From 09ba2b741c162388f24a3a94f6822b3cb771eb53 Mon Sep 17 00:00:00 2001 From: Kaitlyn Michael <76962844+kaitlynmichael@users.noreply.github.com> Date: Mon, 20 Jul 2026 14:29:16 -0500 Subject: [PATCH 1/7] K8s: enrich mentrics (#3656) * metrics page draft * doc-6702 * inline questions --- .../kubernetes/active-active/create-reaadb.md | 2 + .../connect-prometheus-operator.md | 2 + .../kubernetes/re-databases/db-controller.md | 2 + .../re-databases/enrich-metrics-with-tags.md | 156 ++++++++++++++++++ 4 files changed, 162 insertions(+) create mode 100644 content/operate/kubernetes/re-databases/enrich-metrics-with-tags.md diff --git a/content/operate/kubernetes/active-active/create-reaadb.md b/content/operate/kubernetes/active-active/create-reaadb.md index 7f97a422f3..913f90b5ac 100644 --- a/content/operate/kubernetes/active-active/create-reaadb.md +++ b/content/operate/kubernetes/active-active/create-reaadb.md @@ -116,6 +116,8 @@ reaadb-boeing active Valid up In case of errors, review the REAADB custom resource events and the Redis Enterprise operator logs. +To add tags to an Active-Active database and expose them as metric labels, see [Enrich database metrics with tags]({{< relref "/operate/kubernetes/re-databases/enrich-metrics-with-tags" >}}). + ## Example values This article uses the example values listed below. You can also find them in the [YAML examples]({{< relref "/operate/kubernetes/reference/yaml/active-active" >}}) section. diff --git a/content/operate/kubernetes/re-clusters/connect-prometheus-operator.md b/content/operate/kubernetes/re-clusters/connect-prometheus-operator.md index 0ece7365f9..e14d9addd5 100644 --- a/content/operate/kubernetes/re-clusters/connect-prometheus-operator.md +++ b/content/operate/kubernetes/re-clusters/connect-prometheus-operator.md @@ -13,6 +13,8 @@ weight: 92 To collect metrics data from your databases and Redis Enterprise cluster (REC), you can connect your [Prometheus](https://prometheus.io/) server to an endpoint exposed on your REC. Redis Enterprise for Kubernetes creates a dedicated service to expose the `prometheus` port (8070) for data collection. A custom resource called `ServiceMonitor` allows the [Prometheus operator](https://github.com/prometheus-operator/prometheus-operator/tree/main/Documentation) to connect to this port and collect data from Redis Enterprise. +To expose database tags as metric labels so you can filter and group metrics by attributes such as environment or team, see [Enrich database metrics with tags]({{< relref "/operate/kubernetes/re-databases/enrich-metrics-with-tags" >}}). + ## Prerequisites Before connecting Redis Enterprise to Prometheus on your Kubernetes cluster, make sure you've done the following: diff --git a/content/operate/kubernetes/re-databases/db-controller.md b/content/operate/kubernetes/re-databases/db-controller.md index dac57d6bc6..d5ebae6bf9 100644 --- a/content/operate/kubernetes/re-databases/db-controller.md +++ b/content/operate/kubernetes/re-databases/db-controller.md @@ -98,6 +98,8 @@ To modify the database: When the status is `active`, the database is ready for use. +To add tags to a database and expose them as metric labels, see [Enrich database metrics with tags]({{< relref "/operate/kubernetes/re-databases/enrich-metrics-with-tags" >}}). + ## Delete a database The database exists as long as the custom resource exists. diff --git a/content/operate/kubernetes/re-databases/enrich-metrics-with-tags.md b/content/operate/kubernetes/re-databases/enrich-metrics-with-tags.md new file mode 100644 index 0000000000..e05f90222e --- /dev/null +++ b/content/operate/kubernetes/re-databases/enrich-metrics-with-tags.md @@ -0,0 +1,156 @@ +--- +Title: Enrich database metrics with tags +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Expose Redis Enterprise database tags as metric labels so you can filter + dashboards and alerts by attributes such as environment, team, or application. +linkTitle: Enrich metrics with tags +weight: 20 +--- + +Database tags are key-value attributes that you attach to your databases. You can expose selected tag keys as metric labels. Your monitoring stack can then filter and group metrics by those attributes. For example, you can build dashboards scoped to a team or environment and route alerts with context already attached. + +Tag-derived metrics are controlled in two places: + +- **Cluster (REC):** An administrator uses [`spec.metricsConfig`](#configure-the-cluster) on the Redis Enterprise cluster (REC) to turn tag-derived metrics on or off and choose which tag keys are eligible. +- **Database (REDB / REAADB):** Application teams set tag values on individual databases with [`spec.tags`](#tag-a-database) (REDB) or [`spec.globalConfigurations.tags`](#tag-an-active-active-database) (REAADB). + +A tag becomes a metric label only when both of these are true: + +- The tag key is in the cluster's allowlist. +- The tag is set with a value on the database. + +Keys that aren't in the allowlist never appear as labels, even if they're set on a database. + +## How it works + +1. On the REC, set `metricsConfig.exposeDatabaseTags` to `true`. In `metricsConfig.metricsTagKeysExposed`, list the tag keys you want available for metrics. +2. On each database, set the tag values with `spec.tags` (REDB) or `spec.globalConfigurations.tags` (REAADB). +3. The operator syncs the cluster configuration and the database tags to Redis Enterprise. Only keys in the allowlist that are present on a database appear as metric labels. + +The REC defines the metrics configuration. The operator overwrites any changes made directly through the Redis Enterprise REST API. + +## Configure the cluster + +Add `metricsConfig` to the REC `spec` to turn tag-derived metrics on and choose which tag keys are eligible: + +```YAML +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseCluster +metadata: + name: rec +spec: + nodes: 3 + metricsConfig: + exposeDatabaseTags: true + metricsTagKeysExposed: + - env + - team +``` + +In this example, only the `env` and `team` tag keys can appear as metric labels. A tag such as `app` is not exposed even if it is set on a database, because it is not in the allowlist. + +`metricsConfig` supports the following fields. All fields are optional. The operator applies the listed default when a field is unset. + +| Field | Type | Default | Description | +|---|---|---|---| +| `exposeDatabaseTags` | boolean | `false` | Enables or disables tag-derived metrics for the cluster. When `true`, the tag keys listed in `metricsTagKeysExposed` can be used as metric labels. When `false`, no database tag keys are exposed as labels, even if they are listed. | +| `metricsTagKeysExposed` | array of strings | `[]` | Allowlist of database tag keys eligible to be exposed as metric labels. Keys not listed here are never exposed, even if present on a database. | +| `maxRequestsInFlight` | integer | `2` | Maximum number of concurrent metrics scrape requests. Set to `0` to disable the limit. | +| `keyDistributionEnabled` | boolean | `false` | When `true`, export Prometheus histogram metrics for key size and key item distributions. | +| `keySizeBuckets` | string | `""` | Comma-separated bucket boundaries for key size distribution histograms, for example `"128M,512M"`. | +| `keyItemsBuckets` | string | `""` | Comma-separated bucket boundaries for key item distribution histograms, for example `"1M,8M"`. | +| `localStorageMaxSizeMb` | integer | `1024` | Maximum size, in MB, for local metrics storage. | +| `localStorageRetentionDays` | integer | `8` | Number of days to retain local metrics data. | + +Tag key allowlist entries (`metricsTagKeysExposed`) must follow these rules: + +- Keys are lowercased on the cluster. +- Each key must be 1–64 characters and cannot be whitespace only. +- Keys may contain ASCII letters, digits, spaces, and the characters `-`, `_`, `.`, `+`, `@`, and `:`. +- Duplicate keys are rejected. The operator rejects the resource if the same key appears more than once, ignoring case. +- A maximum of 50 keys is allowed. + + + +## Tag a database + +Set tags on a Redis Enterprise database (REDB) with `spec.tags`, a set of key-value pairs: + +```YAML +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseDatabase +metadata: + name: orders-cache +spec: + memorySize: 1GB + tags: + env: prod + team: payments + app: orders-service +``` + +The operator merges these tags into the database's tags on the cluster. With the cluster configuration shown above, only `env` and `team` can appear as metric labels. The `app` tag is stored on the database but not exposed in metrics. + +`spec.tags` is optional. For details on how tags are merged, updated, and removed, see [Managed tags and deletion behavior](#managed-tags-and-deletion-behavior). + +## Tag an Active-Active database + +For an Active-Active database (REAADB), set tags under `spec.globalConfigurations.tags`, also a set of key-value pairs: + +```YAML +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseActiveActiveDatabase +metadata: + name: orders-aa +spec: + globalConfigurations: + tags: + env: prod + team: payments +``` + +The operator applies these tags to the Active-Active database's default configuration and to every participating cluster's instance. The cluster-level allowlist still applies. Configure `metricsConfig` on each participating REC to add the tag keys you want exposed to the allowlist. + +## Managed tags and deletion behavior + +The operator tracks the tag keys it manages for each database. This lets it apply changes, including deletions, without disturbing tags set outside Kubernetes. + +- **External tags are preserved.** Tags that exist on the database but were never declared in `spec.tags` (or `spec.globalConfigurations.tags`) are left in place. +- **The custom resource wins on collision.** If a key exists both on the database and in the custom resource, the operator applies the value from the custom resource. +- **`status.managedTags` records what the operator owns.** After a successful sync, the operator records the tag keys it applied in `status.managedTags`. This record lets it tell a key you removed apart from a key it never managed. +- **Removing a key deletes it.** If you remove a key that was recorded in `status.managedTags`, the operator removes that tag from the database on the next reconciliation. Keys that were never in `status.managedTags`, such as tags set only through the Redis Enterprise REST API, aren't deleted. +- **Reserved keys are rejected.** Keys the operator reserves for its own internal use cannot be set in the spec. For REDB, these are `managed_by`, `redb_name`, `redb_namespace`, `db_service_port`, and `oss_cluster_access`. For REAADB, they also include `redb_resource`, `redb_resource_name`, `global_configurations_spec`, `replication_endpoint_port`, `rerc_name`, and the operator's internal secret-tracking keys (`redis.io/db-sec-name`, `redis.io/db-sec-latest`, `redis.io/certs-latest`, `redis.io/bu-sec-name`, and `redis.io/bu-sec-latest`). The admission controller rejects a custom resource that uses one. + +{{< note >}} +When you upgrade to a release with this feature, `status.managedTags` starts empty for databases that already existed. The operator does not drop existing tags. It reapplies only the keys currently in the spec, so the upgrade has no effect on databases that never used tags. +{{< /note >}} + +## View tagged metrics in Prometheus + + + +For instructions on connecting Prometheus to Redis Enterprise for Kubernetes, see [Export metrics to Prometheus]({{< relref "/operate/kubernetes/re-clusters/connect-prometheus-operator" >}}). + +## Limitations + +- **Allowlist size.** The cluster allows at most 50 tag keys in `metricsTagKeysExposed`. The operator doesn't cap the list itself; the cluster enforces the limit. Keep the allowlist small: each exposed key adds a label dimension to the affected metrics, which increases cardinality in your monitoring stack. +- **When changes take effect.** Changes to `metricsConfig`, `spec.tags`, and `spec.globalConfigurations.tags` apply on the operator's next reconciliation of the resource. No pod or cluster restart is required. Exposed tag labels appear in metrics on the next scrape after the cluster applies the change. From 855df979e81cdba8119875819b7de3f5da431559 Mon Sep 17 00:00:00 2001 From: "redisdocsapp[bot]" <177626021+redisdocsapp[bot]@users.noreply.github.com> Date: Mon, 20 Jul 2026 14:53:16 -0500 Subject: [PATCH 2/7] k8s api docs 8.2.0-10 (#3673) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- content/embeds/k8s/admission_webhook.md | 4 + .../embeds/k8s/log_collector_role_all_mode.md | 6 + .../k8s/log_collector_role_restricted_mode.md | 6 + content/embeds/k8s/openshift_rec.md | 36 -- content/embeds/k8s/openshift_role.md | 8 +- content/embeds/k8s/rerc.md | 2 +- .../reference/api/redis_enterprise_acl_api.md | 127 +++++ ...s_enterprise_active_active_database_api.md | 26 +- .../api/redis_enterprise_cluster_api.md | 186 +++++++ .../api/redis_enterprise_cluster_role_api.md | 178 +++++++ ...dis_enterprise_cluster_role_binding_api.md | 174 ++++++ .../api/redis_enterprise_database_api.md | 280 +++++++++- .../api/redis_enterprise_role_api.md | 298 +++++++++++ .../api/redis_enterprise_role_binding_api.md | 174 ++++++ .../api/redis_enterprise_user_api.md | 500 ++++++++++++++++++ 15 files changed, 1961 insertions(+), 44 deletions(-) create mode 100644 content/operate/kubernetes/reference/api/redis_enterprise_acl_api.md create mode 100644 content/operate/kubernetes/reference/api/redis_enterprise_cluster_role_api.md create mode 100644 content/operate/kubernetes/reference/api/redis_enterprise_cluster_role_binding_api.md create mode 100644 content/operate/kubernetes/reference/api/redis_enterprise_role_api.md create mode 100644 content/operate/kubernetes/reference/api/redis_enterprise_role_binding_api.md create mode 100644 content/operate/kubernetes/reference/api/redis_enterprise_user_api.md diff --git a/content/embeds/k8s/admission_webhook.md b/content/embeds/k8s/admission_webhook.md index 6b11931722..94e2a571eb 100644 --- a/content/embeds/k8s/admission_webhook.md +++ b/content/embeds/k8s/admission_webhook.md @@ -30,6 +30,10 @@ webhooks: - redisenterprisedatabases - redisenterpriseactiveactivedatabases - redisenterpriseremoteclusters + - redisenterpriseacls + - redisenterpriseclusterroles + - redisenterpriseusers + - redisenterpriseroles sideEffects: None timeoutSeconds: 30 ``` diff --git a/content/embeds/k8s/log_collector_role_all_mode.md b/content/embeds/k8s/log_collector_role_all_mode.md index ebcae95acf..1d159917f3 100644 --- a/content/embeds/k8s/log_collector_role_all_mode.md +++ b/content/embeds/k8s/log_collector_role_all_mode.md @@ -160,6 +160,12 @@ rules: - redisenterprisedatabases.app.redislabs.com - redisenterpriseremoteclusters.app.redislabs.com - redisenterpriseactiveactivedatabases.app.redislabs.com + - redisenterpriseacls.app.redislabs.com + - redisenterpriseusers.app.redislabs.com + - redisenterpriseclusterroles.app.redislabs.com + - redisenterpriseclusterrolebindings.app.redislabs.com + - redisenterpriseroles.app.redislabs.com + - redisenterpriserolebindings.app.redislabs.com verbs: - get - list diff --git a/content/embeds/k8s/log_collector_role_restricted_mode.md b/content/embeds/k8s/log_collector_role_restricted_mode.md index c16f3f61e1..28d6263a84 100644 --- a/content/embeds/k8s/log_collector_role_restricted_mode.md +++ b/content/embeds/k8s/log_collector_role_restricted_mode.md @@ -141,6 +141,12 @@ rules: - redisenterprisedatabases.app.redislabs.com - redisenterpriseremoteclusters.app.redislabs.com - redisenterpriseactiveactivedatabases.app.redislabs.com + - redisenterpriseacls.app.redislabs.com + - redisenterpriseusers.app.redislabs.com + - redisenterpriseclusterroles.app.redislabs.com + - redisenterpriseclusterrolebindings.app.redislabs.com + - redisenterpriseroles.app.redislabs.com + - redisenterpriserolebindings.app.redislabs.com verbs: - list - get diff --git a/content/embeds/k8s/openshift_rec.md b/content/embeds/k8s/openshift_rec.md index 7aefe2f340..2a18609b47 100644 --- a/content/embeds/k8s/openshift_rec.md +++ b/content/embeds/k8s/openshift_rec.md @@ -1,39 +1,3 @@ ```yaml -apiVersion: app.redislabs.com/v1 -kind: RedisEnterpriseCluster -metadata: - name: rec - labels: - app: redis-enterprise -spec: - # The number of Redis Enterprise nodes in the clusters. - nodes: 3 - persistentSpec: - # Whether to enable persistent storage for the Redis Enterprise nodes. - enabled: true - - # The size of the persistent volume for each Redis Enterprise node. - volumeSize: 20Gi - - # The resources allocated to each Redis Enterprise node. - redisEnterpriseNodeResources: - requests: - cpu: 2 - memory: 4Gi - limits: - cpu: 2 - memory: 4Gi - - redisEnterpriseImageSpec: - repository: registry.connect.redhat.com/redislabs/redis-enterprise - versionTag: 8.0.18-23 - redisEnterpriseServicesRiggerImageSpec: - repository: registry.connect.redhat.com/redislabs/services-manager - bootstrapperImageSpec: - repository: registry.connect.redhat.com/redislabs/redis-enterprise-operator - usageMeter: - callHomeClient: - imageSpec: - repository: registry.connect.redhat.com/redislabs/call-home-client ``` diff --git a/content/embeds/k8s/openshift_role.md b/content/embeds/k8s/openshift_role.md index eb3a732f61..ab5dd35cfd 100644 --- a/content/embeds/k8s/openshift_role.md +++ b/content/embeds/k8s/openshift_role.md @@ -180,7 +180,6 @@ rules: - route.openshift.io resources: - routes - - routes/custom-host verbs: - create - delete @@ -189,6 +188,13 @@ rules: - patch - update - watch + - apiGroups: + - route.openshift.io + resources: + - routes/custom-host + verbs: + - create + - update - apiGroups: - security.openshift.io resourceNames: diff --git a/content/embeds/k8s/rerc.md b/content/embeds/k8s/rerc.md index f1cd40e254..0bbe2ca09b 100644 --- a/content/embeds/k8s/rerc.md +++ b/content/embeds/k8s/rerc.md @@ -17,7 +17,7 @@ spec: # The database URL suffix, will be used for the active-active # database replication endpoint and replication endpoint SNI. - dbFqdnSuffix: .example-new-york-1-ns1.redislabs.com + dbFqdnSuffix: -example-new-york-1-ns1.redislabs.com # The name of the secret containing cluster credentials. # Needs to be formatted as: "redis-enterprise-" diff --git a/content/operate/kubernetes/reference/api/redis_enterprise_acl_api.md b/content/operate/kubernetes/reference/api/redis_enterprise_acl_api.md new file mode 100644 index 0000000000..3e209fbb89 --- /dev/null +++ b/content/operate/kubernetes/reference/api/redis_enterprise_acl_api.md @@ -0,0 +1,127 @@ +--- +title: RedisEnterpriseACL API Reference +alwaysopen: false +categories: +- docs +- operate +- kubernetes +linkTitle: REACL API +weight: 30 +--- + +apiVersion: + + +- [app.redislabs.com/v1alpha1](#appredislabscomv1alpha1) + + + + +# app.redislabs.com/v1alpha1 + + + + +RedisEnterpriseACL represents an access control list definition for a Redis database. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
apiVersionstringapp.redislabs.com/v1alpha1true
kindstringRedisEnterpriseACLtrue
metadataobjectRefer to the Kubernetes API documentation for the fields of the `metadata` field.true
specobject + RedisEnterpriseACLSpec defines the desired state of RedisEnterpriseACL
+ 		false
statusobject + RedisEnterpriseACLStatus defines the observed state of RedisEnterpriseACL
+ 		false
+ + +### spec +[↩ Parent](#) + +RedisEnterpriseACLSpec defines the desired state of RedisEnterpriseACL + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
aclstring + Redis ACL rule
+ 		false
+ + +### status +[↩ Parent](#) + +RedisEnterpriseACLStatus defines the observed state of RedisEnterpriseACL + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
observedGenerationinteger + The most recent generation of this resource that was observed and acted upon by the controller.
+
+ Format: int64
+ 		false
uidstring + The internal UID of the Redis ACL object defined in the Redis Enterprise Cluster.
+ 		false
diff --git a/content/operate/kubernetes/reference/api/redis_enterprise_active_active_database_api.md b/content/operate/kubernetes/reference/api/redis_enterprise_active_active_database_api.md index 5c16706d1d..7e03ddc22c 100644 --- a/content/operate/kubernetes/reference/api/redis_enterprise_active_active_database_api.md +++ b/content/operate/kubernetes/reference/api/redis_enterprise_active_active_database_api.md @@ -241,7 +241,7 @@ Global configurations for the Active-Active database. Contains the global proper evictionPolicy string - Database eviction policy. see more https://redis.io/docs/latest/operate/rs/databases/memory-performance/eviction-policy/
+ Database eviction policy. see more https://docs.redislabs.com/latest/rs/administering/database-operations/eviction-policy/
false @@ -306,7 +306,7 @@ Global configurations for the Active-Active database. Contains the global proper rackAware boolean - Whether database should be rack aware. This improves availability - more information: https://redis.io/docs/latest/operate/rs/clusters/configure/rack-zone-awareness/
+ Whether database should be rack aware. This improves availability - more information: https://docs.redislabs.com/latest/rs/concepts/high-availability/rack-zone-awareness/
false @@ -396,6 +396,13 @@ Global configurations for the Active-Active database. Contains the global proper Control the density of shards - should they reside on as few or as many nodes as possible. Available options are "dense" or "sparse". If left unset, defaults to "dense".
false + + tags + map[string]string + + Tags to apply to the Active-Active database, as a map of key to value. The same set is merged into the BDB tags array of the default config and every participating-cluster instance. On key collision with an existing BDB tag, the value here wins. Removing a key after it was previously synced (recorded in status.managedTags) removes it from every BDB. Operator-reserved keys (managed_by, redb_name, redb_namespace, db_service_port, oss_cluster_access, redb_resource, redb_resource_name, global_configurations_spec, replication_endpoint_port, rerc_name, and the secret-tracking keys redis.io/db-sec-name, redis.io/db-sec-latest, redis.io/certs-latest, redis.io/bu-sec-name, redis.io/bu-sec-latest) are not allowed and will be rejected.
+ + false tlsMode enum @@ -1078,7 +1085,13 @@ Database auditing configuration. dbConnsAuditing boolean - Enables auditing of database connection and authentication events. When enabled, connection, authentication, and disconnection events are tracked and sent to the configured audit listener (configured at the cluster level). The cluster-level auditing configuration must be set before enabling this on a database.
+ Deprecated: use auditMode instead. +Enables auditing of database connection and authentication events. +When enabled, connection, authentication, and disconnection events are tracked and sent +to the configured audit listener (configured at the cluster level). +The cluster-level auditing configuration must be set before enabling this on a database. +Setting dbConnsAuditing to true is equivalent to auditMode "connection". +If both dbConnsAuditing and auditMode are set, auditMode takes precedence.
false @@ -1760,6 +1773,13 @@ Defines the observed state of RedisEnterpriseActiveActiveDatabase. List of linked REDBs.
false + + managedTags + []string + + List of user-declared tag keys (from spec.globalConfigurations.tags) that were last successfully reconciled to the Active-Active database's BDBs (default config and every participating-cluster instance). Used to detect tag deletions on the next reconcile: keys present here but absent from the current spec.globalConfigurations.tags are removed from all BDB tag sets. Operator-internal keys (managed_by, redb_resource, global_configurations_spec, etc.) are not tracked here.
+ + false participatingClusters []object diff --git a/content/operate/kubernetes/reference/api/redis_enterprise_cluster_api.md b/content/operate/kubernetes/reference/api/redis_enterprise_cluster_api.md index 346b3c63a5..3ccb9e123a 100644 --- a/content/operate/kubernetes/reference/api/redis_enterprise_cluster_api.md +++ b/content/operate/kubernetes/reference/api/redis_enterprise_cluster_api.md @@ -83,6 +83,13 @@ RedisEnterpriseClusterSpec defines the desired state of RedisEnterpriseCluster + accessControl + object + + Access control configuration for the cluster.
+ + false + activeActive object @@ -182,6 +189,13 @@ RedisEnterpriseClusterSpec defines the desired state of RedisEnterpriseCluster Internode encryption (INE) cluster wide policy. An optional boolean setting. Specifies if INE should be on/off for new created REDBs. May be overridden for specific REDB via similar setting, please view the similar setting for REDB for more info.
false + + dmcExternalCBAAuthentication + boolean + + Whether Certificate-Based Authentication (CBA) for client connections to databases is delegated to an external gRPC authentication service, instead of being handled locally inside DMC (the data-path management proxy). If omitted, this field is evaluated as false. Possible values: true/false
+ + false encryptPkeys boolean @@ -245,6 +259,13 @@ RedisEnterpriseClusterSpec defines the desired state of RedisEnterpriseCluster K8s secret or Vault Secret Name/Path to use for Cluster License. When left blank, the license is read from the "license" field. Note that you can't specify non-empty values in both "license" and "licenseSecretName", only one of these fields can be used to pass the license string. The license needs to be stored under the key "license".
false + + metricsConfig + object + + Cluster-level configuration for metrics. Currently controls which database tag keys may be exposed as labels on Redis Enterprise metrics.
+ + false nodeSelector map[string]string @@ -511,6 +532,15 @@ the operator does not validate that.
The configuration of the usage meter.
false + + usageReportFields + enum + + Controls which fields are included in the usage (call-home) report. "all" also includes node count and hostname; "restricted" sends the reduced report. Default is "restricted". Should not be changed unless instructed by Redis support.
+
+ Enum: all, restricted
+ + false userDefinedModules []object @@ -543,6 +573,56 @@ the operator does not validate that.
+### spec.accessControl +[↩ Parent](#spec) + +Access control configuration for the cluster. + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
policyobject + Policy settings for access control behavior.
+ 		false
+ + +### spec.accessControl.policy +[↩ Parent](#specaccesscontrol) + +Policy settings for access control behavior. + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
allowREDBRolesPermissionsboolean + Controls whether the deprecated REDB spec.rolesPermissions field is reconciled. When enabled (default): both spec.rolesPermissions and RedisEnterpriseRole objects are reconciled. When disabled: only RedisEnterpriseRole objects are reconciled, spec.rolesPermissions is ignored.
+ 		false
+ + ### spec.activeActive [↩ Parent](#spec) @@ -1377,6 +1457,80 @@ Address of an LDAP server. +### spec.metricsConfig +[↩ Parent](#spec) + +Cluster-level configuration for metrics. Currently controls which database tag keys may be exposed as labels on Redis Enterprise metrics. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
exposeDatabaseTagsboolean + Master switch for tag-derived metrics. When true, database tag keys listed in metricsTagKeysExposed may be used as labels by metrics consumers. When false, no database tag keys are exposed as metric labels, even if listed in metricsTagKeysExposed. Defaults to false if unset.
+ 		false
keyDistributionEnabledboolean + When true, emit Prometheus classic histogram metrics for key size/items distributions. Defaults to false if unset.
+ 		false
keyItemsBucketsstring + Comma-separated bucket boundaries for key items distribution histograms (e.g., "1M,8M"). Defaults to empty string if unset.
+ 		false
keySizeBucketsstring + Comma-separated bucket boundaries for key size distribution histograms (e.g., "128M,512M"). Defaults to empty string if unset.
+ 		false
localStorageMaxSizeMbinteger + Maximum size in MB for local metrics storage. Defaults to 1024 if unset.
+ 		false
localStorageRetentionDaysinteger + Number of days to retain local metrics data. Defaults to 8 if unset.
+ 		false
maxRequestsInFlightinteger + Maximum number of concurrent master_aggregator scrape requests. Set to 0 to disable the limit. Defaults to 2 if unset.
+ 		false
metricsTagKeysExposed[]string + Allowlist of database tag keys that may be exposed as metric labels when exposeDatabaseTags is true. Keys not listed here are never exposed as metric labels even if they appear on a database. Keys are lowercased on the cluster, must be 1-64 characters and not whitespace-only, and may contain ASCII letters, digits, spaces, '-', '_', '.', '+', '@', and ':'. At most 50 keys are allowed. Defaults to empty list if unset.
+ 		false
+ + ### spec.ocspConfiguration [↩ Parent](#spec) @@ -2595,6 +2749,13 @@ The security configuration that will be applied to RS pods. + fips + object + + FIPS-140 compliance mode settings.
+ + false + readOnlyRootFilesystemPolicy object @@ -2612,6 +2773,31 @@ The security configuration that will be applied to RS pods. +### spec.securityContext.fips +[↩ Parent](#specsecuritycontext) + +FIPS-140 compliance mode settings. + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
enabledboolean + Toggles whether FIPS-140 compliance mode is enabled or not. Defaults to false.
+ 		false
+ + ### spec.securityContext.readOnlyRootFilesystemPolicy [↩ Parent](#specsecuritycontext) diff --git a/content/operate/kubernetes/reference/api/redis_enterprise_cluster_role_api.md b/content/operate/kubernetes/reference/api/redis_enterprise_cluster_role_api.md new file mode 100644 index 0000000000..e8d96357dc --- /dev/null +++ b/content/operate/kubernetes/reference/api/redis_enterprise_cluster_role_api.md @@ -0,0 +1,178 @@ +--- +title: RedisEnterpriseClusterRole API Reference +alwaysopen: false +categories: +- docs +- operate +- kubernetes +linkTitle: RECROLE API +weight: 30 +--- + +apiVersion: + + +- [app.redislabs.com/v1alpha1](#appredislabscomv1alpha1) + + + + +# app.redislabs.com/v1alpha1 + + + + +RedisEnterpriseClusterRole is a cluster role definition. It grants users cluster-scoped access across the Redis Enterprise Cluster. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
apiVersionstringapp.redislabs.com/v1alpha1true
kindstringRedisEnterpriseClusterRoletrue
metadataobjectRefer to the Kubernetes API documentation for the fields of the `metadata` field.true
specobject + RedisEnterpriseClusterRoleSpec defines the desired state of a RedisEnterpriseClusterRole.
+ 		false
statusobject + RedisEnterpriseRoleStatus defines the observed state of a Redis Enterprise role object. This status type is used by both RedisEnterpriseClusterRole and RedisEnterpriseRole which share the same status structure.
+ 		false
+ + +### spec +[↩ Parent](#) + +RedisEnterpriseClusterRoleSpec defines the desired state of a RedisEnterpriseClusterRole. + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
aclobject + ACL defines the data access permissions granted by this cluster role. +Users with this role can access any database in the Redis Enterprise Cluster, +subject to the permissions granted by the referenced ACL. +References a RedisEnterpriseACL (kind RedisEnterpriseACL or empty) or an +internal Redis Enterprise ACL by name (kind 'redis_acl').
+ 		false
managementRoleenum + ManagementRole is the named set of Redis Enterprise management permissions assigned to this cluster role. If omitted, the role uses the None management role.
+
+ Enum: Admin, ClusterMember, ClusterViewer, DBMember, DBViewer, UserManager, None
+ 		false
+ + +### spec.acl +[↩ Parent](#spec) + +ACL defines the data access permissions granted by this cluster role. +Users with this role can access any database in the Redis Enterprise Cluster, +subject to the permissions granted by the referenced ACL. +References a RedisEnterpriseACL (kind RedisEnterpriseACL or empty) or an +internal Redis Enterprise ACL by name (kind 'redis_acl'). + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
namestring + Name of the referent.
+ 		true
kindenum + Kind of the referent.
+
+ Enum: , RedisEnterpriseACL, redis_acl
+ 		false
+ + +### status +[↩ Parent](#) + +RedisEnterpriseRoleStatus defines the observed state of a Redis Enterprise role object. This status type is used by both RedisEnterpriseClusterRole and RedisEnterpriseRole which share the same status structure. + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
observedGenerationinteger + The most recent generation of this resource that was observed and acted upon by the controller.
+
+ Format: int64
+ 		false
uidstring + The internal UID of the Role object defined in the Redis Enterprise Cluster.
+ 		false
diff --git a/content/operate/kubernetes/reference/api/redis_enterprise_cluster_role_binding_api.md b/content/operate/kubernetes/reference/api/redis_enterprise_cluster_role_binding_api.md new file mode 100644 index 0000000000..d374da6917 --- /dev/null +++ b/content/operate/kubernetes/reference/api/redis_enterprise_cluster_role_binding_api.md @@ -0,0 +1,174 @@ +--- +title: RedisEnterpriseClusterRoleBinding API Reference +alwaysopen: false +categories: +- docs +- operate +- kubernetes +linkTitle: RECROLEBINDING API +weight: 30 +--- + +apiVersion: + + +- [app.redislabs.com/v1alpha1](#appredislabscomv1alpha1) + + + + +# app.redislabs.com/v1alpha1 + + + + +RedisEnterpriseClusterRoleBinding binds users to a RedisEnterpriseClusterRole. It grants the users the cluster access defined by that role. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
apiVersionstringapp.redislabs.com/v1alpha1true
kindstringRedisEnterpriseClusterRoleBindingtrue
metadataobjectRefer to the Kubernetes API documentation for the fields of the `metadata` field.true
specobject + RedisEnterpriseRoleBindingSpec defines the desired state of a RedisEnterpriseClusterRoleBinding or RedisEnterpriseRoleBinding.
+ 		false
statusobject + RedisEnterpriseRoleBindingStatus defines the observed state of a RedisEnterpriseClusterRoleBinding or RedisEnterpriseRoleBinding.
+ 		false
+ + +### spec +[↩ Parent](#) + +RedisEnterpriseRoleBindingSpec defines the desired state of a RedisEnterpriseClusterRoleBinding or RedisEnterpriseRoleBinding. + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
roleRefobject + RoleRef holds a reference to the role object being bound. For RedisEnterpriseClusterRoleBinding, this references a RedisEnterpriseClusterRole in the same namespace (kind RedisEnterpriseClusterRole or empty) or an internal Redis Enterprise role by name (kind 'role'). For RedisEnterpriseRoleBinding, this references a RedisEnterpriseRole in the same namespace (kind RedisEnterpriseRole or empty) or an internal Redis Enterprise role by name (kind 'role').
+ 		true
subjects[]object + Subjects holds references to the objects the role applies to. Each subject is a reference to a RedisEnterpriseUser object within the same namespace. The 'kind' field can be left empty, or set to RedisEnterpriseUser. A maximum of 100 subjects may be specified; to bind more, create additional bindings referencing the same role.
+
+ Validations:
  • self.all(s1, self.exists_one(s2, + (has(s1.kind) && s1.kind != '' ? s1.kind : 'RedisEnterpriseUser') == + (has(s2.kind) && s2.kind != '' ? s2.kind : 'RedisEnterpriseUser') && + s1.name == s2.name)) +: subjects must be unique by kind and name
    • +     		false
    + + +### spec.roleRef +[↩ Parent](#spec) + +RoleRef holds a reference to the role object being bound. For RedisEnterpriseClusterRoleBinding, this references a RedisEnterpriseClusterRole in the same namespace (kind RedisEnterpriseClusterRole or empty) or an internal Redis Enterprise role by name (kind 'role'). For RedisEnterpriseRoleBinding, this references a RedisEnterpriseRole in the same namespace (kind RedisEnterpriseRole or empty) or an internal Redis Enterprise role by name (kind 'role'). + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + Name of the referent.
    +     		true
    kindenum + Kind of the referent.
    +
    + Enum: , RedisEnterpriseClusterRole, role
    +     		false
    + + +### spec.subjects[] +[↩ Parent](#spec) + +A reference to another object. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + Name of the referent.
    +     		true
    kindenum + Kind of the referent.
    +
    + Enum: , RedisEnterpriseUser
    +     		false
    diff --git a/content/operate/kubernetes/reference/api/redis_enterprise_database_api.md b/content/operate/kubernetes/reference/api/redis_enterprise_database_api.md index 6e59de0a8f..54d6142968 100644 --- a/content/operate/kubernetes/reference/api/redis_enterprise_database_api.md +++ b/content/operate/kubernetes/reference/api/redis_enterprise_database_api.md @@ -287,7 +287,7 @@ RedisEnterpriseDatabaseSpec defines the desired state of RedisEnterpriseDatabase rolesPermissions []object - List of Redis Enteprise ACL and Role bindings to apply
    + Deprecated: List of Redis Enterprise ACL and Role bindings to apply. This field is deprecated and is ignored when the cluster's spec.accessControl.policy.allowREDBRolesPermissions is set to false.
    false @@ -320,6 +320,13 @@ RedisEnterpriseDatabaseSpec defines the desired state of RedisEnterpriseDatabase Enum: dense, sparse
    false + + tags + map[string]string + + Tags to apply to the database, as a map of key to value. Tags are merged into the BDB's tags on the cluster. If a key here collides with an existing BDB tag, the value from spec.tags wins. Removing a key from spec.tags after it was previously synced (recorded in status.managedTags) will remove it from the BDB. Operator-reserved keys (managed_by, redb_name, redb_namespace, db_service_port, oss_cluster_access) are not allowed and will be rejected.
    + + false tlsMode enum @@ -894,13 +901,158 @@ Database auditing configuration. + auditMode + enum + + Scope used for database auditing. +"disabled" - auditing is disabled. +"connection" - audit connection, authentication and disconnection events only. +"connection_and_crud" - audit connection events and data operations (CRUD). +The cluster-level auditing configuration must be set before enabling auditing on a database. +Defaults to "disabled" when not set; removing the auditing configuration disables auditing.
    +
    + Enum: disabled, connection, connection_and_crud
    + + false + dbConnsAuditing boolean - Enables auditing of database connection and authentication events. + Deprecated: use auditMode instead. +Enables auditing of database connection and authentication events. When enabled, connection, authentication, and disconnection events are tracked and sent to the configured audit listener (configured at the cluster level). -The cluster-level auditing configuration must be set before enabling this on a database.
    +The cluster-level auditing configuration must be set before enabling this on a database. +Setting dbConnsAuditing to true is equivalent to auditMode "connection". +If both dbConnsAuditing and auditMode are set, auditMode takes precedence.
    + + false + + sourceIpFilter + object + + Filters data operation auditing events by client source IP address. +Only relevant when auditMode is "connection_and_crud". +Note: source IP filtering may not work as expected for Redis clients running outside +of the Kubernetes cluster. The operator does not automatically customize the +LoadBalancer service or ingress/route to preserve the client source IP, so connections +may be seen with a translated (NAT'd) address. If you choose to use this filter, it is +your responsibility to ensure source IP preservation is configured and to verify that +auditing behaves as expected in your environment.
    + + false + + usernameFilter + object + + Filters data operation auditing events by client usernames. +Only relevant when auditMode is "connection_and_crud".
    + + false + + + + +### spec.auditing.sourceIpFilter +[↩ Parent](#specauditing) + +Filters data operation auditing events by client source IP address. +Only relevant when auditMode is "connection_and_crud". +Note: source IP filtering may not work as expected for Redis clients running outside +of the Kubernetes cluster. The operator does not automatically customize the +LoadBalancer service or ingress/route to preserve the client source IP, so connections +may be seen with a translated (NAT'd) address. If you choose to use this filter, it is +your responsibility to ensure source IP preservation is configured and to verify that +auditing behaves as expected in your environment. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    cidrRanges[]string + List of CIDR ranges (IPv4 and/or IPv6) to filter by.
    +     		false
    enabledboolean + Whether the source IP filter is active. +When enabled, at least one entry must be provided across ipAddresses and cidrRanges.
    +     		false
    filterTypeenum + Filter type to use for the source IP filter. +"inclusive" - only audit events from the listed addresses/ranges. +"exclusive" - audit events from all addresses/ranges except the listed ones. +The combined number of ipAddresses and cidrRanges may not exceed 512.
    +
    + Enum: inclusive, exclusive
    +     		false
    ipAddresses[]string + List of IP addresses (IPv4 and/or IPv6) to filter by.
    +     		false
    + + +### spec.auditing.usernameFilter +[↩ Parent](#specauditing) + +Filters data operation auditing events by client usernames. +Only relevant when auditMode is "connection_and_crud". + + + + + + + + + + + + + + + + + + + + + + + + @@ -1590,6 +1742,20 @@ RedisEnterpriseDatabaseStatus defines the observed state of RedisEnterpriseDatab Time when the database was last updated
    + + + + + + + + + + @@ -1613,6 +1779,16 @@ RedisEnterpriseDatabaseStatus defines the observed state of RedisEnterpriseDatab ReplicaSource statuses
    + + + + + @@ -1841,3 +2017,101 @@ Information on the database's periodic backup
    NameTypeDescriptionRequired
    enabledboolean + Whether the username filter is active. +When enabled, usernames must contain at least one entry.
    +     		false
    filterTypeenum + Filter type to use for the username filter. +"inclusive" - only audit events from the listed usernames. +"exclusive" - audit events from all usernames except the listed ones.
    +
    + Enum: inclusive, exclusive
    +     		false
    usernames[]string + List of usernames to filter by. +Each username must be 1-255 printable ASCII characters and may not contain +the characters '&', '<', '>' or '"'. At most 512 usernames are allowed.
    		 false
    false
    managedFields[]string + List of optional spec fields the operator has taken ownership of after the user configured them at least once, so removing such a field resets the BDB to its default instead of leaving the inherited value in place.
    +     		false
    managedTags[]string + List of user-declared tag keys (from spec.tags) that were last successfully reconciled to the BDB. Used to detect tag deletions on the next reconcile: keys present here but absent from the current spec.tags are removed from the BDB. Operator-internal keys (managed_by, redb_name, etc.) are not tracked here.
    +     		false
    observedGeneration integer false
    rolesPermissions[]object + The set of role-permission tuples associated with this database. +Populated from spec.rolesPermissions (deprecated), RedisEnterpriseRole objects whose +scopes reference this database, and RedisEnterpriseClusterRole objects (whose ACLs +apply to every database in the Redis Enterprise Cluster).
    +     		false
    shardStatuses map[string]integerfalse
    + + +### status.rolesPermissions[] +[↩ Parent](#status) + +RolePermissionStatus is an observed role-ACL binding on the database. +Role kind: RedisEnterpriseRole, RedisEnterpriseClusterRole, or role; ACL kind: +RedisEnterpriseACL or redis_acl. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    aclobject + Reference to the ACL.
    +     		true
    roleobject + Reference to the role.
    +     		true
    + + +### status.rolesPermissions[].acl +[↩ Parent](#statusrolespermissions) + +Reference to the ACL. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    kindstring + Kind of the referent.
    +     		false
    namestring + Name of the referent.
    +     		false
    + + +### status.rolesPermissions[].role +[↩ Parent](#statusrolespermissions) + +Reference to the role. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    kindstring + Kind of the referent.
    +     		false
    namestring + Name of the referent.
    +     		false
    diff --git a/content/operate/kubernetes/reference/api/redis_enterprise_role_api.md b/content/operate/kubernetes/reference/api/redis_enterprise_role_api.md new file mode 100644 index 0000000000..7fa125dc99 --- /dev/null +++ b/content/operate/kubernetes/reference/api/redis_enterprise_role_api.md @@ -0,0 +1,298 @@ +--- +title: RedisEnterpriseRole API Reference +alwaysopen: false +categories: +- docs +- operate +- kubernetes +linkTitle: REROLE API +weight: 30 +--- + +apiVersion: + + +- [app.redislabs.com/v1alpha1](#appredislabscomv1alpha1) + + + + +# app.redislabs.com/v1alpha1 + + + + +RedisEnterpriseRole is a scoped role definition. It grants users access to selected databases within a Redis Enterprise Cluster. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    apiVersionstringapp.redislabs.com/v1alpha1true
    kindstringRedisEnterpriseRoletrue
    metadataobjectRefer to the Kubernetes API documentation for the fields of the `metadata` field.true
    specobject + RedisEnterpriseRoleSpec defines the desired state of a RedisEnterpriseRole.
    +     		false
    statusobject + RedisEnterpriseRoleStatus defines the observed state of a Redis Enterprise role object. This status type is used by both RedisEnterpriseClusterRole and RedisEnterpriseRole which share the same status structure.
    +     		false
    + + +### spec +[↩ Parent](#) + +RedisEnterpriseRoleSpec defines the desired state of a RedisEnterpriseRole. + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    scopes[]object + Scopes define the databases to which this role applies. +Each scope references a RedisEnterpriseDatabase by name or selector (kind +RedisEnterpriseDatabase or empty), or an internal Redis Enterprise database +by name (kind 'bdb', name only). +For 'bdb' scopes the role grants management access only; its ACL is not bound +to that database's permissions.
    +     		true
    aclobject + ACL defines the data access permissions granted by this scoped role. +References a RedisEnterpriseACL (kind RedisEnterpriseACL or empty) or an +internal Redis Enterprise ACL by name (kind 'redis_acl').
    +     		false
    managementRoleenum + ManagementRole is the named set of Redis Enterprise management permissions assigned to this scoped role. RedisEnterpriseRole supports only database-scoped management roles. If omitted, the role uses the None management role.
    +
    + Enum: DBMember, DBViewer, None
    +     		false
    + + +### spec.scopes[] +[↩ Parent](#spec) + +A reference to another object(s), either directly by name, or via a label selector. + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    kindenum + Kind of the referent.
    +
    + Enum: , RedisEnterpriseDatabase, bdb
    +     		false
    namestring + Name of the referent.
    +     		false
    selectorobject + Selector based on label attached to the object.
    +     		false
    + + +### spec.scopes[].selector +[↩ Parent](#specscopes) + +Selector based on label attached to the object. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    matchExpressions[]object + matchExpressions is a list of label selector requirements. The requirements are ANDed.
    +     		false
    matchLabelsmap[string]string + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
    +     		false
    + + +### spec.scopes[].selector.matchExpressions[] +[↩ Parent](#specscopesselector) + +A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    keystring + key is the label key that the selector applies to.
    +     		true
    operatorstring + operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
    +     		true
    values[]string + values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
    +     		false
    + + +### spec.acl +[↩ Parent](#spec) + +ACL defines the data access permissions granted by this scoped role. +References a RedisEnterpriseACL (kind RedisEnterpriseACL or empty) or an +internal Redis Enterprise ACL by name (kind 'redis_acl'). + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + Name of the referent.
    +     		true
    kindenum + Kind of the referent.
    +
    + Enum: , RedisEnterpriseACL, redis_acl
    +     		false
    + + +### status +[↩ Parent](#) + +RedisEnterpriseRoleStatus defines the observed state of a Redis Enterprise role object. This status type is used by both RedisEnterpriseClusterRole and RedisEnterpriseRole which share the same status structure. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    observedGenerationinteger + The most recent generation of this resource that was observed and acted upon by the controller.
    +
    + Format: int64
    +     		false
    uidstring + The internal UID of the Role object defined in the Redis Enterprise Cluster.
    +     		false
    diff --git a/content/operate/kubernetes/reference/api/redis_enterprise_role_binding_api.md b/content/operate/kubernetes/reference/api/redis_enterprise_role_binding_api.md new file mode 100644 index 0000000000..1406d7dc2e --- /dev/null +++ b/content/operate/kubernetes/reference/api/redis_enterprise_role_binding_api.md @@ -0,0 +1,174 @@ +--- +title: RedisEnterpriseRoleBinding API Reference +alwaysopen: false +categories: +- docs +- operate +- kubernetes +linkTitle: REROLEBINDING API +weight: 30 +--- + +apiVersion: + + +- [app.redislabs.com/v1alpha1](#appredislabscomv1alpha1) + + + + +# app.redislabs.com/v1alpha1 + + + + +RedisEnterpriseRoleBinding binds users to a RedisEnterpriseRole. It grants the users the scoped access defined by that role. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    apiVersionstringapp.redislabs.com/v1alpha1true
    kindstringRedisEnterpriseRoleBindingtrue
    metadataobjectRefer to the Kubernetes API documentation for the fields of the `metadata` field.true
    specobject + RedisEnterpriseRoleBindingSpec defines the desired state of a RedisEnterpriseClusterRoleBinding or RedisEnterpriseRoleBinding.
    +     		false
    statusobject + RedisEnterpriseRoleBindingStatus defines the observed state of a RedisEnterpriseClusterRoleBinding or RedisEnterpriseRoleBinding.
    +     		false
    + + +### spec +[↩ Parent](#) + +RedisEnterpriseRoleBindingSpec defines the desired state of a RedisEnterpriseClusterRoleBinding or RedisEnterpriseRoleBinding. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    roleRefobject + RoleRef holds a reference to the role object being bound. For RedisEnterpriseClusterRoleBinding, this references a RedisEnterpriseClusterRole in the same namespace (kind RedisEnterpriseClusterRole or empty) or an internal Redis Enterprise role by name (kind 'role'). For RedisEnterpriseRoleBinding, this references a RedisEnterpriseRole in the same namespace (kind RedisEnterpriseRole or empty) or an internal Redis Enterprise role by name (kind 'role').
    +     		true
    subjects[]object + Subjects holds references to the objects the role applies to. Each subject is a reference to a RedisEnterpriseUser object within the same namespace. The 'kind' field can be left empty, or set to RedisEnterpriseUser. A maximum of 100 subjects may be specified; to bind more, create additional bindings referencing the same role.
    +
    + Validations:
  • self.all(s1, self.exists_one(s2, + (has(s1.kind) && s1.kind != '' ? s1.kind : 'RedisEnterpriseUser') == + (has(s2.kind) && s2.kind != '' ? s2.kind : 'RedisEnterpriseUser') && + s1.name == s2.name)) +: subjects must be unique by kind and name
    • +     		false
    + + +### spec.roleRef +[↩ Parent](#spec) + +RoleRef holds a reference to the role object being bound. For RedisEnterpriseClusterRoleBinding, this references a RedisEnterpriseClusterRole in the same namespace (kind RedisEnterpriseClusterRole or empty) or an internal Redis Enterprise role by name (kind 'role'). For RedisEnterpriseRoleBinding, this references a RedisEnterpriseRole in the same namespace (kind RedisEnterpriseRole or empty) or an internal Redis Enterprise role by name (kind 'role'). + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + Name of the referent.
    +     		true
    kindenum + Kind of the referent.
    +
    + Enum: , RedisEnterpriseRole, role
    +     		false
    + + +### spec.subjects[] +[↩ Parent](#spec) + +A reference to another object. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + Name of the referent.
    +     		true
    kindenum + Kind of the referent.
    +
    + Enum: , RedisEnterpriseUser
    +     		false
    diff --git a/content/operate/kubernetes/reference/api/redis_enterprise_user_api.md b/content/operate/kubernetes/reference/api/redis_enterprise_user_api.md new file mode 100644 index 0000000000..45087e7d07 --- /dev/null +++ b/content/operate/kubernetes/reference/api/redis_enterprise_user_api.md @@ -0,0 +1,500 @@ +--- +title: RedisEnterpriseUser API Reference +alwaysopen: false +categories: +- docs +- operate +- kubernetes +linkTitle: REUSER API +weight: 30 +--- + +apiVersion: + + +- [app.redislabs.com/v1alpha1](#appredislabscomv1alpha1) + + + + +# app.redislabs.com/v1alpha1 + + + + +RedisEnterpriseUser represents a user definition within a Redis Enterprise Cluster. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    apiVersionstringapp.redislabs.com/v1alpha1true
    kindstringRedisEnterpriseUsertrue
    metadataobjectRefer to the Kubernetes API documentation for the fields of the `metadata` field.true
    specobject + RedisEnterpriseUserSpec defines the desired state of a RedisEnterpriseUser.
    +     		false
    statusobject + RedisEnterpriseUserStatus defines the observed state of a RedisEnterpriseUser.
    +     		false
    + + +### spec +[↩ Parent](#) + +RedisEnterpriseUserSpec defines the desired state of a RedisEnterpriseUser. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    alertsobject + Email alerts settings for this user. User alerts settings are effective only when cluster alerts settings are configured.
    +     		false
    authMethodenum + AuthMethod selects how the user authenticates to Redis Enterprise. 'Basic' (the default) authenticates with Basic Auth, using a password sourced from passwordSecrets. 'Certificate' authenticates with a client certificate whose subject matches certificateSubjectLine; such users carry no password (passwordSecrets must be empty). Certificate users additionally require certificate-based authentication to be configured at the cluster level.
    +
    + Enum: Basic, Certificate
    + Default: Basic
    +     		false
    certificateSubjectLinestring + CertificateSubjectLine is the certificate subject line (RFC2253) used to match the client certificate for certificate-auth users. Required when authMethod is 'Certificate'; must not be set otherwise.
    +     		false
    emailstring + The email address for the user. Optional (Redis Enterprise accepts an empty email). For password users, changing the email after creation is permitted only while spec.passwordSecrets contains exactly one entry: to change the email of a user with two password secrets (Rotatable rotation in progress), first reduce passwordSecrets to a single entry, change the email, then add the second secret back. Certificate-auth users carry no password, so this restriction does not apply to them.
    +     		false
    passwordModeenum + Defines how passwords are managed for this user. Single: Only a single password secret can be specified at a time. Passwords changes can be done by mutating the secret in-place, or by replacing the secret reference to point to another secret. Rotatable: Allows for one or two password secrets to be specified simultaneously. The secrets are required to be immutable, and the operator automatically sets their 'immutable: true' attribute (K8s secrets only) if not already set. Vault secrets are assumed to be used as immutable and are not made immutable automatically. Password changes are typically done by adding a new password secret, and later removing the old one when it's no longer needed. When empty, Single behavior is used. Must not be set for certificate-auth users (authMethod: Certificate), which carry no password.
    +
    + Enum: Single, Rotatable
    +     		false
    passwordSecrets[]object + List of one or more secrets holding the user's password. Each secret must have a key named 'password' with the user's desired password. If multiple secrets are specified, then the passwords from all of them can be used for authenticating as the user. When the user signin status is 'Locked', the user won't be able to authenticate with Redis Enterprise API or UI, and must be unlocked by another user with Admin-role access. To unlock the user, first set a new password via the 'passwordSecrets' field, and then follow the password reset instructions in the following link: https://redis.io/docs/latest/operate/rs/security/access-control/manage-users/login-lockout/#unlock-locked-user-accounts
    +     		false
    usernamestring + The username associated with the user. The username must be unique within the Redis Enterprise cluster, and include only ASCII characters except &,<,>,". If not specified, a default username is assigned and can be discovered via the status section of the RedisEnterpriseUser.
    +     		false
    + + +### spec.alerts +[↩ Parent](#spec) + +Email alerts settings for this user. User alerts settings are effective only when cluster alerts settings are configured. + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Master toggle for email alerts.
    +     		true
    clusterAlertsobject + UserClusterAlertSettings specifies cluster alerts settings for a user.
    +     		false
    databaseAlertsobject + UserDatabaseAlertSettings specifies database alerts settings for a user.
    +     		false
    + + +### spec.alerts.clusterAlerts +[↩ Parent](#specalerts) + +UserClusterAlertSettings specifies cluster alerts settings for a user. + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    enabledboolean + Determines whether cluster alerts are enabled for the user.
    +     		true
    + + +### spec.alerts.databaseAlerts +[↩ Parent](#specalerts) + +UserDatabaseAlertSettings specifies database alerts settings for a user. + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    databases[]object + The databases for which alerts are enabled for this user. If not specified, defaults to all databases.
    +     		false
    + + +### spec.alerts.databaseAlerts.databases[] +[↩ Parent](#specalertsdatabasealerts) + +A reference to another object. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    kindstring + Kind of the referent.
    +     		false
    namestring + Name of the referent.
    +     		false
    + + +### spec.passwordSecrets[] +[↩ Parent](#spec) + +A reference to a Secret object. + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + Name of the Secret.
    +     		true
    + + +### status +[↩ Parent](#) + +RedisEnterpriseUserStatus defines the observed state of a RedisEnterpriseUser. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    conditions[]object + Conditions represent the latest available observations of the user's state.
    +     		false
    observedGenerationinteger + The most recent generation of this resource that was observed and acted upon by the controller.
    +
    + Format: int64
    +     		false
    passwordIssueDatestring + The date in which the password was set.
    +     		false
    passwordSecrets[]object + List of secrets holding the user's password, with their versions.
    +     		false
    roles[]object + List of roles assigned to the user.
    +     		false
    rolesDisplaystring + Formatted string representation of the roles assigned to the user.
    +     		false
    signinStatusstring + Sign-in status for the user. When set to 'Locked', the user won't be able to authenticate with Redis Enterprise API or UI, and must be unlocked by another user with Admin-role access. To unlock the user, set a new password via the 'passwordSecrets' field, and then follow the password reset instructions in the following link: https://redis.io/docs/latest/operate/rs/security/access-control/manage-users/login-lockout/#unlock-locked-user-accounts
    +     		false
    uidstring + The internal UID of the User object defined in the Redis Enterprise Cluster.
    +     		false
    usernamestring + The effective username assigned for the user.
    +     		false
    + + +### status.conditions[] +[↩ Parent](#status) + +Condition contains details for one aspect of the current state of this API Resource. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    lastTransitionTimestring + lastTransitionTime is the last time the condition transitioned from one status to another.
    +
    + Format: date-time
    +     		true
    statusenum + status of the condition, one of True, False, Unknown.
    +
    + Enum: True, False, Unknown
    +     		true
    typestring + type of condition in CamelCase or in foo.example.com/CamelCase.
    +     		true
    messagestring + message is a human readable message indicating details about the transition.
    +     		false
    observedGenerationinteger + observedGeneration represents the .metadata.generation that the condition was set based upon.
    +
    + Format: int64
    + Minimum: 0
    +     		false
    reasonstring + reason contains a programmatic identifier indicating the reason for the condition's last transition.
    +     		false
    + + +### status.passwordSecrets[] +[↩ Parent](#status) + +A versioned reference to a Secret object. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    namestring + Name of the Secret.
    +     		false
    versionstring + Version of the Secret.
    +     		false
    + + +### status.roles[] +[↩ Parent](#status) + +A reference to another object. + + + + + + + + + + + + + + + + + + + + + +
    NameTypeDescriptionRequired
    kindstring + Kind of the referent.
    +     		false
    namestring + Name of the referent.
    +     		false
    From a9321552b8daa1dc2479b454e20781f84324be94 Mon Sep 17 00:00:00 2001 From: Kaitlyn Michael <76962844+kaitlynmichael@users.noreply.github.com> Date: Mon, 20 Jul 2026 16:16:08 -0500 Subject: [PATCH 3/7] K8s: RBAC feature (#3385) * index pages DOC-6679 DOC-6680 DOC-6681 * move security pages into folders * manage users * DOC-6683 manage roles * manage acls draft DOC-6684 * bindings and migration pages * minimum operator version for rbac pages * edits * review feedback changes --- content/operate/_index.md | 8 +- content/operate/kubernetes/_index.md | 8 +- .../kubernetes/active-active/_index.md | 2 +- .../active-active/create-aa-crdb-cli.md | 2 +- .../operate/kubernetes/architecture/_index.md | 8 +- .../8-0-6-releases/8-0-6-8-december2025.md | 2 +- content/operate/kubernetes/security/_index.md | 30 +-- .../security/access-control/_index.md | 149 +++++++++++++ .../security/access-control/manage-acls.md | 120 +++++++++++ .../access-control/manage-bindings.md | 173 +++++++++++++++ .../security/access-control/manage-roles.md | 199 ++++++++++++++++++ .../security/access-control/manage-users.md | 198 +++++++++++++++++ .../migrate-rolespermissions.md | 193 +++++++++++++++++ .../security/allow-resource-adjustment.md | 2 +- .../security/authentication/_index.md | 45 ++++ .../configuration-secrets.md | 15 +- .../security/{ => authentication}/ldap.md | 3 +- .../manage-rec-credentials.md | 3 +- .../security/{ => authentication}/sso.md | 3 +- .../security/certificates/_index.md | 47 +++++ .../add-client-certificates.md | 3 +- .../{ => certificates}/cert-manager.md | 7 +- .../internode-encryption.md | 7 +- .../manage-rec-certificates.md | 9 +- content/operate/kubernetes/security/vault.md | 24 +-- 25 files changed, 1191 insertions(+), 69 deletions(-) create mode 100644 content/operate/kubernetes/security/access-control/_index.md create mode 100644 content/operate/kubernetes/security/access-control/manage-acls.md create mode 100644 content/operate/kubernetes/security/access-control/manage-bindings.md create mode 100644 content/operate/kubernetes/security/access-control/manage-roles.md create mode 100644 content/operate/kubernetes/security/access-control/manage-users.md create mode 100644 content/operate/kubernetes/security/access-control/migrate-rolespermissions.md create mode 100644 content/operate/kubernetes/security/authentication/_index.md rename content/operate/kubernetes/security/{ => authentication}/configuration-secrets.md (92%) rename content/operate/kubernetes/security/{ => authentication}/ldap.md (99%) rename content/operate/kubernetes/security/{ => authentication}/manage-rec-credentials.md (98%) rename content/operate/kubernetes/security/{ => authentication}/sso.md (99%) create mode 100644 content/operate/kubernetes/security/certificates/_index.md rename content/operate/kubernetes/security/{ => certificates}/add-client-certificates.md (93%) rename content/operate/kubernetes/security/{ => certificates}/cert-manager.md (98%) rename content/operate/kubernetes/security/{ => certificates}/internode-encryption.md (94%) rename content/operate/kubernetes/security/{ => certificates}/manage-rec-certificates.md (94%) diff --git a/content/operate/_index.md b/content/operate/_index.md index 7b95e89596..3f839b7264 100644 --- a/content/operate/_index.md +++ b/content/operate/_index.md @@ -45,9 +45,9 @@ hideListLinks: true | | {{}} Redis Cloud | {{}} Redis Software | {{}} Redis Open Source |
    Redis for     Kubernetes | |:-----------|:--------------|:-----------|:--------------|:--------------| | Transport Layer Security (TLS) | [TLS]({{}}) | [TLS]({{}}) | [TLS]({{< relref "/operate/oss_and_stack/management/security/encryption" >}}) | [REDB tlsMode]({{}}) | -| Role-based access control (RBAC) | [Role-based access control]({{}}) | [Access control]({{}}) | [Access control list]({{< relref "/operate/oss_and_stack/management/security/acl" >}}) | [REC credentials]({{}}) | -| Lightweight Directory Access Protocol (LDAP) | | [LDAP authentication]({{}}) | | [Enable LDAP]({{}}) | +| Role-based access control (RBAC) | [Role-based access control]({{}}) | [Access control]({{}}) | [Access control list]({{< relref "/operate/oss_and_stack/management/security/acl" >}}) | [REC credentials]({{}}) | +| Lightweight Directory Access Protocol (LDAP) | | [LDAP authentication]({{}}) | | [Enable LDAP]({{}}) | | Single sign-on (SSO) | [SAML SSO]({{< relref "/operate/rc/security/access-control/saml-sso" >}}) | | | | -| Self-signed certificates | | [Certificates]({{}}) | [Certificate configuration]({{< relref "/operate/oss_and_stack/management/security/encryption#certificate-configuration" >}}) | [REC certificates]({{}}) | -| Internode encryption | [Encryption at rest]({{< relref "/operate/rc/security/encryption-at-rest" >}}) | [Internode encryption]({{}}) | | [Enable internode encryption]({{}}) | +| Self-signed certificates | | [Certificates]({{}}) | [Certificate configuration]({{< relref "/operate/oss_and_stack/management/security/encryption#certificate-configuration" >}}) | [REC certificates]({{}}) | +| Internode encryption | [Encryption at rest]({{< relref "/operate/rc/security/encryption-at-rest" >}}) | [Internode encryption]({{}}) | | [Enable internode encryption]({{}}) | | Auditing | | [Audit events]({{}}) | [Keyspace notifications]({{< relref "/develop/pubsub/keyspace-notifications" >}}) | | diff --git a/content/operate/kubernetes/_index.md b/content/operate/kubernetes/_index.md index d387bafb00..ffb2408e2c 100644 --- a/content/operate/kubernetes/_index.md +++ b/content/operate/kubernetes/_index.md @@ -67,10 +67,10 @@ Set up globally distributed [Active-Active databases]({{< relref "/operate/kuber Manage [secure connections]({{< relref "/operate/kubernetes/security" >}}) and access control for your Redis Enterprise deployment. -- [Manage REC credentials]({{< relref "/operate/kubernetes/security/manage-rec-credentials" >}}) -- [Manage REC certificates]({{< relref "/operate/kubernetes/security/manage-rec-certificates" >}}) -- [Internode encryption]({{< relref "/operate/kubernetes/security/internode-encryption" >}}) -- [LDAP authentication]({{< relref "/operate/kubernetes/security/ldap" >}}) +- [Manage REC credentials]({{< relref "/operate/kubernetes/security/authentication/manage-rec-credentials" >}}) +- [Manage REC certificates]({{< relref "/operate/kubernetes/security/certificates/manage-rec-certificates" >}}) +- [Internode encryption]({{< relref "/operate/kubernetes/security/certificates/internode-encryption" >}}) +- [LDAP authentication]({{< relref "/operate/kubernetes/security/authentication/ldap" >}}) ## Reference diff --git a/content/operate/kubernetes/active-active/_index.md b/content/operate/kubernetes/active-active/_index.md index d271fd34f0..8507cdd046 100644 --- a/content/operate/kubernetes/active-active/_index.md +++ b/content/operate/kubernetes/active-active/_index.md @@ -72,7 +72,7 @@ For examples, see the [YAML examples]({{< relref "/operate/kubernetes/reference/ The operator automates Active-Active certificate updates. When you update the proxy or syncer certificate secret on a participating cluster's REC, the operator detects the change and propagates the new certificate to the other participating clusters. -For details, see [Manage REC certificates]({{< relref "/operate/kubernetes/security/manage-rec-certificates" >}}) and [cert-manager integration]({{< relref "/operate/kubernetes/security/cert-manager" >}}). +For details, see [Manage REC certificates]({{< relref "/operate/kubernetes/security/certificates/manage-rec-certificates" >}}) and [cert-manager integration]({{< relref "/operate/kubernetes/security/certificates/cert-manager" >}}). ### Limitations diff --git a/content/operate/kubernetes/active-active/create-aa-crdb-cli.md b/content/operate/kubernetes/active-active/create-aa-crdb-cli.md index bf6c86d8d6..32d1cb1379 100644 --- a/content/operate/kubernetes/active-active/create-aa-crdb-cli.md +++ b/content/operate/kubernetes/active-active/create-aa-crdb-cli.md @@ -69,7 +69,7 @@ You'll need to create DNS aliases to resolve your API hostname ``, - Description: Combined with database name to create the Active-Active database hostname - Format: string - Example value: `-cluster.ijk.example.com` -- [**REC admin credentials**]({{< relref "/operate/kubernetes/security/manage-rec-credentials" >}}) ` `: +- [**REC admin credentials**]({{< relref "/operate/kubernetes/security/authentication/manage-rec-credentials" >}}) ` `: - Description: Admin username and password for the REC stored in a secret - Format: string - Example value: username: `user@example.com`, password: `something` diff --git a/content/operate/kubernetes/architecture/_index.md b/content/operate/kubernetes/architecture/_index.md index d92a0d1040..7443e0432b 100644 --- a/content/operate/kubernetes/architecture/_index.md +++ b/content/operate/kubernetes/architecture/_index.md @@ -84,25 +84,25 @@ See the [RedisEnterpriseDatabase (REDB) API Reference]({{}}) and [internode encryption]({{}}) using the [RedisEnterpriseCluster (REC)](#redisenterprisecluster-rec) spec. +Redis Enterprise for Kubernetes uses [secrets](https://kubernetes.io/docs/concepts/configuration/secret/) to manage your cluster credentials, cluster certificates, and client certificates. You can configure [LDAP]({{}}) and [internode encryption]({{}}) using the [RedisEnterpriseCluster (REC)](#redisenterprisecluster-rec) spec. ### REC credentials Redis Enterprise for Kubernetes uses the [RedisEnterpriseCluster (REC)]({{}}) [custom resource](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) to create a Redis Enterprise cluster. During creation it generates random credentials for the operator to use. The credentials are saved in a Kubernetes (K8s) [secret](https://kubernetes.io/docs/concepts/configuration/secret/). The secret name defaults to the name of the cluster. -See [Manage REC credentials]({{}}) for more details. +See [Manage REC credentials]({{}}) for more details. ### REC certificates By default, Redis Enterprise Software for Kubernetes generates TLS certificates for the cluster during creation. These self-signed certificates are generated on the first node of each Redis Enterprise cluster (REC) and are copied to all other nodes in the cluster. -See [Manage REC certificates]({{}}) for more details. +See [Manage REC certificates]({{}}) for more details. ### Client certificates For each client certificate you want to use, you need to create a [Kubernetes secret](https://kubernetes.io/docs/concepts/configuration/secret/) to hold it. You can then reference that secret in your [Redis Enterprise database (REDB)](#redisenterprisedatabase-redb) custom resource. -See [Add client certificates]({{}}) for more details. +See [Add client certificates]({{}}) for more details. ## Storage diff --git a/content/operate/kubernetes/release-notes/8-0-6-releases/8-0-6-8-december2025.md b/content/operate/kubernetes/release-notes/8-0-6-releases/8-0-6-8-december2025.md index 9a0f3d35f2..82314b0fff 100644 --- a/content/operate/kubernetes/release-notes/8-0-6-releases/8-0-6-8-december2025.md +++ b/content/operate/kubernetes/release-notes/8-0-6-releases/8-0-6-8-december2025.md @@ -27,7 +27,7 @@ API support has been added for the following features: - REAADB alerts - User-defined modules - Redis Software [8.0.6-54]({{< relref "/operate/rs/release-notes/rs-8-0-releases/rs-8-0-6-54/" >}}) -- User-defined certificates for [internode encryption]({{< relref "/operate/kubernetes/security/internode-encryption" >}}) +- User-defined certificates for [internode encryption]({{< relref "/operate/kubernetes/security/certificates/internode-encryption" >}}) - SAML 2.0 single sign-on (SSO) authentication - Redis Flex diff --git a/content/operate/kubernetes/security/_index.md b/content/operate/kubernetes/security/_index.md index a04831b1ed..f9c0ef8acc 100644 --- a/content/operate/kubernetes/security/_index.md +++ b/content/operate/kubernetes/security/_index.md @@ -5,40 +5,30 @@ categories: - docs - operate - kubernetes -description: Configure security settings for Redis Enterprise clusters and databases on Kubernetes. +description: Configure security settings for Redis Software clusters and databases on Kubernetes. hideListLinks: true linkTitle: Security weight: 50 --- -Configure security settings for your Redis Enterprise deployment on Kubernetes. Redis Enterprise for Kubernetes provides comprehensive security features including TLS encryption, authentication, access control, and certificate management. +Configure security settings for Redis for Kubernetes. Security covers access control, cluster credentials, external identity providers, TLS certificates and encryption, and external secret management. -## Credentials and authentication +## Access control -Manage cluster credentials and authentication settings: +- [Access control]({{< relref "/operate/kubernetes/security/access-control" >}}) — manage Redis Software users, roles, ACLs, and role bindings as Kubernetes custom resources. -- [Manage REC credentials]({{< relref "/operate/kubernetes/security/manage-rec-credentials" >}}) - Configure and manage Redis Enterprise cluster credentials -- [Configuration secrets]({{< relref "/operate/kubernetes/security/configuration-secrets" >}}) - Store Redis Enterprise configuration items in Kubernetes Secrets for automatic updates and secure management -- [LDAP authentication]({{< relref "/operate/kubernetes/security/ldap" >}}) - Integrate with LDAP for centralized authentication -- [SSO authentication]({{< relref "/operate/kubernetes/security/sso" >}}) - Enable SAML-based single sign-on for Cluster Manager UI access +## Authentication -## Certificates and encryption +- [Authentication]({{< relref "/operate/kubernetes/security/authentication" >}}) — manage cluster credentials, LDAP, SAML SSO, and configuration secrets. -Configure TLS certificates and encryption for secure communications: +## Certificates and encryption -- [Manage REC certificates]({{< relref "/operate/kubernetes/security/manage-rec-certificates" >}}) - Configure cluster certificates for TLS encryption -- [cert-manager integration]({{< relref "/operate/kubernetes/security/cert-manager" >}}) - Automate TLS certificate management with cert-manager -- [Add client certificates]({{< relref "/operate/kubernetes/security/add-client-certificates" >}}) - Set up client certificate authentication for databases -- [Internode encryption]({{< relref "/operate/kubernetes/security/internode-encryption" >}}) - Enable encryption between cluster nodes and configure custom certificates +- [Certificates and encryption]({{< relref "/operate/kubernetes/security/certificates" >}}) — provision TLS certificates, integrate cert-manager, add client certificates, and enable internode encryption. ## Secret management -Configure external secret management systems: - -- [HashiCorp Vault integration]({{< relref "/operate/kubernetes/security/vault" >}}) - Configure HashiCorp Vault as the centralized secret management system for Redis Enterprise for Kubernetes +- [HashiCorp Vault integration]({{< relref "/operate/kubernetes/security/vault" >}}) — use HashiCorp Vault as the centralized secret store for Redis for Kubernetes. ## Resource management -Configure security-related resource settings: - -- [Allow resource adjustment]({{< relref "/operate/kubernetes/security/allow-resource-adjustment" >}}) - Enable automatic adjustment of system resources for security compliance +- [Allow resource adjustment]({{< relref "/operate/kubernetes/security/allow-resource-adjustment" >}}) — enable automatic adjustment of system resources for security compliance. diff --git a/content/operate/kubernetes/security/access-control/_index.md b/content/operate/kubernetes/security/access-control/_index.md new file mode 100644 index 0000000000..079ea7ece4 --- /dev/null +++ b/content/operate/kubernetes/security/access-control/_index.md @@ -0,0 +1,149 @@ +--- +Title: Access control +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Manage Redis Software users, roles, ACLs, and role bindings on Kubernetes with custom resources. +hideListLinks: true +linkTitle: Access control +weight: 20 +--- + +Access control lets you manage Redis Software users, roles, ACLs, and role bindings as Kubernetes custom resources. The operator reconciles each resource into the corresponding Redis Software object, so you can use GitOps workflows and Kubernetes Secrets instead of working only through the Redis Software REST API or Cluster Manager UI. + +## How access control works on Redis Software for Kubernetes + +You declare these `app.redislabs.com/v1alpha1` custom resources: + +| Resource | Scope | Purpose | +| --- | --- | --- | +| `RedisEnterpriseUser` | — | A Redis Software user, with credentials in a Kubernetes Secret. | +| `RedisEnterpriseACL` | — | A Redis ACL rule, mapped to a Redis Software ACL object. | +| `RedisEnterpriseRole` | Database | A management role and/or ACL applied to one or more REDBs selected by `spec.scopes`. | +| `RedisEnterpriseRoleBinding` | Database | Assigns a `RedisEnterpriseRole` to a user. | +| `RedisEnterpriseClusterRole` | Cluster | A management role and/or ACL applied across every REDB in the cluster. | +| `RedisEnterpriseClusterRoleBinding` | Cluster | Assigns a `RedisEnterpriseClusterRole` to a user. | + +When you apply one of these resources, the operator: + +1. Validates the spec. +2. Creates or updates the matching object in Redis Software. +3. Reports the resolved Redis Software UID and other state in the resource's `status`. +4. Emits Kubernetes events on reconciliation problems. + +## Roles and bindings + +The role and binding CRDs follow the same pattern as Kubernetes' own RBAC: a `Role` paired with a `RoleBinding` for the narrower scope, and a `ClusterRole` paired with a `ClusterRoleBinding` for cluster-wide access. The narrower scope is the unqualified default — that's why `RedisEnterpriseRole` (no qualifier) is the database-scoped kind, while `RedisEnterpriseClusterRole` carries the explicit `Cluster` prefix. + +### Database scope vs. cluster scope + +| | `RedisEnterpriseRole` | `RedisEnterpriseClusterRole` | +| --- | --- | --- | +| Scope | One or more REDBs | Every REDB in the cluster | +| Selects targets via | `spec.scopes` (REDB name or label selector) — required | No selector; applies cluster-wide | +| `managementRole` values | `DBMember`, `DBViewer`, `None` | `Admin`, `ClusterMember`, `ClusterViewer`, `DBMember`, `DBViewer`, `UserManager`, `None` | +| Binding kind | `RedisEnterpriseRoleBinding` | `RedisEnterpriseClusterRoleBinding` | + +A `RedisEnterpriseClusterRole` applies to every REDB in the cluster, including REDBs represented by resources in other namespaces. The operator applies the role to each REDB individually, so it doesn't reach databases created directly through the Redis Software REST API without a matching REDB resource. + +### What a role grants + +Every role carries permissions on two independent planes. Set either, or both: + +- **`spec.managementRole`** — Redis Software API and Cluster Manager UI permissions, chosen from the built-in roles listed in the table above. Same set of roles you'd assign in Cluster Manager today. +- **`spec.acl`** — a single `RedisEnterpriseACL` reference. The ACL controls Redis data-path access (commands, key patterns, categories). To apply different data-path access to different databases, create a separate role for each. + +### How a user gets permissions + +`RedisEnterpriseUser.spec` has no role references. Permissions reach a user through a binding: + +1. Create a `RedisEnterpriseACL` if you need data-path access. +2. Create a `RedisEnterpriseRole` or `RedisEnterpriseClusterRole` that sets `managementRole`, references the ACL, or both. +3. Create a `RedisEnterpriseRoleBinding` or `RedisEnterpriseClusterRoleBinding` whose `roleRef` points at the role and whose `subjects` list includes the user. + +The user's effective roles appear in `status.roles`. A user with no binding gets the Redis Software `none` role so it's never roleless, but it has zero permissions until a binding lands. + +### End-to-end example + +End-to-end: an ACL, a database-scoped role that uses it, a binding that hands the role to a user, and the user itself. All four resources live in the operator namespace. + +```yaml +--- +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseACL +metadata: + name: read-only +spec: + acl: "+@read ~*" +--- +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseRole +metadata: + name: orders-viewer +spec: + managementRole: DBViewer + scopes: + - name: orders + acl: + name: read-only +--- +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseRoleBinding +metadata: + name: alice-orders-viewer +spec: + roleRef: + name: orders-viewer + subjects: + - name: alice +--- +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseUser +metadata: + name: alice +spec: + email: alice@example.com + username: alice + passwordSecrets: + - name: alice-password +``` + +After applying this and a Secret named `alice-password` with a `password` key, Alice can sign in to Redis Software with `DBViewer` permissions on the `orders` REDB and run read-only Redis commands on every key in that database. + +## What's the same as Redis Software + +The underlying Redis Software behavior is unchanged. For concepts and reference details, see the existing Redis Software docs: + +- [Cluster-scoped role definitions]({{< relref "/operate/rs/security/access-control/create-cluster-roles" >}}) — what `Admin`, `ClusterMember`, `ClusterViewer`, and `UserManager` grant. +- [Database-scoped role definitions]({{< relref "/operate/rs/security/access-control/create-db-roles" >}}) — what `DBMember` and `DBViewer` grant. +- [Combined cluster and database roles]({{< relref "/operate/rs/security/access-control/create-combined-roles" >}}) — when a role grants both planes. +- [Redis ACL syntax]({{< relref "/operate/rs/security/access-control/redis-acl-overview" >}}) — rule format for `RedisEnterpriseACL` resources. +- [Login lockout and unlock]({{< relref "/operate/rs/security/access-control/manage-users/login-lockout" >}}) — how locked users are recovered. +- [Password complexity rules]({{< relref "/operate/rs/security/access-control/manage-passwords/password-complexity-rules" >}}) and [password expiration]({{< relref "/operate/rs/security/access-control/manage-passwords/password-expiration" >}}) — applied by Redis Software regardless of how the password is delivered. +- [Default user]({{< relref "/operate/rs/security/access-control/manage-users/default-user" >}}) — the built-in cluster admin account. + +## What's different on Kubernetes + +- **Resources are declarative.** You define users, roles, ACLs, and bindings in YAML and let the operator apply them. The Cluster Manager UI and REST API still work but are no longer the source of truth. +- **Role assignment lives on the binding, not the user.** In Redis Software, you assign roles by editing the user. On Kubernetes, you create a separate `RedisEnterpriseRoleBinding` or `RedisEnterpriseClusterRoleBinding`. See [Roles and bindings](#roles-and-bindings). +- **Database and cluster scope are separate objects.** A `RedisEnterpriseRole` covers database scope and a `RedisEnterpriseClusterRole` covers cluster scope. In Redis Software, a single role object carries both. +- **Passwords live in Kubernetes Secrets.** Each `RedisEnterpriseUser` references one or more Secrets. A `Rotatable` mode supports two Secrets at once for zero-downtime rotation. The operator marks Kubernetes Secrets immutable to prevent in-place edits. + +## Known limitations + +Access control resources are reconciled only in the operator namespace. Password Secrets must live in the same namespace, and database scopes resolve to REDBs in that namespace. + +## In this section + +- [Manage users]({{< relref "/operate/kubernetes/security/access-control/manage-users" >}}) — create `RedisEnterpriseUser` resources, rotate passwords, recover from lockouts. +- [Manage roles]({{< relref "/operate/kubernetes/security/access-control/manage-roles" >}}) — create database and cluster roles with the right scope and management permissions. +- [Manage ACLs]({{< relref "/operate/kubernetes/security/access-control/manage-acls" >}}) — create and update `RedisEnterpriseACL` resources used by roles. +- [Manage role bindings]({{< relref "/operate/kubernetes/security/access-control/manage-bindings" >}}) — assign roles to users with `RedisEnterpriseRoleBinding` and `RedisEnterpriseClusterRoleBinding`. +- [Migrate from REDB rolesPermissions]({{< relref "/operate/kubernetes/security/access-control/migrate-rolespermissions" >}}) — move from the deprecated `RedisEnterpriseDatabase.spec.rolesPermissions` field to the new CRD model. + +## Related topics + +- [Redis Software for Kubernetes operator API reference]({{< relref "/operate/kubernetes/reference/api" >}}) — field-by-field specification for every CRD in the `app.redislabs.com/v1alpha1` group. +- [Redis databases (REDB)]({{< relref "/operate/kubernetes/re-databases" >}}) — the resources that role scopes resolve against. diff --git a/content/operate/kubernetes/security/access-control/manage-acls.md b/content/operate/kubernetes/security/access-control/manage-acls.md new file mode 100644 index 0000000000..f405daa526 --- /dev/null +++ b/content/operate/kubernetes/security/access-control/manage-acls.md @@ -0,0 +1,120 @@ +--- +Title: Manage ACLs +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Create and update RedisEnterpriseACL resources to control Redis data-path permissions on Kubernetes. +linkTitle: Manage ACLs +weight: 30 +--- + +A `RedisEnterpriseACL` resource holds a Redis ACL rule that controls which commands, keys, and categories a user can access at the Redis data path. The operator reconciles the resource into a Redis Software ACL object that roles can reference. + +ACLs are reusable: one `RedisEnterpriseACL` can be attached to any number of `RedisEnterpriseRole` or `RedisEnterpriseClusterRole` resources. The role decides which databases the ACL applies to; the ACL itself just defines the rule. + +To grant a user the permissions in an ACL, reference the ACL from a role and bind the role to the user. See [Manage roles]({{< relref "/operate/kubernetes/security/access-control/manage-roles" >}}) and [Manage role bindings]({{< relref "/operate/kubernetes/security/access-control/manage-bindings" >}}). + +## Before you start + +- Requires Redis Software for Kubernetes operator 8.0.24-TBD or later. +- The `RedisEnterpriseACL` resource must live in the operator namespace. +- The rule string uses Redis ACL syntax — key patterns, command categories, and explicit commands. See [Redis ACL overview]({{< relref "/operate/rs/security/access-control/redis-acl-overview" >}}) for the full syntax. + +## Create an ACL + +`spec.acl` is a single Redis ACL rule string. + +```yaml +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseACL +metadata: + name: read-only +spec: + acl: "+@read ~*" +``` + +Apply the resource and confirm reconciliation: + +```sh +kubectl apply -f read-only-acl.yaml +kubectl get redisenterpriseacl read-only -o yaml +``` + +`status.uid` holds the Redis Software ACL UID once the operator has created the object. + +### Common rule patterns + +| Use case | Rule | +| --- | --- | +| Read-only access to all keys | `+@read ~*` | +| Read and write access to all keys | `+@all ~*` | +| Read-only access to a key prefix | `+@read ~customer:*` | +| A specific command set | `+get +set +del ~app:*` | +| Block dangerous commands | `+@all -@dangerous ~*` | + +For category names (`@read`, `@write`, `@admin`, `@dangerous`, etc.) and the full operator precedence rules, see [Redis ACL overview]({{< relref "/operate/rs/security/access-control/redis-acl-overview" >}}). + +## Update an ACL + +Edit `spec.acl` and re-apply. The operator updates the Redis Software ACL object in place, so the change immediately affects every database that uses the ACL through a role. + +```sh +kubectl edit redisenterpriseacl read-only +``` + +`status.observedGeneration` reaches the resource's `metadata.generation` once the update has been applied. + +An update changes effective permissions for every connected user. Treat ACL changes the same way as role changes: validate them on a non-production cluster first. For a safer rollout, create a new ACL and swap the role reference instead of editing the existing ACL in place. + +## Inspect ACL status + +The `status` block is minimal: + +| Field | Meaning | +| --- | --- | +| `uid` | Internal Redis Software ACL UID. Present once reconciliation succeeds. | +| `observedGeneration` | The `metadata.generation` the operator last acted on. | + +To find roles that reference this ACL, scan the role resources: + +```sh +kubectl get redisenterpriserole -o yaml | \ + yq '.items[] | select(.spec.acl.name == "read-only") | .metadata.name' +kubectl get redisenterpriseclusterrole -o yaml | \ + yq '.items[] | select(.spec.acl.name == "read-only") | .metadata.name' +``` + +## Delete an ACL + +Delete or modify any roles that reference the ACL first (modify them to no longer reference it), then delete the ACL itself: + +```sh +kubectl delete redisenterpriseacl read-only +``` + +If a role still references the ACL, Redis Software may reject the deletion. The operator emits an `RSOperationFailed` event with the underlying message. Remove the reference (or delete the role) and retry. + +## Troubleshoot + +Watch reconciliation events with `kubectl describe redisenterpriseacl `. Common events: + +| Event | Meaning | +| --- | --- | +| `RSObjectNotFound` | The Redis Software ACL the resource previously resolved against no longer exists. The operator will recreate it on the next reconcile. | +| `RSOperationFailed` | A Redis Software API call failed. The message typically includes the syntax error or in-use conflict. | + +Other things to check: + +- **`status.uid` is empty** — The operator hasn't reconciled the ACL yet, or Redis Software rejected the rule. Check the events for an `RSOperationFailed` with the syntax message. +- **Rule parses but grants nothing** — A common cause is an explicit `-@all` later in the rule overriding earlier `+` clauses. Redis ACL evaluation is order-sensitive; see the [Redis ACL overview]({{< relref "/operate/rs/security/access-control/redis-acl-overview" >}}). +- **Delete is blocked** — A `RedisEnterpriseRole` or `RedisEnterpriseClusterRole` still references the ACL in `spec.acl`. Remove the reference or delete the role first. + +For full field details, see the [`RedisEnterpriseACL`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_acl_api" >}}) API reference. + +## Related topics + +- [Redis ACL overview]({{< relref "/operate/rs/security/access-control/redis-acl-overview" >}}) — rule syntax, categories, and evaluation order. +- [Manage roles]({{< relref "/operate/kubernetes/security/access-control/manage-roles" >}}) — attach ACLs to `RedisEnterpriseRole` and `RedisEnterpriseClusterRole` resources. +- [Manage role bindings]({{< relref "/operate/kubernetes/security/access-control/manage-bindings" >}}) — grant the role to a user. diff --git a/content/operate/kubernetes/security/access-control/manage-bindings.md b/content/operate/kubernetes/security/access-control/manage-bindings.md new file mode 100644 index 0000000000..3d91b4df7e --- /dev/null +++ b/content/operate/kubernetes/security/access-control/manage-bindings.md @@ -0,0 +1,173 @@ +--- +Title: Manage role bindings +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Assign roles to users with RedisEnterpriseRoleBinding and RedisEnterpriseClusterRoleBinding resources. +linkTitle: Manage role bindings +weight: 40 +--- + +A role binding assigns a role to one or more users. Redis Software for Kubernetes supports two binding kinds, one for database-scoped roles and one for cluster-scoped roles: + +- `RedisEnterpriseRoleBinding` — binds a `RedisEnterpriseRole` (database-scoped) to users. +- `RedisEnterpriseClusterRoleBinding` — binds a `RedisEnterpriseClusterRole` (cluster-scoped) to users. + +Both have the same two spec fields: `roleRef` points at a single role, and `subjects` lists the users who receive it. A user holds the permissions defined by every role bound to it across all bindings. + +For the conceptual model and a complete end-to-end example, see [Roles and bindings]({{< relref "/operate/kubernetes/security/access-control/_index#roles-and-bindings" >}}). + +## Common patterns + +Each binding references exactly one role through `roleRef` and lists up to 100 subjects. A user can be the subject of many bindings, so you grant a user multiple roles by creating multiple bindings. Beyond that, the CRD model doesn't enforce a granularity — pick one of these patterns and stick with it across the namespace to make audits and reviews predictable: + +- **One binding per role, many subjects** — every user with the role lives in one resource. A single apply changes access for every user at once, which can be either a feature or a hazard depending on the change. +- **One binding per user-role pair** — most verbose, but each grant is a discrete resource. Useful for attributing changes in GitOps and for scoping Kubernetes RBAC permissions on individual bindings. + +## Before you start + +- Requires Redis Software for Kubernetes operator 8.0.24-TBD or later. +- The binding resource, the role it references, and any `RedisEnterpriseUser` subjects must all live in the operator namespace. +- Create the role before the binding when possible. The operator still admits a binding that references a missing role — the binding stays unresolved until the role lands. + +## Create a database role binding + +`RedisEnterpriseRoleBinding` references a `RedisEnterpriseRole` and a list of subjects: + +```yaml +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseRoleBinding +metadata: + name: alice-orders-viewer +spec: + roleRef: + kind: RedisEnterpriseRole + name: orders-viewer + subjects: + - kind: RedisEnterpriseUser + name: alice +``` + +`kind` on `roleRef` defaults to `RedisEnterpriseRole` and can be omitted. Subjects default to `RedisEnterpriseUser` the same way. + +To grant the same role to several users, list them as separate subjects: + +```yaml +spec: + roleRef: + name: orders-viewer + subjects: + - name: alice + - name: bob + - name: carol +``` + +### Apply order doesn't matter + +The operator admits a binding even when the role it references doesn't exist yet. The binding stays unresolved until the role lands, and the user picks up the role on the next reconcile. This lets `kubectl apply -f manifests/` work regardless of file order. + +While the role is missing, the affected user's `RolesBound` condition is `False` with reason `RoleNotFound`: + +```sh +kubectl get redisenterpriseuser alice -o jsonpath='{.status.conditions[?(@.type=="RolesBound")]}' +``` + +The condition flips to `True` once the missing role exists and reconciles. + +## Create a cluster role binding + +`RedisEnterpriseClusterRoleBinding` has the same shape but references a `RedisEnterpriseClusterRole`: + +```yaml +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseClusterRoleBinding +metadata: + name: ops-admins +spec: + roleRef: + kind: RedisEnterpriseClusterRole + name: cluster-admin + subjects: + - name: alice + - name: bob +``` + +A cluster role binding grants the role across every REDB in the cluster, including REDBs represented by resources in other namespaces. Reserve cluster role bindings for administrators who need cluster-wide access. + +## Subjects + +Each entry in `spec.subjects` references a `RedisEnterpriseUser` in the operator namespace. `spec.subjects[].kind` can be left empty or set to `RedisEnterpriseUser`, and `name` is the resource's `metadata.name`: + +```yaml +spec: + subjects: + - kind: RedisEnterpriseUser + name: alice + - name: bob # kind defaults to RedisEnterpriseUser +``` + +A binding can list up to 100 subjects. To grant the role to more users, create additional bindings that reference the same role. + +## Update a binding + +Edit `spec.subjects` to add or remove users from the role, or change `roleRef` to point at a different role. + +- **Add a user** — append a new entry to `subjects` and apply. The user picks up the role on the next reconcile. +- **Remove a user** — delete the entry from `subjects`. The user loses the role; other subjects in the binding keep their access. +- **Replace the role** — change `roleRef.name`. Subjects lose the old role and gain the new one. Consider creating a new binding instead if you need a staged rollout. + +A user's effective roles appear in `status.roles` on the `RedisEnterpriseUser`. + +## Find bindings that reference a role or user + +Before renaming or deleting a role, find every binding that points at it: + +```sh +kubectl get redisenterpriserolebinding -o json | \ + jq '.items[] | select(.spec.roleRef.name == "orders-viewer") | .metadata.name' +kubectl get redisenterpriseclusterrolebinding -o json | \ + jq '.items[] | select(.spec.roleRef.name == "orders-viewer") | .metadata.name' +``` + +To find every binding that grants a role to a specific user: + +```sh +kubectl get redisenterpriserolebinding -o json | \ + jq '.items[] | select(.spec.subjects[]?.name == "alice") | .metadata.name' +kubectl get redisenterpriseclusterrolebinding -o json | \ + jq '.items[] | select(.spec.subjects[]?.name == "alice") | .metadata.name' +``` + +## Inspect binding status + +The binding's own `status` block is empty. To see whether a binding has actually granted permissions, check the referenced user instead: + +```sh +kubectl get redisenterpriseuser alice -o jsonpath='{.status.roles}' +``` + +## Delete a binding + +```sh +kubectl delete redisenterpriserolebinding alice-orders-viewer +``` + +Removing the binding revokes the role from every subject listed in it. If you delete the only binding that granted a user any role, the operator falls back to assigning the `none` role so the user is never roleless. + +## Troubleshoot + +Watch reconciliation events with `kubectl describe redisenterpriserolebinding ` (or `redisenterpriseclusterrolebinding`). Since bindings are observed by the user controller, the most useful diagnostic signals appear on the user resource: + +- **The user's `RolesBound` condition is `False` with reason `RoleNotFound`** — A binding references this user but points at a role that doesn't exist. Either create the missing role or fix `roleRef.name`. See [Apply order doesn't matter](#apply-order-doesnt-matter). +- **User has permissions you didn't expect** — Multiple bindings may be granting the same user different roles. Use the recipes in [Find bindings that reference a role or user](#find-bindings-that-reference-a-role-or-user) to list everything that targets the user. +- **`MissingRoleUIDs` event on a user** — Redis Software has role UIDs assigned to the user that the operator can't trace back to any Kubernetes role resource. This typically means roles were granted directly through the Redis Software REST API or Cluster Manager UI, bypassing the CRD model. Recreate the assignment as a `RedisEnterpriseRoleBinding` (or `RedisEnterpriseClusterRoleBinding`) so the CRD model is the source of truth, then revoke the direct assignment. + +For full field details, see the [`RedisEnterpriseRoleBinding`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_role_binding_api" >}}) and [`RedisEnterpriseClusterRoleBinding`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_role_binding_api" >}}) API reference. + +## Related topics + +- [Roles and bindings]({{< relref "/operate/kubernetes/security/access-control/_index#roles-and-bindings" >}}) — the conceptual model and an end-to-end example. +- [Manage roles]({{< relref "/operate/kubernetes/security/access-control/manage-roles" >}}) — create the roles a binding references. +- [Manage users]({{< relref "/operate/kubernetes/security/access-control/manage-users" >}}) — create the users a binding lists as subjects. diff --git a/content/operate/kubernetes/security/access-control/manage-roles.md b/content/operate/kubernetes/security/access-control/manage-roles.md new file mode 100644 index 0000000000..46292a32d9 --- /dev/null +++ b/content/operate/kubernetes/security/access-control/manage-roles.md @@ -0,0 +1,199 @@ +--- +Title: Manage roles +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Create RedisEnterpriseRole and RedisEnterpriseClusterRole resources to grant Redis Software permissions on Kubernetes. +linkTitle: Manage roles +weight: 20 +--- + +A role defines a reusable set of Redis Software permissions — Cluster Manager and API access, Redis data-path access, or both — that you grant to users by creating a binding. Redis Software for Kubernetes supports two role kinds, one scoped to one or more databases, the other scoped to the entire cluster: + +- `RedisEnterpriseRole` — applies to one or more REDBs selected by `spec.scopes`. Use when you want to grant access to a specific database or set of databases. +- `RedisEnterpriseClusterRole` — applies cluster-wide, across every REDB. Use for administrative access or for permissions you want everywhere. + +For details on how roles and bindings work together, see [Roles and bindings]({{< relref "/operate/kubernetes/security/access-control/_index#roles-and-bindings" >}}). To assign a role to a user, see [Manage role bindings]({{< relref "/operate/kubernetes/security/access-control/manage-bindings" >}}). + +## Before you start + +- Requires Redis Software for Kubernetes operator 8.0.24-TBD or later. +- The role resource must live in the operator namespace. Database scopes resolve to REDBs in that namespace. +- Decide whether you need [management permissions](#choose-a-management-role), [data-path permissions](#attach-an-acl), or both. +- If the role references one or more `RedisEnterpriseACL` resources, create those first. See [Manage ACLs]({{< relref "/operate/kubernetes/security/access-control/manage-acls" >}}). + +## Choose a management role + +`spec.managementRole` picks a Redis Software built-in role that controls API and Cluster Manager UI permissions. The allowed values differ by CRD: + +| CRD | Allowed `managementRole` values | +| --- | --- | +| `RedisEnterpriseRole` | `DBMember`, `DBViewer`, `None` | +| `RedisEnterpriseClusterRole` | `Admin`, `ClusterMember`, `ClusterViewer`, `DBMember`, `DBViewer`, `UserManager`, `None` | + +`None` grants no management permissions and is the default when `managementRole` is omitted. For what each Redis Software role grants, see [Cluster-scoped role definitions]({{< relref "/operate/rs/security/access-control/create-cluster-roles" >}}) and [Database-scoped role definitions]({{< relref "/operate/rs/security/access-control/create-db-roles" >}}). + +## Create a database role + +A `RedisEnterpriseRole` must reference at least one database in `spec.scopes`. Each scope picks REDBs by name or by label selector — not both. + +### Scope a role by REDB name + +```yaml +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseRole +metadata: + name: orders-viewer +spec: + managementRole: DBViewer + scopes: + - kind: RedisEnterpriseDatabase + name: orders + acl: + kind: RedisEnterpriseACL + name: read-only +``` + +`kind` defaults to `RedisEnterpriseDatabase` and can be omitted. + +To scope a role to several databases by name, list each one as its own scope entry: + +```yaml +spec: + managementRole: DBViewer + scopes: + - name: orders + - name: customers + - name: inventory + acl: + name: read-only +``` + +The role's `spec.acl` applies to every REDB in `spec.scopes`. If a database needs a different ACL, create a separate role for it. + +### Scope a role by label selector + +Use a selector when you want the role to follow a set of REDBs that share labels, rather than naming each one: + +```yaml +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseRole +metadata: + name: prod-db-viewer +spec: + managementRole: DBViewer + scopes: + - selector: + matchLabels: + environment: production + acl: + name: read-only +``` + +`selector.matchExpressions` is also supported. + +### Scope rules + +- At least one entry in `spec.scopes` is required. +- Each scope must set `name` or `selector`, not both. +- `scopes[].kind` must be `RedisEnterpriseDatabase` or empty. + +## Create a cluster role + +A `RedisEnterpriseClusterRole` has no `scopes` field — it applies across every REDB in the Redis Software cluster. + +```yaml +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseClusterRole +metadata: + name: support-readonly +spec: + managementRole: ClusterViewer + acl: + name: read-only +``` + +Common patterns: + +- **Read-only operator** — `managementRole: ClusterViewer`, no ACL. +- **Cluster admin** — `managementRole: Admin`, no ACL. Use sparingly. +- **Cluster-wide data access** — `managementRole: None` (or omit) with an `acl`. The ACL applies to every REDB in the cluster. + +## Attach an ACL + +Both role kinds carry a single `RedisEnterpriseACL` reference in `spec.acl`. The ACL grants Redis data-path permissions (commands, key patterns, categories) to users who hold the role. + +```yaml +spec: + acl: + kind: RedisEnterpriseACL + name: read-only # kind defaults to RedisEnterpriseACL and can be omitted +``` + +Rules: + +- `acl.kind` must be `RedisEnterpriseACL` or empty. +- For a `RedisEnterpriseRole`, the ACL applies to every database the role's scopes select. If you need different data-path access for different databases, create a separate role for each. +- For a `RedisEnterpriseClusterRole`, the ACL applies to every REDB in the cluster. + +Set `spec.managementRole` alone, `spec.acl` alone, or both. A role with neither set effectively grants nothing. + +## Update a role + +`kubectl apply` (or `kubectl edit`) updates the underlying Redis Software role. The operator reconciles changes to: + +- `managementRole` — replaces the management permission set on the Redis Software role. +- `scopes` — re-resolves which REDBs the role attaches to. REDBs that drop out of the scope have the role's permissions removed. +- `acl` — re-applies the data-path permissions to scoped REDBs (or cluster-wide for cluster roles). + +`status.observedGeneration` reaches the resource's `metadata.generation` once the update has been applied. + +## Inspect role status + +The `status` block is intentionally minimal: + +| Field | Meaning | +| --- | --- | +| `uid` | Internal Redis Software role UID. Present once the role has reconciled successfully. A role must have a `uid` before it can contribute permissions to any database. | +| `observedGeneration` | The `metadata.generation` the operator last acted on. Compare with `metadata.generation` to confirm the latest spec has been processed. | + +To see which users currently hold the role, list bindings that reference it: + +```sh +kubectl get redisenterpriserolebinding -o yaml | \ + yq '.items[] | select(.spec.roleRef.name == "orders-viewer")' +``` + +For cluster roles, replace `redisenterpriserolebinding` with `redisenterpriseclusterrolebinding`. + +## Delete a role + +Delete any bindings that reference the role first, then delete the role. Find the bindings with the recipes in [Find bindings that reference a role or user]({{< relref "/operate/kubernetes/security/access-control/manage-bindings#find-bindings-that-reference-a-role-or-user" >}}), delete each by name, then delete the role: + +```sh +kubectl delete redisenterpriserolebinding alice-orders-viewer +kubectl delete redisenterpriserole orders-viewer +``` + +If a binding still references the role at the moment of deletion, Redis Software may reject the delete and the operator emits a `RoleDeletionBlocked` event. Resolve the blocking binding and retry. + +## Troubleshoot + +Watch reconciliation events with `kubectl describe redisenterpriserole ` (or `redisenterpriseclusterrole`). Common issues: + +- **`status.uid` is empty** — The role hasn't reconciled. Check the events. Common causes: an ACL reference points to a non-existent `RedisEnterpriseACL`, or admission rejected the spec (missing scopes, scope with both `name` and `selector`, wrong `kind`). +- **Scope selector matches nothing** — A label-selector scope is valid even if no REDB currently matches. The role contributes permissions only to REDBs that match at reconcile time. Add the labels or fix the selector. +- **Permissions don't reach the database** — Check `status.uid` on the role, the matching REDB's `status.rolesPermissions`, and confirm a binding assigns the role to the user. +- **`RoleDeletionBlocked`** — A binding still references the role in Redis Software. Delete the binding first. + +For full field details, see the [`RedisEnterpriseRole`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_role_api" >}}) and [`RedisEnterpriseClusterRole`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_role_api" >}}) API reference. + +## Related topics + +- [Roles and bindings]({{< relref "/operate/kubernetes/security/access-control/_index#roles-and-bindings" >}}) — the conceptual model. +- [Manage role bindings]({{< relref "/operate/kubernetes/security/access-control/manage-bindings" >}}) — assign a role to a user. +- [Manage ACLs]({{< relref "/operate/kubernetes/security/access-control/manage-acls" >}}) — define the data-path permissions a role references. +- [Manage users]({{< relref "/operate/kubernetes/security/access-control/manage-users" >}}) — create the users that bindings target. +- [Migrate from REDB rolesPermissions]({{< relref "/operate/kubernetes/security/access-control/migrate-rolespermissions" >}}) — move from the deprecated `RedisEnterpriseDatabase.spec.rolesPermissions` field to the new CRD model. diff --git a/content/operate/kubernetes/security/access-control/manage-users.md b/content/operate/kubernetes/security/access-control/manage-users.md new file mode 100644 index 0000000000..fdb35b9d10 --- /dev/null +++ b/content/operate/kubernetes/security/access-control/manage-users.md @@ -0,0 +1,198 @@ +--- +Title: Manage users +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Create and update Redis Software users on Kubernetes with the RedisEnterpriseUser custom resource. +linkTitle: Manage users +weight: 10 +--- + +A `RedisEnterpriseUser` resource defines a Redis Software user. The operator creates the user in Redis Software and keeps it in sync with the resource. Passwords live in Kubernetes Secrets that the resource references by name. + +This page covers creating users, changing passwords, and recovering locked accounts. To grant a user permissions, see [Manage role bindings]({{< relref "/operate/kubernetes/security/access-control/manage-bindings" >}}). + +## Before you start + +- Requires Redis Software for Kubernetes operator 8.0.24-TBD or later. +- The `RedisEnterpriseUser` resource and every referenced password Secret must live in the operator namespace. +- Passwords must satisfy the cluster's [password complexity rules]({{< relref "/operate/rs/security/access-control/manage-passwords/password-complexity-rules" >}}). + +## Create a user + +1. Create a Secret with the password under the key `password`: + + ```sh + kubectl create secret generic alice-password \ + --from-literal=password='S0me-Str0ng-Passw0rd!' + ``` + +2. Create the `RedisEnterpriseUser` resource: + + ```yaml + apiVersion: app.redislabs.com/v1alpha1 + kind: RedisEnterpriseUser + metadata: + name: alice + spec: + email: alice@example.com + username: alice + passwordSecrets: + - name: alice-password + ``` + +3. Apply the resource and confirm the operator created the user: + + ```sh + kubectl apply -f alice.yaml + kubectl get redisenterpriseuser alice -o yaml + ``` + + `status.uid` holds the Redis Software user ID once reconciliation succeeds. `status.signinStatus` reports the user's current sign-in state. + +The new user has no permissions until you create a role binding. The operator assigns the Redis Software `none` role so the user is never roleless. + +### Required and optional fields + +| Field | Required | Notes | +| --- | --- | --- | +| `spec.email` | Yes | Must be unique in the cluster. | +| `spec.username` | No | Defaults to a generated value. ASCII only, excluding `&`, `<`, `>`, `"`. The effective value appears in `status.username`. | +| `spec.passwordSecrets` | Yes | At least one Secret. Each Secret must have a `password` key. | +| `spec.passwordMode` | No | `Single` (default) or `Rotatable`. See [Choose a password mode](#choose-a-password-mode). | +| `spec.alerts` | No | Email alert settings. Effective only when [cluster alerts]({{< relref "/operate/rs/clusters/configure/cluster-settings#alert-settings" >}}) are configured. | + +For the full schema, see [`RedisEnterpriseUser`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_user_api" >}}). + +### Use a generated username + +If you omit `spec.username`, the operator assigns one and reports it in `status.username`. Read it with: + +```sh +kubectl get redisenterpriseuser alice -o jsonpath='{.status.username}' +``` + +Use that value when you sign in to Redis Software. To reference the user from a binding's `subjects` list, use the resource name (`metadata.name`) instead — not the generated username. + +## Choose a password mode + +`spec.passwordMode` controls how passwords change. + +- **`Single`** (default) — Exactly one entry in `passwordSecrets`. To change the password, update the value in the Secret or point the resource at a different Secret. Suitable for interactive users. +- **`Rotatable`** — One or two entries in `passwordSecrets`. The operator marks each referenced Kubernetes Secret immutable so the password can't be edited in place. Suitable for service accounts that need zero-downtime credential rotation. Vault-backed secrets are treated as immutable but aren't modified by the operator. + +You can't switch modes while the user has two password secrets. Reduce to one secret first. + +## Change a password + +### Single mode + +Edit the Secret value, then re-apply it. The operator detects the new version and updates the user's password. + +```sh +kubectl create secret generic alice-password \ + --from-literal=password='N3w-Str0ng-Passw0rd!' \ + --dry-run=client -o yaml | kubectl apply -f - +``` + +Alternatively, create a new Secret and update `spec.passwordSecrets[0].name` to point at it. + +### Rotatable mode (zero-downtime rotation) + +In Rotatable mode the operator makes referenced Kubernetes Secrets immutable, so you rotate by adding a new Secret alongside the old one. + +1. Create a new Secret with the next password. +2. Add it to `spec.passwordSecrets`. Both passwords now authenticate. +3. Update clients to use the new password. +4. Remove the old Secret from `spec.passwordSecrets`. Only the new password authenticates. +5. Delete the old Secret when nothing else references it. + +`status.passwordSecrets` lists each active Secret with its resolved version. + +## Update the email address + +You can change `spec.email` only while `passwordSecrets` contains exactly one entry. If a Rotatable rotation is in progress, reduce to a single secret first, change the email, then add the second secret back. + +## Configure email alerts + +Email alerts deliver only when the cluster has alert email settings configured. The user's alerts have two layers: a master `enabled` toggle for the whole user, and a per-category toggle for cluster alerts. Database alerts are configured by listing the databases the user should receive alerts for: + +```yaml +spec: + alerts: + enabled: true # master toggle; required for any alert to deliver + clusterAlerts: + enabled: true # opt in to cluster-level alerts + databaseAlerts: + databases: # list specific databases, or omit to receive all + - name: my-database +``` + +Omit `databaseAlerts.databases` to receive alerts for every database. + +## Inspect user status + +The `status` block reports observed state from Redis Software: + +| Field | Meaning | +| --- | --- | +| `uid` | Internal Redis Software user ID. Appears once the user is reconciled. | +| `username` | Effective username, including any default the operator assigned. | +| `roles` / `rolesDisplay` | Roles currently bound to the user. | +| `signinStatus` | `Unknown`, `Active`, `Locked`, or `PasswordExpired`. | +| `passwordIssueDate` | When Redis Software last accepted the user's password. | +| `passwordSecrets` | Each referenced Secret with the resolved version the operator reconciled. | +| `observedGeneration` | The `metadata.generation` the operator last acted on. Compare with `metadata.generation` to confirm reconciliation has caught up. | +| `conditions` | The `RolesBound` condition reports whether every bound role resolves. | + +## Recover a locked user + +`status.signinStatus: Locked` means the user failed too many sign-in attempts. The operator skips password changes while the user is locked, so you must update the resource before unlocking — otherwise the operator can later reconcile the old desired password back onto the user. + +1. Update the password in the `RedisEnterpriseUser` source of truth: change the referenced Secret value (Single mode) or add a new Secret reference (Rotatable mode). +2. Follow the [Redis Software unlock procedure]({{< relref "/operate/rs/security/access-control/manage-users/login-lockout#unlock-locked-user-accounts" >}}) to reset and unlock the account in the cluster. + +`status.signinStatus: PasswordExpired` clears once you set a new password through the resource. + +## Delete a user + +Delete every binding that references the user before deleting the user itself. Use the recipes in [Find bindings that reference a role or user]({{< relref "/operate/kubernetes/security/access-control/manage-bindings#find-bindings-that-reference-a-role-or-user" >}}) to list them, delete each by name, then delete the user: + +```sh +kubectl delete redisenterpriserolebinding alice-orders-viewer +kubectl delete redisenterpriseuser alice +``` + +The operator removes the user from Redis Software. A finalizer keeps the Kubernetes resource until the Redis Software user and any related Secret finalizers are cleaned up; deletion may take longer or stall if the Redis Software API is unavailable. + +Password Secrets aren't deleted — remove them separately when nothing else references them. + +## Troubleshoot + +Watch reconciliation events with `kubectl describe redisenterpriseuser `. Common events: + +| Event | Meaning | +| --- | --- | +| `PasswordSecretMissing` | A name in `passwordSecrets` doesn't exist in the operator namespace. | +| `PasswordSecretInvalid` | The Secret exists but has no `password` key, or the value is empty. | +| `UserPasswordAdded` / `UserPasswordReplaced` / `UserPasswordDeleted` | Normal reconciliation actions. Useful for confirming a rotation step. | +| `UserLocked` | Password operations are skipped because the user is locked. See [Recover a locked user](#recover-a-locked-user). | +| `MissingRoleUIDs` | The user has Redis Software role UIDs that no longer map back to a Kubernetes role resource. | +| `RSObjectNotFound` | A Redis Software object the user previously resolved against is gone. | +| `RSOperationFailed` | A Redis Software API call failed; check the message for details. | + +Other things to check: + +- **`status.signinStatus: Unknown`** — The operator hasn't reconciled the user yet, or it can't read the referenced Secret. Check `PasswordSecretMissing` and `PasswordSecretInvalid` events. +- **`RolesBound` condition is `False` with reason `RoleNotFound`** — A binding references this user but points at a role that doesn't exist. Create the role or fix the binding. +- **Secret edit rejected** — In Rotatable mode the operator sets `immutable: true` on the Secret. Create a new Secret instead of editing an existing one. +- **Cluster Manager UI shows a different role than expected** — Roles come from `RedisEnterpriseRoleBinding` and `RedisEnterpriseClusterRoleBinding` resources, not from the user spec. Check the bindings, not the user. + +## Related topics + +- [Manage role bindings]({{< relref "/operate/kubernetes/security/access-control/manage-bindings" >}}) — assign roles to this user. +- [Default user]({{< relref "/operate/rs/security/access-control/manage-users/default-user" >}}) — the built-in cluster admin account, managed outside the CRD model. +- [Password complexity rules]({{< relref "/operate/rs/security/access-control/manage-passwords/password-complexity-rules" >}}) and [password expiration]({{< relref "/operate/rs/security/access-control/manage-passwords/password-expiration" >}}). +- [`RedisEnterpriseUser` API reference]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_user_api" >}}). diff --git a/content/operate/kubernetes/security/access-control/migrate-rolespermissions.md b/content/operate/kubernetes/security/access-control/migrate-rolespermissions.md new file mode 100644 index 0000000000..da811ab0fa --- /dev/null +++ b/content/operate/kubernetes/security/access-control/migrate-rolespermissions.md @@ -0,0 +1,193 @@ +--- +Title: Migrate from REDB rolesPermissions +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Move database role assignments from the deprecated RedisEnterpriseDatabase.spec.rolesPermissions field to the RBAC CRD model. +linkTitle: Migrate from REDB rolesPermissions +weight: 50 +--- + +`RedisEnterpriseDatabase.spec.rolesPermissions` assigns Redis Software role and ACL names directly to a database. The field is deprecated, replaced by the RBAC CRDs (`RedisEnterpriseRole`, `RedisEnterpriseACL`, and bindings), which let you manage roles, ACLs, and assignments as Kubernetes resources. + +This page covers moving an existing database from `rolesPermissions` to the CRD model, then disabling the deprecated field at the cluster level. + +## Before you start + +- Requires Redis Software for Kubernetes operator 8.0.24-TBD or later. +- Every user who currently holds access through `rolesPermissions` must exist as a `RedisEnterpriseUser` resource before you can bind a CRD role to them. If you created users through the Redis Software REST API or Cluster Manager UI, migrate them first. See [Manage users]({{< relref "/operate/kubernetes/security/access-control/manage-users" >}}). +- List which Redis Software users hold each role. The CRD inventory only captures the database side of the assignment; the user-to-role mapping lives in Redis Software. Pull it from the Cluster Manager UI or the [Redis Software users REST API]({{< relref "/operate/rs/references/rest-api/objects/user" >}}). + +## How the two sources interact + +By default, the operator reconciles both sources of database role permissions: + +- The deprecated `RedisEnterpriseDatabase.spec.rolesPermissions` list on each REDB. +- Permissions derived from `RedisEnterpriseRole` resources that scope to the REDB. + +The operator merges and de-duplicates the two sets before sending them to Redis Software. `RedisEnterpriseDatabase.status.rolesPermissions` shows the merged result: + +- Entries from the deprecated field use Redis Software's internal role and ACL names. +- Entries from CRDs reference `RedisEnterpriseRole` and `RedisEnterpriseACL` resources. + +You can run both sources in parallel during migration. Once every database is completely migrated, disable the deprecated field cluster-wide (see [Disable the deprecated field](#disable-the-deprecated-field)). + +## Reference existing Redis Software objects + +You don't have to recreate every database, ACL, and role as a custom resource. When an object was created directly through the Redis Software REST API or Cluster Manager UI, a CRD reference can point at it by name using an internal kind, so you can bring it under CRD-managed bindings without redefining it: + +| Field | Internal kind | References | +| --- | --- | --- | +| `scopes[].kind` | `bdb` | An internal Redis Software database by name. Name only — no selector. The role grants management access only; its ACL isn't bound to that database. | +| `acl.kind` | `redis_acl` | An internal Redis Software ACL by name. | +| `roleRef.kind` | `role` | An internal Redis Software role by name, from a binding. | + +The reference resolves by name against the existing Redis Software object. Use internal references to migrate assignments incrementally, then replace them with full `RedisEnterpriseDatabase`, `RedisEnterpriseACL`, and `RedisEnterpriseRole` resources as you bring each object under the CRD model. + +## Migrate a database + +For each database, capture what `rolesPermissions` currently grants, recreate it as CRDs, verify the result, then remove the deprecated field. + +### 1. Inventory the existing entries + +List the `rolesPermissions` entries on every REDB in the operator namespace: + +```sh +kubectl get redisenterprisedatabase -o yaml | \ + yq '.items[] | {name: .metadata.name, rolesPermissions: .spec.rolesPermissions}' +``` + +Each entry has a `role` (Redis Software role name) and an `acl` (Redis Software ACL name). The `type` is always `redis-enterprise`. + +### 2. Create RedisEnterpriseACL resources + +For every distinct ACL name in the inventory, create a `RedisEnterpriseACL` resource that holds the same rule string. See [Manage ACLs]({{< relref "/operate/kubernetes/security/access-control/manage-acls" >}}). + +```yaml +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseACL +metadata: + name: read-only +spec: + acl: "+@read ~*" +``` + +The resource `metadata.name` doesn't have to match the original Redis Software ACL name, but matching makes the merged `status.rolesPermissions` easier to read. + +### 3. Create RedisEnterpriseRole resources + +For each role-ACL-REDB combination in the inventory, create a `RedisEnterpriseRole` scoped to the target REDB. See [Manage roles]({{< relref "/operate/kubernetes/security/access-control/manage-roles" >}}). + +```yaml +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseRole +metadata: + name: orders-viewer +spec: + managementRole: DBViewer + scopes: + - name: orders + acl: + name: read-only +``` + +Set `managementRole` to match the Redis Software role's management level. If the original entry only granted data-path access, omit `managementRole` — it defaults to `None`. + +If the same role-ACL pair applies to more than one REDB, collapse them into a single `RedisEnterpriseRole` with multiple `scopes` entries instead of creating one role per REDB: + +```yaml +spec: + managementRole: DBViewer + scopes: + - name: orders + - name: customers + - name: inventory + acl: + name: read-only +``` + +### 4. Create bindings for affected users + +For each user that previously gained access through `rolesPermissions`, create a `RedisEnterpriseRoleBinding` that references the new role. See [Manage role bindings]({{< relref "/operate/kubernetes/security/access-control/manage-bindings" >}}). + +```yaml +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseRoleBinding +metadata: + name: alice-orders-viewer +spec: + roleRef: + name: orders-viewer + subjects: + - name: alice +``` + +### 5. Verify + +Confirm Redis Software still grants the expected access: + +```sh +kubectl get redisenterprisedatabase orders -o yaml | \ + yq '.status.rolesPermissions' +``` + +The merged `status.rolesPermissions` shows entries from both sources. Before you remove the deprecated entries, authenticate as one of the affected users and run a Redis command the role allows: + +```sh +redis-cli -h -p --user alice --pass GET some:key +``` + +Replace the endpoint and port with the values from the REDB's `status.publicService` (or `status.internalService`). + +### 6. Remove the deprecated entries + +Once verification passes, remove the migrated entries from `spec.rolesPermissions`: + +```sh +kubectl edit redisenterprisedatabase orders +``` + +After the next reconcile, `status.rolesPermissions` should contain only CRD-derived entries. Repeat for every REDB. + +## Disable the deprecated field + +After every database is completely migrated, switch the cluster policy to ignore `spec.rolesPermissions` so no one can re-introduce it: + +```yaml +apiVersion: app.redislabs.com/v1 +kind: RedisEnterpriseCluster +metadata: + name: rec +spec: + accessControl: + policy: + allowREDBRolesPermissions: false +``` + +With `allowREDBRolesPermissions: false`: + +- The operator stops reconciling `spec.rolesPermissions` on every REDB. +- The operator removes from Redis Software any permissions that came only from `spec.rolesPermissions`. +- The operator emits a `RolesPermissionsIgnored` event on any REDB that still has the deprecated field set. + +The default is `true` (both sources reconciled). Set the flag back to `true` only as a rollback. + +## Roll back + +To revert to the deprecated field, set `allowREDBRolesPermissions: true` (or omit it) on the `RedisEnterpriseCluster` and re-add the previous entries to each REDB's `spec.rolesPermissions`. CRD-managed permissions continue to work in parallel. + +## Troubleshoot + +- **A user is missing access after you remove the deprecated entries** — A `RedisEnterpriseRole` or binding is missing for that user. Check `RedisEnterpriseUser.status.roles` against the original inventory and add the missing CRDs. +- **`status.rolesPermissions` is empty after migration** — The new roles haven't reconciled. Each `RedisEnterpriseRole` needs `status.uid` populated before it contributes to a REDB. Check the role's events. +- **`RolesPermissionsIgnored` event on a REDB after disabling the field** — A `spec.rolesPermissions` entry remains on the REDB. Edit the REDB and remove the field entirely. + +## Related topics + +- [Manage roles]({{< relref "/operate/kubernetes/security/access-control/manage-roles" >}}) — full details on `RedisEnterpriseRole` and `RedisEnterpriseClusterRole`. +- [Manage ACLs]({{< relref "/operate/kubernetes/security/access-control/manage-acls" >}}) — define the data-path permissions roles reference. +- [Manage role bindings]({{< relref "/operate/kubernetes/security/access-control/manage-bindings" >}}) — assign the new roles to users. +- [`RedisEnterpriseDatabase` API reference]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_database_api" >}}) — the source schema, including the deprecated `rolesPermissions` field. +- [`RedisEnterpriseCluster` API reference]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api" >}}) — the `accessControl.policy.allowREDBRolesPermissions` flag. diff --git a/content/operate/kubernetes/security/allow-resource-adjustment.md b/content/operate/kubernetes/security/allow-resource-adjustment.md index b3be0f7800..472c746b76 100644 --- a/content/operate/kubernetes/security/allow-resource-adjustment.md +++ b/content/operate/kubernetes/security/allow-resource-adjustment.md @@ -6,7 +6,7 @@ categories: description: Enable automatic system resource adjustments for Redis Enterprise to increase file descriptor limits. linkTitle: Auto resource adjustment title: Allow automatic resource adjustment -weight: 98 +weight: 50 --- Redis Enterprise for Kubernetes 7.22.0-6 introduces the ability to run with automatic resource adjustment disabled, which drops all capabilities from the Redis Enterprise container and sets `allowPrivilegeEscalation` to `false`. All other security-related settings remain the same as in automatic resource adjustment enabled. Automatic resource adjustment disabled is the default for installations and upgrades of the Redis Enterprise operator for versions 7.22.0-6 and later. diff --git a/content/operate/kubernetes/security/authentication/_index.md b/content/operate/kubernetes/security/authentication/_index.md new file mode 100644 index 0000000000..1e3a046cf1 --- /dev/null +++ b/content/operate/kubernetes/security/authentication/_index.md @@ -0,0 +1,45 @@ +--- +Title: Authentication +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Manage Redis Software cluster credentials, LDAP, SSO, and configuration secrets on Kubernetes. +hideListLinks: true +linkTitle: Authentication +weight: 10 +--- + +Authentication covers cluster credentials, external identity providers (LDAP and SAML SSO), and configuration secrets. The operator generates the initial cluster admin credentials, applies LDAP and SSO settings from the `RedisEnterpriseCluster` spec, and reads configuration values from Kubernetes Secrets you can update without a cluster restart. + +## How authentication works on Redis for Kubernetes + +- **Cluster credentials** are auto-generated at install and stored in a Kubernetes Secret named after the REC resource. Retrieve and update them with `kubectl`. +- **LDAP** is configured on the `RedisEnterpriseCluster` spec. The operator applies the configuration through the Redis Software REST API. +- **SAML SSO** is enabled on the REC spec. The operator configures the identity provider connection in Redis Software. +- **Configuration secrets** let you store sensitive configuration items in Kubernetes Secrets that the operator references. Updates to the Secret reconcile automatically. + +## What's the same as Redis Software + +The underlying Redis Software behavior is unchanged. For concepts and reference details, see the existing Redis Software docs: + +- [LDAP authentication overview]({{< relref "/operate/rs/security/access-control/ldap" >}}) — server requirements, supported attributes, and the LDAP model. +- [Enable role-based LDAP]({{< relref "/operate/rs/security/access-control/ldap/enable-role-based-ldap" >}}) — concepts behind role-based LDAP. +- [Map LDAP groups to roles]({{< relref "/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles" >}}) — group-to-role mapping rules. +- [SAML single sign-on]({{< relref "/operate/rs/security/access-control/saml-sso" >}}) — identity provider requirements and SAML attribute mappings. +- [Default user]({{< relref "/operate/rs/security/access-control/manage-users/default-user" >}}) — what the bootstrap admin account is for. + +## What's different on Kubernetes + +- **Initial credentials are auto-generated by default.** If you don't provide them, the operator generates them and stores them in the credentials Secret, which you retrieve after the REC is up. You can instead supply your own Secret name and credentials at cluster creation time. +- **Change the cluster admin credentials in Redis Software, then mirror them to the Secret.** Update the credentials directly in Redis Software and reflect the new values in the credentials Secret — see [Manage REC credentials]({{< relref "/operate/kubernetes/security/authentication/manage-rec-credentials" >}}). Credentials for other users are managed through their `RedisEnterpriseUser` resources and Secrets. +- **LDAP and SSO configuration is part of the REC spec.** The operator applies it through the Redis Software REST API, so the configuration is source-controlled. +- **Sensitive values live in Kubernetes Secrets** (or HashiCorp Vault) instead of in Redis Software configuration files. + +## In this section + +- [Manage REC credentials]({{< relref "/operate/kubernetes/security/authentication/manage-rec-credentials" >}}) — retrieve and update the cluster admin credentials Secret. +- [Configuration secrets]({{< relref "/operate/kubernetes/security/authentication/configuration-secrets" >}}) — store config items in Kubernetes Secrets and reconcile updates automatically. +- [LDAP authentication]({{< relref "/operate/kubernetes/security/authentication/ldap" >}}) — configure LDAP for Cluster Manager and database access. +- [SSO authentication]({{< relref "/operate/kubernetes/security/authentication/sso" >}}) — configure SAML single sign-on for the Cluster Manager UI. diff --git a/content/operate/kubernetes/security/configuration-secrets.md b/content/operate/kubernetes/security/authentication/configuration-secrets.md similarity index 92% rename from content/operate/kubernetes/security/configuration-secrets.md rename to content/operate/kubernetes/security/authentication/configuration-secrets.md index aa432b10bb..6efa72a6e5 100644 --- a/content/operate/kubernetes/security/configuration-secrets.md +++ b/content/operate/kubernetes/security/authentication/configuration-secrets.md @@ -3,10 +3,11 @@ categories: - docs - operate - kubernetes +aliases: [/operate/kubernetes/security/configuration-secrets/] description: Store Redis Enterprise configuration items in Kubernetes Secrets for automatic updates and secure management. linkTitle: Configuration secrets title: Store configuration in Kubernetes Secrets -weight: 96 +weight: 20 --- You can store Redis Enterprise configuration items in Kubernetes Secrets for automatic updates and secure management. When you update these Secrets, the operator immediately reads the changes and propagates them to the Redis Enterprise Cluster (REC). @@ -70,7 +71,7 @@ You can customize the credential secret name during cluster creation using the ` The `clusterCredentialSecretName` field cannot be changed after cluster creation. {{}} -For detailed instructions, see [Customize the credential secret name]({{< relref "/operate/kubernetes/security/manage-rec-credentials#customize-the-credential-secret-name" >}}). +For detailed instructions, see [Customize the credential secret name]({{< relref "/operate/kubernetes/security/authentication/manage-rec-credentials#customize-the-credential-secret-name" >}}). ## TLS certificate configuration @@ -84,7 +85,7 @@ You can store TLS certificates in Kubernetes Secrets to secure communication bet kubectl -n create secret generic client-cert-secret --from-file=cert= ``` -2. Add the secret to your REDB using the `clientAuthenticationCertificates` property. See [Add client certificates]({{< relref "/operate/kubernetes/security/add-client-certificates" >}}) for details. +2. Add the secret to your REDB using the `clientAuthenticationCertificates` property. See [Add client certificates]({{< relref "/operate/kubernetes/security/certificates/add-client-certificates" >}}) for details. ### Service certificates @@ -115,7 +116,7 @@ kubectl create secret generic dp-internode-cert \ --from-literal=name=dp_internode_encryption ``` -Reference these secrets in your REC specification under `spec.certificates`. See [Internode encryption]({{< relref "/operate/kubernetes/security/internode-encryption" >}}) for complete configuration details. +Reference these secrets in your REC specification under `spec.certificates`. See [Internode encryption]({{< relref "/operate/kubernetes/security/certificates/internode-encryption" >}}) for complete configuration details. ## Secrets and PEM files in Redis Enterprise pods @@ -150,7 +151,7 @@ Field names vary by deployment. ## See also -- [Manage REC credentials]({{< relref "/operate/kubernetes/security/manage-rec-credentials" >}}) -- [Manage REC certificates]({{< relref "/operate/kubernetes/security/manage-rec-certificates" >}}) -- [Add client certificates]({{< relref "/operate/kubernetes/security/add-client-certificates" >}}) +- [Manage REC credentials]({{< relref "/operate/kubernetes/security/authentication/manage-rec-credentials" >}}) +- [Manage REC certificates]({{< relref "/operate/kubernetes/security/certificates/manage-rec-certificates" >}}) +- [Add client certificates]({{< relref "/operate/kubernetes/security/certificates/add-client-certificates" >}}) - [Redis Enterprise Cluster API reference]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api" >}}) diff --git a/content/operate/kubernetes/security/ldap.md b/content/operate/kubernetes/security/authentication/ldap.md similarity index 99% rename from content/operate/kubernetes/security/ldap.md rename to content/operate/kubernetes/security/authentication/ldap.md index e839618640..e106befad6 100644 --- a/content/operate/kubernetes/security/ldap.md +++ b/content/operate/kubernetes/security/authentication/ldap.md @@ -5,9 +5,10 @@ categories: - docs - operate - kubernetes +aliases: [/operate/kubernetes/security/ldap/] description: Enable LDAP authentication for Redis Enterprise for Kubernetes. linkTitle: Enable LDAP -weight: 95 +weight: 30 --- ## LDAP support for Redis Enterprise Software diff --git a/content/operate/kubernetes/security/manage-rec-credentials.md b/content/operate/kubernetes/security/authentication/manage-rec-credentials.md similarity index 98% rename from content/operate/kubernetes/security/manage-rec-credentials.md rename to content/operate/kubernetes/security/authentication/manage-rec-credentials.md index 6af331b9be..9924ede82b 100644 --- a/content/operate/kubernetes/security/manage-rec-credentials.md +++ b/content/operate/kubernetes/security/authentication/manage-rec-credentials.md @@ -5,8 +5,9 @@ categories: - docs - operate - kubernetes +aliases: [/operate/kubernetes/security/manage-rec-credentials/] linkTitle: Manage REC credentials -weight: 93 +weight: 10 --- Redis Enterprise for Kubernetes uses a custom resource called [`RedisEnterpriseCluster`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api" >}}) to create a Redis Enterprise cluster (REC). During creation, it generates random credentials for the operator to use. The credentials are saved in a Kubernetes (K8s) [secret](https://kubernetes.io/docs/concepts/configuration/secret/). The secret name defaults to the cluster name and is specified by the `clusterCredentialSecretName` field in the REC specification. diff --git a/content/operate/kubernetes/security/sso.md b/content/operate/kubernetes/security/authentication/sso.md similarity index 99% rename from content/operate/kubernetes/security/sso.md rename to content/operate/kubernetes/security/authentication/sso.md index 87f1b94cb7..81538dc629 100644 --- a/content/operate/kubernetes/security/sso.md +++ b/content/operate/kubernetes/security/authentication/sso.md @@ -5,9 +5,10 @@ categories: - docs - operate - kubernetes +aliases: [/operate/kubernetes/security/sso/] description: Enable SAML-based SSO authentication for Redis Enterprise for Kubernetes. linkTitle: Enable SSO -weight: 94 +weight: 40 --- diff --git a/content/operate/kubernetes/security/certificates/_index.md b/content/operate/kubernetes/security/certificates/_index.md new file mode 100644 index 0000000000..192b4c2e40 --- /dev/null +++ b/content/operate/kubernetes/security/certificates/_index.md @@ -0,0 +1,47 @@ +--- +Title: Certificates and encryption +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Manage TLS certificates, client certificates, and internode encryption for Redis Software on Kubernetes. +hideListLinks: true +linkTitle: Certificates and encryption +weight: 30 +--- + +Certificates and encryption use Kubernetes Secrets and cert-manager integration to provision, distribute, and rotate the TLS certificates that Redis Software relies on. The operator distributes referenced certificates across every cluster node. + +## How certificates work on Redis for Kubernetes + +- **Cluster certificates** live in Kubernetes Secrets that the `RedisEnterpriseCluster` spec references. The operator distributes them to every cluster node. +- **cert-manager** can issue and rotate certificates automatically. +- **Client certificates** live in a Secret that the database references for mutual TLS authentication. +- **Internode encryption** is configured on the REC spec. The operator places the certificates on each node. + +## What's the same as Redis Software + +The underlying certificate roles, requirements, and TLS behavior are unchanged. For concepts and reference details, see the existing Redis Software docs: + +- [Certificate roles and types]({{< relref "/operate/rs/security/certificates" >}}) — which certificate is used for what. +- [Create certificates]({{< relref "/operate/rs/security/certificates/create-certificates" >}}) — certificate requirements (SAN, CN, validity). +- [Update certificates]({{< relref "/operate/rs/security/certificates/updating-certificates" >}}) — rotation considerations on Redis Software. +- [Monitor certificates]({{< relref "/operate/rs/security/certificates/monitor-certificates" >}}) — certificate expiration alerts. +- [Client certificate authentication]({{< relref "/operate/rs/security/certificates/certificate-based-authentication" >}}) — how the cluster validates client certificates. +- [TLS protocols]({{< relref "/operate/rs/security/encryption/tls/tls-protocols" >}}) and [ciphers]({{< relref "/operate/rs/security/encryption/tls/ciphers" >}}) — protocol and cipher selection. +- [Enable TLS]({{< relref "/operate/rs/security/encryption/tls/enable-tls" >}}) — TLS for management, replication, and client connections. +- [Internode encryption]({{< relref "/operate/rs/security/encryption/internode-encryption" >}}) — purpose and scope. +- [PEM encryption]({{< relref "/operate/rs/security/encryption/pem-encryption" >}}) — encrypted private keys. + +## What's different on Kubernetes + +- **You capture certificates in Kubernetes Secrets and reference them declaratively in the REC spec.** The operator applies them to the cluster through the Redis Software REST API — the same way certificates are applied on Redis Software, cluster-wide rather than file-by-file on each node. +- **cert-manager can issue and rotate certificates automatically**, replacing manual rotation steps. + +## In this section + +- [Manage REC certificates]({{< relref "/operate/kubernetes/security/certificates/manage-rec-certificates" >}}) — configure cluster TLS certificates. +- [cert-manager integration]({{< relref "/operate/kubernetes/security/certificates/cert-manager" >}}) — automate certificate issuance and rotation with cert-manager. +- [Add client certificates]({{< relref "/operate/kubernetes/security/certificates/add-client-certificates" >}}) — enable client certificate authentication for databases. +- [Internode encryption]({{< relref "/operate/kubernetes/security/certificates/internode-encryption" >}}) — enable encryption between cluster nodes. diff --git a/content/operate/kubernetes/security/add-client-certificates.md b/content/operate/kubernetes/security/certificates/add-client-certificates.md similarity index 93% rename from content/operate/kubernetes/security/add-client-certificates.md rename to content/operate/kubernetes/security/certificates/add-client-certificates.md index 3fe87b1828..082095a87b 100644 --- a/content/operate/kubernetes/security/add-client-certificates.md +++ b/content/operate/kubernetes/security/certificates/add-client-certificates.md @@ -3,10 +3,11 @@ categories: - docs - operate - kubernetes +aliases: [/operate/kubernetes/security/add-client-certificates/] description: Add client certificates to your REDB custom resource. linkTitle: Add client certificates title: Add client certificates -weight: 95 +weight: 30 --- For each client certificate you want to use with your database, you need to create a Kubernetes secret to hold it. You can then reference that secret in your Redis Enterprise database (REDB) custom resource spec. diff --git a/content/operate/kubernetes/security/cert-manager.md b/content/operate/kubernetes/security/certificates/cert-manager.md similarity index 98% rename from content/operate/kubernetes/security/cert-manager.md rename to content/operate/kubernetes/security/certificates/cert-manager.md index 1ea4da28ed..2944d93db6 100644 --- a/content/operate/kubernetes/security/cert-manager.md +++ b/content/operate/kubernetes/security/certificates/cert-manager.md @@ -5,9 +5,10 @@ categories: - docs - operate - kubernetes +aliases: [/operate/kubernetes/security/cert-manager/] description: Automate TLS certificate management for Redis for Kubernetes using cert-manager. linkTitle: cert-manager -weight: 89 +weight: 20 --- [cert-manager](https://cert-manager.io/) is a Kubernetes add-on that automates the management and issuance of TLS certificates. The Redis operator integrates with cert-manager, so you can use automatically managed certificates for: @@ -173,7 +174,7 @@ spec: port: 636 ``` -For more details on LDAP configuration, see [Enable LDAP authentication]({{< relref "/operate/kubernetes/security/ldap" >}}). +For more details on LDAP configuration, see [Enable LDAP authentication]({{< relref "/operate/kubernetes/security/authentication/ldap" >}}). ## Active-Active databases with automatic certificate sync @@ -348,7 +349,7 @@ If you encounter certificate chain validation errors: ## See also - [cert-manager documentation](https://cert-manager.io/docs/) -- [Manage REC certificates]({{< relref "/operate/kubernetes/security/manage-rec-certificates" >}}) +- [Manage REC certificates]({{< relref "/operate/kubernetes/security/certificates/manage-rec-certificates" >}}) - [RedisEnterpriseCluster API reference]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api" >}}) - [RedisEnterpriseDatabase API reference]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_database_api" >}}) - [HashiCorp Vault integration]({{< relref "/operate/kubernetes/security/vault" >}}) diff --git a/content/operate/kubernetes/security/internode-encryption.md b/content/operate/kubernetes/security/certificates/internode-encryption.md similarity index 94% rename from content/operate/kubernetes/security/internode-encryption.md rename to content/operate/kubernetes/security/certificates/internode-encryption.md index ffe28eea28..a72dfb07bc 100644 --- a/content/operate/kubernetes/security/internode-encryption.md +++ b/content/operate/kubernetes/security/certificates/internode-encryption.md @@ -4,9 +4,10 @@ categories: - docs - operate - kubernetes +aliases: [/operate/kubernetes/security/internode-encryption/] description: Enable encryption for communication between REC nodes and configure custom certificates. linkTitle: Internode encryption -weight: 99 +weight: 40 --- Internode encryption provides added security by encrypting communication between nodes in your Redis Enterprise cluster (REC). @@ -130,6 +131,6 @@ When you remove a certificate secret reference from the REC specification, the o ## More info -- [Manage REC certificates]({{< relref "/operate/kubernetes/security/manage-rec-certificates" >}}) - General certificate management for Redis Enterprise clusters -- [Configuration secrets]({{< relref "/operate/kubernetes/security/configuration-secrets" >}}) - Best practices for storing configuration in Kubernetes secrets +- [Manage REC certificates]({{< relref "/operate/kubernetes/security/certificates/manage-rec-certificates" >}}) - General certificate management for Redis Enterprise clusters +- [Configuration secrets]({{< relref "/operate/kubernetes/security/authentication/configuration-secrets" >}}) - Best practices for storing configuration in Kubernetes secrets - [Internode encryption for Redis Enterprise Software]({{< relref "/operate/rs/security/encryption/internode-encryption.md" >}}) - Detailed information about how internode encryption works diff --git a/content/operate/kubernetes/security/manage-rec-certificates.md b/content/operate/kubernetes/security/certificates/manage-rec-certificates.md similarity index 94% rename from content/operate/kubernetes/security/manage-rec-certificates.md rename to content/operate/kubernetes/security/certificates/manage-rec-certificates.md index c51a2b1508..c6a5fbd2e1 100644 --- a/content/operate/kubernetes/security/manage-rec-certificates.md +++ b/content/operate/kubernetes/security/certificates/manage-rec-certificates.md @@ -5,9 +5,10 @@ categories: - docs - operate - kubernetes +aliases: [/operate/kubernetes/security/manage-rec-certificates/] description: Install your own certificates to replace the self-signed certificates used by a Redis Enterprise cluster on Kubernetes. linkTitle: Manage REC certificates -weight: 94 +weight: 10 --- Redis Software for Kubernetes generates self-signed TLS certificates for each new cluster. You can replace any of those certificates with your own. @@ -21,7 +22,7 @@ For the list of certificates and what each one encrypts, see the [certificates t ## Method 1: Manage certificates with the REC custom resource -This is the Kubernetes-native method. The operator detects changes to a referenced secret and rotates the certificate without manual intervention. You can create the secret manually, or have [cert-manager]({{< relref "/operate/kubernetes/security/cert-manager" >}}) issue and renew it automatically. +This is the Kubernetes-native method. The operator detects changes to a referenced secret and rotates the certificate without manual intervention. You can create the secret manually, or have [cert-manager]({{< relref "/operate/kubernetes/security/certificates/cert-manager" >}}) issue and renew it automatically. ### Supported certificates @@ -65,7 +66,7 @@ The operator accepts several key names for the certificate and private key, so y {{}}On Redis Software for Kubernetes versions older than 8.0.18, also include `--from-literal=name=` in the `kubectl create secret` command, where `` is the value from the **Certificate name in Redis Software** column in the [supported certificates](#supported-certificates) table.{{}} -For internode encryption certificates, see [Internode encryption]({{< relref "/operate/kubernetes/security/internode-encryption" >}}) for the full setup, which covers enabling internode encryption alongside the certificate configuration. +For internode encryption certificates, see [Internode encryption]({{< relref "/operate/kubernetes/security/certificates/internode-encryption" >}}) for the full setup, which covers enabling internode encryption alongside the certificate configuration. ### Step 2: Reference the secret in the REC custom resource @@ -116,7 +117,7 @@ After the update, verify the rotation as described in [Step 3](#step-3-verify-th The operator automates certificate updates for [Active-Active]({{< relref "/operate/kubernetes/active-active" >}}) databases. When you update the proxy or syncer certificate secret referenced by the REC, the operator detects the change and propagates the new certificate to all participating clusters. -This automation applies whether you manage the secret directly or with [cert-manager]({{< relref "/operate/kubernetes/security/cert-manager#active-active-databases-with-automatic-certificate-sync" >}}). +This automation applies whether you manage the secret directly or with [cert-manager]({{< relref "/operate/kubernetes/security/certificates/cert-manager#active-active-databases-with-automatic-certificate-sync" >}}). ## More info diff --git a/content/operate/kubernetes/security/vault.md b/content/operate/kubernetes/security/vault.md index 70bfbff9f1..08531d61cd 100644 --- a/content/operate/kubernetes/security/vault.md +++ b/content/operate/kubernetes/security/vault.md @@ -7,7 +7,7 @@ categories: - kubernetes description: Configure HashiCorp Vault as the centralized secret management system for Redis Enterprise for Kubernetes. linkTitle: HashiCorp Vault integration -weight: 97 +weight: 40 --- You can configure HashiCorp Vault as the centralized secret management system for the Redis Enterprise Kubernetes operator, replacing the default Kubernetes secrets. This integration provides enhanced security, centralized secret management, and advanced features like secret rotation and audit logging. @@ -22,18 +22,18 @@ When Vault integration is enabled, all secrets referenced in Redis Enterprise cu | **Cluster secrets** | | | | | | [Cluster credentials]({{< relref "/operate/kubernetes/deployment/quick-start" >}}) | [`clusterCredentialSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#redisenterprisespec" >}}) | Authentication credentials for cluster access | | | [License]({{< relref "/operate/kubernetes/deployment/quick-start#install-the-license" >}}) | [`licenseSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#redisenterprisespec" >}}) | Redis Enterprise license key | -| | [API certificate]({{< relref "/operate/kubernetes/security/manage-rec-certificates" >}}) | [`apiCertificateSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#redisenterprisespec" >}}) | TLS certificate for API server | -| | [Cluster manager certificate]({{< relref "/operate/kubernetes/security/manage-rec-certificates" >}}) | [`cmCertificateSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#redisenterprisespec" >}}) | TLS certificate for cluster manager | +| | [API certificate]({{< relref "/operate/kubernetes/security/certificates/manage-rec-certificates" >}}) | [`apiCertificateSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#redisenterprisespec" >}}) | TLS certificate for API server | +| | [Cluster manager certificate]({{< relref "/operate/kubernetes/security/certificates/manage-rec-certificates" >}}) | [`cmCertificateSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#redisenterprisespec" >}}) | TLS certificate for cluster manager | | | [Metrics exporter certificate]({{< relref "/operate/kubernetes/re-clusters/connect-prometheus-operator" >}}) | [`metricsExporterCertificateSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#redisenterprisespec" >}}) | TLS certificate for metrics exporter | -| | [Proxy certificate]({{< relref "/operate/kubernetes/security/manage-rec-certificates" >}}) | [`proxyCertificateSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#redisenterprisespec" >}}) | TLS certificate for proxy | +| | [Proxy certificate]({{< relref "/operate/kubernetes/security/certificates/manage-rec-certificates" >}}) | [`proxyCertificateSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#redisenterprisespec" >}}) | TLS certificate for proxy | | | [Syncer certificate]({{< relref "/operate/kubernetes/active-active" >}}) | [`syncerCertificateSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#redisenterprisespec" >}}) | TLS certificate for Active-Active syncer | -| | [LDAP client certificate]({{< relref "/operate/kubernetes/security/ldap" >}}) | [`ldapClientCertificateSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#redisenterprisespec" >}}) | TLS certificate for LDAP client authentication | -| | [LDAP bind credentials]({{< relref "/operate/kubernetes/security/ldap" >}}) | [`bindCredentialsSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#specldap" >}}) | Credentials for authenticating to the LDAP server | -| | [CPINE certificate]({{< relref "/operate/kubernetes/security/manage-rec-certificates" >}}) | [`cpInternodeEncryptionCertificateSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#speccertificates" >}}) | TLS certificate for Control Plane Internode Encryption (CPINE) | -| | [DPINE certificate]({{< relref "/operate/kubernetes/security/manage-rec-certificates" >}}) | [`dpInternodeEncryptionCertificateSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#speccertificates" >}}) | TLS certificate for Data Plane Internode Encryption (DPINE) | -| | [SSO service certificate]({{< relref "/operate/kubernetes/security/sso" >}}) | [`ssoServiceCertificateSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#speccertificates" >}}) | Service Provider (SP) certificate for SAML SSO | -| | [SSO issuer certificate]({{< relref "/operate/kubernetes/security/sso" >}}) | [`ssoIssuerCertificateSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#speccertificates" >}}) | Identity Provider (IdP) public certificate for SAML SSO | -| | [SSO IdP metadata]({{< relref "/operate/kubernetes/security/sso" >}}) | [`idpMetadataSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#specssosaml" >}}) | SAML Identity Provider metadata XML | +| | [LDAP client certificate]({{< relref "/operate/kubernetes/security/authentication/ldap" >}}) | [`ldapClientCertificateSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#redisenterprisespec" >}}) | TLS certificate for LDAP client authentication | +| | [LDAP bind credentials]({{< relref "/operate/kubernetes/security/authentication/ldap" >}}) | [`bindCredentialsSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#specldap" >}}) | Credentials for authenticating to the LDAP server | +| | [CPINE certificate]({{< relref "/operate/kubernetes/security/certificates/manage-rec-certificates" >}}) | [`cpInternodeEncryptionCertificateSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#speccertificates" >}}) | TLS certificate for Control Plane Internode Encryption (CPINE) | +| | [DPINE certificate]({{< relref "/operate/kubernetes/security/certificates/manage-rec-certificates" >}}) | [`dpInternodeEncryptionCertificateSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#speccertificates" >}}) | TLS certificate for Data Plane Internode Encryption (DPINE) | +| | [SSO service certificate]({{< relref "/operate/kubernetes/security/authentication/sso" >}}) | [`ssoServiceCertificateSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#speccertificates" >}}) | Service Provider (SP) certificate for SAML SSO | +| | [SSO issuer certificate]({{< relref "/operate/kubernetes/security/authentication/sso" >}}) | [`ssoIssuerCertificateSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#speccertificates" >}}) | Identity Provider (IdP) public certificate for SAML SSO | +| | [SSO IdP metadata]({{< relref "/operate/kubernetes/security/authentication/sso" >}}) | [`idpMetadataSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#specssosaml" >}}) | SAML Identity Provider metadata XML | | | [User-defined module credentials]({{< relref "/operate/kubernetes/re-databases/modules" >}}) | [`credentialsSecret`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api#specuserdefinedmodulessourcehttps" >}}) | Credentials for downloading user-defined modules from authenticated repositories | | **Database secrets** | | | | | | [Database passwords]({{< relref "/operate/kubernetes/networking/database-connectivity/#credentials-and-secrets-management" >}}) | Various | Passwords for Redis databases | @@ -44,7 +44,7 @@ When Vault integration is enabled, all secrets referenced in Redis Enterprise cu | | [Swift backup credentials]({{< relref "/operate/kubernetes/re-databases" >}}) | [`swiftSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_database_api#redisenterprisedbspec" >}}) | Swift storage credentials for database backups | | | [Azure Blob backup credentials]({{< relref "/operate/kubernetes/re-databases" >}}) | [`absSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_database_api#redisenterprisedbspec" >}}) | Azure Blob storage credentials for database backups | | | [Google Cloud backup credentials]({{< relref "/operate/kubernetes/re-databases" >}}) | [`gcsSecretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_database_api#redisenterprisedbspec" >}}) | Google Cloud storage credentials for database backups | -| | [Client authentication certificates]({{< relref "/operate/kubernetes/security/add-client-certificates" >}}) | Various | TLS client certificates for authentication | +| | [Client authentication certificates]({{< relref "/operate/kubernetes/security/certificates/add-client-certificates" >}}) | Various | TLS client certificates for authentication | | **Other secrets** | | | | | | [Remote cluster secrets]({{< relref "/operate/kubernetes/active-active" >}}) | [`secretName`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_remote_cluster_api#redisenterpriseremoteclusterspec" >}}) | Credentials for Redis Enterprise Remote Cluster (RERC) configurations | | | [Active-Active database secrets]({{< relref "/operate/kubernetes/active-active" >}}) | [`globalConfigurations`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_active_active_database_api#redisenterpriseactiveactivedatabasespec" >}}) | All secret names specified in REAADB global configurations | From 47a8093b6f908bfceaf3e346041ae4efe03dff3a Mon Sep 17 00:00:00 2001 From: Kaitlyn Michael <76962844+kaitlynmichael@users.noreply.github.com> Date: Mon, 20 Jul 2026 16:16:34 -0500 Subject: [PATCH 4/7] RBAC API reference pages (#3680) --- content/operate/kubernetes/reference/_index.md | 9 +++++++++ content/operate/kubernetes/reference/api/_index.md | 6 ++++++ 2 files changed, 15 insertions(+) diff --git a/content/operate/kubernetes/reference/_index.md b/content/operate/kubernetes/reference/_index.md index 6f6e504dbb..6ffe5a142a 100644 --- a/content/operate/kubernetes/reference/_index.md +++ b/content/operate/kubernetes/reference/_index.md @@ -88,6 +88,15 @@ Review complete API specifications for all Redis Enterprise custom resources: - [Active-Active database API (REAADB)]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_active_active_database_api" >}}) - Manage Active-Active databases - [Remote cluster API (RERC)]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_remote_cluster_api" >}}) - Configure remote cluster connections +### Access control resources + +- [RedisEnterpriseUser API (REUSER)]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_user_api" >}}) - Manage users for access control +- [RedisEnterpriseRole API (REROLE)]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_role_api" >}}) - Define roles scoped to selected databases +- [RedisEnterpriseRoleBinding API (REROLEBINDING)]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_role_binding_api" >}}) - Bind users to a scoped role +- [RedisEnterpriseClusterRole API (RECROLE)]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_role_api" >}}) - Define cluster-scoped roles +- [RedisEnterpriseClusterRoleBinding API (RECROLEBINDING)]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_role_binding_api" >}}) - Bind users to a cluster-scoped role +- [RedisEnterpriseACL API (REACL)]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_acl_api" >}}) - Define access control lists + ## Compatibility Check supported Kubernetes distributions and versions: diff --git a/content/operate/kubernetes/reference/api/_index.md b/content/operate/kubernetes/reference/api/_index.md index 6c165ea70a..1b3037b4ce 100644 --- a/content/operate/kubernetes/reference/api/_index.md +++ b/content/operate/kubernetes/reference/api/_index.md @@ -29,6 +29,12 @@ The operator uses different API versions to indicate stability and feature matur | [RedisEnterpriseDatabase (REDB)](redis_enterprise_database_api) | `v1alpha1` | Creates and configures Redis databases | | [RedisEnterpriseActiveActiveDatabase (REAADB)](redis_enterprise_active_active_database_api) | `v1alpha1` | Sets up active-active databases across clusters | | [RedisEnterpriseRemoteCluster (RERC)](redis_enterprise_remote_cluster_api) | `v1alpha1` | Defines remote cluster connections for active-active | +| [RedisEnterpriseUser (REUSER)](redis_enterprise_user_api) | `v1alpha1` | Defines users for cluster access control | +| [RedisEnterpriseRole (REROLE)](redis_enterprise_role_api) | `v1alpha1` | Defines a role scoped to selected databases | +| [RedisEnterpriseRoleBinding (REROLEBINDING)](redis_enterprise_role_binding_api) | `v1alpha1` | Binds users to a RedisEnterpriseRole | +| [RedisEnterpriseClusterRole (RECROLE)](redis_enterprise_cluster_role_api) | `v1alpha1` | Defines a cluster-scoped role | +| [RedisEnterpriseClusterRoleBinding (RECROLEBINDING)](redis_enterprise_cluster_role_binding_api) | `v1alpha1` | Binds users to a RedisEnterpriseClusterRole | +| [RedisEnterpriseACL (REACL)](redis_enterprise_acl_api) | `v1alpha1` | Defines an access control list (ACL) for a database | ## Working with the APIs From edd85f8392bda6546af117e4f930903285281e51 Mon Sep 17 00:00:00 2001 From: Kaitlyn Michael <76962844+kaitlynmichael@users.noreply.github.com> Date: Tue, 21 Jul 2026 11:41:51 -0500 Subject: [PATCH 5/7] DOC-6701: Duckburg 8.2.0 release notes (#3663) * DOC-6701: Duckburg 8.2.0 release notes Add the Redis Enterprise for Kubernetes 8.2.0 (Duckburg) release-notes line and the 8.2.0-8 (July 2026) release note. Drafted from the dev release doc and verified against operator tag v8.2.0-8; version numbers are placeholders to swap at the GA build cut. Co-Authored-By: Claude Opus 4.8 (1M context) * supported distros update * RN edits * take out duckburg mentions * build number --------- Co-authored-by: Claude Opus 4.8 (1M context) --- .../reference/supported_k8s_distributions.md | 53 ++++--- .../8-2-0-releases/8-2-0-12-july2026.md | 148 ++++++++++++++++++ .../release-notes/8-2-0-releases/_index.md | 38 +++++ 3 files changed, 213 insertions(+), 26 deletions(-) create mode 100644 content/operate/kubernetes/release-notes/8-2-0-releases/8-2-0-12-july2026.md create mode 100644 content/operate/kubernetes/release-notes/8-2-0-releases/_index.md diff --git a/content/operate/kubernetes/reference/supported_k8s_distributions.md b/content/operate/kubernetes/reference/supported_k8s_distributions.md index 8f08eee3c4..21c2593d5e 100644 --- a/content/operate/kubernetes/reference/supported_k8s_distributions.md +++ b/content/operate/kubernetes/reference/supported_k8s_distributions.md @@ -34,43 +34,44 @@ The tables below use the following status icons: ### Latest release -Operator releases **8.0.10-15** through **8.0.20-21** support the following Kubernetes and OpenShift versions. +Operator release **8.2.0-12** supports the following Kubernetes and OpenShift versions. | OpenShift | Kubernetes | Support status | |---|---|---| +| — | 1.36 | ✅ Supported | | 4.22 | 1.35 | ✅ Supported | | 4.21 | 1.34 | ✅ Supported | | 4.20 | 1.33 | ✅ Supported | | 4.19 | 1.32 | ⚠️ Deprecated | -| 4.18 | 1.31 | ⚠️ Deprecated | ### Version history The following table lists the Kubernetes versions supported by every operator version. Operator versions run from newest (left) to oldest (right). -{{}}| | Redis operator | **8.0.20-21** | **8.0.18-11** | **8.0.10-15** | **8.0.6-6** | **8.0.2-2** | **7.22.2-21** | **7.22.0-15** | **7.22.0-7** | **7.8.6-1** | **7.8.4-9** | **7.8.4-8** | **7.8.2-6** | **7.4.6-2** | **7.4.2-12** | **7.4.2-2** | **7.2.4-12** | **7.2.4-7** | **7.2.4-2** | **6.4.2-8** | **6.4.2-6** | **6.4.2-5** | **6.4.2-4** | **6.2.18-41** | **6.2.18-3** | **6.2.12-1** | **6.2.10-45** | **6.2.10-34** | **6.2.10-4** | **6.2.8-15** | **6.2.8-11** | **6.2.8-2** | **6.2.4-1** | -|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| -| | | May 2026 | March 2026 | Jan 2026 | Dec 2025 | Oct 2025 | Oct 2025 | July 2025 | April 2025 | March 2025 | March 2025 | Feb 2025 | Nov 2024 | July 2024 | May 2024 | March 2024 | Dec 2023 | Oct 2023 | Aug 2023 | July 2023 | June 2023 | April 2023 | March 2023 | Jan 2023 | Nov 2022 | Sept 2022 | July 2022 | May 2022 | March 2022 | Jan 2022 | Jan 2022 | Nov 2021 | Sept 2021 | -| OpenShift | Kubernetes | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| 4.22 | 1.35 | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| 4.21 | 1.34 | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| 4.20 | 1.33 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | -| 4.19 | 1.32 | ⚠️ | ⚠️ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | -| 4.18 | 1.31 | ⚠️ | ⚠️ | ⚠️ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | -| 4.17 | 1.30 | | | | | ❌ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | -| 4.16 | 1.29 | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | -| 4.15 | 1.28 | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | -| 4.14 | 1.27 | | | | | | | | | | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | -| 4.13 | 1.26 | | | | | | | | | | | | | ⚠️ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | -| 4.12 | 1.25 | | | | | | | | | | | | | | | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | -| 4.11 | 1.24 | | | | | | | | | | | | | | | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | -| 4.10 | 1.23 | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | -| 4.09 | 1.22 | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | -| 4.08 | 1.21 | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | -| 4.07 | 1.20 | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | -| 4.06 | 1.19 | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | -| 4.05 | 1.18 | | | | | | | | | | | | | | | | | | | | | | | | | | | | ✅ | ✅ | ✅ | ✅ | ✅ | -| 4.04 | 1.17 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | -| 4.03 | 1.16 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | +{{}}| | Redis operator | **8.2.0-12** | **8.0.20-21** | **8.0.18-11** | **8.0.10-15** | **8.0.6-6** | **8.0.2-2** | **7.22.2-21** | **7.22.0-15** | **7.22.0-7** | **7.8.6-1** | **7.8.4-9** | **7.8.4-8** | **7.8.2-6** | **7.4.6-2** | **7.4.2-12** | **7.4.2-2** | **7.2.4-12** | **7.2.4-7** | **7.2.4-2** | **6.4.2-8** | **6.4.2-6** | **6.4.2-5** | **6.4.2-4** | **6.2.18-41** | **6.2.18-3** | **6.2.12-1** | **6.2.10-45** | **6.2.10-34** | **6.2.10-4** | **6.2.8-15** | **6.2.8-11** | **6.2.8-2** | **6.2.4-1** | +|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| +| | | July 2026 | May 2026 | March 2026 | Jan 2026 | Dec 2025 | Oct 2025 | Oct 2025 | July 2025 | April 2025 | March 2025 | March 2025 | Feb 2025 | Nov 2024 | July 2024 | May 2024 | March 2024 | Dec 2023 | Oct 2023 | Aug 2023 | July 2023 | June 2023 | April 2023 | March 2023 | Jan 2023 | Nov 2022 | Sept 2022 | July 2022 | May 2022 | March 2022 | Jan 2022 | Jan 2022 | Nov 2021 | Sept 2021 | +| OpenShift | Kubernetes | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| — | 1.36 | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| 4.22 | 1.35 | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| 4.21 | 1.34 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| 4.20 | 1.33 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | +| 4.19 | 1.32 | ⚠️ | ⚠️ | ⚠️ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | +| 4.18 | 1.31 | ❌ | ⚠️ | ⚠️ | ⚠️ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | +| 4.17 | 1.30 | | | | | | ❌ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | +| 4.16 | 1.29 | | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | +| 4.15 | 1.28 | | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | +| 4.14 | 1.27 | | | | | | | | | | | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | +| 4.13 | 1.26 | | | | | | | | | | | | | | ⚠️ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | +| 4.12 | 1.25 | | | | | | | | | | | | | | | | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | +| 4.11 | 1.24 | | | | | | | | | | | | | | | | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | +| 4.10 | 1.23 | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | +| 4.09 | 1.22 | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | +| 4.08 | 1.21 | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | +| 4.07 | 1.20 | | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | +| 4.06 | 1.19 | | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | +| 4.05 | 1.18 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ✅ | ✅ | ✅ | ✅ | ✅ | +| 4.04 | 1.17 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | +| 4.03 | 1.16 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | {{}} diff --git a/content/operate/kubernetes/release-notes/8-2-0-releases/8-2-0-12-july2026.md b/content/operate/kubernetes/release-notes/8-2-0-releases/8-2-0-12-july2026.md new file mode 100644 index 0000000000..42f31d0089 --- /dev/null +++ b/content/operate/kubernetes/release-notes/8-2-0-releases/8-2-0-12-july2026.md @@ -0,0 +1,148 @@ +--- +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Feature release with Redis Enterprise RBAC custom resource definitions, REDB metric enrichment through tags, and Redis Software 8.2.0. +hideListLinks: true +linkTitle: 8.2.0-12 (July 2026) +title: Redis Enterprise for Kubernetes 8.2.0-12 (July 2026) release notes +weight: 27 +--- + +Redis Enterprise for Kubernetes 8.2.0-12 is a feature release that supports [Redis Software 8.2.0]({{}}) and includes new features, bug fixes, and enhancements. + +## Highlights + +- Support for managing Redis Enterprise role-based access control (RBAC) through new custom resource definitions (CRDs). +- REDB metric enrichment through tags. +- Support for Redis Software 8.2.0. + +## Enhancements + +- Added support for Redis Enterprise RBAC through new custom resource definitions +- Added REDB metric enrichment through tags +- Migrated the operator and services rigger images to UBI9-micro +- Added REC support for `dmc_external_cba_authentication` +- Added a new Vault plugin with packaged version updates, released separately +- On OpenShift, images are now pulled from Red Hat repositories by default +- Added data-path command auditing through REDB +- Added FIPS 140-3 compliance support +- Added Kubernetes 1.36 and OpenShift 4.22 support +- Added Redis Software 8.2.0 support + +## Resolved issues + +- Fixed cases that caused Redis Enterprise "ghost" containers +- Fixed excessive updates to the Kubernetes API server that caused high logging volume +- Removed nonessential users from container images +- Security fixes +- Fixed an REDB reapply error after recovery +- Fixed a memory usage increase in the bootstrapper container + +## API changes + +This release adds the RBAC custom resource definitions and new fields for access control, metrics, auditing, and FIPS compliance. The table below summarizes the notable changes. For the complete field-level reference, see the [API reference]({{< relref "/operate/kubernetes/reference/api/" >}}). + +| **CRD** | **Field** | **Change** | **Description** | +|---|---|---|---| +| RedisEnterpriseUser (REUSER) | — | Added | New CRD that defines a user for cluster access control. | +| RedisEnterpriseRole (REROLE) | — | Added | New CRD that defines a role scoped to selected databases. | +| RedisEnterpriseRoleBinding (REROLEBINDING) | — | Added | New CRD that binds users to a `RedisEnterpriseRole`. | +| RedisEnterpriseClusterRole (RECROLE) | — | Added | New CRD that defines a cluster-scoped role. | +| RedisEnterpriseClusterRoleBinding (RECROLEBINDING) | — | Added | New CRD that binds users to a `RedisEnterpriseClusterRole`. | +| RedisEnterpriseACL (REACL) | — | Added | New CRD that defines an access control list (ACL) for a database. | +| REC | `spec.accessControl` | Added | Configures cluster access control, including whether the deprecated REDB `rolesPermissions` field is reconciled. | +| REC | `spec.dmcExternalCBAAuthentication` | Added | Delegates client certificate-based authentication to an external authentication service. | +| REC | `spec.metricsConfig` | Added | Configures cluster metrics, including database tag keys exposed as metric labels and key size and items distribution histograms. | +| REC | `spec.securityContext.fips` | Added | Enables FIPS 140-3 compliance mode. | +| REDB | `spec.auditing` | Added | Configures data-path command auditing, including audit mode and source IP and username filters. | +| REDB | `spec.tags` | Added | Map of tags used to enrich exported database metrics. | +| REDB | `spec.rolesPermissions` | Modified | Deprecated in favor of the RBAC CRDs; still reconciled for backward compatibility. | +| REAADB | `spec.globalConfigurations.tags` | Added | Map of tags used to enrich exported metrics for the Active-Active database. | + +## Supported distributions + +Redis Enterprise for Kubernetes is compatible with [CNCF-conformant](https://www.cncf.io/training/certification/software-conformance/) Kubernetes platforms. The operator follows standard Kubernetes APIs and practices and is designed to run consistently across certified Kubernetes environments. + +The following table shows supported Kubernetes versions at the time of this release. For a list of platforms tested with this release, see [Supported Kubernetes distributions]({{< relref "/operate/kubernetes/reference/supported_k8s_distributions" >}}). + +| Kubernetes | **Redis 8.2.0-12** | +|---|---| +| 1.36 | Supported | +| 1.35 | Supported | +| 1.34 | Supported | +| 1.33 | Supported | +| 1.32 | Deprecated | + +## Downloads + +- **Redis Enterprise**: `redislabs/redis:8.2.0-25.12` (`redislabs/redis:8.2.0-25.12.minimal` for minimal base image) +- **Operator**: `redislabs/operator:8.2.0-12` +- **Services Rigger**: `redislabs/k8s-controller:8.2.0-12` +- **Call Home Client**: `redislabs/re-call-home-client:8.2.0-12` + +### OpenShift downloads + +- **OLM operator bundle**: `8.2.0-12.0` +- **Redis Enterprise**: `registry.connect.redhat.com/redislabs/redis-enterprise:8.2.0-25.12` (`registry.connect.redhat.com/redislabs/redis-enterprise:8.2.0-25.12.minimal` for minimal base image) +- **Operator**: `registry.connect.redhat.com/redislabs/redis-enterprise-operator:8.2.0-12` +- **Services Rigger**: `registry.connect.redhat.com/redislabs/services-manager:8.2.0-12` +- **Call Home Client**: `registry.connect.redhat.com/redislabs/call-home-client:8.2.0-12` + +## Known limitations + +- **SSO configuration does not work with IPv6 or dual-stack (IPv4/IPv6) clusters.** + +- **Upgrades from versions earlier than 7.4.2-2 are not supported.** If you use an earlier version, upgrade to 7.4.2-2 before upgrading to this version. + +- **Missing endpoint for admission endpoint (rare).** Restart the operator pod. + +- **The REDB `redisVersion` field cannot be used for memcached databases.** + +- **Modifying the database suffix for an Active-Active database while the services rigger is terminating causes a loop.** The services rigger deletes and recreates ingress or route resources repeatedly. Wait for the services rigger pod to finish terminating before modifying the suffix. + +- **REAADB changes might fail with "gateway timeout" errors, especially on OpenShift.** Retry the operation. + +- **Creating two databases with the same name in the Redis Enterprise Cluster Manager UI deletes the service and makes the database unavailable.** Avoid duplicate database names. The admission controller prevents duplicate names when you create databases through the Kubernetes operator. + +- **Installing the operator bundle produces the warning `Warning: would violate PodSecurity "restricted: v1.24"`.** Ignore this warning. Red Hat documentation identifies this issue as benign. + +- **RERC resources must have a unique name.** The `rec-name/rec-namespace` string must differ from all other participating clusters in the Active-Active database. + +- **Admission does not block REAADB resources with a `shardCount` that exceeds the license quota.** Correct the REAADB configuration and reapply. + +- **The Active-Active controller supports only global database options.** Location-specific configuration is not supported. + +- **Removing an Active-Active setup might leave services or routes undeleted.** Delete the services or routes manually. + +- **Setting `autoUpgrade` to `true` can cause unexpected database upgrades when `redisUpgradePolicy` is also `true`.** Contact support if your deployment is affected. + +- **Using the previous quick start guide causes REDB creation issues due to an unrecognized memory field name.** Use the current version of the Deploy Redis Enterprise Software for Kubernetes guide. + +- **PVC size does not work with decimal values.** Use integer values for the PVC size. + +- **REC might report error states on initial startup.** No workaround exists. Ignore the errors. + +- **HashiCorp Vault integration does not support Gesher.** No workaround exists. Gesher support is deprecated. + +- **REC clusters fail to start on Kubernetes clusters with unsynchronized clocks.** Use NTP to synchronize the underlying Kubernetes nodes. + +- **Deleting an OpenShift project with a deployed REC might hang.** When an REC cluster is deployed in a project (namespace) with REDB resources, you must delete the REDB resources before deleting the REC. The project deletion hangs until you delete the REDB resources. Delete the REDB resources first, then delete the REC, and then delete the project. + +- **Clusters must be named "rec" in OLM-based deployments.** When you deploy the operator through OLM, the security context constraints (SCC) are bound to a specific service account name ("rec"). The deployment fails if the cluster has a different name. + +- **Readiness probe does not correctly report failures.** The StatefulSet readiness probe does not mark a node as "not ready" when running `rladmin status` on node failure. + +- **Internal DNS and Kubernetes DNS might conflict.** DNS conflicts can occur between the cluster `mdns_server` and Kubernetes DNS. This affects only DNS resolution from within cluster nodes for Kubernetes DNS names. + +- **Kubernetes-based 5.4.10 clusters might negatively affect existing 5.4.6 clusters.** Upgrade your clusters to the latest version. + +- **Node CPU usage is reported instead of pod CPU usage.** The reported CPU usage is for the Kubernetes worker node hosting the REC pod, not the pod itself. + +- **An unreachable cluster shows status as running.** When a cluster is unreachable, the status remains `running` instead of showing an error. + +- **Long cluster names cause routes to be rejected.** A cluster name longer than 20 characters causes route rejection because the host part of the domain name exceeds 63 characters. Limit the cluster name to 20 characters or fewer. + +- **Cluster CR (REC) errors are not reported after invalid updates.** A cluster CR specification error is not reported if you update two or more invalid CR resources in sequence. diff --git a/content/operate/kubernetes/release-notes/8-2-0-releases/_index.md b/content/operate/kubernetes/release-notes/8-2-0-releases/_index.md new file mode 100644 index 0000000000..19de8344fd --- /dev/null +++ b/content/operate/kubernetes/release-notes/8-2-0-releases/_index.md @@ -0,0 +1,38 @@ +--- +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Releases with support for Redis Enterprise Software 8.2.0 +hideListLinks: true +linkTitle: 8.2.0 releases +title: Redis Enterprise for Kubernetes 8.2.0 release notes +weight: 83 +--- + +Redis Enterprise for Kubernetes 8.2.0 includes new features, bug fixes, enhancements, and support for Redis Software 8.2.0. The latest release is 8.2.0-12 with support for Redis Software version 8.2.0-25. + +## Detailed release notes + +{{}} + +## Supported distributions + +Redis Enterprise for Kubernetes is compatible with [CNCF-conformant](https://www.cncf.io/training/certification/software-conformance/) Kubernetes platforms. The operator follows standard Kubernetes APIs and practices and is designed to run consistently across certified Kubernetes environments. + +The following table shows supported Kubernetes versions at the time of this release. For a list of platforms tested with this release, see [Supported Kubernetes distributions]({{< relref "/operate/kubernetes/reference/supported_k8s_distributions" >}}). + + + +| Kubernetes | **Redis 8.2.0** | +|---|---| +| 1.36 | Supported | +| 1.35 | Supported | +| 1.34 | Supported | +| 1.33 | Supported | +| 1.32 | Deprecated | + +## Known limitations + +See the [8.2.0-12 (July 2026)]({{}}) release notes for known limitations. From f139fe10071232956805271aeec716763f551dcf Mon Sep 17 00:00:00 2001 From: Kaitlyn Michael Date: Tue, 21 Jul 2026 11:34:06 -0500 Subject: [PATCH 6/7] K8s RBAC: set GA operator version to 8.2.0-12 Replace the stale 8.0.24-TBD placeholder with the confirmed Duckburg GA operator build (8.2.0-12) on the RBAC task pages. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../operate/kubernetes/security/access-control/manage-acls.md | 2 +- .../kubernetes/security/access-control/manage-bindings.md | 2 +- .../operate/kubernetes/security/access-control/manage-roles.md | 2 +- .../operate/kubernetes/security/access-control/manage-users.md | 2 +- .../security/access-control/migrate-rolespermissions.md | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/content/operate/kubernetes/security/access-control/manage-acls.md b/content/operate/kubernetes/security/access-control/manage-acls.md index f405daa526..f9b80b147d 100644 --- a/content/operate/kubernetes/security/access-control/manage-acls.md +++ b/content/operate/kubernetes/security/access-control/manage-acls.md @@ -18,7 +18,7 @@ To grant a user the permissions in an ACL, reference the ACL from a role and bin ## Before you start -- Requires Redis Software for Kubernetes operator 8.0.24-TBD or later. +- Requires Redis Software for Kubernetes operator 8.2.0-12 or later. - The `RedisEnterpriseACL` resource must live in the operator namespace. - The rule string uses Redis ACL syntax — key patterns, command categories, and explicit commands. See [Redis ACL overview]({{< relref "/operate/rs/security/access-control/redis-acl-overview" >}}) for the full syntax. diff --git a/content/operate/kubernetes/security/access-control/manage-bindings.md b/content/operate/kubernetes/security/access-control/manage-bindings.md index 3d91b4df7e..4f480fc0fb 100644 --- a/content/operate/kubernetes/security/access-control/manage-bindings.md +++ b/content/operate/kubernetes/security/access-control/manage-bindings.md @@ -28,7 +28,7 @@ Each binding references exactly one role through `roleRef` and lists up to 100 s ## Before you start -- Requires Redis Software for Kubernetes operator 8.0.24-TBD or later. +- Requires Redis Software for Kubernetes operator 8.2.0-12 or later. - The binding resource, the role it references, and any `RedisEnterpriseUser` subjects must all live in the operator namespace. - Create the role before the binding when possible. The operator still admits a binding that references a missing role — the binding stays unresolved until the role lands. diff --git a/content/operate/kubernetes/security/access-control/manage-roles.md b/content/operate/kubernetes/security/access-control/manage-roles.md index 46292a32d9..1a3e1ba738 100644 --- a/content/operate/kubernetes/security/access-control/manage-roles.md +++ b/content/operate/kubernetes/security/access-control/manage-roles.md @@ -19,7 +19,7 @@ For details on how roles and bindings work together, see [Roles and bindings]({{ ## Before you start -- Requires Redis Software for Kubernetes operator 8.0.24-TBD or later. +- Requires Redis Software for Kubernetes operator 8.2.0-12 or later. - The role resource must live in the operator namespace. Database scopes resolve to REDBs in that namespace. - Decide whether you need [management permissions](#choose-a-management-role), [data-path permissions](#attach-an-acl), or both. - If the role references one or more `RedisEnterpriseACL` resources, create those first. See [Manage ACLs]({{< relref "/operate/kubernetes/security/access-control/manage-acls" >}}). diff --git a/content/operate/kubernetes/security/access-control/manage-users.md b/content/operate/kubernetes/security/access-control/manage-users.md index fdb35b9d10..856383c77f 100644 --- a/content/operate/kubernetes/security/access-control/manage-users.md +++ b/content/operate/kubernetes/security/access-control/manage-users.md @@ -16,7 +16,7 @@ This page covers creating users, changing passwords, and recovering locked accou ## Before you start -- Requires Redis Software for Kubernetes operator 8.0.24-TBD or later. +- Requires Redis Software for Kubernetes operator 8.2.0-12 or later. - The `RedisEnterpriseUser` resource and every referenced password Secret must live in the operator namespace. - Passwords must satisfy the cluster's [password complexity rules]({{< relref "/operate/rs/security/access-control/manage-passwords/password-complexity-rules" >}}). diff --git a/content/operate/kubernetes/security/access-control/migrate-rolespermissions.md b/content/operate/kubernetes/security/access-control/migrate-rolespermissions.md index da811ab0fa..6b950963cd 100644 --- a/content/operate/kubernetes/security/access-control/migrate-rolespermissions.md +++ b/content/operate/kubernetes/security/access-control/migrate-rolespermissions.md @@ -16,7 +16,7 @@ This page covers moving an existing database from `rolesPermissions` to the CRD ## Before you start -- Requires Redis Software for Kubernetes operator 8.0.24-TBD or later. +- Requires Redis Software for Kubernetes operator 8.2.0-12 or later. - Every user who currently holds access through `rolesPermissions` must exist as a `RedisEnterpriseUser` resource before you can bind a CRD role to them. If you created users through the Redis Software REST API or Cluster Manager UI, migrate them first. See [Manage users]({{< relref "/operate/kubernetes/security/access-control/manage-users" >}}). - List which Redis Software users hold each role. The CRD inventory only captures the database side of the assignment; the user-to-role mapping lives in Redis Software. Pull it from the Cluster Manager UI or the [Redis Software users REST API]({{< relref "/operate/rs/references/rest-api/objects/user" >}}). From e307e621747c867b344f81232278bd246c67fa4a Mon Sep 17 00:00:00 2001 From: Kaitlyn Michael Date: Tue, 21 Jul 2026 11:51:47 -0500 Subject: [PATCH 7/7] review edits --- .../api/redis_enterprise_active_active_database_api.md | 4 ++-- .../reference/api/redis_enterprise_cluster_api.md | 4 ++-- .../kubernetes/security/access-control/manage-bindings.md | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/content/operate/kubernetes/reference/api/redis_enterprise_active_active_database_api.md b/content/operate/kubernetes/reference/api/redis_enterprise_active_active_database_api.md index 7e03ddc22c..ab0e5dd090 100644 --- a/content/operate/kubernetes/reference/api/redis_enterprise_active_active_database_api.md +++ b/content/operate/kubernetes/reference/api/redis_enterprise_active_active_database_api.md @@ -241,7 +241,7 @@ Global configurations for the Active-Active database. Contains the global proper evictionPolicy string - Database eviction policy. see more https://docs.redislabs.com/latest/rs/administering/database-operations/eviction-policy/
    + Database eviction policy. See more https://redis.io/docs/latest/rs/administering/database-operations/eviction-policy/
    false @@ -306,7 +306,7 @@ Global configurations for the Active-Active database. Contains the global proper rackAware boolean - Whether database should be rack aware. This improves availability - more information: https://docs.redislabs.com/latest/rs/concepts/high-availability/rack-zone-awareness/
    + Whether database should be rack aware. This improves availability - more information: https://redis.io/docs/latest/rs/concepts/high-availability/rack-zone-awareness/
    false diff --git a/content/operate/kubernetes/reference/api/redis_enterprise_cluster_api.md b/content/operate/kubernetes/reference/api/redis_enterprise_cluster_api.md index 3ccb9e123a..37f5d910f1 100644 --- a/content/operate/kubernetes/reference/api/redis_enterprise_cluster_api.md +++ b/content/operate/kubernetes/reference/api/redis_enterprise_cluster_api.md @@ -263,7 +263,7 @@ RedisEnterpriseClusterSpec defines the desired state of RedisEnterpriseCluster metricsConfig object - Cluster-level configuration for metrics. Currently controls which database tag keys may be exposed as labels on Redis Enterprise metrics.
    + Cluster-level configuration for metrics. Currently controls which database tag keys may be exposed as labels on Redis Software metrics.
    false @@ -1460,7 +1460,7 @@ Address of an LDAP server. ### spec.metricsConfig [↩ Parent](#spec) -Cluster-level configuration for metrics. Currently controls which database tag keys may be exposed as labels on Redis Enterprise metrics. +Cluster-level configuration for metrics. Currently controls which database tag keys may be exposed as labels on Redis Software metrics. diff --git a/content/operate/kubernetes/security/access-control/manage-bindings.md b/content/operate/kubernetes/security/access-control/manage-bindings.md index 4f480fc0fb..b8cfc6f4c0 100644 --- a/content/operate/kubernetes/security/access-control/manage-bindings.md +++ b/content/operate/kubernetes/security/access-control/manage-bindings.md @@ -74,7 +74,7 @@ While the role is missing, the affected user's `RolesBound` condition is `False` kubectl get redisenterpriseuser alice -o jsonpath='{.status.conditions[?(@.type=="RolesBound")]}' ``` -The condition flips to `True` once the missing role exists and reconciles. +The condition flips to `True` after the missing role exists and reconciles. ## Create a cluster role binding @@ -169,5 +169,5 @@ For full field details, see the [`RedisEnterpriseRoleBinding`]({{< relref "/oper ## Related topics - [Roles and bindings]({{< relref "/operate/kubernetes/security/access-control/_index#roles-and-bindings" >}}) — the conceptual model and an end-to-end example. -- [Manage roles]({{< relref "/operate/kubernetes/security/access-control/manage-roles" >}}) — create the roles a binding references. -- [Manage users]({{< relref "/operate/kubernetes/security/access-control/manage-users" >}}) — create the users a binding lists as subjects. +- [Manage roles]({{< relref "/operate/kubernetes/security/access-control/manage-roles" >}}) — create the roles that a binding references. +- [Manage users]({{< relref "/operate/kubernetes/security/access-control/manage-users" >}}) — create the users that a binding lists as subjects.