Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions content/embeds/k8s-642-redb-admission-webhook-name-change.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,13 @@

1. Delete the existing `ValidatingWebhookConfiguration` on the Kubernetes cluster (named `redb-admission`).

```sh
kubectl delete ValidatingWebhookConfiguration redb-admission
```
```sh
kubectl delete ValidatingWebhookConfiguration redb-admission
```

1. Apply the resource from the new file.

```sh
kubectl apply -f deploy/admission/webhook.yaml
```
```sh
kubectl apply -f deploy/admission/webhook.yaml
```

24 changes: 12 additions & 12 deletions content/embeds/k8s-admission-webhook-cert.md
Original file line number Diff line number Diff line change
@@ -1,45 +1,45 @@
1. Verify the `admission-tls` secret exists.

```sh
kubectl get secret admission-tls
kubectl get secret admission-tls
```

The output should look similar to

```
NAME TYPE DATA AGE
admission-tls Opaque 2 2m43s
```sh
NAME TYPE DATA AGE
admission-tls Opaque 2 2m43s
```

2. Save the certificate to a local environment variable.
1. Save the certificate to a local environment variable.

```sh
CERT=`kubectl get secret admission-tls -o jsonpath='{.data.cert}'`
```

3. Create a Kubernetes validating webhook, replacing `<namespace>` with the namespace where the REC was installed.
1. Create a Kubernetes validating webhook, replacing `<namespace>` with the namespace where the REC was installed.

The `webhook.yaml` template can be found in [redis-enterprise-k8s-docs/admission](https://github.com/RedisLabs/redis-enterprise-k8s-docs/tree/master/admission)

```sh
sed 's/OPERATOR_NAMESPACE/<namespace>/g' webhook.yaml | kubectl create -f -
```

4. Create a patch file for the Kubernetes validating webhook.
1. Create a patch file for the Kubernetes validating webhook.

```sh
cat > modified-webhook.yaml <<EOF
webhooks:
- name: redisenterprise.admission.redislabs
clientConfig:
caBundle: $CERT
admissionReviewVersions: ["v1beta1"]
caBundle: $CERT
admissionReviewVersions: ["v1beta1"]
EOF
```

5. Patch the webhook with the certificate.
1. Patch the webhook with the certificate.

```sh
kubectl patch ValidatingWebhookConfiguration \
redis-enterprise-admission --patch "$(cat modified-webhook.yaml)"
redis-enterprise-admission --patch "$(cat modified-webhook.yaml)"
```
2 changes: 0 additions & 2 deletions content/operate/kubernetes/active-active/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -86,9 +86,7 @@ For a full list of fields and options, see the [RERC API reference]({{<relref "/
### Limitations

* Existing Redis databases cannot be migrated to a REAADB. (DOC-3594)

* Admission is not blocking REAADB with `shardCount` which exceeds license quota. (RED-96301)

Workaround: Fix the problems with the REAADB and reapply.
* The `<rec-name>/<rec-namespace>` value must be unique for each RERC resource. (RED-96302)
* Only global database options are supported, no support for specifying configuration per location.
Expand Down
131 changes: 70 additions & 61 deletions content/operate/kubernetes/deployment/openshift/openshift-cli.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,55 +23,60 @@ To see which version of Redis Enterprise for Kubernetes supports your OpenShift

1. Create a new project.

```bash
```sh
oc new-project <your-project-name>
```

1. Verify the newly created project.

```bash
```sh
oc project <your-project-name>
```

1. Get the deployment files.

```bash
```sh
git clone https://github.com/RedisLabs/redis-enterprise-k8s-docs
```


1. Deploy the OpenShift operator bundle.

{{<note>}} If you are using version 6.2.18-41 or earlier, you must [apply the security context constraint](#install-security-context-constraint) before the operator bundle. {{</note>}}
If you are using version 6.2.18-41 or earlier, you must [apply the security context constraint](#install-security-context-constraint) before the operator bundle.

```sh
oc apply -f openshift.bundle.yaml
```

{{< warning >}}Changes to the `openshift.bundle.yaml` file can cause unexpected results.{{< /warning >}}
{{< warning >}}
Changes to the `openshift.bundle.yaml` file can cause unexpected results.
{{< /warning >}}

1. Verify that your `redis-enterprise-operator` deployment is running.

```bash
```sh
oc get deployment
```

A typical response looks like this:

```bash
```sh
NAME READY UP-TO-DATE AVAILABLE AGE
redis-enterprise-operator 1/1 1 1 0m36s
```

{{<warning>}}DO NOT modify or delete the StatefulSet created during the deployment process. Doing so could destroy your Redis Enterprise cluster (REC).{{</warning>}}
{{<warning>}}
DO NOT modify or delete the StatefulSet created during the deployment process. Doing so could destroy your Redis Enterprise cluster (REC).
{{</warning>}}

## Install security context constraint

The Redis Enterprise pods must run in OpenShift with privileges set in a [Security Context Constraint](https://docs.openshift.com/container-platform/4.4/authentication/managing-security-context-constraints.html#security-context-constraints-about_configuring-internal-oauth). This grants the pod various rights, such as the ability to change system limits or run as a particular user.

1. Apply the file `scc.yaml` file.

{{<warning>}}Do not edit this file. {{</warning>}}
{{<warning>}}
Do not edit this file.
{{</warning>}}

```sh
oc apply -f openshift/scc.yaml
Expand All @@ -92,12 +97,14 @@ The Redis Enterprise pods must run in OpenShift with privileges set in a [Securi
system:serviceaccount:<my-project>:<rec>
```

{{<note>}} If you are using version 6.2.18-41 or earlier, add additional permissions for your cluster.

oc adm policy add-scc-to-user redis-enterprise-scc \
system:serviceaccount:<my-project>:redis-enterprise-operator
{{<note>}}
If you are using version 6.2.18-41 or earlier, add additional permissions for your cluster.

{{</note>}}
```sh
oc adm policy add-scc-to-user redis-enterprise-scc \
system:serviceaccount:<my-project>:redis-enterprise-operator
```
{{</note>}}

You can check the name of your project using the `oc project` command. To replace the project name, use `oc edit project myproject`. Replace `rec` with the name of your Redis Enterprise cluster, if different.

Expand All @@ -110,12 +117,12 @@ The Redis Enterprise pods must run in OpenShift with privileges set in a [Securi
The REC name cannot be changed after cluster creation.

{{<note>}}
Each Redis Enterprise cluster requires at least 3 nodes. Single-node RECs are not supported.
Each Redis Enterprise cluster requires at least 3 nodes. Single-node RECs are not supported.
{{</note>}}

1. Apply the custom resource file to create your Redis Enterprise cluster.
2. Apply the custom resource file to create your Redis Enterprise cluster.

```bash
```sh
oc apply -f <rec_rhel>.yaml
```

Expand All @@ -128,9 +135,9 @@ The Redis Enterprise pods must run in OpenShift with privileges set in a [Securi
```

You should receive a response similar to the following:

```sh
| NAME | READY | STATUS | RESTARTS | AGE |
NAME | READY | STATUS | RESTARTS | AGE |
| -------------------------------- | ----- | ------- | -------- | --- |
| rec-name-0 | 2/2 | Running | 0 | 1m |
| rec-name-1 | 2/2 | Running | 0 | 1m |
Expand All @@ -149,90 +156,92 @@ If not limited, the webhook intercepts requests from all namespaces. If you have

1. Verify your namespace is labeled and the label is unique to this namespace, as shown in the next example.

```bash
```sh
apiVersion: v1
kind: Namespace
metadata:
labels:
namespace-name: staging
namespace-name: staging
name: staging
```

1. Patch the webhook spec with the `namespaceSelector` field.
```bash
1. Patch the webhook spec with the `namespaceSelector` field.

```sh
cat > modified-webhook.yaml <<EOF
webhooks:
- name: redisenterprise.admission.redislabs
namespaceSelector:
matchLabels:
namespace-name: staging
matchLabels:
namespace-name: staging
EOF
```

1. Apply the patch.

```bash
oc patch ValidatingWebhookConfiguration \
redis-enterprise-admission --patch "$(cat modified-webhook.yaml)"
```
{{<note>}}
For releases before 6.4.2-4, use this command instead:
```sh
oc patch ValidatingWebhookConfiguration \
redb-admission --patch "$(cat modified-webhook.yaml)"
redis-enterprise-admission --patch "$(cat modified-webhook.yaml)"
```

The 6.4.2-4 release introduces a new `ValidatingWebhookConfiguration` to replace `redb-admission`. See the [6.4.2-4 release notes]({{< relref "/operate/kubernetes/release-notes/6-4-2-releases/" >}}).
{{</note>}}
{{<note>}}
For releases before 6.4.2-4, use this command instead:

```sh
oc patch ValidatingWebhookConfiguration \
redb-admission --patch "$(cat modified-webhook.yaml)"
```

The 6.4.2-4 release introduces a new `ValidatingWebhookConfiguration` to replace `redb-admission`. See the [6.4.2-4 release notes]({{< relref "/operate/kubernetes/release-notes/6-4-2-releases/" >}}).
{{</note>}}

### Verify admission controller installation

Apply an invalid resource as shown below to force the admission controller to reject it. If it applies successfully, the admission controller is not installed correctly.

```bash
oc apply -f - << EOF
apiVersion: app.redislabs.com/v1alpha1
kind: RedisEnterpriseDatabase
metadata:
name: redis-enterprise-database
spec:
evictionPolicy: illegal
EOF
```sh
oc apply -f - << EOF
apiVersion: app.redislabs.com/v1alpha1
kind: RedisEnterpriseDatabase
metadata:
name: redis-enterprise-database
spec:
evictionPolicy: illegal
EOF
```

You should see this error from the admission controller webhook `redisenterprise.admission.redislabs`.

```bash
Error from server: error when creating "STDIN": admission webhook "redisenterprise.admission.redislabs" denied the request: eviction_policy: u'illegal' is not one of [u'volatile-lru', u'volatile-ttl', u'volatile-random', u'allkeys-lru', u'allkeys-random', u'noeviction', u'volatile-lfu', u'allkeys-lfu']
```
```sh
Error from server: error when creating "STDIN": admission webhook "redisenterprise.admission.redislabs" denied the request: eviction_policy: u'illegal' is not one of [u'volatile-lru', u'volatile-ttl', u'volatile-random', u'allkeys-lru', u'allkeys-random', u'noeviction', u'volatile-lfu', u'allkeys-lfu']
```

## Create a Redis Enterprise database custom resource

The operator uses the instructions in the Redis Enterprise database (REDB) custom resources to manage databases on the Redis Enterprise cluster.

1. Create a `RedisEnterpriseDatabase` custom resource.

This example creates a test database. For production databases, see [create a database]({{< relref "/operate/kubernetes/re-databases/db-controller.md#create-a-database" >}}) and [RedisEnterpriseDatabase API reference]({{< relref "/operate/kubernetes/reference/redis_enterprise_database_api" >}}).
This example creates a test database. For production databases, see [create a database]({{< relref "/operate/kubernetes/re-databases/db-controller.md#create-a-database" >}}) and [RedisEnterpriseDatabase API reference]({{< relref "/operate/kubernetes/reference/redis_enterprise_database_api" >}}).

```bash
cat << EOF > /tmp/redis-enterprise-database.yml
apiVersion: app.redislabs.com/v1alpha1
kind: RedisEnterpriseDatabase
metadata:
name: redis-enterprise-database
spec:
memorySize: 100MB
EOF
```
```sh
cat << EOF > /tmp/redis-enterprise-database.yml
apiVersion: app.redislabs.com/v1alpha1
kind: RedisEnterpriseDatabase
metadata:
name: redis-enterprise-database
spec:
memorySize: 100MB
EOF
```

1. Apply the newly created REDB resource.

```bash
```sh
oc apply -f /tmp/redis-enterprise-database.yml
```

## More info

- [Redis Enterprise cluster API]({{<relref "/operate/kubernetes/reference/redis_enterprise_cluster_api">}})
- [Redis Enterprise database API]({{<relref "/operate/kubernetes/reference/redis_enterprise_database_api">}})

Loading
Loading