changes to your existing SCC (security context constraint).
62
62
63
-
## OpenShift Upgrades
63
+
## OpenShift upgrades
64
64
65
-
If running in **unprivileged mode**, remove the custom `redis-enterprise-scc-v2` and disconnect it from the REC service account after completing your upgrade.
65
+
If running in **unprivileged mode**, remove the custom `redis-enterprise-scc-v2` SCC and unbind it from the REC service account after completing your upgrade.
66
66
67
-
If running in **privileged mode**, manually reapply the [security context constraints (SCC)](https://docs.openshift.com/container-platform/4.8/authentication/managing-security-context-constraints.html) file ([`scc.yaml`]({{< relref "/operate/kubernetes/deployment/openshift/openshift-cli#deploy-the-operator" >}})) and bind it to your service account.
67
+
If running in **privileged mode**, manually reapply the [security context constraints (SCC)](https://docs.openshift.com/container-platform/4.8/authentication/managing-security-context-constraints.html) file ([`scc.yaml`]({{< relref "/operate/kubernetes/deployment/openshift/openshift-cli#deploy-the-operator" >}})) and rebind it to the REC service account.
68
68
69
69
```sh
70
70
oc apply -f openshift/scc.yaml
@@ -81,7 +81,7 @@ New installations of Redis Enterprise for Kubernetes 7.22.0-6 and later automati
81
81
82
82
To enable **privileged mode** after installation, apply and grant permissions to the `redis-enterprise-scc-v2` SCC.
83
83
84
-
1. Apply the file `scc.yaml` file.
84
+
1. Apply the `scc.yaml` file.
85
85
86
86
{{<warning>}}
87
87
Do not edit this file.
@@ -108,9 +108,8 @@ Do not edit this file.
108
108
109
109
The `SYS_RESOURCE` capability may be required if processes in the container need to raise resource limits, such as the maximum number of open file descriptors.
110
110
111
-
Some Redis Enterprise processes require the ability to open at least 100,000 file descriptors. If the default limit is lower and the container lacks the `SYS_RESOURCE` capability, the process may fail repeatedly, rendering the cluster unusable. To use unprivileged mode, configure your Kubernetes worker nodes to ensure a default file descriptor limit of at least 100,000.
111
+
Some Redis Enterprise processes require the ability to open at least 100,000 file descriptors. If the default limit is lower and the container lacks the `SYS_RESOURCE` capability, the process may fail repeatedly, rendering the cluster unusable. To use unprivileged mode, configure your Kubernetes worker nodes to ensure a default file descriptor limit of at least 100,000.
112
112
113
113
If you are already running a Redis Enterprise Cluster on Kubernetes, your worker nodes are likely configured correctly. In this case, it is safe to upgrade the operator and use unprivileged mode.
114
114
115
115
Based on our testing, all major cloud providers configure Kubernetes worker nodes with file descriptor limits well above the required minimum. These setups are compatible with unprivileged mode. The only known exception is clusters created with [Kubespray](hhttps://kubespray.io/#/), which sets default file descriptor limits below the required 100,000. If you use Kubespray with default settings, you must run the operator in privileged mode.
Copy file name to clipboardExpand all lines: content/operate/kubernetes/upgrade/upgrade-olm.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -75,7 +75,6 @@ You can monitor the upgrade from the **Installed Operators** page. A new Redis E
75
75
76
76
## Reapply the SCC
77
77
78
-
79
78
If you are using OpenShift, you must manually reappply the [security context constraints (SCC)](https://docs.openshift.com/container-platform/4.8/authentication/managing-security-context-constraints.html) file ([`scc.yaml`]({{< relref "/operate/kubernetes/deployment/openshift/openshift-cli#deploy-the-operator" >}})) and bind it to your service account.
0 commit comments