Skip to content

Commit f64f63f

Browse files
kaitlynmichaelkaitlynmichael
committed
Add comprehensive YAML examples subsection for Kubernetes reference documentation
- Created new YAML examples subsection in content/operate/kubernetes/reference/yaml-examples/ - Added 4 dedicated example pages for different deployment scenarios: * basic-deployment.md - Essential YAML files for simple Redis Enterprise deployment * rack-awareness.md - YAML examples for rack-aware deployments across availability zones * active-active.md - YAML examples for Active-Active databases across multiple clusters * multi-namespace.md - YAML examples for deploying across multiple namespaces - Added log-collector-rbac.md to logs section with RBAC configurations for restricted and all collection modes - Each YAML example is in its own linkable subsection for direct referencing - Updated reference index to include new YAML examples subsection - Updated logs index to include log collector RBAC documentation - All pages include complete YAML examples using existing embed files from content/embeds/k8s/ - Provides step-by-step instructions, configuration explanations, and troubleshooting guidance - Cross-referenced with relevant API documentation and guides
1 parent 5d74ac8 commit f64f63f

File tree

8 files changed

+1635
-0
lines changed

8 files changed

+1635
-0
lines changed

‎content/operate/kubernetes/logs/_index.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ Access and manage Redis Enterprise logs on Kubernetes for monitoring, troublesho
1818
Learn how to collect and access logs from your Redis Enterprise deployment:
1919

2020
- [Collect logs]({{< relref "/operate/kubernetes/logs/collect-logs" >}}) - Methods for collecting logs from Redis Enterprise pods and containers
21+
- [Log collector RBAC]({{< relref "/operate/kubernetes/logs/log-collector-rbac" >}}) - RBAC configurations for log collection in restricted and all modes
2122

2223
## Log storage and access
2324

‎content/operate/kubernetes/logs/log-collector-rbac.md‎

Lines changed: 203 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,203 @@
1+
---
2+
Title: Log collector RBAC
3+
alwaysopen: false
4+
categories:
5+
- docs
6+
- operate
7+
- kubernetes
8+
description: RBAC configurations for Redis Enterprise log collector in all and restricted modes.
9+
linkTitle: Log collector RBAC
10+
weight: 20
11+
---
12+
13+
This page provides YAML examples for configuring RBAC permissions for the Redis Enterprise log collector tool. The log collector requires different permission levels depending on the collection mode you choose.
14+
15+
## Overview
16+
17+
The Redis Enterprise log collector script helps gather diagnostic information for troubleshooting. It has two collection modes that require different RBAC permissions:
18+
19+
- **Restricted mode**: Collects only Redis Enterprise-related resources and logs (default for versions 6.2.18-3+)
20+
- **All mode**: Collects comprehensive cluster information including non-Redis resources (default for versions 6.2.12-1 and earlier)
21+
22+
## When to use each mode
23+
24+
### Restricted mode (recommended)
25+
26+
Use restricted mode when:
27+
- You want to minimize security exposure
28+
- Your organization has strict RBAC policies
29+
- You only need Redis Enterprise-specific troubleshooting data
30+
- You're running version 6.2.18-3 or later (default mode)
31+
32+
### All mode
33+
34+
Use all mode when:
35+
- You need comprehensive cluster diagnostics
36+
- Redis Support specifically requests additional cluster information
37+
- You're troubleshooting complex issues that may involve non-Redis resources
38+
- You're running version 6.2.12-1 or earlier (default mode)
39+
40+
## Permission differences
41+
42+
The key differences between the two modes:
43+
44+
| Resource Category | Restricted Mode | All Mode |
45+
|------------------|----------------|----------|
46+
| **Cluster-level resources** | Limited | Full access |
47+
| **Node information** | ❌ No access | ✅ Full access |
48+
| **Storage classes** | ❌ No access | ✅ Full access |
49+
| **Volume attachments** | ❌ No access | ✅ Full access |
50+
| **Certificate signing requests** | ❌ No access | ✅ Full access |
51+
| **Operator resources** | ❌ No access | ✅ Full access |
52+
| **Istio resources** | ❌ No access | ✅ Full access |
53+
54+
## Restricted mode RBAC
55+
56+
Use restricted mode for minimal security exposure while still collecting essential Redis Enterprise diagnostics.
57+
58+
**File: `log-collector-restricted-rbac.yaml`**
59+
60+
{{<embed-md "k8s/log_collector_role_restricted_mode.md">}}
61+
62+
### Restricted mode permissions
63+
64+
The restricted mode provides access to:
65+
66+
**Role permissions (namespace-scoped):**
67+
- **Pods and logs**: Read pod information and access container logs
68+
- **Pod exec**: Execute commands inside containers for diagnostics
69+
- **Core resources**: Access to services, endpoints, ConfigMaps, secrets, and storage resources
70+
- **Workload resources**: Read deployments, StatefulSets, DaemonSets, and jobs
71+
- **Redis Enterprise resources**: Full read access to all Redis Enterprise custom resources
72+
- **Networking**: Read ingress and network policy configurations
73+
- **OpenShift routes**: Read route configurations (for OpenShift environments)
74+
75+
**ClusterRole permissions (cluster-scoped):**
76+
- **Persistent volumes**: Read cluster-wide storage information
77+
- **Namespaces**: Read namespace information
78+
- **RBAC**: Read cluster roles and bindings
79+
- **Custom resource definitions**: Read Redis Enterprise CRDs
80+
- **Admission controllers**: Read ValidatingWebhook configurations
81+
82+
## All mode RBAC
83+
84+
Use all mode when you need comprehensive cluster diagnostics or when specifically requested by Redis Support.
85+
86+
**File: `log-collector-all-rbac.yaml`**
87+
88+
{{<embed-md "k8s/log_collector_role_all_mode.md">}}
89+
90+
### All mode additional permissions
91+
92+
In addition to all restricted mode permissions, all mode provides:
93+
94+
**Additional ClusterRole permissions:**
95+
- **Nodes**: Read cluster node information and status
96+
- **Storage classes**: Read storage class configurations
97+
- **Volume attachments**: Read volume attachment status
98+
- **Certificate signing requests**: Read certificate management information
99+
- **Operator resources**: Read OLM (Operator Lifecycle Manager) resources
100+
- **Istio resources**: Read Istio service mesh configurations
101+
102+
## Role binding
103+
104+
Bind the Role to your service account in each namespace where you want to collect logs.
105+
106+
**File: `log-collector-role-binding.yaml`**
107+
108+
```yaml
109+
apiVersion: rbac.authorization.k8s.io/v1
110+
kind: RoleBinding
111+
metadata:
112+
name: redis-enterprise-log-collector
113+
namespace: <target-namespace>
114+
subjects:
115+
- kind: ServiceAccount
116+
name: redis-enterprise-log-collector
117+
namespace: <service-account-namespace>
118+
roleRef:
119+
kind: Role
120+
name: redis-enterprise-log-collector
121+
apiGroup: rbac.authorization.k8s.io
122+
```
123+
124+
## Cluster role binding
125+
126+
Bind the ClusterRole to your service account for cluster-wide permissions.
127+
128+
**File: `log-collector-cluster-role-binding.yaml`**
129+
130+
```yaml
131+
apiVersion: rbac.authorization.k8s.io/v1
132+
kind: ClusterRoleBinding
133+
metadata:
134+
name: redis-enterprise-log-collector
135+
subjects:
136+
- kind: ServiceAccount
137+
name: redis-enterprise-log-collector
138+
namespace: <service-account-namespace>
139+
roleRef:
140+
kind: ClusterRole
141+
name: redis-enterprise-log-collector
142+
apiGroup: rbac.authorization.k8s.io
143+
```
144+
145+
## Usage
146+
147+
Apply the appropriate RBAC configuration and role bindings, then run the log collector with the desired mode:
148+
149+
```bash
150+
# Restricted mode (default for 6.2.18-3+)
151+
python log_collector.py -m restricted -n <namespace>
152+
153+
# All mode
154+
python log_collector.py -m all -n <namespace>
155+
```
156+
157+
## Security considerations
158+
159+
### Principle of least privilege
160+
161+
- **Start with restricted mode**: Use restricted mode unless you specifically need additional cluster information
162+
- **Limit namespace access**: Only grant permissions in namespaces where log collection is needed
163+
- **Time-bound access**: Consider creating temporary RBAC resources for log collection activities
164+
165+
### Sensitive data handling
166+
167+
Both modes collect:
168+
- **Secrets metadata**: Names and types of secrets (not the actual secret values)
169+
- **ConfigMap data**: Configuration information that may contain sensitive settings
170+
- **Pod logs**: Application logs that may contain sensitive information
171+
172+
Ensure collected logs are handled according to your organization's data security policies.
173+
174+
## Troubleshooting
175+
176+
### Permission denied errors
177+
178+
If you encounter permission errors:
179+
180+
1. **Verify RBAC resources**: Ensure roles and bindings are applied correctly
181+
2. **Check service account**: Confirm the service account has the necessary bindings
182+
3. **Validate namespace access**: Ensure role bindings exist in target namespaces
183+
4. **Review mode requirements**: Verify you're using the correct mode for your needs
184+
185+
### Missing resources
186+
187+
If the log collector reports missing resources:
188+
189+
1. **Check cluster role permissions**: Ensure ClusterRole is applied and bound
190+
2. **Verify CRD access**: Confirm access to Redis Enterprise custom resource definitions
191+
3. **Review mode selection**: Consider switching to all mode if additional resources are needed
192+
193+
## Next steps
194+
195+
- [Learn about log collection]({{< relref "/operate/kubernetes/logs/collect-logs" >}})
196+
- [Explore YAML deployment examples]({{< relref "/operate/kubernetes/reference/yaml-examples" >}})
197+
- [Configure monitoring]({{< relref "/operate/kubernetes/re-clusters/connect-prometheus-operator" >}})
198+
199+
## Related documentation
200+
201+
- [Collect logs guide]({{< relref "/operate/kubernetes/logs/collect-logs" >}})
202+
- [Kubernetes RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)
203+
- [Redis Enterprise troubleshooting]({{< relref "/operate/kubernetes/logs" >}})

‎content/operate/kubernetes/reference/_index.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,19 @@ kubectl delete rec my-cluster
7272

7373
**Important:** Always delete databases (REDB) before deleting the cluster (REC) to ensure proper cleanup.
7474

75+
## YAML examples
76+
77+
Complete YAML examples for common deployment scenarios:
78+
79+
- [YAML examples]({{< relref "/operate/kubernetes/reference/yaml-examples" >}}) - Ready-to-use YAML configurations for different deployment types
80+
81+
### Example categories
82+
83+
- [Basic deployment]({{< relref "/operate/kubernetes/reference/yaml-examples/basic-deployment" >}}) - Essential YAML files for simple Redis Enterprise deployment
84+
- [Rack awareness]({{< relref "/operate/kubernetes/reference/yaml-examples/rack-awareness" >}}) - YAML examples for rack-aware deployments across availability zones
85+
- [Active-Active]({{< relref "/operate/kubernetes/reference/yaml-examples/active-active" >}}) - YAML examples for Active-Active databases across multiple clusters
86+
- [Multi-namespace]({{< relref "/operate/kubernetes/reference/yaml-examples/multi-namespace" >}}) - YAML examples for deploying across multiple namespaces
87+
7588
## API reference
7689

7790
Complete API specifications for all Redis Enterprise custom resources:

‎content/operate/kubernetes/reference/yaml-examples/_index.md‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
---
2+
Title: YAML examples
3+
alwaysopen: false
4+
categories:
5+
- docs
6+
- operate
7+
- kubernetes
8+
description: Example YAML files for deploying Redis Enterprise on Kubernetes with different configurations.
9+
hideListLinks: true
10+
linkTitle: YAML examples
11+
weight: 85
12+
---
13+
14+
This section provides complete YAML examples for common Redis Enterprise for Kubernetes deployment scenarios. Each example includes the necessary configuration files and step-by-step instructions for editing and applying them.
15+
16+
## How to use these examples
17+
18+
### Download and customize
19+
20+
1. Copy the YAML content from the examples below
21+
2. Save each YAML block to a separate file with a descriptive name
22+
3. Edit the configuration values to match your environment
23+
4. Apply the files in the correct order using `kubectl apply`
24+
25+
### Configuration storage
26+
27+
Redis Enterprise for Kubernetes stores configuration in several places:
28+
29+
- **Custom resources**: Cluster and database specifications are stored as Kubernetes custom resources (REC, REDB, REAADB, RERC)
30+
- **Secrets**: Sensitive data like passwords and certificates are stored in Kubernetes secrets
31+
- **ConfigMaps**: Non-sensitive configuration data is stored in ConfigMaps
32+
- **RBAC resources**: Permissions are defined through Roles, ClusterRoles, and their bindings
33+
34+
### Applying YAML files
35+
36+
Apply YAML files using `kubectl apply`:
37+
38+
```bash
39+
# Apply a single file
40+
kubectl apply -f my-config.yaml
41+
42+
# Apply multiple files
43+
kubectl apply -f rbac/ -f cluster/ -f database/
44+
45+
# Apply with validation
46+
kubectl apply --dry-run=client -f my-config.yaml
47+
```
48+
49+
### Monitoring deployment
50+
51+
Check the status of your resources after applying:
52+
53+
```bash
54+
# Check operator deployment
55+
kubectl get deployment redis-enterprise-operator
56+
57+
# Check cluster status
58+
kubectl get rec
59+
kubectl describe rec <cluster-name>
60+
61+
# Check database status
62+
kubectl get redb
63+
kubectl describe redb <database-name>
64+
65+
# View events for troubleshooting
66+
kubectl get events --sort-by=.metadata.creationTimestamp
67+
```
68+
69+
## Example categories
70+
71+
### Basic deployment
72+
73+
Essential YAML files for a simple Redis Enterprise deployment:
74+
75+
- [Basic deployment examples]({{< relref "/operate/kubernetes/reference/yaml-examples/basic-deployment" >}}) - Service account, RBAC, cluster, and database configurations
76+
77+
### Rack awareness
78+
79+
YAML examples for rack-aware deployments that distribute Redis Enterprise nodes across availability zones:
80+
81+
- [Rack awareness examples]({{< relref "/operate/kubernetes/reference/yaml-examples/rack-awareness" >}}) - Rack-aware cluster configuration and required RBAC
82+
83+
### Active-Active
84+
85+
YAML examples for Active-Active database deployments across multiple clusters:
86+
87+
- [Active-Active examples]({{< relref "/operate/kubernetes/reference/yaml-examples/active-active" >}}) - Multi-cluster Active-Active database setup
88+
89+
### Multi-namespace
90+
91+
YAML examples for deploying Redis Enterprise across multiple namespaces:
92+
93+
- [Multi-namespace examples]({{< relref "/operate/kubernetes/reference/yaml-examples/multi-namespace" >}}) - Cross-namespace operator and cluster configurations
94+
95+
## Best practices
96+
97+
When working with these YAML examples:
98+
99+
- **Start simple**: Begin with basic deployment examples before moving to advanced configurations
100+
- **Validate syntax**: Use `kubectl apply --dry-run=client` to check YAML syntax before applying
101+
- **Version control**: Store your customized YAML files in version control
102+
- **Environment-specific values**: Use separate YAML files or tools like Kustomize for environment-specific configurations
103+
- **Resource naming**: Use consistent, descriptive names for all resources
104+
- **Documentation**: Add annotations to describe the purpose of each resource
105+
106+
## Related documentation
107+
108+
- [API reference]({{< relref "/operate/kubernetes/reference" >}}) - Complete API specifications for all custom resources
109+
- [Quick start deployment]({{< relref "/operate/kubernetes/deployment/quick-start" >}}) - Step-by-step deployment guide
110+
- [Multi-namespace deployment]({{< relref "/operate/kubernetes/re-clusters/multi-namespace" >}}) - Detailed multi-namespace setup guide
111+
- [Active-Active databases]({{< relref "/operate/kubernetes/active-active" >}}) - Active-Active configuration and management

0 commit comments

Comments
 (0)