diff --git a/content/embeds/k8s/multi-ns_role.md b/content/embeds/k8s/multi-ns_role.md
index 60ae8ca5a2..d650750e8f 100644
--- a/content/embeds/k8s/multi-ns_role.md
+++ b/content/embeds/k8s/multi-ns_role.md
@@ -8,7 +8,12 @@ metadata:
rules:
- apiGroups:
- app.redislabs.com
- resources: ["redisenterprisedatabases", "redisenterprisedatabases/status", "redisenterprisedatabases/finalizers"]
+ resources: ["redisenterprisedatabases",
+ "redisenterprisedatabases/status",
+ "redisenterprisedatabases/finalizers",
+ "redisenterpriseactiveactivedatabases",
+ "redisenterpriseactiveactivedatabases/status",
+ "redisenterpriseactiveactivedatabases/finalizers"]
verbs: ["delete", "get", "list", "patch", "create", "update", "watch"]
- apiGroups: [""]
resources: ["secrets"]
@@ -18,7 +23,7 @@ rules:
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["events"]
- verbs: ["create"]
+ verbs: ["create", "patch"]
- apiGroups: [""]
resources: ["services"]
verbs: ["get", "list", "update", "patch", "create", "delete", "watch"]
diff --git a/content/embeds/k8s/openshift_rec.md b/content/embeds/k8s/openshift_rec.md
index ac360007fd..c2e06b18d6 100644
--- a/content/embeds/k8s/openshift_rec.md
+++ b/content/embeds/k8s/openshift_rec.md
@@ -26,7 +26,7 @@ spec:
memory: 4Gi
redisEnterpriseImageSpec:
repository: registry.connect.redhat.com/redislabs/redis-enterprise
- versionTag: 7.8.6-13
+ versionTag: 7.22.0-28
redisEnterpriseServicesRiggerImageSpec:
repository: registry.connect.redhat.com/redislabs/services-manager
bootstrapperImageSpec:
diff --git a/content/embeds/k8s/openshift_role.md b/content/embeds/k8s/openshift_role.md
index 4ec70f6635..7247a5af54 100644
--- a/content/embeds/k8s/openshift_role.md
+++ b/content/embeds/k8s/openshift_role.md
@@ -72,6 +72,18 @@ rules:
- update
- list
- watch
+ - apiGroups:
+ - batch
+ resources:
+ - cronjobs
+ verbs:
+ - create
+ - delete
+ - get
+ - patch
+ - update
+ - list
+ - watch
- apiGroups:
- policy
resources:
@@ -169,7 +181,7 @@ rules:
- apiGroups:
- security.openshift.io
resourceNames:
- - nonroot
+ - nonroot-v2
resources:
- securitycontextconstraints
verbs:
diff --git a/content/embeds/k8s/openshift_scc.md b/content/embeds/k8s/openshift_scc.md
index 39b3cba9c7..a8c79b5a92 100644
--- a/content/embeds/k8s/openshift_scc.md
+++ b/content/embeds/k8s/openshift_scc.md
@@ -4,7 +4,7 @@ kind: SecurityContextConstraints
metadata:
name: redis-enterprise-scc-v2
annotations:
- kubernetes.io/description: redis-enterprise-scc-v2 is the minimal SCC needed to run Redis Enterprise nodes on Kubernetes. It provides the same features as restricted-v2 SCC, but allows pods to enable the SYS_RESOURCE capability, which is required by Redis Enterprise nodes to manage file descriptor limits and OOM scores for database shards. Additionally, it requires pods to run as UID/GID 1001, which are the UID/GID used within the Redis Enterprise node containers.
+ kubernetes.io/description: redis-enterprise-scc-v2 is the minimal SCC needed to run Redis Enterprise nodes on Kubernetes with automatic FD limit adjustment enabled. It provides the same features as restricted-v2 SCC, but allows pods to enable the SYS_RESOURCE capability, which is required by Redis Enterprise nodes to manage file descriptor limits and OOM scores for database shards. Additionally, it requires pods to run as UID/GID 1001, which are the UID/GID used within the Redis Enterprise node containers.
allowedCapabilities:
- SYS_RESOURCE
allowHostDirVolumePlugin: false
@@ -12,7 +12,7 @@ allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
-allowPrivilegeEscalation: false
+allowPrivilegeEscalation: true
allowPrivilegedContainer: false
readOnlyRootFilesystem: false
runAsUser:
diff --git a/content/embeds/k8s/role.md b/content/embeds/k8s/role.md
index 54e8004198..9a059e28e8 100644
--- a/content/embeds/k8s/role.md
+++ b/content/embeds/k8s/role.md
@@ -72,6 +72,18 @@ rules:
- update
- list
- watch
+ - apiGroups:
+ - batch
+ resources:
+ - cronjobs
+ verbs:
+ - create
+ - delete
+ - get
+ - patch
+ - update
+ - list
+ - watch
- apiGroups:
- policy
resources:
diff --git a/content/operate/kubernetes/reference/redis_enterprise_active_active_database_api.md b/content/operate/kubernetes/reference/redis_enterprise_active_active_database_api.md
index 86be70118a..ee57f8d38b 100644
--- a/content/operate/kubernetes/reference/redis_enterprise_active_active_database_api.md
+++ b/content/operate/kubernetes/reference/redis_enterprise_active_active_database_api.md
@@ -135,6 +135,13 @@ RedisEnterpriseActiveActiveDatabaseSpec defines the desired state of RedisEnterp
The desired replication endpoint's port number for users who utilize LoadBalancers for sync between AA replicas and need to provide the specific port number that the LoadBalancer listens to.
| readOnlyRootFilesystemPolicy | object |
- Whether RS containers has a read-only root filesystem and what is the policy. some mandatory paths are still writable so RS can work properly. + Policy controlling whether to enable read-only root filesystem for the Redis Enterprise software containers. Note that certain filesystem paths remain writable through mounted volumes to ensure proper functionality. + |
+ false | +
| resourceLimits | +object | +
+ Settings pertaining to resource limits management by the Redis Enterprise Node container. |
false |
| enabled | boolean |
- Whether RS containers has a read-only root filesystem. Default is false. + Whether to enable read-only root filesystem for the Redis Enterprise software containers. Default is false. |
true |
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| allowAutoAdjustment | +boolean | +
+ Allow Redis Enterprise to adjust resource limits, like max open file descriptors, of its data plane processes. When this option is enabled, the SYS_RESOURCE capability is added to the Redis Enterprise pods, and their allowPrivilegeEscalation field is set. Turned off by default. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| callHomeClient | +object | +
+ + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| disabled | +boolean | +
+ Whether to disable the call home client. Enabled by default. + |
+ false | +
| imageSpec | +object | +
+ Image specification + |
+ false | +
| resources | +object | +
+ Compute resource requirements for Call Home Client pod + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| digestHash | +string | +
+ The digest hash of the container image to pull. When specified, the container image is pulled according to the digest hash instead of the image tag. The versionTag field must also be specified with the image tag matching this digest hash. Note: This field is only supported for OLM deployments. + |
+ false | +
| imagePullPolicy | +string | +
+ The image pull policy to be applied to the container image. One of Always, Never, IfNotPresent. + |
+ false | +
| repository | +string | +
+ The repository (name) of the container image to be deployed. + |
+ false | +
| versionTag | +string | +
+ The tag of the container image to be deployed. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| claims | +[]object | +
+ Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container.
+ This is an alpha field and requires enabling the DynamicResourceAllocation feature gate.
+ This field is immutable. It can only be set for containers. + |
+ false | +
| limits | +map[string]int or string | +
+ Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + |
+ false | +
| requests | +map[string]int or string | +
+ Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container. + |
+ true | +