Skip to content

Commit d3d7a60

Browse files
copy edits
1 parent dc5d412 commit d3d7a60

File tree

2 files changed

+6
-7
lines changed

2 files changed

+6
-7
lines changed

content/operate/kubernetes/security/enable-privileged-mode.md

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -60,11 +60,11 @@ securityContext:
6060

6161
OpenShift users upgrading to 7.22.0-6 need to make changes to your existing SCC (security context constraint).
6262

63-
## OpenShift Upgrades
63+
## OpenShift upgrades
6464

65-
If running in **unprivileged mode**, remove the custom `redis-enterprise-scc-v2` and disconnect it from the REC service account after completing your upgrade.
65+
If running in **unprivileged mode**, remove the custom `redis-enterprise-scc-v2` SCC and unbind it from the REC service account after completing your upgrade.
6666

67-
If running in **privileged mode**, manually reapply the [security context constraints (SCC)](https://docs.openshift.com/container-platform/4.8/authentication/managing-security-context-constraints.html) file ([`scc.yaml`]({{< relref "/operate/kubernetes/deployment/openshift/openshift-cli#deploy-the-operator" >}})) and bind it to your service account.
67+
If running in **privileged mode**, manually reapply the [security context constraints (SCC)](https://docs.openshift.com/container-platform/4.8/authentication/managing-security-context-constraints.html) file ([`scc.yaml`]({{< relref "/operate/kubernetes/deployment/openshift/openshift-cli#deploy-the-operator" >}})) and rebind it to the REC service account.
6868

6969
```sh
7070
oc apply -f openshift/scc.yaml
@@ -81,7 +81,7 @@ New installations of Redis Enterprise for Kubernetes 7.22.0-6 and later automati
8181

8282
To enable **privileged mode** after installation, apply and grant permissions to the `redis-enterprise-scc-v2` SCC.
8383

84-
1. Apply the file `scc.yaml` file.
84+
1. Apply the `scc.yaml` file.
8585

8686
{{<warning>}}
8787
Do not edit this file.
@@ -108,9 +108,8 @@ Do not edit this file.
108108

109109
The `SYS_RESOURCE` capability may be required if processes in the container need to raise resource limits, such as the maximum number of open file descriptors.
110110

111-
Some Redis Enterprise processes require the ability to open at least 100,000 file descriptors. If the default limit is lower and the container lacks the `SYS_RESOURCE` capability, the process may fail repeatedly, rendering the cluster unusable. To use unprivileged mode, configure your Kubernetes worker nodes to ensure a default file descriptor limit of at least 100,000.
111+
Some Redis Enterprise processes require the ability to open at least 100,000 file descriptors. If the default limit is lower and the container lacks the `SYS_RESOURCE` capability, the process may fail repeatedly, rendering the cluster unusable. To use unprivileged mode, configure your Kubernetes worker nodes to ensure a default file descriptor limit of at least 100,000.
112112

113113
If you are already running a Redis Enterprise Cluster on Kubernetes, your worker nodes are likely configured correctly. In this case, it is safe to upgrade the operator and use unprivileged mode.
114114

115115
Based on our testing, all major cloud providers configure Kubernetes worker nodes with file descriptor limits well above the required minimum. These setups are compatible with unprivileged mode. The only known exception is clusters created with [Kubespray](hhttps://kubespray.io/#/), which sets default file descriptor limits below the required 100,000. If you use Kubespray with default settings, you must run the operator in privileged mode.
116-

content/operate/kubernetes/upgrade/upgrade-olm.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,6 @@ You can monitor the upgrade from the **Installed Operators** page. A new Redis E
7575

7676
## Reapply the SCC
7777

78-
7978
If you are using OpenShift, you must manually reappply the [security context constraints (SCC)](https://docs.openshift.com/container-platform/4.8/authentication/managing-security-context-constraints.html) file ([`scc.yaml`]({{< relref "/operate/kubernetes/deployment/openshift/openshift-cli#deploy-the-operator" >}})) and bind it to your service account.
8079

8180
```sh
@@ -86,6 +85,7 @@ oc apply -f openshift/scc.yaml
8685
oc adm policy add-scc-to-user redis-enterprise-scc-v2 \
8786
system:serviceaccount:<my-project>:<rec-name>
8887
```
88+
8989
## Upgrade the Redis Enterprise Cluster
9090

9191
{{<warning>}}

0 commit comments

Comments
 (0)