diff --git a/content/embeds/k8s/openshift_role.md b/content/embeds/k8s/openshift_role.md index ab5dd35cfd..6b62feb4f5 100644 --- a/content/embeds/k8s/openshift_role.md +++ b/content/embeds/k8s/openshift_role.md @@ -176,6 +176,18 @@ rules: - create - delete - watch + - apiGroups: + - gateway.networking.k8s.io + resources: + - tlsroutes + verbs: + - create + - patch + - delete + - list + - update + - get + - watch - apiGroups: - route.openshift.io resources: diff --git a/content/embeds/k8s/rerc.md b/content/embeds/k8s/rerc.md index 0bbe2ca09b..6057d020f4 100644 --- a/content/embeds/k8s/rerc.md +++ b/content/embeds/k8s/rerc.md @@ -19,7 +19,10 @@ spec: # database replication endpoint and replication endpoint SNI. dbFqdnSuffix: -example-new-york-1-ns1.redislabs.com - # The name of the secret containing cluster credentials. + # The name of the secret containing cluster credentials, either basic-auth + # ('username' and 'password' keys) or a client certificate/key pair of a + # cluster user with the proper permissions, optionally with a 'trusted_ca' + # PEM bundle for verifying the cluster's server certificate. # Needs to be formatted as: "redis-enterprise-" secretName: redis-enterprise-new-york-1 ``` diff --git a/content/embeds/k8s/role.md b/content/embeds/k8s/role.md index 7ab9a48de7..daf7e3ed05 100644 --- a/content/embeds/k8s/role.md +++ b/content/embeds/k8s/role.md @@ -176,4 +176,16 @@ rules: - create - delete - watch + - apiGroups: + - gateway.networking.k8s.io + resources: + - tlsroutes + verbs: + - create + - patch + - delete + - list + - update + - get + - watch ``` diff --git a/content/operate/kubernetes/active-active/create-reaadb.md b/content/operate/kubernetes/active-active/create-reaadb.md index 337093aa39..30db82d4c9 100644 --- a/content/operate/kubernetes/active-active/create-reaadb.md +++ b/content/operate/kubernetes/active-active/create-reaadb.md @@ -24,10 +24,12 @@ To create an Active-Active database, make sure you've completed all the followin * Name of each REC (``) * Namespace for each REC (``) -3. Configure the REC [`ingressOrRoutes` field](/content/operate/kubernetes/networking/ingressorroutespec.md) and [create DNS records](/content/operate/kubernetes/networking/ingressorroutespec.md#configure-dns/). +3. Configure the REC [`ingressOrRouteSpec` field](/content/operate/kubernetes/networking/ingressorroutespec.md) and [create DNS records](/content/operate/kubernetes/networking/ingressorroutespec.md#configure-dns/). * REC API hostname (`api--.`) * Database hostname suffix (`.db--.`) + To use the Kubernetes Gateway API instead, see [Expose Active-Active databases](/content/operate/kubernetes/networking/gateway-api.md#expose-active-active-databases). + 4. [Prepare participating clusters](/content/operate/kubernetes/active-active/prepare-clusters.md) * RERC name (`) * RERC secret name (`redis-enterprise-`) @@ -50,6 +52,8 @@ Example RERC (`rerc-raegan`) for the REC named `rec-arlington` in the namespace For more details on RERC fields, see the [RERC API reference](/content/operate/kubernetes/reference/api/redis_enterprise_remote_cluster_api.md). +If you use [Gateway API routing](/content/operate/kubernetes/networking/gateway-api.md#expose-active-active-databases), also set `replicationPort` in each RERC. + 2. Create a Redis Enterprise remote cluster from each RERC custom resource file. ```sh diff --git a/content/operate/kubernetes/active-active/edit-clusters.md b/content/operate/kubernetes/active-active/edit-clusters.md index b1a8da9215..0341dccb1e 100644 --- a/content/operate/kubernetes/active-active/edit-clusters.md +++ b/content/operate/kubernetes/active-active/edit-clusters.md @@ -91,6 +91,8 @@ To communicate with other clusters, all participating clusters need access to th secretName: redis-enterprise-rerc-logan ``` + If your participating clusters use [Gateway API routing](/content/operate/kubernetes/networking/gateway-api.md#expose-active-active-databases), also set `replicationPort` in the RERC. + 1. Create the RERC custom resource. ```sh diff --git a/content/operate/kubernetes/active-active/edit-rerc.md b/content/operate/kubernetes/active-active/edit-rerc.md index acfec81d64..a134348265 100644 --- a/content/operate/kubernetes/active-active/edit-rerc.md +++ b/content/operate/kubernetes/active-active/edit-rerc.md @@ -30,6 +30,8 @@ kubectl patch rerc rerc-ohare --type merge --patch \ '{"spec":{"dbFqdnSuffix": ".example2-cluster-rec-chicago-ns-illinois.example.com"}}' ``` +The `replicationPort` field, used for [Gateway API routing](/content/operate/kubernetes/networking/gateway-api.md#expose-active-active-databases), is an exception. Set it on every copy of the RERC, on every participating cluster, not only on the local RERC. + ## Update RERC secret If the credentials are changed or updated for a REC participating cluster, you need to manually edit the RERC secret and apply it to all participating clusters. diff --git a/content/operate/kubernetes/active-active/prepare-clusters.md b/content/operate/kubernetes/active-active/prepare-clusters.md index 58ca79c27b..57016f3cc8 100644 --- a/content/operate/kubernetes/active-active/prepare-clusters.md +++ b/content/operate/kubernetes/active-active/prepare-clusters.md @@ -21,10 +21,12 @@ Before you prepare your clusters to participate in an Active-Active database, ma * Name of each REC (``) * Namespace for each REC (``) -3. Configure the REC [`ingressOrRoutes` field](/content/operate/kubernetes/networking/ingressorroutespec.md) and [create DNS records](/content/operate/kubernetes/networking/ingressorroutespec.md#configure-dns/). +3. Configure the REC [`ingressOrRouteSpec` field](/content/operate/kubernetes/networking/ingressorroutespec.md) and [create DNS records](/content/operate/kubernetes/networking/ingressorroutespec.md#configure-dns/). * REC API hostname (`api--.`) * Database hostname suffix (`.db--.`) + To use the Kubernetes Gateway API instead, see [Expose Active-Active databases](/content/operate/kubernetes/networking/gateway-api.md#expose-active-active-databases). Gateway API routing also requires `replicationPort` in each RedisEnterpriseRemoteCluster (RERC). + Next you'll [collect credentials](#collect-rec-credentials) for your participating clusters and create secrets for the RedisEnterprsieRemoteCluster (RERC) to use. For a list of example values used throughout this article, see the [Example values](#example-values) section. diff --git a/content/operate/kubernetes/architecture/_index.md b/content/operate/kubernetes/architecture/_index.md index 1382bbd12c..c2f592efde 100644 --- a/content/operate/kubernetes/architecture/_index.md +++ b/content/operate/kubernetes/architecture/_index.md @@ -125,8 +125,9 @@ By default, Kubernetes doesn't allow you to access your Redis database from outs - Ingress controllers [HAProxy](https://haproxy-ingress.github.io/) and [NGINX](https://kubernetes.github.io/ingress-nginx/) require an `ingress` API resource. - [Istio](https://istio.io/latest/docs/setup/getting-started/) requires `Gateway` and `VirtualService` API resources. - OpenShift uses [routes](/content/operate/kubernetes/networking/routes.md) to route external traffic. +- The [Kubernetes Gateway API](/content/operate/kubernetes/networking/gateway-api.md) uses `TLSRoute` resources that the operator attaches to a Gateway you own. -The [Active-Active databases](#active-active-databases) require one of above routing methods to be configured in the REC with the [ingressOrRouteSpec field](/content/operate/kubernetes/reference/api/redis_enterprise_cluster_api.md#specingressorroutespec). +The [Active-Active databases](#active-active-databases) require routing configured in the REC, either with the [ingressOrRouteSpec field](/content/operate/kubernetes/reference/api/redis_enterprise_cluster_api.md#specingressorroutespec) or with [Gateway API routing](/content/operate/kubernetes/networking/gateway-api.md). ## Services Rigger diff --git a/content/operate/kubernetes/flex/_index.md b/content/operate/kubernetes/flex/_index.md index 63211332f8..6687fb6040 100644 --- a/content/operate/kubernetes/flex/_index.md +++ b/content/operate/kubernetes/flex/_index.md @@ -56,14 +56,41 @@ This design delivers predictable latency and throughput as datasets grow beyond ## Compatibility -Flex is compatible with the Redis API and supports all Redis data types, including JSON and probabilistic data structures (Bloom filters, Count-Min Sketch, Top-K). +Flex is compatible with the Redis API and supports all Redis data types, including JSON and probabilistic data structures (Bloom filters, Count-Min Sketch, Top-K). [Redis Search](/content/develop/ai/search-and-query/_index.md) on Flex databases is in preview. See [Redis Search on Flex](#redis-search-on-flex). The following features are not yet supported with Flex: -- Redis Query Engine (RQE) - Time series - Active-Active +## Redis Search on Flex + +Redis Search on Flex stores search indexes on flash, so large indexes don't need to fit in RAM. You use the same Redis Search commands and client libraries as you do with an in-memory database. + +> [!NOTE] +> Redis Search on Flex is in preview and supports a subset of Redis Search features. For supported features and limitations, see [Index and search data in Flex databases](/content/operate/rs/flex/search.md). For command support, see [Redis Search commands](/content/operate/oss_and_stack/stack-with-enterprise/search/commands.md). + +To use Redis Search on Flex, you need Redis Software for Kubernetes version 8.2.6 or later and Redis database version 8.8 or later. + +To turn on Redis Search on Flex, set `searchOnBigstore` and `isRof` to `true` when you create a Flex database: + +```yaml +apiVersion: app.redislabs.com/v1alpha1 +kind: RedisEnterpriseDatabase +metadata: + name: +spec: + memorySize: + isRof: true + rofRamSize: + redisVersion: "8.8" + searchOnBigstore: true +``` + +You can't change `searchOnBigstore` after you create the database. + +Set `rofRamSize` to at least 20% of `memorySize` for databases that use Redis Search on Flex. + ## When to use Flex Use Flex when you need to: diff --git a/content/operate/kubernetes/flex/plan.md b/content/operate/kubernetes/flex/plan.md index bb52ab5010..398c44a646 100644 --- a/content/operate/kubernetes/flex/plan.md +++ b/content/operate/kubernetes/flex/plan.md @@ -82,12 +82,12 @@ Redis Flex supports: - All standard Redis data types - Redis JSON - Redis probabilistic data structures (Bloom filters, Count-Min Sketch, Top-K) +- Redis Search, in preview. See [Redis Search on Flex](/content/operate/kubernetes/flex/_index.md#redis-search-on-flex). ### Not supported Redis Flex doesn't support: -- Redis Query Engine (RQE) - RedisTimeSeries - Active-Active databases diff --git a/content/operate/kubernetes/networking/_index.md b/content/operate/kubernetes/networking/_index.md index fb25199d78..839e5b800d 100644 --- a/content/operate/kubernetes/networking/_index.md +++ b/content/operate/kubernetes/networking/_index.md @@ -29,9 +29,10 @@ Choose the appropriate method for your environment to enable external access: ## Automatic ingress configuration -For Active-Active databases, configure automatic ingress creation: +For Active-Active databases and the cluster API, the operator can create routes for you: - [REC external routing](/content/operate/kubernetes/networking/ingressorroutespec.md) - Use `ingressOrRouteSpec` field in RedisEnterpriseCluster (REC) for automatic ingress creation +- [Gateway API routing](/content/operate/kubernetes/networking/gateway-api.md) - Use the `spec.gateway` field in the REC to attach `TLSRoute` resources to a Kubernetes Gateway that you own. Also exposes the Cluster Manager UI and metrics endpoints. ## `ingressOrRouteSpec` for Active-Active databases diff --git a/content/operate/kubernetes/networking/database-connectivity.md b/content/operate/kubernetes/networking/database-connectivity.md index 158c1af53a..87d1f90204 100644 --- a/content/operate/kubernetes/networking/database-connectivity.md +++ b/content/operate/kubernetes/networking/database-connectivity.md @@ -107,7 +107,7 @@ auth ## External database access -To access databases from outside the Kubernetes cluster, you need to configure external routing. Currently supported methods for external access are ingress controllers or OpenShift routes. +To access databases from outside the Kubernetes cluster, you need to configure external routing. Currently supported methods for external access are ingress controllers or OpenShift routes. Active-Active databases can also use [Gateway API routing](/content/operate/kubernetes/networking/gateway-api.md). ### Ingress controllers diff --git a/content/operate/kubernetes/networking/gateway-api.md b/content/operate/kubernetes/networking/gateway-api.md new file mode 100644 index 0000000000..36359714da --- /dev/null +++ b/content/operate/kubernetes/networking/gateway-api.md @@ -0,0 +1,288 @@ +--- +Title: Route external traffic with Gateway API +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Expose the cluster API, Cluster Manager UI, metrics, and Active-Active databases through a Kubernetes Gateway. +linkTitle: Gateway API routing +weight: 35 +--- + +Redis Software for Kubernetes can expose your RedisEnterpriseCluster (REC) endpoints and Active-Active databases through the [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/). You add a `spec.gateway` section to the REC, and the operator creates a `TLSRoute` for each exposed endpoint and attaches it to a Gateway that you own. The operator never creates or changes the Gateway itself. + +Traffic uses TLS passthrough. The Gateway routes each connection by its Server Name Indication (SNI) hostname and never terminates TLS, so one Gateway listener can serve many endpoints. + +You can expose the following through Gateway API: + +- The cluster API +- The Cluster Manager UI +- The metrics endpoint +- Active-Active databases (REAADB) + +Regular databases (REDB) can't be exposed through Gateway API. To expose them, use [Ingress routing](/content/operate/kubernetes/networking/ingress.md), [Istio ingress routing](/content/operate/kubernetes/networking/istio-ingress.md), or [OpenShift routes](/content/operate/kubernetes/networking/routes.md). + +## Prerequisites + +Before you configure Gateway API routing, you need: + +- Gateway API custom resource definitions (CRDs) version 1.5 or later, installed from the standard channel. The operator requires `TLSRoute` v1, which earlier versions don't provide. +- A Gateway controller that supports `TLSRoute` with TLS passthrough. +- A Gateway with listeners that use protocol `TLS` and TLS mode `Passthrough`. +- Gateway listeners that accept routes from the REC namespace. By default, a listener accepts routes only from the Gateway's own namespace. If the Gateway is in another namespace, set `allowedRoutes.namespaces.from` to `All`, or to `Selector` with a selector that matches the REC namespace. Otherwise, the Gateway rejects every route with reason `NotAllowedByListeners`. +- DNS records that resolve each fully qualified domain name (FQDN) you expose to the Gateway's address. For Active-Active databases, every participating cluster must also be able to resolve these names, because replication traffic uses them. + +The following example shows the listeners of a Gateway that uses one listener for the cluster endpoints and one for databases: + +```yaml +spec: + listeners: + - name: https + port: 443 + protocol: TLS + tls: + mode: Passthrough + allowedRoutes: + namespaces: + from: All + - name: redis-tls + port: + protocol: TLS + tls: + mode: Passthrough + allowedRoutes: + namespaces: + from: All +``` + +## Set cluster-wide defaults + +Use `spec.gateway.default` to set values that every exposed endpoint inherits: + +- `gatewayRef`: The `name` and `namespace` of the Gateway to attach routes to. If you omit `namespace`, the operator uses the REC namespace. +- `fqdnSuffix`: The DNS suffix the operator uses to build each endpoint's hostname. +- `routeLabels` and `routeAnnotations`: Metadata to add to every route. See [Add labels and annotations to routes](#add-labels-and-annotations-to-routes). + +Each endpoint section can set its own `gatewayRef`, which overrides the default. + +## Expose the cluster API, UI, and metrics + +The `spec.gateway.api`, `spec.gateway.ui`, and `spec.gateway.metrics` sections each expose one cluster endpoint. All three are off by default. Each section supports these fields: + +- `enabled`: Set to `true` to expose the endpoint. +- `fqdn`: The endpoint's hostname. If you omit it, the operator uses `api.`, `ui.`, or `metrics.`. +- `listenerName`: The Gateway listener to attach to. It maps to the route's `parentRef.sectionName`. If you omit it, the Gateway controller selects a compatible listener. +- `listenerPort`: The Gateway listener port. It maps to the route's `parentRef.port`. +- `gatewayRef`, `routeLabels`, and `routeAnnotations`: Per-endpoint overrides of the defaults. + +To expose the cluster endpoints: + +1. Create a patch file, replacing the `` with your own values. + + ```yaml + spec: + gateway: + default: + gatewayRef: + name: + namespace: + fqdnSuffix: + api: + enabled: true + listenerName: https + listenerPort: 443 + ui: + enabled: true + listenerName: https + listenerPort: 443 + metrics: + enabled: true + listenerName: https + listenerPort: 443 + ``` + +1. Apply the patch to the REC. + + ```sh + kubectl patch rec --type merge --patch-file + ``` + +1. Confirm that the operator created the routes. They're named `-api`, `-ui`, and `-metrics`. + + ```sh + kubectl get tlsroute -n + ``` + +1. Test access to the cluster API through the Gateway. + + ```sh + curl -k -u ":" https://api./v1/cluster + ``` + + The `-k` option skips certificate verification for this test. The REC admin credentials are stored in a secret named after the REC. See [Connect to the admin console](/content/operate/kubernetes/re-clusters/connect-to-admin-console.md). + +> [!NOTE] +> - The UI endpoint requires the Cluster Manager server. If `spec.servicesConfiguration.cmServer.operatingMode` is set to `disabled`, enabling `spec.gateway.ui` makes the REC spec invalid. +> - Enabling `spec.gateway.metrics` changes the metrics service from a headless service to a ClusterIP service so that the Gateway can route to it. The service stays ClusterIP if you later turn off the metrics endpoint. + +## Expose Active-Active databases + +The `spec.gateway.activeActiveDatabases` section exposes Active-Active databases. Each exposed database gets one route, and that route carries both client traffic and replication traffic between participating clusters. Configure this section on every participating REC. + +The section supports these fields: + +- `autoEnable`: Which Active-Active databases to expose. `None` (the default) exposes none, `All` exposes every Active-Active database on the cluster, and `Selector` exposes databases whose labels match `selector`. +- `selector`: A label selector, required when `autoEnable` is `Selector`. +- `fqdnSuffix`: The DNS suffix for database hostnames. A database's hostname is `.`. If you omit it, the hostname is `.crdb.`. +- `listenerName` and `listenerPort`: The Gateway listener for databases. +- `gatewayRef`, `routeLabels`, and `routeAnnotations`: Overrides of the defaults. + +Active-Active databases are configured only at the REC level. The REAADB has no Gateway settings of its own. + +Each participating cluster needs its own `fqdnSuffix`, so that each database hostname is unique to its cluster and SNI routes it to the right cluster. + +To expose Active-Active databases: + +1. On each participating cluster, patch the REC with an `activeActiveDatabases` section, replacing the `` with your own values. This example also exposes the cluster API, so that participating clusters can reach each other's API through the Gateway. + + ```yaml + spec: + gateway: + default: + gatewayRef: + name: + namespace: + fqdnSuffix: + api: + enabled: true + listenerName: https + listenerPort: 443 + activeActiveDatabases: + autoEnable: Selector + selector: + matchLabels: + : "" + fqdnSuffix: + listenerName: redis-tls + ``` + + ```sh + kubectl patch rec --type merge --patch-file + ``` + +1. Set `spec.replicationPort` on every RedisEnterpriseRemoteCluster (RERC), on every participating cluster. This is typically the same port as the database listener on the Gateway of the cluster that the RERC describes. One port serves all Active-Active databases on that cluster; the Gateway tells them apart by SNI. + + ```sh + kubectl patch rerc --type merge --patch '{"spec":{"replicationPort": }}' + ``` + + Unlike `apiFqdnUrl`, you can edit `replicationPort` on any copy of an RERC, not only on the RERC's local cluster. + +1. If `autoEnable` is `Selector`, label each existing database on every participating cluster. + + ```sh + kubectl label reaadb = + ``` + +1. Confirm that each cluster created a route for the database. The route is named after the database. + + ```sh + kubectl get tlsroute -n + ``` + +A database you create after you enable Gateway exposure needs the label on the cluster where you create it, as long as the following conditions hold: + +- That cluster's RERC for each peer has `replicationPort` set and no `externalReplicationPort`. +- Each peer REC uses `autoEnable: Selector`. + +The operator then creates the route on each peer cluster automatically. + +If the REAADB is in a consumer namespace, its route name and hostname use `-` in place of the database name. + +To test the database, write a key through one cluster's Gateway and read it through another's. Use each cluster's database hostname as both the host and the SNI value. This example uses a client certificate and key, which you need only if the database requires client authentication. The `--insecure` option skips certificate verification for the test. + +```sh +redis-cli --tls --insecure --cert --key \ + --sni -h \ + -p SET + +redis-cli --tls --insecure --cert --key \ + --sni -h \ + -p GET +``` + +## Add labels and annotations to routes + +Use `routeLabels` and `routeAnnotations` to add metadata to the routes the operator creates, for example an annotation that an external DNS controller reads. You can set them in `spec.gateway.default`, in each endpoint section, and in `spec.gateway.activeActiveDatabases`. Values in an endpoint section are merged over the defaults and win on key conflicts. + +```yaml +spec: + gateway: + api: + enabled: true + routeAnnotations: + external-dns.alpha.kubernetes.io/hostname: api. +``` + +Labels the operator manages always take precedence over your labels. The operator doesn't apply labels with the keys `role` or `bdb`. + +## Check route status + +The REC status reports each cluster endpoint under `status.gateway.api`, `status.gateway.ui`, and `status.gateway.metrics`, with the endpoint's `fqdn`, `routeName`, and `conditions`. + +```sh +kubectl describe rec +``` + +A healthy endpoint has a condition of type `Ready` with status `True` and reason `RouteReady`, and the message `TLSRoute is accepted and its backend references are resolved`. + +For Active-Active databases, the REAADB status shows the endpoint each participating cluster advertises to its peers, under `status.participatingClusters[].replicationEndpoint`. A cluster that uses Gateway API advertises `:`. + +```sh +kubectl get reaadb -o jsonpath='{.status.participatingClusters}' +``` + +Events with reason `GatewayEndpointCutover` on the REAADB show when a cluster is waiting for its route to be accepted and when it switches its advertised endpoint to the Gateway. + +```sh +kubectl get events --field-selector involvedObject.name= +``` + +## Troubleshooting + +| What you see | What it means | What to do | +| --- | --- | --- | +| REC endpoint condition reason `RoutePending`, message `Waiting for the Gateway controller to report route readiness` | The route exists, but the Gateway controller hasn't reported on it yet. | Check that `gatewayRef` names an existing Gateway and that your Gateway controller is running. | +| REC endpoint condition reason `RouteNotReady`, or a reason reported by the Gateway controller | The Gateway didn't accept the route, or the route's backend didn't resolve. | Check the route's `Accepted` and `ResolvedRefs` conditions with `kubectl get tlsroute -o yaml`. | +| REC spec is invalid, with a message that names a `spec.gateway` field | A `spec.gateway` setting can't be resolved, for example an enabled endpoint with no hostname or no Gateway. | Fix the field the message names. | +| REC endpoint condition reason `RouteReconcileFailed` | The operator couldn't create or update the route. | Read the condition message for the cause. | +| REC endpoint condition reason `GatewayAPIUnavailable`, message `Gateway API TLSRoute v1 is not available; the operator requires Gateway API >= 1.5 (standard channel)` | The `TLSRoute` v1 CRD isn't installed. | Install Gateway API CRDs version 1.5 or later from the standard channel. | +| REAADB warning event reason `ParticipatingClusterRERCStatus`, message ending `does not set spec.replicationPort; gateway exposure is pending` | The database is selected for Gateway exposure, but an RERC has no `replicationPort`. If the database has an existing exposure method, it keeps serving through it. If it has none, this is an error. | Set `spec.replicationPort` on every RERC, on every participating cluster. | +| REAADB warning event reason `MissingOrInvalidLinkedRERC`, or a rejected `kubectl apply`, with a message containing `equals the legacy dbFqdnSuffix-derived FQDN` | During migration, the database's Gateway hostname is the same as its existing hostname, so the two can't be told apart. | Set `spec.gateway.activeActiveDatabases.fqdnSuffix` to a suffix that differs from the RERC `dbFqdnSuffix`. | +| REAADB warning event reason `MissingOrInvalidLinkedRERC`, or a rejected `kubectl apply`, with a message containing `refusing to tear down the gateway route` | You turned off Gateway exposure for a database on a cluster that has no other way to expose it. The route stays in place so replication keeps working. | Select the database for Gateway exposure again, or configure another exposure method on that cluster first. | + +## Migrate from ingressOrRouteSpec + +Gateway API routing works alongside an existing [`ingressOrRouteSpec`](/content/operate/kubernetes/networking/ingressorroutespec.md) configuration, so you can migrate without downtime. Both methods serve traffic during the migration, and each cluster switches each database to the Gateway only after its route is ready. Clusters switch independently. + +1. Upgrade the operator on all participating clusters. + +1. Set `spec.replicationPort` on every RERC, on every participating cluster. + +1. On each REC, add `spec.gateway`. Use `autoEnable: Selector` to migrate one database at a time, or `All` to migrate every database. The Gateway hostnames must differ from your existing `dbFqdnSuffix` hostnames. + +1. If you use `Selector`, label each database on every participating cluster. + +1. Wait for each cluster to switch. A `GatewayEndpointCutover` event marks the switch, and the REAADB `replicationEndpoint` changes to the Gateway hostname. Move your Redis clients to the Gateway hostnames at any time; both methods serve traffic. + +1. To move the API traffic between participating clusters, expose the cluster API through the Gateway. Then, one cluster at a time, update `apiFqdnUrl` in that cluster's local RERC to its Gateway API hostname. Wait for the REAADBs to return to `active` before you update the next cluster. + +1. Remove `spec.ingressOrRouteSpec` from the REC last. + +> [!WARNING] +> Removing `spec.ingressOrRouteSpec` deletes every Ingress or route the operator created for the REC at once, including the API route and every database route. Remove it only after all clients and participating clusters use the Gateway hostnames. + +To roll back a database before you remove `spec.ingressOrRouteSpec`, remove its label, or set `autoEnable` to `None`. The operator deletes the database's route and returns to advertising the existing endpoint. + +If a cluster exposes Active-Active databases through load balancer services with `externalReplicationPort` instead of `ingressOrRouteSpec`, you can migrate the same way. Keep `externalReplicationPort` set while the Gateway route becomes ready, and remove it after the cluster switches. This works only while the REC's `spec.servicesRiggerSpec.databaseServiceType` includes `load_balancer`. A REC with `ingressOrRouteSpec` can't combine `externalReplicationPort` with Gateway exposure. diff --git a/content/operate/kubernetes/networking/ingress.md b/content/operate/kubernetes/networking/ingress.md index 009b412912..5d0668fb0c 100644 --- a/content/operate/kubernetes/networking/ingress.md +++ b/content/operate/kubernetes/networking/ingress.md @@ -14,6 +14,8 @@ weight: 5 > [!WARNING] > The community [Ingress-NGINX controller](https://github.com/kubernetes/ingress-nginx) (`kubernetes/ingress-nginx`) is retired. Best-effort maintenance ended in March 2026 and the project no longer ships releases, bug fixes, or security updates. If you are not already using it, use HAProxy or Istio as shown below. +To expose Active-Active databases and cluster endpoints through the Kubernetes Gateway API, see [Gateway API routing](/content/operate/kubernetes/networking/gateway-api.md). + ## Prerequisites Before creating an Ingress, you'll need: diff --git a/content/operate/kubernetes/networking/ingressorroutespec.md b/content/operate/kubernetes/networking/ingressorroutespec.md index c1bb7f0afa..324490623f 100644 --- a/content/operate/kubernetes/networking/ingressorroutespec.md +++ b/content/operate/kubernetes/networking/ingressorroutespec.md @@ -14,6 +14,8 @@ An Ingress is an API resource that provides a standardized and flexible way to m > [!WARNING] > The community [Ingress-NGINX controller](https://github.com/kubernetes/ingress-nginx) (`kubernetes/ingress-nginx`) is retired. Best-effort maintenance ended in March 2026 and the project no longer ships releases, bug fixes, or security updates. If you are not already using it, use HAProxy or Istio. +To use the Kubernetes Gateway API instead, see [Gateway API routing](/content/operate/kubernetes/networking/gateway-api.md). It covers [migrating from `ingressOrRouteSpec`](/content/operate/kubernetes/networking/gateway-api.md#migrate-from-ingressorroutespec) without downtime. + ## Install Ingress controller Redis Enterprise for Kubernetes supports the Ingress controllers below: diff --git a/content/operate/kubernetes/networking/routes.md b/content/operate/kubernetes/networking/routes.md index ea74ebca6a..b009f8cd5c 100644 --- a/content/operate/kubernetes/networking/routes.md +++ b/content/operate/kubernetes/networking/routes.md @@ -12,6 +12,8 @@ weight: 15 OpenShift routes allow requests to be routed to the database or cluster API from outside the cluster. For more information about routes, see [OpenShift documentation](https://docs.openshift.com/container-platform/4.13/networking/routes/route-configuration.html). +To expose Active-Active databases and cluster endpoints through the Kubernetes Gateway API, see [Gateway API routing](/content/operate/kubernetes/networking/gateway-api.md). + ## Prerequisites * Before you can connect to your database from outside the cluster, you'll need the root CA certificate of the DMC Proxy server to validate the server certificate. diff --git a/content/operate/kubernetes/re-clusters/_index.md b/content/operate/kubernetes/re-clusters/_index.md index 7f410a3acf..db9fa9c317 100644 --- a/content/operate/kubernetes/re-clusters/_index.md +++ b/content/operate/kubernetes/re-clusters/_index.md @@ -23,6 +23,30 @@ Manage your Redis Enterprise cluster lifecycle and configuration: - [Multi-namespace deployment](/content/operate/kubernetes/re-clusters/multi-namespace.md) - Deploy clusters across multiple Kubernetes namespaces - [Delete custom resources](/content/operate/kubernetes/re-clusters/delete-custom-resources.md) - Safely remove REC and related resources +### Disconnect clients on password removal + +Redis Software 8.0.2 and later can actively disconnect client connections that authenticated with a removed, revoked, or rotated password. In Redis Software, you configure this setting through the REST API. See the [cluster object](/content/operate/rs/references/rest-api/objects/cluster/_index.md) and [database (`bdb`) object](/content/operate/rs/references/rest-api/objects/bdb/_index.md). Starting with operator version X.Y.Z, the operator configures it through the custom resources instead: + + + +- Cluster-wide policy: `spec.disconnectClientsOnPasswordRemoval` on the REC (`Enabled`, `Disabled`, or `Auto`). +- Per-database setting: `spec.disconnectClientsOnPasswordRemoval` on the [REDB](/content/operate/kubernetes/re-databases/db-controller.md#disconnect-clients-on-password-removal) (boolean; the Redis Software default is `false`). Takes effect only when the cluster-wide policy is `Auto`. +- Active-Active databases: `spec.globalConfigurations.disconnectClientsOnPasswordRemoval` on the REAADB, propagated to all participating clusters. See [Set global database configurations](/content/operate/kubernetes/active-active/global-config.md). Takes effect when the cluster-wide policy on the participating clusters is `Auto`. + +Set the cluster-wide policy in your REC specification: + +```yaml +spec: + disconnectClientsOnPasswordRemoval: Enabled +``` + +Allowed values are `Enabled`, `Disabled`, and `Auto`. `Auto` (the Redis Software default) defers the decision to each database's own setting. `Enabled` and `Disabled` force the behavior for all databases in the cluster, ignoring the per-database setting. + +Whether the operator owns the setting depends on your upgrade path: + +- Resources **created by operator version X.Y.Z or later**: the operator owns the setting from creation. Configure it only through the custom resource. Changes made through the Redis Software REST API or admin console are reverted the next time the operator reconciles the resource. Removing the field from the spec reverts the setting to its Redis Software default (`Auto` for the cluster, `false` for a database); it does not keep the last value. +- Resources **that existed before you upgraded to operator version X.Y.Z**: values configured through the Redis Software REST API are preserved. The operator takes ownership only once you set the field in the custom resource. From then on, ownership is permanent. If you later remove the field, the setting reverts to the Redis Software default, not to the previously configured value. + ## Storage and performance Optimize storage and performance for your Redis Enterprise cluster: diff --git a/content/operate/kubernetes/re-clusters/connect-to-admin-console.md b/content/operate/kubernetes/re-clusters/connect-to-admin-console.md index 91e00afd44..489753c390 100644 --- a/content/operate/kubernetes/re-clusters/connect-to-admin-console.md +++ b/content/operate/kubernetes/re-clusters/connect-to-admin-console.md @@ -14,7 +14,7 @@ weight: 10 The username and password for the Redis Enterprise Software [admin console](/content/operate/rs/_index.md) are stored in a Kubernetes [secret](https://kubernetes.io/docs/concepts/configuration/secret/). After retrieving your credentials, you can use port forwarding to connect to the admin console. > [!NOTE] -> There are several methods for accessing the admin console. Port forwarding is the simplest, but not the most efficient method for long-term use. You could also use a load balancer service or Ingress. +> There are several methods for accessing the admin console. Port forwarding is the simplest, but not the most efficient method for long-term use. You could also use a load balancer service, Ingress, or [Gateway API routing](/content/operate/kubernetes/networking/gateway-api.md#expose-the-cluster-api-ui-and-metrics). 1. Switch to the namespace with your Redis Enterprise cluster (REC). diff --git a/content/operate/kubernetes/re-databases/db-controller.md b/content/operate/kubernetes/re-databases/db-controller.md index 4e05971662..7648a2d2a3 100644 --- a/content/operate/kubernetes/re-databases/db-controller.md +++ b/content/operate/kubernetes/re-databases/db-controller.md @@ -99,6 +99,23 @@ To modify the database: To add tags to a database and expose them as metric labels, see [Enrich database metrics with tags](/content/operate/kubernetes/re-databases/enrich-metrics-with-tags.md). +## Disconnect clients on password removal + +Redis Software can actively disconnect client connections that authenticated with a removed, revoked, or rotated password. The per-database setting applies only when the [cluster-wide policy](/content/operate/kubernetes/re-clusters/_index.md#disconnect-clients-on-password-removal) is `Auto`; if the cluster policy is `Enabled` or `Disabled`, that value applies to every database in the cluster. This setting requires Redis Software 8.0.2 or later; configuring it through the custom resource requires operator version X.Y.Z or later. + + + +Set the per-database value in your REDB specification: + +```yaml +spec: + disconnectClientsOnPasswordRemoval: true +``` + +The Redis Software default for a database is `false`. See the [Redis Software REST API database (`bdb`) object](/content/operate/rs/references/rest-api/objects/bdb/_index.md) for details about the underlying setting. + +For when the operator takes ownership of this setting, and how to configure it for Active-Active databases, see [Disconnect clients on password removal](/content/operate/kubernetes/re-clusters/_index.md#disconnect-clients-on-password-removal). Once the operator owns the setting, configure it only through the REDB specification; removing the field reverts the database to `false`. + ## Delete a database The database exists as long as the custom resource exists. diff --git a/content/operate/kubernetes/reference/api/redis_enterprise_active_active_database_api.md b/content/operate/kubernetes/reference/api/redis_enterprise_active_active_database_api.md index ab0e5dd090..a90a6b5886 100644 --- a/content/operate/kubernetes/reference/api/redis_enterprise_active_active_database_api.md +++ b/content/operate/kubernetes/reference/api/redis_enterprise_active_active_database_api.md @@ -181,6 +181,17 @@ Global configurations for the Active-Active database. Contains the global proper Database auditing configuration.
false + + authorizedSubjects + []object + + Client certificate subjects authorized to connect when clientCertSubjectValidationType is +'SanCn' or 'FullSubject', which require at least one entry. Maps to the database's +'authorized_subjects' setting. Subject attributes are case-sensitive. +If neither field was ever set, the operator leaves the database setting unchanged; otherwise +an omitted value means an empty list (see status.managedFields).
+ + false backup object @@ -195,6 +206,24 @@ Global configurations for the Active-Active database. Contains the global proper The Secrets containing TLS Client Certificate to use for Authentication
false + + clientCertSubjectValidationType + enum + + Additional validation of client certificate subjects during mutual TLS authentication. +Maps to the database's 'client_cert_subject_validation_type' setting. +'Disabled' performs no subject validation; 'SanCn' requires the certificate's Subject +Alternative Name (SAN) DNS entries or Common Name (CN) to match an authorizedSubjects entry; +'FullSubject' requires the full certificate subject to match an entry. +Applies only to client certificates validated through a CA certificate listed in +clientAuthenticationCertificates; listed leaf certificates skip this validation. +Required when authorizedSubjects is set. If neither field was ever set, the operator leaves +the database setting unchanged; otherwise an omitted value means 'Disabled' +(see status.managedFields).
+
+ Enum: Disabled, SanCn, FullSubject
+ + false connectionSettings object @@ -237,11 +266,18 @@ Global configurations for the Active-Active database. Contains the global proper Is connecting with a default user allowed? If disabled, the DatabaseSecret will not be created or updated
false + + disconnectClientsOnPasswordRemoval + boolean + + Controls whether the proxy disconnects clients of this database whose password was removed. Effective only when the cluster-level setting is "Auto" (see the RedisEnterpriseCluster field of the same name). The operator takes ownership of this BDB setting once the field is set (recorded in status.managedFields); removing the field afterwards resets the BDB to the false default. Requires Redis Enterprise 8.0 or newer.
+ + false evictionPolicy string - Database eviction policy. See more https://redis.io/docs/latest/rs/administering/database-operations/eviction-policy/
+ Database eviction policy. see more https://docs.redislabs.com/latest/rs/administering/database-operations/eviction-policy/
false @@ -306,7 +342,7 @@ Global configurations for the Active-Active database. Contains the global proper rackAware boolean - Whether database should be rack aware. This improves availability - more information: https://redis.io/docs/latest/rs/concepts/high-availability/rack-zone-awareness/
+ Whether database should be rack aware. This improves availability - more information: https://docs.redislabs.com/latest/rs/concepts/high-availability/rack-zone-awareness/
false @@ -323,6 +359,13 @@ Global configurations for the Active-Active database. Contains the global proper Redis OSS version. Version can be specified via prefix, or via channels - for existing databases - Upgrade Redis OSS version. For new databases - the version which the database will be created with. If set to 'major' - will always upgrade to the most recent major Redis version. If set to 'latest' - will always upgrade to the most recent Redis version. Depends on 'redisUpgradePolicy' - if you want to set the value to 'latest' for some databases, you must set redisUpgradePolicy on the cluster before. Possible values are 'major' or 'latest' When using upgrade - make sure to backup the database before. This value is used only for database type 'redis'. Note - Specifying Redis version is currently not supported for Active-Active database.
false + + replicaReadOnly + boolean + + Boolean (default: false); If true, enables an Active-Passive setup where Replica Of databases only allow read operations. Only configurable during database creation and cannot be changed later.
+ + false replicaSources []object @@ -382,6 +425,13 @@ Global configurations for the Active-Active database. Contains the global proper Number of database server-side shards
false + + sharding + object + + Sharding-related configuration. The number of shards and their placement are controlled by the existing top-level shardCount and shardsPlacement. Not supported for Active-Active databases.
+ + false shardingEnabled boolean @@ -1098,6 +1148,66 @@ If both dbConnsAuditing and auditMode are set, auditMode takes precedence.
+### spec.globalConfigurations.authorizedSubjects[] +[↩ Parent](#specglobalconfigurations) + +An X.509 certificate subject (distinguished name) authorized to authenticate using a client certificate. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
CNstring + Common Name (CN) component of the certificate subject. Required.
+ 		true
Cstring + Country (C) component of the certificate subject.
+ 		false
Lstring + Locality (L) component of the certificate subject.
+ 		false
Ostring + Organization (O) component of the certificate subject.
+ 		false
OU[]string + Organizational Unit (OU) components of the certificate subject.
+ 		false
STstring + State or province (ST) component of the certificate subject.
+ 		false
+ + ### spec.globalConfigurations.backup [↩ Parent](#specglobalconfigurations) @@ -1679,6 +1789,93 @@ Redis Enterprise Role and ACL Binding +### spec.globalConfigurations.sharding +[↩ Parent](#specglobalconfigurations) + +Sharding-related configuration. The number of shards and their placement are controlled by the existing top-level shardCount and shardsPlacement. Not supported for Active-Active databases. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
asmScalingboolean + Enables smooth scaling via Atomic Slot Migration: shardCount then accepts any value, in any direction, including decreasing the count. Requires autoShardsBalancing. Not supported for Active-Active or Redis-on-Flash databases.
+ 		false
autoShardsBalancingboolean + Enables RS shard balancing for this database, including background auto-rebalancing: RS may move data between shards on its own whenever their imbalance exceeds the configured thresholds, see autoShardsBalancingSettings. Requires hashingPolicy OssSharding and a database Redis version of 8.4 or above. Note: enabling this also turns on the database's internal cluster mode (redis_cluster_enabled), which RS requires for balancing. Cluster mode stays on when balancing is disabled again - RS won't allow disabling it once the database has shards with split slot ranges.
+ 		false
autoShardsBalancingSettingsobject + Optional tuning of autoShardsBalancing. Every field has a default, which is used both when the settings are absent and when an individual field is unset. The settings are ignored while autoShardsBalancing is off.
+ 		false
hashingPolicyenum + Hashing policy for a sharded database. Defaults to ShardKeyRegex (regex-based hashing) when absent. Note: once the database has shards with split slot ranges, RS won't allow reverting from OssSharding back to ShardKeyRegex.
+
+ Enum: ShardKeyRegex, OssSharding
+ 		false
+ + +### spec.globalConfigurations.sharding.autoShardsBalancingSettings +[↩ Parent](#specglobalconfigurationssharding) + +Optional tuning of autoShardsBalancing. Every field has a default, which is used both when the settings are absent and when an individual field is unset. The settings are ignored while autoShardsBalancing is off. + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
gracePeriodSecondsinteger + The imbalance must persist for this long before a rebalance starts. Defaults to 120 when unset.
+ 		false
shardImbalanceThresholdint or string + Rebalance only when a shard deviates from its ideal size by at least this much. The effective trigger is the larger of this and shardImbalanceThresholdPercentage. Defaults to 300Mi when unset. Values below the Redis Enterprise minimum (50Mi) are rejected by the cluster.
+ 		false
shardImbalanceThresholdPercentageinteger + Rebalance only when a shard deviates from its ideal size by at least this percent. The effective trigger is the larger of this and shardImbalanceThreshold. Defaults to 20 when unset.
+ 		false
+ + ### spec.globalConfigurations.upgradeSpec [↩ Parent](#specglobalconfigurations) @@ -1773,6 +1970,13 @@ Defines the observed state of RedisEnterpriseActiveActiveDatabase. List of linked REDBs.
false + + managedFields + []string + + List of optional global-configuration spec fields the operator has taken ownership of after the user configured them at least once, so removing such a field resets the databases to their default instead of leaving the inherited value in place.
+ + false managedTags []string @@ -1858,6 +2062,16 @@ The status of a participating cluster. Format: int64
false + + replicationEndpoint + string + + The replication endpoint this participating cluster advertises to its +peers, as configured in the Active-Active database. When the database is +exposed via the Gateway API this is the gateway FQDN and port; otherwise +it is derived from the remote cluster's dbFqdnSuffix.
+ + false replicationStatus enum diff --git a/content/operate/kubernetes/reference/api/redis_enterprise_cluster_api.md b/content/operate/kubernetes/reference/api/redis_enterprise_cluster_api.md index 37f5d910f1..6f0a9db827 100644 --- a/content/operate/kubernetes/reference/api/redis_enterprise_cluster_api.md +++ b/content/operate/kubernetes/reference/api/redis_enterprise_cluster_api.md @@ -103,6 +103,25 @@ RedisEnterpriseClusterSpec defines the desired state of RedisEnterpriseCluster Additional antiAffinity terms in order to support installation on different zones/vcenters
false + + apiBasicAuth + object + + Configures basic (username/password) authentication for the Redis Enterprise REST API.
+ + false + + apiCertificateBasedAuth + object + + Configures Certificate-Based Authentication (CBA), i.e. mutual TLS client +certificate authentication, for the Redis Enterprise control-plane REST API. +This setting is additive on the server side: enabling it makes client certificates +an accepted authentication method for connecting to the control plane, in addition +to basic/digest authentication, unless basic authentication is explicitly turned +off via apiBasicAuth.
+ + false auditing object @@ -138,6 +157,13 @@ RedisEnterpriseClusterSpec defines the desired state of RedisEnterpriseCluster RS Cluster Certificates. Used to modify the certificates used by the cluster. See the "RSClusterCertificates" struct described above to see the supported certificates.
false + + clientMaintenanceNotifications + object + + Controls proactive client maintenance notification settings.
+ + false clusterCredentialSecretName string @@ -189,6 +215,15 @@ RedisEnterpriseClusterSpec defines the desired state of RedisEnterpriseCluster Internode encryption (INE) cluster wide policy. An optional boolean setting. Specifies if INE should be on/off for new created REDBs. May be overridden for specific REDB via similar setting, please view the similar setting for REDB for more info.
false + + disconnectClientsOnPasswordRemoval + enum + + Controls whether the proxy disconnects clients whose password was removed. Tri-state; the operator only writes this value when status.managedAPIs.disconnectClientsOnPasswordRemoval is true (it flips true the first time this field is set). On new clusters the operator manages this field from creation and enforces the Auto default until the spec is set.
+
+ Enum: Enabled, Disabled, Auto
+ + false dmcExternalCBAAuthentication boolean @@ -224,6 +259,14 @@ RedisEnterpriseClusterSpec defines the desired state of RedisEnterpriseCluster Labels that the user defines for their convenience
false + + gateway + object + + Configures exposure of cluster service endpoints and Active-Active databases via +the Kubernetes Gateway API.
+ + false hostAliases []object @@ -263,7 +306,7 @@ RedisEnterpriseClusterSpec defines the desired state of RedisEnterpriseCluster metricsConfig object - Cluster-level configuration for metrics. Currently controls which database tag keys may be exposed as labels on Redis Software metrics.
+ Cluster-level configuration for metrics. Currently controls which database tag keys may be exposed as labels on Redis Enterprise metrics.
false @@ -289,6 +332,15 @@ RedisEnterpriseClusterSpec defines the desired state of RedisEnterpriseCluster An API object that represents the cluster's OCSP configuration. To enable OCSP, the cluster's proxy certificate should contain the OCSP responder URL.
false + + operatorClientAuth + object + + Selects which credential the operator presents to the control-plane REST API. +This is a client-side concern: it does not, by itself, configure the cluster to +accept certificates (see apiCertificateBasedAuth).
+ + false ossClusterSettings object @@ -671,6 +723,170 @@ Specification for ActiveActive setup. At most one of ingressOrRouteSpec or activ +### spec.apiBasicAuth +[↩ Parent](#spec) + +Configures basic (username/password) authentication for the Redis Enterprise REST API. + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
enabledboolean + Whether the Redis Enterprise cluster accepts basic (username/password) authentication +on its REST API. Maps to the cluster's 'control_plane_basic_authentication' setting +and requires Redis Enterprise 8.2.0 or newer. When set to false, the cluster rejects +passwords on all REST API requests; only certificate-based (mTLS) and JWT +authentication are accepted, and the operator itself must be configured to use +certificate authentication (operatorClientAuth.method: Certificate). The operator +applies this setting only after verifying that certificate authentication is fully in +effect, to avoid losing access to the cluster. When unset, the operator does not +manage this cluster setting.
+ 		false
+ + +### spec.apiCertificateBasedAuth +[↩ Parent](#spec) + +Configures Certificate-Based Authentication (CBA), i.e. mutual TLS client +certificate authentication, for the Redis Enterprise control-plane REST API. +This setting is additive on the server side: enabling it makes client certificates +an accepted authentication method for connecting to the control plane, in addition +to basic/digest authentication, unless basic authentication is explicitly turned +off via apiBasicAuth. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
authorizedSubjects[]object + The list of certificate subjects authorized to authenticate to the control-plane +REST API using client certificates. Maps to the cluster's 'mtls_authorized_subjects' +setting. The subject declared in operatorClientAuth.certificateSubjectLine is +added automatically and need not be listed here.
+ 		false
clientCertSubjectValidationTypeenum + Determines how the Redis Enterprise cluster validates the subject of client +certificates presented for authentication. Maps to the cluster's +'mtls_client_cert_subject_validation_type' setting. +'Disabled' performs no subject validation; 'SanCn' validates the Subject Alternative +Name / Common Name; 'FullSubject' validates the full certificate subject.
+
+ Enum: Disabled, SanCn, FullSubject
+ 		false
enabledboolean + Whether the control-plane REST API accepts client certificate authentication. +Maps to the Redis Enterprise cluster's 'mtls_certificate_authentication' setting. +Evaluated as false when omitted while the operator manages CBA (see +status.managedAPIs); if CBA was never configured through this block, the +cluster setting is left unchanged. +Possible values: true/false
+ 		false
trustedCASecretNamestring + Name or path of the secret containing the trusted CA used to validate client +certificates presented to the control-plane REST API. The CA certificate is pushed +to the Redis Enterprise cluster as 'mtls_trusted_ca'. +The secret must contain the CA certificate in PEM format under a key named +'certificate', 'cert', or 'tls.crt'.
+ 		false
+ + +### spec.apiCertificateBasedAuth.authorizedSubjects[] +[↩ Parent](#specapicertificatebasedauth) + +CertificateSubject identifies an X.509 certificate subject (distinguished name) that is +authorized to authenticate to the control plane using a client certificate. Field names +follow standard X.509 distinguished name (DN) component abbreviations. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
CNstring + Common Name (CN) component of the certificate subject. Required.
+ 		true
Cstring + Country (C) component of the certificate subject.
+ 		false
Lstring + Locality (L) component of the certificate subject.
+ 		false
Ostring + Organization (O) component of the certificate subject.
+ 		false
OU[]string + Organizational Unit (OU) components of the certificate subject.
+ 		false
STstring + State or province (ST) component of the certificate subject.
+ 		false
+ + ### spec.auditing [↩ Parent](#spec) @@ -957,14 +1173,14 @@ RS Cluster Certificates. Used to modify the certificates used by the cluster. Se cpInternodeEncryptionCertificateSecretName string - Secret name to use for cluster's Control Plane Internode Encryption (CPINE) certificate. The secret must have the following keys - A key named 'certificate'/'cert'/'tls.crt' with the value of the certificate in PEM format. A key named 'key'/'tls.key' with the value of the private key. Optionally, a key named 'ca.crt', containing the public certificate of the root CA. If present, the root CA certificate is appended to the certificate provided in the 'tls.crt' (or equivalent) key, to form a full certificate chain. Otherwise, the certificate in 'tls.crt' must include a full certificate chain inline. This key is typically populated by the cert-manager when it has access to the root certificate. Otherwise, it could be added manually. If left blank, a cluster-provided certificate will be used.
+ Secret name to use for cluster's Control Plane Internode Encryption (CPINE) certificate. The secret must have the following keys - A key named 'certificate'/'cert'/'tls.crt' with the value of the certificate in PEM format. A key named 'key'/'tls.key' with the value of the private key. Optionally, a key named 'ca.crt', containing the public certificate of the root CA. If present, the root CA certificate is appended to the certificate provided in the 'tls.crt' (or equivalent) key, to form a full certificate chain. Otherwise, the certificate in 'tls.crt' must include a full certificate chain inline. This key is typically populated by the cert-manager when it has access to the root certificate. Otherwise, it could be added manually. If left blank and dpInternodeEncryptionCertificateSecretName is set, the DPINE certificate is used for CPINE as well. If both are left blank, cluster-provided certificates are used.
false dpInternodeEncryptionCertificateSecretName string - Secret name to use for cluster's Data Plane Internode Encryption (DPINE) certificate. The secret must have the following keys - A key named 'certificate'/'cert'/'tls.crt' with the value of the certificate in PEM format. A key named 'key'/'tls.key' with the value of the private key. Optionally, a key named 'ca.crt', containing the public certificate of the root CA. If present, the root CA certificate is appended to the certificate provided in the 'tls.crt' (or equivalent) key, to form a full certificate chain. Otherwise, the certificate in 'tls.crt' must include a full certificate chain inline. This key is typically populated by the cert-manager when it has access to the root certificate. Otherwise, it could be added manually. If left blank, a cluster-provided certificate will be used.
+ Secret name to use for cluster's Data Plane Internode Encryption (DPINE) certificate. The secret must have the following keys - A key named 'certificate'/'cert'/'tls.crt' with the value of the certificate in PEM format. A key named 'key'/'tls.key' with the value of the private key. Optionally, a key named 'ca.crt', containing the public certificate of the root CA. If present, the root CA certificate is appended to the certificate provided in the 'tls.crt' (or equivalent) key, to form a full certificate chain. Otherwise, the certificate in 'tls.crt' must include a full certificate chain inline. This key is typically populated by the cert-manager when it has access to the root certificate. Otherwise, it could be added manually. If left blank and cpInternodeEncryptionCertificateSecretName is set, the CPINE certificate is used for DPINE as well. If both are left blank, cluster-provided certificates are used.
false @@ -1013,10 +1229,10 @@ RS Cluster Certificates. Used to modify the certificates used by the cluster. Se -### spec.containerTimezone +### spec.clientMaintenanceNotifications [↩ Parent](#spec) -Container timezone configuration. While the default timezone on all containers is UTC, this setting can be used to set the timezone on services rigger/bootstrapper/RS containers. You can either propagate the hosts timezone to RS pods or set it manually via timezoneName. +Controls proactive client maintenance notification settings. @@ -1028,27 +1244,27 @@ Container timezone configuration. While the default timezone on all containers i - + - - + +
propagateHostossMode object - Identifies that container timezone should be in sync with the host, this option mounts a hostPath volume onto RS pods that could be restricted in some systems.
+ Client maintenance notifications settings for clients connected to databases with OSS cluster API enabled.
 false
timezoneNamestringproxyModeobject - POSIX-style timezone name as a string to be passed as EnvVar to RE pods, e.g. "Europe/London".
+ Client maintenance notifications settings for clients connected to databases running in enterprise (proxy) mode.
 false
-### spec.extraEnvVars[] -[↩ Parent](#spec) - +### spec.clientMaintenanceNotifications.ossMode +[↩ Parent](#specclientmaintenancenotifications) +Client maintenance notifications settings for clients connected to databases with OSS cluster API enabled. @@ -1060,34 +1276,45 @@ Container timezone configuration. While the default timezone on all containers i - - - - - - - + + - - - + +
namestring -
- 		true
valuestringenabledboolean -
+ Whether client maintenance notifications are enabled for OSS clusters. Defaults to False.
 false
valueFromobject
+ + +### spec.clientMaintenanceNotifications.proxyMode +[↩ Parent](#specclientmaintenancenotifications) + +Client maintenance notifications settings for clients connected to databases running in enterprise (proxy) mode. + + + + + + + + + + + + +
NameTypeDescriptionRequired
enabledboolean -
+ Whether client maintenance notifications are enabled for DBs with no OSS cluster API enabled (a.k.a. Proxy/Enterprise mode). Defaults to False.
 false
-### spec.hostAliases[] +### spec.containerTimezone [↩ Parent](#spec) -HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the pod's hosts file. +Container timezone configuration. While the default timezone on all containers is UTC, this setting can be used to set the timezone on services rigger/bootstrapper/RS containers. You can either propagate the hosts timezone to RS pods or set it manually via timezoneName. @@ -1099,27 +1326,27 @@ HostAlias holds the mapping between IP and hostnames that will be injected as an - - + + - +
hostnames[]stringpropagateHostobject - Hostnames for the above IP address.
+ Identifies that container timezone should be in sync with the host, this option mounts a hostPath volume onto RS pods that could be restricted in some systems.
 false
iptimezoneName string - IP address of the host file entry.
+ POSIX-style timezone name as a string to be passed as EnvVar to RE pods, e.g. "Europe/London".
 false
-### spec.ingressOrRouteSpec +### spec.extraEnvVars[] [↩ Parent](#spec) -Access configurations for the Redis Enterprise cluster and databases. At most one of ingressOrRouteSpec or activeActive fields can be set at the same time. + @@ -1131,43 +1358,35 @@ Access configurations for the Redis Enterprise cluster and databases. At most on - + - + - - - - - - + - - + +
apiFqdnUrlname string - RS API URL
+
true
dbFqdnSuffixvalue string - DB ENDPOINT SUFFIX - will be used to set the db host ingress . Creates a host name so it should be unique if more than one db is created on the cluster with the same name
- 		true
methodenum - Used to distinguish between different platforms implementation.

- Enum: openShiftRoute, ingress, istio
truefalse
ingressAnnotationsmap[string]stringvalueFromobject - Additional annotations to set on ingress resources created by the operator
+
false
-### spec.ldap +### spec.gateway [↩ Parent](#spec) -Cluster-level LDAP configuration, such as server addresses, protocol, authentication and query settings. +Configures exposure of cluster service endpoints and Active-Active databases via +the Kubernetes Gateway API. @@ -1179,108 +1398,135 @@ Cluster-level LDAP configuration, such as server addresses, protocol, authentica - + - + - + - - - - - - + - - + + - + - - + + - - + + - - - + +
authenticationQueryactiveActiveDatabases object - Configuration of authentication queries, mapping between the username, provided to the cluster for authentication, and the LDAP Distinguished Name.
+ Exposes Active-Active databases via Gateway. REC-scoped only; per-database +overrides are not supported for Active-Active databases.
truefalse
authorizationQueryapi object - Configuration of authorization queries, mapping between a user's Distinguished Name and its group memberships.
- 		true
protocolenum - Specifies the LDAP protocol to use. One of: LDAP, LDAPS, STARTTLS.
-
- Enum: LDAP, LDAPS, STARTTLS
+ Exposes the RS API endpoint via Gateway.
truefalse
servers[]objectdefaultobject - One or more LDAP servers. If multiple servers are specified, they must all share an identical organization tree structure.
+ Shared fallbacks (gatewayRef, fqdnSuffix) used by endpoints that do not set +their own.
truefalse
bindCredentialsSecretNamestringmetricsobject - Name of a secret within the same namespace, holding the credentials used to communicate with the LDAP server for authentication queries. The secret must have a key named 'dn' with the Distinguished Name of the user to execute the query, and 'password' with its password. If left blank, credentials-based authentication is disabled.
+ Exposes the metrics exporter endpoint via Gateway.
 false
caCertificateSecretNamestringuiobject - Name of a secret within the same namespace, holding a PEM-encoded CA certificate for validating the TLS connection to the LDAP server. The secret must have a key named 'cert' with the certificate data. This field is applicable only when the protocol is LDAPS or STARTTLS.
+ Exposes the CM UI endpoint via Gateway.
 false
cacheTTLSecondsinteger
+ + +### spec.gateway.activeActiveDatabases +[↩ Parent](#specgateway) + +Exposes Active-Active databases via Gateway. REC-scoped only; per-database +overrides are not supported for Active-Active databases. + + + + + + + + + + + + + - - + + - + + + + + + - - + + - - + + - - + + - - + +
NameTypeDescriptionRequired
autoEnableenum - The maximum TTL of cached entries.
+ Controls which Active-Active databases are Gateway-enabled by default: +None (default), All, or Selector (only those matching selector).
+
+ Enum: None, All, Selector
 false
cbabooleanfqdnSuffixstring - Whether to allow LDAP as an identity source for certificate-based authentication. Disabled by default.
+ FQDN suffix for Active-Active endpoints; the per-database FQDN defaults to +..
 false
cbaIdentityOidgatewayRefobject + Overrides default.gatewayRef for this endpoint.
+ 		false
listenerName string - The certificate subject OID to use when CBA identity source is set to SubjectOID.
+ Gateway listener name; maps to the Route's parentRef.sectionName. If omitted, +the Gateway implementation selects a compatible listener.
 false
cbaIdentitySourceenumlistenerPortinteger - The certificate subject identity source to use for LDAP lookup. Applicable only when CBA is enabled. One of SubjectCN, SubjectOID.
+ Gateway listener port; maps to the Route's parentRef.port.

- Enum: SubjectCN, SubjectOID
+ Minimum: 1
+ Maximum: 65535
 false
directoryTimeoutSecondsintegerrouteAnnotationsmap[string]string - The connection timeout to the LDAP server when authenticating a user, in seconds
+ Annotations for this endpoint's TLSRoute (e.g. for external-dns), merged over +gateway.default.routeAnnotations (these win on key conflicts).
 false
enabledForControlPlanebooleanrouteLabelsmap[string]string - Whether to enable LDAP for control plane access. Disabled by default.
+ Labels for this endpoint's TLSRoute, merged over gateway.default.routeLabels +(these win on key conflicts). Operator-managed labels always take precedence.
 false
enabledForDataPlanebooleanselectorobject - Whether to enable LDAP for data plane access. Disabled by default.
+ Label selector over Active-Active databases. Used only when autoEnable=Selector.
 false
-### spec.ldap.authenticationQuery -[↩ Parent](#specldap) +### spec.gateway.activeActiveDatabases.gatewayRef +[↩ Parent](#specgatewayactiveactivedatabases) -Configuration of authentication queries, mapping between the username, provided to the cluster for authentication, and the LDAP Distinguished Name. +Overrides default.gatewayRef for this endpoint. @@ -1292,27 +1538,27 @@ Configuration of authentication queries, mapping between the username, provided - - + + - + - +
queryobjectnamestring - Configuration for a search query. Mutually exclusive with the 'template' field. The substring '%u' in the query filter will be replaced with the username.
+ Name of the Gateway.
falsetrue
templatenamespace string - Configuration for a template query. Mutually exclusive with the 'query' field. The substring '%u' will be replaced with the username, e.g., 'cn=%u,ou=dev,dc=example,dc=com'.
+ Namespace of the Gateway. Defaults to the resource's namespace if omitted.
 false
-### spec.ldap.authenticationQuery.query -[↩ Parent](#specldapauthenticationquery) +### spec.gateway.activeActiveDatabases.selector +[↩ Parent](#specgatewayactiveactivedatabases) -Configuration for a search query. Mutually exclusive with the 'template' field. The substring '%u' in the query filter will be replaced with the username. +Label selector over Active-Active databases. Used only when autoEnable=Selector. @@ -1324,36 +1570,30 @@ Configuration for a search query. Mutually exclusive with the 'template' field. - - - - - - - + + - + - - + + - +
basestring - The Distinguished Name of the entry at which to start the search, e.g., 'ou=dev,dc=example,dc=com'.
- 		true
filterstringmatchExpressions[]object - An RFC-4515 string representation of the filter to apply in the search. For an authentication query, the substring '%u' will be replaced with the username, e.g., '(cn=%u)'. For an authorization query, the substring '%D' will be replaced with the user's Distinguished Name, e.g., '(members=%D)'.
+ matchExpressions is a list of label selector requirements. The requirements are ANDed.
truefalse
scopeenummatchLabelsmap[string]string - The search scope for an LDAP query. One of: BaseObject, SingleLevel, WholeSubtree
-
- Enum: BaseObject, SingleLevel, WholeSubtree
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
truefalse
-### spec.ldap.authorizationQuery -[↩ Parent](#specldap) +### spec.gateway.activeActiveDatabases.selector.matchExpressions[] +[↩ Parent](#specgatewayactiveactivedatabasesselector) -Configuration of authorization queries, mapping between a user's Distinguished Name and its group memberships. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values. @@ -1365,27 +1605,38 @@ Configuration of authorization queries, mapping between a user's Distinguished N - + - + - - + + + + + + +
attributekey string - Configuration for an attribute query. Mutually exclusive with the 'query' field. Holds the name of an attribute of the LDAP user entity that contains a list of the groups that the user belongs to, e.g., 'memberOf'.
+ key is the label key that the selector applies to.
falsetrue
queryobjectoperatorstring - Configuration for a search query. Mutually exclusive with the 'attribute' field. The substring '%D' in the query filter will be replaced with the user's Distinguished Name.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
+ 		true
values[]string + values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
-### spec.ldap.authorizationQuery.query -[↩ Parent](#specldapauthorizationquery) +### spec.gateway.api +[↩ Parent](#specgateway) -Configuration for a search query. Mutually exclusive with the 'attribute' field. The substring '%D' in the query filter will be replaced with the user's Distinguished Name. +Exposes the RS API endpoint via Gateway. @@ -1397,36 +1648,68 @@ Configuration for a search query. Mutually exclusive with the 'attribute' field. - + + + + + + - + - + + + + + + - + - - + + - + + + + + + + + + + +
baseenabledboolean + Whether this endpoint is exposed via Gateway. Defaults to false.
+ 		false
fqdn string - The Distinguished Name of the entry at which to start the search, e.g., 'ou=dev,dc=example,dc=com'.
+ Explicit FQDN for this endpoint. Defaults to ..
truefalse
filtergatewayRefobject + Overrides default.gatewayRef for this endpoint.
+ 		false
listenerName string - An RFC-4515 string representation of the filter to apply in the search. For an authentication query, the substring '%u' will be replaced with the username, e.g., '(cn=%u)'. For an authorization query, the substring '%D' will be replaced with the user's Distinguished Name, e.g., '(members=%D)'.
+ Gateway listener name; maps to the Route's parentRef.sectionName. If omitted, +the Gateway implementation selects a compatible listener.
truefalse
scopeenumlistenerPortinteger - The search scope for an LDAP query. One of: BaseObject, SingleLevel, WholeSubtree
+ Gateway listener port; maps to the Route's parentRef.port.

- Enum: BaseObject, SingleLevel, WholeSubtree
+ Minimum: 1
+ Maximum: 65535
truefalse
routeAnnotationsmap[string]string + Annotations for this endpoint's TLSRoute (e.g. for external-dns), merged over +gateway.default.routeAnnotations (these win on key conflicts).
+ 		false
routeLabelsmap[string]string + Labels for this endpoint's TLSRoute, merged over gateway.default.routeLabels +(these win on key conflicts). Operator-managed labels always take precedence.
+ 		false
-### spec.ldap.servers[] -[↩ Parent](#specldap) +### spec.gateway.api.gatewayRef +[↩ Parent](#specgatewayapi) -Address of an LDAP server. +Overrides default.gatewayRef for this endpoint. @@ -1438,29 +1721,28 @@ Address of an LDAP server. - + - - + +
hostname string - Host name of the LDAP server
+ Name of the Gateway.
 true
portintegernamespacestring - Port number of the LDAP server. If unspecified, defaults to 389 for LDAP and STARTTLS protocols, and 636 for LDAPS protocol.
-
- Format: int32
+ Namespace of the Gateway. Defaults to the resource's namespace if omitted.
 false
-### spec.metricsConfig -[↩ Parent](#spec) +### spec.gateway.default +[↩ Parent](#specgateway) -Cluster-level configuration for metrics. Currently controls which database tag keys may be exposed as labels on Redis Software metrics. +Shared fallbacks (gatewayRef, fqdnSuffix) used by endpoints that do not set +their own. @@ -1472,69 +1754,79 @@ Cluster-level configuration for metrics. Currently controls which database tag k - - - - - - - - - - - + - - + + - - + + - - + + - - - + +
exposeDatabaseTagsboolean - Master switch for tag-derived metrics. When true, database tag keys listed in metricsTagKeysExposed may be used as labels by metrics consumers. When false, no database tag keys are exposed as metric labels, even if listed in metricsTagKeysExposed. Defaults to false if unset.
- 		false
keyDistributionEnabledboolean - When true, emit Prometheus classic histogram metrics for key size/items distributions. Defaults to false if unset.
- 		false
keyItemsBucketsfqdnSuffix string - Comma-separated bucket boundaries for key items distribution histograms (e.g., "1M,8M"). Defaults to empty string if unset.
+ Base FQDN suffix used to derive endpoint hostnames when an explicit FQDN is not +set. Defaults: api., ui., metrics., +.db. (database), .crdb. (Active-Active).
 false
keySizeBucketsstringgatewayRefobject - Comma-separated bucket boundaries for key size distribution histograms (e.g., "128M,512M"). Defaults to empty string if unset.
+ Default Gateway referenced by endpoints that do not specify their own gatewayRef.
 false
localStorageMaxSizeMbintegerrouteAnnotationsmap[string]string - Maximum size in MB for local metrics storage. Defaults to 1024 if unset.
+ Default annotations applied to the TLSRoutes the operator creates (e.g. for +external-dns). A per-endpoint routeAnnotations entry overrides the matching +default key.
 false
localStorageRetentionDaysintegerrouteLabelsmap[string]string - Number of days to retain local metrics data. Defaults to 8 if unset.
+ Default labels applied to the TLSRoutes the operator creates. A per-endpoint +routeLabels entry overrides the matching default key; operator-managed labels +always take precedence.
 false
maxRequestsInFlightinteger
+ + +### spec.gateway.default.gatewayRef +[↩ Parent](#specgatewaydefault) + +Default Gateway referenced by endpoints that do not specify their own gatewayRef. + + + + + + + + + + + + + - + - - + +
NameTypeDescriptionRequired
namestring - Maximum number of concurrent master_aggregator scrape requests. Set to 0 to disable the limit. Defaults to 2 if unset.
+ Name of the Gateway.
falsetrue
metricsTagKeysExposed[]stringnamespacestring - Allowlist of database tag keys that may be exposed as metric labels when exposeDatabaseTags is true. Keys not listed here are never exposed as metric labels even if they appear on a database. Keys are lowercased on the cluster, must be 1-64 characters and not whitespace-only, and may contain ASCII letters, digits, spaces, '-', '_', '.', '+', '@', and ':'. At most 50 keys are allowed. Defaults to empty list if unset.
+ Namespace of the Gateway. Defaults to the resource's namespace if omitted.
 false
-### spec.ocspConfiguration -[↩ Parent](#spec) +### spec.gateway.metrics +[↩ Parent](#specgateway) -An API object that represents the cluster's OCSP configuration. To enable OCSP, the cluster's proxy certificate should contain the OCSP responder URL. +Exposes the metrics exporter endpoint via Gateway. @@ -1546,48 +1838,68 @@ An API object that represents the cluster's OCSP configuration. To enable OCSP, - + - - + + - - + + - - + + - + + + + + + + + + + +
ocspFunctionalityenabled boolean - Whether to enable/disable OCSP mechanism for the cluster.
+ Whether this endpoint is exposed via Gateway. Defaults to false.
 false
queryFrequencyintegerfqdnstring - Determines the interval (in seconds) in which the control plane will poll the OCSP responder for a new status for the server certificate. Minimum value is 60. Maximum value is 86400.
+ Explicit FQDN for this endpoint. Defaults to ..
 false
recoveryFrequencyintegergatewayRefobject - Determines the interval (in seconds) in which the control plane will poll the OCSP responder for a new status for the server certificate when the current staple is invalid. Minimum value is 60. Maximum value is 86400.
+ Overrides default.gatewayRef for this endpoint.
 false
recoveryMaxTriesintegerlistenerNamestring - Determines the maximum number for the OCSP recovery attempts. After max number of tries passed, the control plane will revert back to the regular frequency. Minimum value is 1. Maximum value is 100.
+ Gateway listener name; maps to the Route's parentRef.sectionName. If omitted, +the Gateway implementation selects a compatible listener.
 false
responseTimeoutlistenerPort integer - Determines the time interval (in seconds) for which the request waits for a response from the OCSP responder. Minimum value is 1. Maximum value is 60.
+ Gateway listener port; maps to the Route's parentRef.port.
+
+ Minimum: 1
+ Maximum: 65535
+ 		false
routeAnnotationsmap[string]string + Annotations for this endpoint's TLSRoute (e.g. for external-dns), merged over +gateway.default.routeAnnotations (these win on key conflicts).
+ 		false
routeLabelsmap[string]string + Labels for this endpoint's TLSRoute, merged over gateway.default.routeLabels +(these win on key conflicts). Operator-managed labels always take precedence.
 false
-### spec.ossClusterSettings -[↩ Parent](#spec) +### spec.gateway.metrics.gatewayRef +[↩ Parent](#specgatewaymetrics) -Cluster-level configuration for OSS cluster mode databases. +Overrides default.gatewayRef for this endpoint. @@ -1599,36 +1911,27 @@ Cluster-level configuration for OSS cluster mode databases. - - + + - + - - - - - - - + +
externalAccessTypeenumnamestring - Specifies the mechanism for enabling external access to OSS cluster databases. When unset or set to "Disabled", external access is not allowed for any OSS cluster databases. When set to a specific mechanism (e.g., "LoadBalancer"), that mechanism is used to provide external access. Note: Individual databases must still enable external access via their ossClusterSettings.enableExternalAccess field.
-
- Enum: LoadBalancer, Disabled
+ Name of the Gateway.
falsetrue
loadBalancerobject - Configuration for LoadBalancer services created to assign public IPs for Redis Enterprise cluster nodes.
- 		false
podCIDRs[]stringnamespacestring - A list of Kubernetes pod CIDR ranges from which pod IPs are allocated. Supports both IPv4 (e.g., "10.30.0.0/16") and IPv6 addresses. This field should only be configured when OSS cluster databases need to be accessed from both internal and external clients. When configured, internal communication can reach pods directly using their pod IPs, bypassing the external access mechanism (e.g., load balancer services) for improved performance. IMPORTANT: For this feature to work correctly, the entire data path must preserve the client source IP address. This is required because the Redis server uses the client's source IP to construct the CLUSTER SHARDS/SLOTS response - returning pod IPs for internal clients (matching podCIDRs) or load balancer addresses for external clients. On cloud platforms, this typically requires configuring the load balancer to preserve source IPs.
+ Namespace of the Gateway. Defaults to the resource's namespace if omitted.
 false
-### spec.ossClusterSettings.loadBalancer -[↩ Parent](#specossclustersettings) +### spec.gateway.ui +[↩ Parent](#specgateway) -Configuration for LoadBalancer services created to assign public IPs for Redis Enterprise cluster nodes. +Exposes the CM UI endpoint via Gateway. @@ -1640,75 +1943,68 @@ Configuration for LoadBalancer services created to assign public IPs for Redis E - - + + - - + + - -
externalTrafficPolicyenumenabledboolean - ExternalTrafficPolicy specifies the externalTrafficPolicy for LoadBalancer services created for Redis Enterprise cluster nodes. Choose "Local" to configure the LoadBalancer to only route traffic to the single worker node hosting the Redis Enterprise cluster node for that service. Choose "Cluster" to route traffic to any worker node, providing a more stable behavior during failovers, but with increased overhead due to additional hop. Defaults to "Local" when podCIDRs is configured, and "Cluster" otherwise.
-
- Enum: Cluster, Local
+ Whether this endpoint is exposed via Gateway. Defaults to false.
 false
serviceAnnotationsmap[string]stringfqdnstring - Additional annotations to set on LoadBalancer services created for Redis Enterprise cluster nodes. These annotations are merged with global service annotations from spec.services.servicesAnnotations.
+ Explicit FQDN for this endpoint. Defaults to ..
 false
- - -### spec.persistentSpec -[↩ Parent](#spec) - -Persistent storage configuration for Redis Enterprise cluster. - - - - - - - - - - - - - + + + - - + + - - + + - - + + + + + + +
NameTypeDescriptionRequired
enablePersistentVolumeResizeboolean
gatewayRefobject - Whether to enable PersistentVolumes resize. Disabled by default. Read the instruction in pvc_expansion readme carefully before using this feature.
+ Overrides default.gatewayRef for this endpoint.
 false
enabledbooleanlistenerNamestring - Whether to add persistent volume to Redis Enterprise pods
+ Gateway listener name; maps to the Route's parentRef.sectionName. If omitted, +the Gateway implementation selects a compatible listener.
 false
storageClassNamestringlistenerPortinteger - Storage class for persistent volume in Redis Enterprise pods. Leave empty to use the default. If using the default this way, make sure the Kubernetes Cluster has a default Storage Class configured. This can be done by running a `kubectl get storageclass` and see if one of the Storage Classes' names contains a `(default)` mark.
+ Gateway listener port; maps to the Route's parentRef.port.
+
+ Minimum: 1
+ Maximum: 65535
 false
volumeSizeint or stringrouteAnnotationsmap[string]string - By default, if you omit spec.persistentSpec.volumeSize, the operator allocates a persistent volume that is five times (5x) the Redis Enterprise node memory request defined in spec.redisEnterpriseNodeResources.requests.memory (per node). This 5x ratio is the recommended minimum capacity. To enable resizing after creating the cluster, see the Expand PVC docs: https://redis.io/docs/latest/operate/kubernetes/re-clusters/expand-pvc/
+ Annotations for this endpoint's TLSRoute (e.g. for external-dns), merged over +gateway.default.routeAnnotations (these win on key conflicts).
+ 		false
routeLabelsmap[string]string + Labels for this endpoint's TLSRoute, merged over gateway.default.routeLabels +(these win on key conflicts). Operator-managed labels always take precedence.
 false
-### spec.podAntiAffinity -[↩ Parent](#spec) +### spec.gateway.ui.gatewayRef +[↩ Parent](#specgatewayui) -Override for the default anti-affinity rules of the Redis Enterprise pods. More info: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#an-example-of-a-pod-that-uses-pod-affinity +Overrides default.gatewayRef for this endpoint. @@ -1720,27 +2016,27 @@ Override for the default anti-affinity rules of the Redis Enterprise pods. More - - + + - + - - + +
preferredDuringSchedulingIgnoredDuringExecution[]objectnamestring -
+ Name of the Gateway.
falsetrue
requiredDuringSchedulingIgnoredDuringExecution[]objectnamespacestring -
+ Namespace of the Gateway. Defaults to the resource's namespace if omitted.
 false
-### spec.podStartingPolicy +### spec.hostAliases[] [↩ Parent](#spec) -Mitigation setting for STS pods stuck in "ContainerCreating" +HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the pod's hosts file. @@ -1752,29 +2048,27 @@ Mitigation setting for STS pods stuck in "ContainerCreating" - - + + - + - - + + - +
enabledbooleanhostnames[]string - Enables detection and mitigation of pod startup issues.
+ Hostnames for the above IP address.
truefalse
startingThresholdSecondsintegeripstring - Time in seconds to wait before taking action on a pod stuck during startup. Set to 0 to disable.
-
- Format: int32
+ IP address of the host file entry.
truefalse
-### spec.podTolerations[] +### spec.ingressOrRouteSpec [↩ Parent](#spec) - +Access configurations for the Redis Enterprise cluster and databases. At most one of ingressOrRouteSpec or activeActive fields can be set at the same time. @@ -1786,79 +2080,43 @@ Mitigation setting for STS pods stuck in "ContainerCreating" - - - - - - + - + - + - + - - + + - + - - - - - -
effectstring -
- 		false
keyapiFqdnUrl string -
+ RS API URL
falsetrue
operatordbFqdnSuffix string -
+ DB ENDPOINT SUFFIX - will be used to set the db host ingress . Creates a host name so it should be unique if more than one db is created on the cluster with the same name
falsetrue
tolerationSecondsintegermethodenum + Used to distinguish between different platforms implementation.

-
- Format: int64
+ Enum: openShiftRoute, ingress, istio
falsetrue
valuestring -
- 		false
- - -### spec.pullSecrets[] -[↩ Parent](#spec) - - - - - - - - - - - - - - - + +
NameTypeDescriptionRequired
namestringingressAnnotationsmap[string]string - Secret name
+ Additional annotations to set on ingress resources created by the operator
 false
-### spec.redisEnterpriseAdditionalPodSpecAttributes +### spec.ldap [↩ Parent](#spec) -ADVANCED USAGE USE AT YOUR OWN RISK - -specify pod attributes that are required for the statefulset - Redis Enterprise pods. -Pod attributes managed by the operator might override these settings. -Also make sure the attributes are supported by the K8s version running on the cluster - -the operator does not validate that. +Cluster-level LDAP configuration, such as server addresses, protocol, authentication and query settings. @@ -1870,96 +2128,843 @@ the operator does not validate that. - - + + - + - + - + - - + + - + - - + + - + - + - - + + - - + + - - + + - - + + - - + + - - + + - + - - + + + + +
activeDeadlineSecondsintegerauthenticationQueryobject -
-
- Format: int64
+ Configuration of authentication queries, mapping between the username, provided to the cluster for authentication, and the LDAP Distinguished Name.
falsetrue
affinityauthorizationQuery object -
+ Configuration of authorization queries, mapping between a user's Distinguished Name and its group memberships.
falsetrue
automountServiceAccountTokenbooleanprotocolenum + Specifies the LDAP protocol to use. One of: LDAP, LDAPS, STARTTLS.

+ Enum: LDAP, LDAPS, STARTTLS
falsetrue
dnsConfigobjectservers[]object -
+ One or more LDAP servers. If multiple servers are specified, they must all share an identical organization tree structure.
falsetrue
dnsPolicybindCredentialsSecretName string -
+ Name of a secret within the same namespace, holding the credentials used to communicate with the LDAP server for authentication queries. The secret must have a key named 'dn' with the Distinguished Name of the user to execute the query, and 'password' with its password. If left blank, credentials-based authentication is disabled.
 false
enableServiceLinksbooleancaCertificateSecretNamestring -
+ Name of a secret within the same namespace, holding a PEM-encoded CA certificate for validating the TLS connection to the LDAP server. The secret must have a key named 'cert' with the certificate data. This field is applicable only when the protocol is LDAPS or STARTTLS.
 false
ephemeralContainers[]objectcacheTTLSecondsinteger -
+ The maximum TTL of cached entries.
 false
hostAliases[]objectcbaboolean -
+ Whether to allow LDAP as an identity source for certificate-based authentication. Disabled by default.
 false
hostIPCbooleancbaIdentityOidstring -
+ The certificate subject OID to use when CBA identity source is set to SubjectOID.
 false
hostNetworkbooleancbaIdentitySourceenum + The certificate subject identity source to use for LDAP lookup. Applicable only when CBA is enabled. One of SubjectCN, SubjectOID.

+ Enum: SubjectCN, SubjectOID
 false
hostPIDbooleandirectoryTimeoutSecondsinteger -
+ The connection timeout to the LDAP server when authenticating a user, in seconds
 false
hostUsersenabledForControlPlane boolean -
+ Whether to enable LDAP for control plane access. Disabled by default.
 false
hostnamestringenabledForDataPlaneboolean -
+ Whether to enable LDAP for data plane access. Disabled by default.
+ 		false
+ + +### spec.ldap.authenticationQuery +[↩ Parent](#specldap) + +Configuration of authentication queries, mapping between the username, provided to the cluster for authentication, and the LDAP Distinguished Name. + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
queryobject + Configuration for a search query. Mutually exclusive with the 'template' field. The substring '%u' in the query filter will be replaced with the username.
+ 		false
templatestring + Configuration for a template query. Mutually exclusive with the 'query' field. The substring '%u' will be replaced with the username, e.g., 'cn=%u,ou=dev,dc=example,dc=com'.
+ 		false
+ + +### spec.ldap.authenticationQuery.query +[↩ Parent](#specldapauthenticationquery) + +Configuration for a search query. Mutually exclusive with the 'template' field. The substring '%u' in the query filter will be replaced with the username. + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
basestring + The Distinguished Name of the entry at which to start the search, e.g., 'ou=dev,dc=example,dc=com'.
+ 		true
filterstring + An RFC-4515 string representation of the filter to apply in the search. For an authentication query, the substring '%u' will be replaced with the username, e.g., '(cn=%u)'. For an authorization query, the substring '%D' will be replaced with the user's Distinguished Name, e.g., '(members=%D)'.
+ 		true
scopeenum + The search scope for an LDAP query. One of: BaseObject, SingleLevel, WholeSubtree
+
+ Enum: BaseObject, SingleLevel, WholeSubtree
+ 		true
+ + +### spec.ldap.authorizationQuery +[↩ Parent](#specldap) + +Configuration of authorization queries, mapping between a user's Distinguished Name and its group memberships. + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
attributestring + Configuration for an attribute query. Mutually exclusive with the 'query' field. Holds the name of an attribute of the LDAP user entity that contains a list of the groups that the user belongs to, e.g., 'memberOf'.
+ 		false
queryobject + Configuration for a search query. Mutually exclusive with the 'attribute' field. The substring '%D' in the query filter will be replaced with the user's Distinguished Name.
+ 		false
+ + +### spec.ldap.authorizationQuery.query +[↩ Parent](#specldapauthorizationquery) + +Configuration for a search query. Mutually exclusive with the 'attribute' field. The substring '%D' in the query filter will be replaced with the user's Distinguished Name. + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
basestring + The Distinguished Name of the entry at which to start the search, e.g., 'ou=dev,dc=example,dc=com'.
+ 		true
filterstring + An RFC-4515 string representation of the filter to apply in the search. For an authentication query, the substring '%u' will be replaced with the username, e.g., '(cn=%u)'. For an authorization query, the substring '%D' will be replaced with the user's Distinguished Name, e.g., '(members=%D)'.
+ 		true
scopeenum + The search scope for an LDAP query. One of: BaseObject, SingleLevel, WholeSubtree
+
+ Enum: BaseObject, SingleLevel, WholeSubtree
+ 		true
+ + +### spec.ldap.servers[] +[↩ Parent](#specldap) + +Address of an LDAP server. + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
hoststring + Host name of the LDAP server
+ 		true
portinteger + Port number of the LDAP server. If unspecified, defaults to 389 for LDAP and STARTTLS protocols, and 636 for LDAPS protocol.
+
+ Format: int32
+ 		false
+ + +### spec.metricsConfig +[↩ Parent](#spec) + +Cluster-level configuration for metrics. Currently controls which database tag keys may be exposed as labels on Redis Enterprise metrics. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
exposeDatabaseTagsboolean + Master switch for tag-derived metrics. When true, database tag keys listed in metricsTagKeysExposed may be used as labels by metrics consumers. When false, no database tag keys are exposed as metric labels, even if listed in metricsTagKeysExposed. Defaults to false if unset.
+ 		false
keyDistributionEnabledboolean + When true, emit Prometheus classic histogram metrics for key size/items distributions. Defaults to false if unset.
+ 		false
keyItemsBucketsstring + Comma-separated bucket boundaries for key items distribution histograms (e.g., "1M,8M"). Defaults to empty string if unset.
+ 		false
keySizeBucketsstring + Comma-separated bucket boundaries for key size distribution histograms (e.g., "128M,512M"). Defaults to empty string if unset.
+ 		false
localStorageMaxSizeMbinteger + Maximum size in MB for local metrics storage. Defaults to 1024 if unset.
+ 		false
localStorageRetentionDaysinteger + Number of days to retain local metrics data. Defaults to 8 if unset.
+ 		false
maxRequestsInFlightinteger + Maximum number of concurrent master_aggregator scrape requests. Set to 0 to disable the limit. Defaults to 2 if unset.
+ 		false
metricsTagKeysExposed[]string + Allowlist of database tag keys that may be exposed as metric labels when exposeDatabaseTags is true. Keys not listed here are never exposed as metric labels even if they appear on a database. Keys are lowercased on the cluster, must be 1-64 characters and not whitespace-only, and may contain ASCII letters, digits, spaces, '-', '_', '.', '+', '@', and ':'. At most 50 keys are allowed. Defaults to empty list if unset.
+ 		false
+ + +### spec.ocspConfiguration +[↩ Parent](#spec) + +An API object that represents the cluster's OCSP configuration. To enable OCSP, the cluster's proxy certificate should contain the OCSP responder URL. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
ocspFunctionalityboolean + Whether to enable/disable OCSP mechanism for the cluster.
+ 		false
queryFrequencyinteger + Determines the interval (in seconds) in which the control plane will poll the OCSP responder for a new status for the server certificate. Minimum value is 60. Maximum value is 86400.
+ 		false
recoveryFrequencyinteger + Determines the interval (in seconds) in which the control plane will poll the OCSP responder for a new status for the server certificate when the current staple is invalid. Minimum value is 60. Maximum value is 86400.
+ 		false
recoveryMaxTriesinteger + Determines the maximum number for the OCSP recovery attempts. After max number of tries passed, the control plane will revert back to the regular frequency. Minimum value is 1. Maximum value is 100.
+ 		false
responseTimeoutinteger + Determines the time interval (in seconds) for which the request waits for a response from the OCSP responder. Minimum value is 1. Maximum value is 60.
+ 		false
+ + +### spec.operatorClientAuth +[↩ Parent](#spec) + +Selects which credential the operator presents to the control-plane REST API. +This is a client-side concern: it does not, by itself, configure the cluster to +accept certificates (see apiCertificateBasedAuth). + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
certificateSubjectLinestring + CertificateSubjectLine is the subject line of the client certificate the operator +presents; never derived from the certificate itself. Required when Method is +'Certificate'; CN/O/OU/L/ST/C attributes only, CN mandatory. Must exactly match the +certificate's RFC2253 subject string, no spaces after commas (e.g. 'CN=operator,O=redis'): +the cluster matches certificate-auth users by the literal string. +The operator adds this subject to the cluster's 'mtls_authorized_subjects'.
+ 		false
clientCertificateSecretNamestring + Name or path of the secret containing the client certificate/key the operator +presents to the control-plane REST API. Required when Method is 'certificate'. +The secret must be in the same format as other operator-managed certificate +secrets (cert-manager TLS secret, or legacy opaque secret with 'tls.crt'/'cert' +and 'tls.key'/'key'). When ClusterCredentialSecretType is 'vault', this is a +Vault KV path (same naming rules as ClusterCredentialSecretName); the services +rigger, bootstrapper, node hook scripts and call-home client receive the cert via +Vault Agent inject.
+ 		false
methodenum + Method selects how the operator authenticates to the control-plane REST API. +If omitted, this field is evaluated as 'Basic'.
+
+ Enum: Basic, Certificate
+ 		false
+ + +### spec.ossClusterSettings +[↩ Parent](#spec) + +Cluster-level configuration for OSS cluster mode databases. + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
externalAccessTypeenum + Specifies the mechanism for enabling external access to OSS cluster databases. When unset or set to "Disabled", external access is not allowed for any OSS cluster databases. When set to a specific mechanism (e.g., "LoadBalancer"), that mechanism is used to provide external access. Note: Individual databases must still enable external access via their ossClusterSettings.enableExternalAccess field.
+
+ Enum: LoadBalancer, Disabled
+ 		false
loadBalancerobject + Configuration for LoadBalancer services created to assign public IPs for Redis Enterprise cluster nodes.
+ 		false
podCIDRs[]string + A list of Kubernetes pod CIDR ranges from which pod IPs are allocated. Supports both IPv4 (e.g., "10.30.0.0/16") and IPv6 addresses. This field should only be configured when OSS cluster databases need to be accessed from both internal and external clients. When configured, internal communication can reach pods directly using their pod IPs, bypassing the external access mechanism (e.g., load balancer services) for improved performance. IMPORTANT: For this feature to work correctly, the entire data path must preserve the client source IP address. This is required because the Redis server uses the client's source IP to construct the CLUSTER SHARDS/SLOTS response - returning pod IPs for internal clients (matching podCIDRs) or load balancer addresses for external clients. On cloud platforms, this typically requires configuring the load balancer to preserve source IPs.
+ 		false
+ + +### spec.ossClusterSettings.loadBalancer +[↩ Parent](#specossclustersettings) + +Configuration for LoadBalancer services created to assign public IPs for Redis Enterprise cluster nodes. + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
externalTrafficPolicyenum + ExternalTrafficPolicy specifies the externalTrafficPolicy for LoadBalancer services created for Redis Enterprise cluster nodes. Choose "Local" to configure the LoadBalancer to only route traffic to the single worker node hosting the Redis Enterprise cluster node for that service. Choose "Cluster" to route traffic to any worker node, providing a more stable behavior during failovers, but with increased overhead due to additional hop. Defaults to "Local" when podCIDRs is configured, and "Cluster" otherwise.
+
+ Enum: Cluster, Local
+ 		false
serviceAnnotationsmap[string]string + Additional annotations to set on LoadBalancer services created for Redis Enterprise cluster nodes. These annotations are merged with global service annotations from spec.services.servicesAnnotations.
+ 		false
+ + +### spec.persistentSpec +[↩ Parent](#spec) + +Persistent storage configuration for Redis Enterprise cluster. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
enablePersistentVolumeResizeboolean + Whether to enable PersistentVolumes resize. Disabled by default. Read the instruction in pvc_expansion readme carefully before using this feature.
+ 		false
enabledboolean + Whether to add persistent volume to Redis Enterprise pods
+ 		false
storageClassNamestring + Storage class for persistent volume in Redis Enterprise pods. Leave empty to use the default. If using the default this way, make sure the Kubernetes Cluster has a default Storage Class configured. This can be done by running a `kubectl get storageclass` and see if one of the Storage Classes' names contains a `(default)` mark.
+ 		false
volumeSizeint or string + By default, if you omit spec.persistentSpec.volumeSize, the operator allocates a persistent volume that is five times (5x) the Redis Enterprise node memory request defined in spec.redisEnterpriseNodeResources.requests.memory (per node). This 5x ratio is the recommended minimum capacity. To enable resizing after creating the cluster, see the Expand PVC docs: https://redis.io/docs/latest/operate/kubernetes/re-clusters/expand-pvc/
+ 		false
+ + +### spec.podAntiAffinity +[↩ Parent](#spec) + +Override for the default anti-affinity rules of the Redis Enterprise pods. More info: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#an-example-of-a-pod-that-uses-pod-affinity + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
preferredDuringSchedulingIgnoredDuringExecution[]object +
+ 		false
requiredDuringSchedulingIgnoredDuringExecution[]object +
+ 		false
+ + +### spec.podStartingPolicy +[↩ Parent](#spec) + +Mitigation setting for STS pods stuck in "ContainerCreating" + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
enabledboolean + Enables detection and mitigation of pod startup issues.
+ 		true
startingThresholdSecondsinteger + Time in seconds to wait before taking action on a pod stuck during startup. Set to 0 to disable.
+
+ Format: int32
+ 		true
+ + +### spec.podTolerations[] +[↩ Parent](#spec) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
effectstring +
+ 		false
keystring +
+ 		false
operatorstring +
+ 		false
tolerationSecondsinteger +
+
+ Format: int64
+ 		false
valuestring +
+ 		false
+ + +### spec.pullSecrets[] +[↩ Parent](#spec) + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
namestring + Secret name
+ 		false
+ + +### spec.redisEnterpriseAdditionalPodSpecAttributes +[↩ Parent](#spec) + +ADVANCED USAGE USE AT YOUR OWN RISK - +specify pod attributes that are required for the statefulset - Redis Enterprise pods. +Pod attributes managed by the operator might override these settings. +Also make sure the attributes are supported by the K8s version running on the cluster - +the operator does not validate that. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -4284,24 +5289,245 @@ HTTPS source configuration for downloading the module via HTTPS + + + + + + + +
NameTypeDescriptionRequired
activeDeadlineSecondsinteger +
+
+ Format: int64
+ 		false
affinityobject +
+ 		false
automountServiceAccountTokenboolean +
+ 		false
dnsConfigobject +
+ 		false
dnsPolicystring +
+ 		false
enableServiceLinksboolean +
+ 		false
ephemeralContainers[]object +
+ 		false
hostAliases[]object +
+ 		false
hostIPCboolean +
+ 		false
hostNetworkboolean +
+ 		false
hostPIDboolean +
+ 		false
hostUsersboolean +
+ 		false
hostnamestring +
false
url string - URL to download the module from (must use https:// scheme)
+ URL to download the module from (must use https:// scheme)
+ 		true
credentialsSecretstring + Name of the Kubernetes secret containing credentials for downloading the module, if needed. The secret must contain 'username' and 'password' keys.
+ 		false
+ + +### spec.volumes[] +[↩ Parent](#spec) + +Volume represents a named volume in a pod that may be accessed by any container in the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + - - + +
NameTypeDescriptionRequired
namestring +
+ 		true
awsElasticBlockStoreobject +
+ 		false
azureDiskobject +
+ 		false
azureFileobject +
+ 		false
cephfsobject +
+ 		false
cinderobject +
+ 		false
configMapobject +
+ 		false
csiobject +
+ 		false
downwardAPIobject +
+ 		false
emptyDirobject +
+ 		false
fcobject +
+ 		false
flexVolumeobject +
+ 		false
flockerobject +
+ 		false
gcePersistentDiskobject +
+ 		false
gitRepoobject +
+ 		false
glusterfsobject +
+ 		false
hostPathobject +
+ 		false
iscsiobject +
+ 		false
nfsobject +
+ 		false
persistentVolumeClaimobject +
+ 		false
photonPersistentDiskobject +
+ 		false
portworxVolumeobject +
+ 		false
projectedobject +
+ 		false
quobyteobject +
+ 		false
rbdobject +
+ 		false
scaleIOobject +
+ 		false
secretobject +
+ 		false
storageosobject +
truefalse
credentialsSecretstringvsphereVolumeobject - Name of the Kubernetes secret containing credentials for downloading the module, if needed. The secret must contain 'username' and 'password' keys.
+
false
-### spec.volumes[] -[↩ Parent](#spec) +### status +[↩ Parent](#) + -Volume represents a named volume in a pod that may be accessed by any container in the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes @@ -4313,214 +5539,382 @@ Volume represents a named volume in a pod that may be accessed by any container - - + + - + - - + + - + - - + + - + - - + + - - + + - + - + - - + + - + - + - + - - + + - - + + - - + + + +
namestringapiCertificateBasedAuthActiveboolean -
+ Whether control-plane certificate authentication (mtls_certificate_authentication) +was last observed enabled on the cluster. The operator and services rigger present +client certificates only while this is true.
truefalse
awsElasticBlockStoreobjectbundledDatabaseVersions[]object -
+ Versions of open source databases bundled by Redis Enterprise Software - please note that in order to use a specific version it should be supported by the ‘upgradePolicy’ - ‘major’ or ‘latest’ according to the desired version (major/minor)
 false
azureDiskcertificatesStatus object -
+ Stores information about cluster certificates and their update process. In Active-Active databases, this is used to detect updates to the certificates, and trigger synchronization across the participating clusters.
 false
azureFileobjectclusterCredentialSecretNamestring -
+ The name of the secret containing cluster credentials currently in use by the cluster. This field tracks the current credential secret name and is updated when the secret name changes.
 false
cephfsgateway object -
+ Status of cluster service endpoints exposed through the Kubernetes Gateway API.
 false
cinderobjectingressOrRouteMethodStatusstring -
+ The ingressOrRouteSpec/ActiveActive spec method that exist
 false
configMapobjectinitContainerFailures[]object -
+ Failures of operator-managed init containers (such as the read-only root filesystem setup), one entry per failing pod and container; empty when all such init containers are healthy.
 false
csilicenseStatus object
false
downwardAPImanagedAPIs object -
+ Indicates cluster APIs that are being managed by the operator. This only applies to cluster APIs which are optionally-managed by the operator, such as cluster LDAP configuration. Most other APIs are automatically managed by the operator, and are not listed here.
 false
emptyDirobjectmodules[]object
false
fcocspStatus object -
+ An API object that represents the cluster's OCSP status
 false
flexVolumeoperatorClientCertStatus object -
+ Status of the operator's control-plane client certificate when spec.operatorClientAuth.method is Certificate. Cleared when certificate authentication is not in use.
 false
flockerpersistenceStatus object -
+ The status of the Persistent Volume Claims that are used for Redis Enterprise cluster persistence. The status will correspond to the status of one or more of the PVCs (failed/resizing if one of them is in resize or failed to resize)
 false
gcePersistentDiskobjectredisEnterpriseIPFamilystring
false
gitRepoobjectspecStatusstring
false
glusterfsobjectstatestring
false
+ + +### status.bundledDatabaseVersions[] +[↩ Parent](#status) + + + + + + + + + + + + + + + + + - - + + - + - + + + + + + + +
NameTypeDescriptionRequired
dbTypestring +
+ 		true
hostPathobjectversionstring
falsetrue
iscsifeatureSupport object + Feature support flags for this database version
+ 		false
majorboolean
false
+ + +### status.bundledDatabaseVersions[].featureSupport +[↩ Parent](#statusbundleddatabaseversions) + +Feature support flags for this database version + + + + + + + + + + + + + + + - - + + + + + +
NameTypeDescriptionRequired
activeActiveboolean + Indicates whether this version supports Active-Active (CRDB) databases
+ 		true
nfsobjectflexboolean + Indicates whether this version supports Redis on Flash (Flex)
+ 		true
+ + +### status.certificatesStatus +[↩ Parent](#status) + +Stores information about cluster certificates and their update process. In Active-Active databases, this is used to detect updates to the certificates, and trigger synchronization across the participating clusters. + + + + + + + + + + + + + - + + + + + +
NameTypeDescriptionRequired
generationinteger + Generation stores the version of the cluster's Proxy and Syncer certificate secrets. This generation counter is automatically incremented when proxy or syncer certificates are updated. In Active-Active databases (REAADB), the operator monitors this field to detect certificate changes and automatically triggers a CRDB force update (equivalent to 'crdb-cli crdb update --force'), which synchronizes the certificate changes to all participating clusters, eliminating the need for manual intervention to maintain sync.

+ Format: int64
 false
persistentVolumeClaimupdateStatusstring + The status of the cluster's certificates update
+ 		false
+ + +### status.gateway +[↩ Parent](#status) + +Status of cluster service endpoints exposed through the Kubernetes Gateway API. + + + + + + + + + + + + - + - + + +
NameTypeDescriptionRequired
api object
false
photonPersistentDiskmetrics object
false
portworxVolumeui object
false
+ + +### status.gateway.api +[↩ Parent](#statusgateway) + + + + + + + + + + + + + + + + + - - + + - - + + + + + +
NameTypeDescriptionRequired
conditions[]object +
+ 		false
projectedobjectfqdnstring
false
quobyteobjectrouteNamestring +
+ 		false
+ + +### status.gateway.api.conditions[] +[↩ Parent](#statusgatewayapi) + + + + + + + + + + + + + + + - + - - + + - + - - + + - + - - + + - + - - + + - + - - + +
NameTypeDescriptionRequired
lastTransitionTimestring
+
+ Format: date-time
falsetrue
rbdobjectmessagestring
falsetrue
scaleIOobjectreasonstring
falsetrue
secretobjectstatusenum
+
+ Enum: True, False, Unknown
falsetrue
storageosobjecttypestring
falsetrue
vsphereVolumeobjectobservedGenerationinteger
+
+ Format: int64
+ Minimum: 0
 false
-### status -[↩ Parent](#) +### status.gateway.metrics +[↩ Parent](#statusgateway) @@ -4534,95 +5928,99 @@ Volume represents a named volume in a pod that may be accessed by any container - bundledDatabaseVersions + conditions []object - Versions of open source databases bundled by Redis Enterprise Software - please note that in order to use a specific version it should be supported by the ‘upgradePolicy’ - ‘major’ or ‘latest’ according to the desired version (major/minor)
- - false - - certificatesStatus - object - - Stores information about cluster certificates and their update process. In Active-Active databases, this is used to detect updates to the certificates, and trigger synchronization across the participating clusters.
+
false - clusterCredentialSecretName + fqdn string - The name of the secret containing cluster credentials currently in use by the cluster. This field tracks the current credential secret name and is updated when the secret name changes.
+
false - ingressOrRouteMethodStatus + routeName string - - The ingressOrRouteSpec/ActiveActive spec method that exist
- - false - - licenseStatus - object
false - - managedAPIs - object - - Indicates cluster APIs that are being managed by the operator. This only applies to cluster APIs which are optionally-managed by the operator, such as cluster LDAP configuration. Most other APIs are automatically managed by the operator, and are not listed here.
- - false - - modules - []object + + + + +### status.gateway.metrics.conditions[] +[↩ Parent](#statusgatewaymetrics) + + + + + + + + + + + + + + + - + - - + + - + - - + + - + - - + + - + - + - + - - + +
NameTypeDescriptionRequired
lastTransitionTimestring
+
+ Format: date-time
falsetrue
ocspStatusobjectmessagestring - An API object that represents the cluster's OCSP status
+
falsetrue
persistenceStatusobjectreasonstring - The status of the Persistent Volume Claims that are used for Redis Enterprise cluster persistence. The status will correspond to the status of one or more of the PVCs (failed/resizing if one of them is in resize or failed to resize)
+
falsetrue
redisEnterpriseIPFamilystringstatusenum
+
+ Enum: True, False, Unknown
falsetrue
specStatustype string
falsetrue
statestringobservedGenerationinteger
+
+ Format: int64
+ Minimum: 0
 false
-### status.bundledDatabaseVersions[] -[↩ Parent](#status) +### status.gateway.ui +[↩ Parent](#statusgateway) @@ -4636,29 +6034,22 @@ Volume represents a named volume in a pod that may be accessed by any container - dbType - string + conditions + []object
- true + false - version + fqdn string
- true - - featureSupport - object - - Feature support flags for this database version
- false - major - boolean + routeName + string
@@ -4667,10 +6058,10 @@ Volume represents a named volume in a pod that may be accessed by any container -### status.bundledDatabaseVersions[].featureSupport -[↩ Parent](#statusbundleddatabaseversions) +### status.gateway.ui.conditions[] +[↩ Parent](#statusgatewayui) + -Feature support flags for this database version @@ -4682,27 +6073,62 @@ Feature support flags for this database version - - + + - - + + + + + + + + + + + + + + + + + + + + + +
activeActivebooleanlastTransitionTimestring - Indicates whether this version supports Active-Active (CRDB) databases
+
+
+ Format: date-time
 true
flexbooleanmessagestring - Indicates whether this version supports Redis on Flash (Flex)
+
+ 		true
reasonstring +
+ 		true
statusenum +
+
+ Enum: True, False, Unknown
+ 		true
typestring +
true
observedGenerationinteger +
+
+ Format: int64
+ Minimum: 0
+ 		false
-### status.certificatesStatus +### status.initContainerFailures[] [↩ Parent](#status) -Stores information about cluster certificates and their update process. In Active-Active databases, this is used to detect updates to the certificates, and trigger synchronization across the participating clusters. +InitContainerFailure describes a failed operator-managed init container detected in one of the cluster's pods. @@ -4714,19 +6140,40 @@ Stores information about cluster certificates and their update process. In Activ - + + + + + + - + + + + + + + + + + + @@ -4851,6 +6298,34 @@ Indicates cluster APIs that are being managed by the operator. This only applies + + + + + + + + + + + + + + + + + + + +
generationcontainerNamestring + Name of the init container that failed.
+ 		false
exitCode integer - Generation stores the version of the cluster's Proxy and Syncer certificate secrets. This generation counter is automatically incremented when proxy or syncer certificates are updated. In Active-Active databases (REAADB), the operator monitors this field to detect certificate changes and automatically triggers a CRDB force update (equivalent to 'crdb-cli crdb update --force'), which synchronizes the certificate changes to all participating clusters, eliminating the need for manual intervention to maintain sync.
+ Exit code of the failed init container, when known.

- Format: int64
+ Format: int32
 false
updateStatusmessage string - The status of the cluster's certificates update
+ Human-readable description of the failure, including the command to inspect the init container logs for the underlying cause.
+ 		false
podNamestring + Name of the pod whose init container failed.
+ 		false
reasonstring + Reason reported by Kubernetes for the failure (for example, "Error" or "CrashLoopBackOff").
 false
apiCertificateBasedAuthboolean + Indicate whether control-plane certificate-based authentication (CBA) is managed by the operator. Enabled once spec.apiCertificateBasedAuth is set for the first time. Once enabled, the operator keeps reconciling the cluster's mtls_certificate_authentication setting even if the spec block is removed; in that case the operator disables it.
+ 		false
clientMaintenanceNotificationsOssModeboolean + Indicate whether OSS cluster client maintenance notifications are managed by the operator. Enabled once spec.clientMaintenanceNotifications.ossMode.enabled is set for the first time, and stays enabled if the field is later removed; in that case the operator disables the setting.
+ 		false
clientMaintenanceNotificationsProxyModeboolean + Indicate whether proxy-mode client maintenance notifications are managed by the operator. Enabled once spec.clientMaintenanceNotifications.proxyMode.enabled is set for the first time, and stays enabled if the field is later removed; in that case the operator disables the setting.
+ 		false
disconnectClientsOnPasswordRemovalboolean + Indicate whether disconnect-clients-on-password-removal is managed by the operator. Enabled automatically for new clusters. Once enabled, the operator keeps reconciling the cluster value even if the user removes spec.disconnectClientsOnPasswordRemoval; in that case the operator writes the auto default.
+ 		false
ldap boolean @@ -4960,6 +6435,45 @@ An API object that represents the cluster's OCSP status
+### status.operatorClientCertStatus +[↩ Parent](#status) + +Status of the operator's control-plane client certificate when spec.operatorClientAuth.method is Certificate. Cleared when certificate authentication is not in use. + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
expirationDatestring + When the leaf client certificate expires (RFC3339).
+ 		false
secretNamestring + Name of the secret referenced by spec.operatorClientAuth.clientCertificateSecretName.
+ 		false
statestring + State of the client certificate: Valid, ExpiringSoon, or Expired.
+ 		false
+ + ### status.persistenceStatus [↩ Parent](#status) diff --git a/content/operate/kubernetes/reference/api/redis_enterprise_database_api.md b/content/operate/kubernetes/reference/api/redis_enterprise_database_api.md index 54d6142968..dfda6695cd 100644 --- a/content/operate/kubernetes/reference/api/redis_enterprise_database_api.md +++ b/content/operate/kubernetes/reference/api/redis_enterprise_database_api.md @@ -103,6 +103,17 @@ RedisEnterpriseDatabaseSpec defines the desired state of RedisEnterpriseDatabase Database auditing configuration.
false + + authorizedSubjects + []object + + Client certificate subjects authorized to connect when clientCertSubjectValidationType is +'SanCn' or 'FullSubject', which require at least one entry. Maps to the database's +'authorized_subjects' setting. Subject attributes are case-sensitive. +If neither field was ever set, the operator leaves the database setting unchanged; otherwise +an omitted value means an empty list (see status.managedFields).
+ + false backup object @@ -117,6 +128,24 @@ RedisEnterpriseDatabaseSpec defines the desired state of RedisEnterpriseDatabase The Secrets containing TLS Client Certificate to use for Authentication
false + + clientCertSubjectValidationType + enum + + Additional validation of client certificate subjects during mutual TLS authentication. +Maps to the database's 'client_cert_subject_validation_type' setting. +'Disabled' performs no subject validation; 'SanCn' requires the certificate's Subject +Alternative Name (SAN) DNS entries or Common Name (CN) to match an authorizedSubjects entry; +'FullSubject' requires the full certificate subject to match an entry. +Applies only to client certificates validated through a CA certificate listed in +clientAuthenticationCertificates; listed leaf certificates skip this validation. +Required when authorizedSubjects is set. If neither field was ever set, the operator leaves +the database setting unchanged; otherwise an omitted value means 'Disabled' +(see status.managedFields).
+
+ Enum: Disabled, SanCn, FullSubject
+ + false connectionSettings object @@ -159,6 +188,13 @@ RedisEnterpriseDatabaseSpec defines the desired state of RedisEnterpriseDatabase Allows connections with the default user. When disabled, the DatabaseSecret is not created or updated.
false + + disconnectClientsOnPasswordRemoval + boolean + + Controls whether the proxy disconnects clients of this database whose password was removed. Effective only when the cluster-level setting is "Auto" (see the RedisEnterpriseCluster field of the same name). The operator takes ownership of this BDB setting once the field is set (recorded in status.managedFields); removing the field afterwards resets the BDB to the false default. Requires Redis Enterprise 8.0 or newer.
+ + false evictionPolicy string @@ -245,6 +281,13 @@ RedisEnterpriseDatabaseSpec defines the desired state of RedisEnterpriseDatabase Redis OSS version. Version can be specified via prefix, or via channels - for existing databases - Upgrade Redis OSS version. For new databases - the version which the database will be created with. If set to 'major' - will always upgrade to the most recent major Redis version. If set to 'latest' - will always upgrade to the most recent Redis version. Depends on 'redisUpgradePolicy' - if you want to set the value to 'latest' for some databases, you must set redisUpgradePolicy on the cluster before. Possible values are 'major' or 'latest' When using upgrade - make sure to backup the database before. This value is used only for database type 'redis'
false + + replicaReadOnly + boolean + + Boolean (default: false); If true, enables an Active-Passive setup where Replica Of databases only allow read operations. Only configurable during database creation and cannot be changed later.
+ + false replicaSources []object @@ -304,6 +347,13 @@ RedisEnterpriseDatabaseSpec defines the desired state of RedisEnterpriseDatabase Number of database server-side shards.
false + + sharding + object + + Sharding-related configuration. The number of shards and their placement are controlled by the existing top-level shardCount and shardsPlacement. Not supported for Active-Active databases.
+ + false shardingEnabled boolean @@ -1059,6 +1109,66 @@ the characters '&', '<', '>' or '"'. At most 512 usernames are allowed.
+### spec.authorizedSubjects[] +[↩ Parent](#spec) + +An X.509 certificate subject (distinguished name) authorized to authenticate using a client certificate. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
CNstring + Common Name (CN) component of the certificate subject. Required.
+ 		true
Cstring + Country (C) component of the certificate subject.
+ 		false
Lstring + Locality (L) component of the certificate subject.
+ 		false
Ostring + Organization (O) component of the certificate subject.
+ 		false
OU[]string + Organizational Unit (OU) components of the certificate subject.
+ 		false
STstring + State or province (ST) component of the certificate subject.
+ 		false
+ + ### spec.backup [↩ Parent](#spec) @@ -1640,6 +1750,93 @@ Redis Enterprise Role and ACL Binding +### spec.sharding +[↩ Parent](#spec) + +Sharding-related configuration. The number of shards and their placement are controlled by the existing top-level shardCount and shardsPlacement. Not supported for Active-Active databases. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
asmScalingboolean + Enables smooth scaling via Atomic Slot Migration: shardCount then accepts any value, in any direction, including decreasing the count. Requires autoShardsBalancing. Not supported for Active-Active or Redis-on-Flash databases.
+ 		false
autoShardsBalancingboolean + Enables RS shard balancing for this database, including background auto-rebalancing: RS may move data between shards on its own whenever their imbalance exceeds the configured thresholds, see autoShardsBalancingSettings. Requires hashingPolicy OssSharding and a database Redis version of 8.4 or above. Note: enabling this also turns on the database's internal cluster mode (redis_cluster_enabled), which RS requires for balancing. Cluster mode stays on when balancing is disabled again - RS won't allow disabling it once the database has shards with split slot ranges.
+ 		false
autoShardsBalancingSettingsobject + Optional tuning of autoShardsBalancing. Every field has a default, which is used both when the settings are absent and when an individual field is unset. The settings are ignored while autoShardsBalancing is off.
+ 		false
hashingPolicyenum + Hashing policy for a sharded database. Defaults to ShardKeyRegex (regex-based hashing) when absent. Note: once the database has shards with split slot ranges, RS won't allow reverting from OssSharding back to ShardKeyRegex.
+
+ Enum: ShardKeyRegex, OssSharding
+ 		false
+ + +### spec.sharding.autoShardsBalancingSettings +[↩ Parent](#specsharding) + +Optional tuning of autoShardsBalancing. Every field has a default, which is used both when the settings are absent and when an individual field is unset. The settings are ignored while autoShardsBalancing is off. + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
gracePeriodSecondsinteger + The imbalance must persist for this long before a rebalance starts. Defaults to 120 when unset.
+ 		false
shardImbalanceThresholdint or string + Rebalance only when a shard deviates from its ideal size by at least this much. The effective trigger is the larger of this and shardImbalanceThresholdPercentage. Defaults to 300Mi when unset. Values below the Redis Enterprise minimum (50Mi) are rejected by the cluster.
+ 		false
shardImbalanceThresholdPercentageinteger + Rebalance only when a shard deviates from its ideal size by at least this percent. The effective trigger is the larger of this and shardImbalanceThreshold. Defaults to 20 when unset.
+ 		false
+ + ### spec.upgradeSpec [↩ Parent](#spec) @@ -1700,6 +1897,13 @@ RedisEnterpriseDatabaseStatus defines the observed state of RedisEnterpriseDatab BigStore version for Redis on Flash databases (1 for Auto Tiering, 2 for Redis Flex). Read-only field populated from RS.
false + + conditions + []object + + Conditions hold the latest observations of the database's state, e.g. the ScalingInProgress condition while a shardCount change is applied.
+ + false createdTime string @@ -1765,6 +1969,15 @@ RedisEnterpriseDatabaseStatus defines the observed state of RedisEnterpriseDatab Format: int64
false + + observedShardCount + integer + + The database's current shard count, as reported by the Redis Enterprise cluster.
+
+ Format: int32
+ + false redisEnterpriseCluster string @@ -1796,6 +2009,13 @@ apply to every database in the Redis Enterprise Cluster).
Aggregated statuses of shards
false + + shardSyncStatuses + map[string]integer + + Aggregated sync statuses of shards ('in_progress' / 'idle' / 'link_down')
+ + false specStatus string @@ -1920,6 +2140,73 @@ Information on the database's periodic backup +### status.conditions[] +[↩ Parent](#status) + +Condition contains details for one aspect of the current state of this API Resource. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameTypeDescriptionRequired
lastTransitionTimestring +
+
+ Format: date-time
+ 		true
messagestring +
+ 		true
reasonstring +
+ 		true
statusenum +
+
+ Enum: True, False, Unknown
+ 		true
typestring +
+ 		true
observedGenerationinteger +
+
+ Format: int64
+ Minimum: 0
+ 		false
+ + ### status.internalEndpoints[] [↩ Parent](#status) diff --git a/content/operate/kubernetes/reference/api/redis_enterprise_remote_cluster_api.md b/content/operate/kubernetes/reference/api/redis_enterprise_remote_cluster_api.md index 6bd2c71962..8dedb2cc3c 100644 --- a/content/operate/kubernetes/reference/api/redis_enterprise_remote_cluster_api.md +++ b/content/operate/kubernetes/reference/api/redis_enterprise_remote_cluster_api.md @@ -117,11 +117,21 @@ Represents a remote participating cluster. Database URL suffix. Used for the Active-Active database replication endpoint and replication endpoint SNI.
false + + replicationPort + integer + + External port used for Active-Active database replication when databases are exposed via the Gateway API. A single port serves all Active-Active databases in this remote cluster, distinguished by SNI.
+
+ Minimum: 1
+ Maximum: 65535
+ + false secretName string - Name of the secret containing cluster credentials. Must use the following format: "redis-enterprise-".
+ Name of the secret containing cluster credentials. Must use the following format: "redis-enterprise-". The secret holds either basic-auth credentials ('username' and 'password' keys), or a client certificate/key pair of a cluster user with the proper permissions ('certificate'/'cert'/'tls.crt' and 'tls.key'/'key' keys, or a TLS-type secret), optionally with a 'trusted_ca' PEM bundle for verifying the cluster's server certificate.
false diff --git a/content/operate/kubernetes/reference/supported_k8s_distributions.md b/content/operate/kubernetes/reference/supported_k8s_distributions.md index 21c2593d5e..c782a4eb0d 100644 --- a/content/operate/kubernetes/reference/supported_k8s_distributions.md +++ b/content/operate/kubernetes/reference/supported_k8s_distributions.md @@ -34,7 +34,7 @@ The tables below use the following status icons: ### Latest release -Operator release **8.2.0-12** supports the following Kubernetes and OpenShift versions. +Operator release **8.2.6-21** supports the following Kubernetes and OpenShift versions. | OpenShift | Kubernetes | Support status | |---|---|---| @@ -48,30 +48,30 @@ Operator release **8.2.0-12** supports the following Kubernetes and OpenShift ve The following table lists the Kubernetes versions supported by every operator version. Operator versions run from newest (left) to oldest (right). -{{}}| | Redis operator | **8.2.0-12** | **8.0.20-21** | **8.0.18-11** | **8.0.10-15** | **8.0.6-6** | **8.0.2-2** | **7.22.2-21** | **7.22.0-15** | **7.22.0-7** | **7.8.6-1** | **7.8.4-9** | **7.8.4-8** | **7.8.2-6** | **7.4.6-2** | **7.4.2-12** | **7.4.2-2** | **7.2.4-12** | **7.2.4-7** | **7.2.4-2** | **6.4.2-8** | **6.4.2-6** | **6.4.2-5** | **6.4.2-4** | **6.2.18-41** | **6.2.18-3** | **6.2.12-1** | **6.2.10-45** | **6.2.10-34** | **6.2.10-4** | **6.2.8-15** | **6.2.8-11** | **6.2.8-2** | **6.2.4-1** | -|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| -| | | July 2026 | May 2026 | March 2026 | Jan 2026 | Dec 2025 | Oct 2025 | Oct 2025 | July 2025 | April 2025 | March 2025 | March 2025 | Feb 2025 | Nov 2024 | July 2024 | May 2024 | March 2024 | Dec 2023 | Oct 2023 | Aug 2023 | July 2023 | June 2023 | April 2023 | March 2023 | Jan 2023 | Nov 2022 | Sept 2022 | July 2022 | May 2022 | March 2022 | Jan 2022 | Jan 2022 | Nov 2021 | Sept 2021 | -| OpenShift | Kubernetes | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| — | 1.36 | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| 4.22 | 1.35 | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| 4.21 | 1.34 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | | | -| 4.20 | 1.33 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | -| 4.19 | 1.32 | ⚠️ | ⚠️ | ⚠️ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | -| 4.18 | 1.31 | ❌ | ⚠️ | ⚠️ | ⚠️ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | -| 4.17 | 1.30 | | | | | | ❌ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | -| 4.16 | 1.29 | | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | -| 4.15 | 1.28 | | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | -| 4.14 | 1.27 | | | | | | | | | | | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | -| 4.13 | 1.26 | | | | | | | | | | | | | | ⚠️ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | -| 4.12 | 1.25 | | | | | | | | | | | | | | | | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | -| 4.11 | 1.24 | | | | | | | | | | | | | | | | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | -| 4.10 | 1.23 | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | -| 4.09 | 1.22 | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | -| 4.08 | 1.21 | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | -| 4.07 | 1.20 | | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | -| 4.06 | 1.19 | | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | -| 4.05 | 1.18 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ✅ | ✅ | ✅ | ✅ | ✅ | -| 4.04 | 1.17 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | -| 4.03 | 1.16 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | +{{}}| | Redis operator | **8.2.6-21** | **8.2.0-12** | **8.0.20-21** | **8.0.18-11** | **8.0.10-15** | **8.0.6-6** | **8.0.2-2** | **7.22.2-21** | **7.22.0-15** | **7.22.0-7** | **7.8.6-1** | **7.8.4-9** | **7.8.4-8** | **7.8.2-6** | **7.4.6-2** | **7.4.2-12** | **7.4.2-2** | **7.2.4-12** | **7.2.4-7** | **7.2.4-2** | **6.4.2-8** | **6.4.2-6** | **6.4.2-5** | **6.4.2-4** | **6.2.18-41** | **6.2.18-3** | **6.2.12-1** | **6.2.10-45** | **6.2.10-34** | **6.2.10-4** | **6.2.8-15** | **6.2.8-11** | **6.2.8-2** | **6.2.4-1** | +|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| +| | | Oct 2026 | July 2026 | May 2026 | March 2026 | Jan 2026 | Dec 2025 | Oct 2025 | Oct 2025 | July 2025 | April 2025 | March 2025 | March 2025 | Feb 2025 | Nov 2024 | July 2024 | May 2024 | March 2024 | Dec 2023 | Oct 2023 | Aug 2023 | July 2023 | June 2023 | April 2023 | March 2023 | Jan 2023 | Nov 2022 | Sept 2022 | July 2022 | May 2022 | March 2022 | Jan 2022 | Jan 2022 | Nov 2021 | Sept 2021 | +| OpenShift | Kubernetes | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| — | 1.36 | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| 4.22 | 1.35 | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| 4.21 | 1.34 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | | | +| 4.20 | 1.33 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | | | +| 4.19 | 1.32 | ⚠️ | ⚠️ | ⚠️ | ⚠️ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | | | | +| 4.18 | 1.31 | | ❌ | ⚠️ | ⚠️ | ⚠️ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | | +| 4.17 | 1.30 | | | | | | | ❌ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | | | +| 4.16 | 1.29 | | | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | | +| 4.15 | 1.28 | | | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | | | | | +| 4.14 | 1.27 | | | | | | | | | | | | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | | | +| 4.13 | 1.26 | | | | | | | | | | | | | | | ⚠️ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | | | +| 4.12 | 1.25 | | | | | | | | | | | | | | | | | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | | | +| 4.11 | 1.24 | | | | | | | | | | | | | | | | | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | | +| 4.10 | 1.23 | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | | | | +| 4.09 | 1.22 | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | | +| 4.08 | 1.21 | | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | +| 4.07 | 1.20 | | | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | +| 4.06 | 1.19 | | | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | ✅ | ✅ | ✅ | ✅ | ✅ | +| 4.05 | 1.18 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ✅ | ✅ | ✅ | ✅ | ✅ | +| 4.04 | 1.17 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | +| 4.03 | 1.16 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ❌ | ⚠️ | {{}} diff --git a/content/operate/kubernetes/release-notes/8-2-6-releases/8-2-6-21-october2026.md b/content/operate/kubernetes/release-notes/8-2-6-releases/8-2-6-21-october2026.md new file mode 100644 index 0000000000..7e7e52927f --- /dev/null +++ b/content/operate/kubernetes/release-notes/8-2-6-releases/8-2-6-21-october2026.md @@ -0,0 +1,151 @@ +--- +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Feature release with Kubernetes Gateway API support, certificate-based authentication for the REST API, client maintenance notifications, FIPS 140-3 on Amazon EKS with Bottlerocket, and Redis Software 8.2.6. +hideListLinks: true +linkTitle: 8.2.6-21 (October 2026) +title: Redis Software for Kubernetes 8.2.6-21 (October 2026) release notes +weight: 27 +--- + +Redis Software for Kubernetes 8.2.6-21 is a feature release that supports [Redis Software 8.2.6](/content/operate/rs/release-notes/rs-8-2-releases/_index.md) and includes new features, bug fixes, and enhancements. + +## Highlights + +- Support for exposing cluster endpoints and Active-Active databases through the Kubernetes Gateway API. +- Certificate-based authentication for the Redis Software REST API, with the option to turn off basic authentication. +- Support for Redis Software 8.2.6. + +## Enhancements + +- Added support for exposing the cluster's REST API, Cluster Manager UI, and metrics endpoints, and Active-Active databases, through the [Kubernetes Gateway API](/content/operate/kubernetes/networking/gateway-api.md) +- Added [certificate-based authentication](/content/operate/kubernetes/security/authentication/certificate-auth.md) to the REST API for the operator and for users, and the option to turn off basic authentication +- Added REC support for client maintenance notifications, for databases that use the OSS Cluster API and for databases in proxy mode +- Added [FIPS 140-3](/content/operate/kubernetes/security/fips.md) support on Amazon EKS with Bottlerocket FIPS worker nodes +- Added the `disconnectClientsOnPasswordRemoval` setting to the REC, REDB, and REAADB, which controls whether the proxy disconnects clients whose password was removed +- Added support for custom labels on database Services, which the services rigger no longer removes +- Added Redis Software 8.2.6 support + +## Resolved issues + +- Fixed the operator overwriting `nodeAffinity` and `podAffinity` set in `redisEnterpriseAdditionalPodSpecAttributes` +- Fixed the REC getting stuck in the Upgrade state after you upgraded a FIPS-enabled cluster +- Fixed changes to module arguments on an existing REDB not being applied to the database shards +- Fixed the operator failing to update the REC LDAP configuration when you switched `spec.ldap.authenticationQuery` from `template` to `query` +- Fixed new REAADBs being created without modules when `spec.globalConfigurations.modulesList` wasn't set +- Fixed `ossCluster` being ignored for REDBs that use the `all-nodes` proxy policy +- Fixed the log collector in restricted mode leaving collected resources out of the package when it couldn't read PersistentVolumes +- Fixed the log collector leaving out the error message when it failed to collect a resource + +## API changes + +This release adds fields for Gateway API exposure, REST API authentication, client maintenance notifications, and client certificate validation. The table below summarizes the notable changes. For the complete field-level reference, see the [API reference](/content/operate/kubernetes/reference/api/_index.md). + +| **CRD** | **Field** | **Change** | **Description** | +|---|---|---|---| +| REC | `spec.gateway` | Added | Exposes the cluster's REST API, Cluster Manager UI, and metrics endpoints, and Active-Active databases, through the Kubernetes Gateway API. | +| REC | `status.gateway` | Added | Reports the status of Gateway API exposure. | +| REC | `spec.apiCertificateBasedAuth` | Added | Configures certificate-based authentication for the REST API, including the trusted CA and authorized certificate subjects. | +| REC | `spec.operatorClientAuth` | Added | Selects whether the operator authenticates to the REST API with a username and password (`Basic`) or a client certificate (`Certificate`). | +| REC | `spec.apiBasicAuth` | Added | Turns basic (username and password) authentication for the REST API on or off. | +| REC | `status.apiCertificateBasedAuthActive`, `status.operatorClientCertStatus` | Added | Report whether certificate-based authentication is active and the state of the operator's client certificate. | +| REC | `spec.clientMaintenanceNotifications` | Added | Enables client maintenance notifications for databases that use the OSS Cluster API (`ossMode`) and for databases in proxy mode (`proxyMode`). | +| REC | `spec.disconnectClientsOnPasswordRemoval` | Added | Controls whether the proxy disconnects clients whose password was removed, cluster-wide. | +| REC | `status.initContainerFailures` | Added | Lists operator-managed init containers that are failing, one entry per pod and container. | +| REDB | `spec.disconnectClientsOnPasswordRemoval` | Added | Per-database setting for disconnecting clients whose password was removed. Takes effect only when the cluster-level setting is `Auto`. | +| REDB | `spec.clientCertSubjectValidationType`, `spec.authorizedSubjects` | Added | Validate client certificate subjects during mutual TLS authentication. | +| REDB | `spec.replicaReadOnly` | Added | Makes a Replica Of database read-only, for an Active-Passive setup. Configurable only when you create the database. | +| REAADB | `spec.globalConfigurations.disconnectClientsOnPasswordRemoval` | Added | Per-database setting for disconnecting clients whose password was removed. | +| REAADB | `spec.globalConfigurations.clientCertSubjectValidationType`, `spec.globalConfigurations.authorizedSubjects` | Added | Validate client certificate subjects during mutual TLS authentication. | +| REAADB | `status.participatingClusters[].replicationEndpoint` | Added | Reports the replication endpoint each participating cluster advertises. | +| RERC | `spec.replicationPort` | Added | External port for Active-Active replication when databases are exposed through the Gateway API. One port serves all Active-Active databases in the remote cluster. | + +## Supported distributions + +Redis Software for Kubernetes is compatible with [CNCF-conformant](https://www.cncf.io/training/certification/software-conformance/) Kubernetes platforms. The operator follows standard Kubernetes APIs and practices and is designed to run consistently across certified Kubernetes environments. + +The following table shows supported Kubernetes versions at the time of this release. For a list of platforms tested with this release, see [Supported Kubernetes distributions](/content/operate/kubernetes/reference/supported_k8s_distributions.md). + +| Kubernetes | **Redis 8.2.6-21** | +|---|---| +| 1.36 | Supported | +| 1.35 | Supported | +| 1.34 | Supported | +| 1.33 | Supported | +| 1.32 | Deprecated | + +## Downloads + +- **Redis Enterprise**: `redislabs/redis:8.2.6-25.21` (`redislabs/redis:8.2.6-25.21.minimal` for minimal base image) +- **Operator**: `redislabs/operator:8.2.6-21` +- **Services Rigger**: `redislabs/k8s-controller:8.2.6-21` +- **Call Home Client**: `redislabs/re-call-home-client:8.2.6-21` + +### OpenShift downloads + +- **OLM operator bundle**: `8.2.6-21.1` +- **Redis Enterprise**: `registry.connect.redhat.com/redislabs/redis-enterprise:8.2.6-25.21` (`registry.connect.redhat.com/redislabs/redis-enterprise:8.2.6-25.21.minimal` for minimal base image) +- **Operator**: `registry.connect.redhat.com/redislabs/redis-enterprise-operator:8.2.6-21` +- **Services Rigger**: `registry.connect.redhat.com/redislabs/services-manager:8.2.6-21` +- **Call Home Client**: `registry.connect.redhat.com/redislabs/call-home-client:8.2.6-21` + +## Known limitations + +- **Active-Active database updates can be rejected after upgrading to 8.2.6.** On clusters running versions earlier than 8.2.6, a cluster master failover (for example, during a Kubernetes operator upgrade) can interrupt a change to an Active-Active database while the change is in progress. After the upgrade to 8.2.6, updates to that database can still be rejected with 409 – Another operation is already in progress. This only happens if the configuration change started within seconds of the failover. Workaround: Before you upgrade, wait until all pending Active-Active database changes have finished. + +- **SSO configuration does not work with IPv6 or dual-stack (IPv4/IPv6) clusters.** + +- **Upgrades from versions earlier than 7.4.2-2 are not supported.** If you use an earlier version, upgrade to 7.4.2-2 before upgrading to this version. + +- **Missing endpoint for admission endpoint (rare).** Restart the operator pod. + +- **The REDB `redisVersion` field cannot be used for memcached databases.** + +- **Modifying the database suffix for an Active-Active database while the services rigger is terminating causes a loop.** The services rigger deletes and recreates ingress or route resources repeatedly. Wait for the services rigger pod to finish terminating before modifying the suffix. + +- **REAADB changes might fail with "gateway timeout" errors, especially on OpenShift.** Retry the operation. + +- **Creating two databases with the same name in the Redis Enterprise Cluster Manager UI deletes the service and makes the database unavailable.** Avoid duplicate database names. The admission controller prevents duplicate names when you create databases through the Kubernetes operator. + +- **Installing the operator bundle produces the warning `Warning: would violate PodSecurity "restricted: v1.24"`.** Ignore this warning. Red Hat documentation identifies this issue as benign. + +- **RERC resources must have a unique name.** The `rec-name/rec-namespace` string must differ from all other participating clusters in the Active-Active database. + +- **Admission does not block REAADB resources with a `shardCount` that exceeds the license quota.** Correct the REAADB configuration and reapply. + +- **The Active-Active controller supports only global database options.** Location-specific configuration is not supported. + +- **Removing an Active-Active setup might leave services or routes undeleted.** Delete the services or routes manually. + +- **Setting `autoUpgrade` to `true` can cause unexpected database upgrades when `redisUpgradePolicy` is also `true`.** Contact support if your deployment is affected. + +- **Using the previous quick start guide causes REDB creation issues due to an unrecognized memory field name.** Use the current version of the Deploy Redis Enterprise Software for Kubernetes guide. + +- **PVC size does not work with decimal values.** Use integer values for the PVC size. + +- **REC might report error states on initial startup.** No workaround exists. Ignore the errors. + +- **HashiCorp Vault integration does not support Gesher.** No workaround exists. Gesher support is deprecated. + +- **REC clusters fail to start on Kubernetes clusters with unsynchronized clocks.** Use NTP to synchronize the underlying Kubernetes nodes. + +- **Deleting an OpenShift project with a deployed REC might hang.** When an REC cluster is deployed in a project (namespace) with REDB resources, you must delete the REDB resources before deleting the REC. The project deletion hangs until you delete the REDB resources. Delete the REDB resources first, then delete the REC, and then delete the project. + +- **Clusters must be named "rec" in OLM-based deployments.** When you deploy the operator through OLM, the security context constraints (SCC) are bound to a specific service account name ("rec"). The deployment fails if the cluster has a different name. + +- **Readiness probe does not correctly report failures.** The StatefulSet readiness probe does not mark a node as "not ready" when running `rladmin status` on node failure. + +- **Internal DNS and Kubernetes DNS might conflict.** DNS conflicts can occur between the cluster `mdns_server` and Kubernetes DNS. This affects only DNS resolution from within cluster nodes for Kubernetes DNS names. + +- **Kubernetes-based 5.4.10 clusters might negatively affect existing 5.4.6 clusters.** Upgrade your clusters to the latest version. + +- **Node CPU usage is reported instead of pod CPU usage.** The reported CPU usage is for the Kubernetes worker node hosting the REC pod, not the pod itself. + +- **An unreachable cluster shows status as running.** When a cluster is unreachable, the status remains `running` instead of showing an error. + +- **Long cluster names cause routes to be rejected.** A cluster name longer than 20 characters causes route rejection because the host part of the domain name exceeds 63 characters. Limit the cluster name to 20 characters or fewer. + +- **Cluster CR (REC) errors are not reported after invalid updates.** A cluster CR specification error is not reported if you update two or more invalid CR resources in sequence. diff --git a/content/operate/kubernetes/release-notes/8-2-6-releases/_index.md b/content/operate/kubernetes/release-notes/8-2-6-releases/_index.md new file mode 100644 index 0000000000..2bd4cecc23 --- /dev/null +++ b/content/operate/kubernetes/release-notes/8-2-6-releases/_index.md @@ -0,0 +1,36 @@ +--- +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Releases with support for Redis Software 8.2.6 +hideListLinks: true +linkTitle: 8.2.6 releases +title: Redis Software for Kubernetes 8.2.6 release notes +weight: 82 +--- + +Redis Software for Kubernetes 8.2.6 includes new features, bug fixes, enhancements, and support for Redis Software 8.2.6. The latest release is 8.2.6-21 with support for Redis Software version 8.2.6-25. + +## Detailed release notes + +{{}} + +## Supported distributions + +Redis Software for Kubernetes is compatible with [CNCF-conformant](https://www.cncf.io/training/certification/software-conformance/) Kubernetes platforms. The operator follows standard Kubernetes APIs and practices and is designed to run consistently across certified Kubernetes environments. + +The following table shows supported Kubernetes versions at the time of this release. For a list of platforms tested with this release, see [Supported Kubernetes distributions](/content/operate/kubernetes/reference/supported_k8s_distributions.md). + +| Kubernetes | **Redis 8.2.6** | +|---|---| +| 1.36 | Supported | +| 1.35 | Supported | +| 1.34 | Supported | +| 1.33 | Supported | +| 1.32 | Deprecated | + +## Known limitations + +See the [8.2.6-21 (October 2026)](/content/operate/kubernetes/release-notes/8-2-6-releases/8-2-6-21-october2026.md) release notes for known limitations. diff --git a/content/operate/kubernetes/security/access-control/manage-users.md b/content/operate/kubernetes/security/access-control/manage-users.md index d1455f8f27..a726c575b5 100644 --- a/content/operate/kubernetes/security/access-control/manage-users.md +++ b/content/operate/kubernetes/security/access-control/manage-users.md @@ -60,7 +60,7 @@ The new user has no permissions until you create a role binding. The operator as | --- | --- | --- | | `spec.email` | Yes | Must be unique in the cluster. | | `spec.username` | No | Defaults to a generated value. ASCII only, excluding `&`, `<`, `>`, `"`. The effective value appears in `status.username`. | -| `spec.passwordSecrets` | Yes | At least one Secret. Each Secret must have a `password` key. | +| `spec.passwordSecrets` | Yes, unless `authMethod` is `Certificate` | At least one Secret. Each Secret must have a `password` key. Leave empty for [certificate-based users](/content/operate/kubernetes/security/authentication/certificate-auth.md#add-certificate-based-users). | | `spec.passwordMode` | No | `Single` (default) or `Rotatable`. See [Choose a password mode](#choose-a-password-mode). | | `spec.alerts` | No | Email alert settings. Effective only when [cluster alerts](/content/operate/rs/clusters/configure/cluster-settings.md#alert-settings) are configured. | @@ -111,6 +111,8 @@ In Rotatable mode the operator makes referenced Kubernetes Secrets immutable, so `status.passwordSecrets` lists each active Secret with its resolved version. +The cluster's `disconnectClientsOnPasswordRemoval` setting controls whether connections that authenticated with the removed password are actively disconnected. When the cluster setting is `Auto`, the database's own setting controls it. See [Disconnect clients on password removal](/content/operate/kubernetes/re-clusters/_index.md#disconnect-clients-on-password-removal). + ## Update the email address You can change `spec.email` only while `passwordSecrets` contains exactly one entry. If a Rotatable rotation is in progress, reduce to a single secret first, change the email, then add the second secret back. diff --git a/content/operate/kubernetes/security/authentication/_index.md b/content/operate/kubernetes/security/authentication/_index.md index cc4b03d3eb..13b5596500 100644 --- a/content/operate/kubernetes/security/authentication/_index.md +++ b/content/operate/kubernetes/security/authentication/_index.md @@ -44,3 +44,4 @@ The underlying Redis Software behavior is unchanged. For concepts and reference - [Configuration secrets](/content/operate/kubernetes/security/authentication/configuration-secrets.md) — store config items in Kubernetes Secrets and reconcile updates automatically. - [LDAP authentication](/content/operate/kubernetes/security/authentication/ldap.md) — configure LDAP for Cluster Manager and database access. - [SSO authentication](/content/operate/kubernetes/security/authentication/sso.md) — configure SAML single sign-on for the Cluster Manager UI. +- [REST API certificate authentication](/content/operate/kubernetes/security/authentication/certificate-auth.md) — authenticate the operator and users to the REST API with client certificates, and optionally turn off password authentication. diff --git a/content/operate/kubernetes/security/authentication/certificate-auth.md b/content/operate/kubernetes/security/authentication/certificate-auth.md new file mode 100644 index 0000000000..1db2d38740 --- /dev/null +++ b/content/operate/kubernetes/security/authentication/certificate-auth.md @@ -0,0 +1,290 @@ +--- +Title: Authenticate to the REST API with client certificates +alwaysopen: false +categories: +- docs +- operate +- kubernetes +description: Authenticate the operator and users to the Redis Software REST API with client certificates, and optionally turn off password authentication. +linkTitle: REST API certificate auth +weight: 50 +--- + +The operator and your users can authenticate to the Redis Software REST API with client certificates instead of usernames and passwords. After they all use certificates, you can turn off basic (username and password) authentication. + +Three `RedisEnterpriseCluster` (REC) spec blocks control this: + +| Spec block | What it controls | +| --- | --- | +| `apiCertificateBasedAuth` | Whether the cluster accepts client certificates on the REST API, which CA it trusts, and which certificate subjects it authorizes. | +| `operatorClientAuth` | Which credential the operator presents to the REST API: a username and password (`Basic`) or a client certificate (`Certificate`). | +| `apiBasicAuth` | Whether the cluster accepts usernames and passwords on the REST API. | + +Enabling certificate-based authentication adds a way to authenticate. It doesn't remove basic authentication. Passwords keep working until you set `apiBasicAuth.enabled` to `false`. Each user and the operator authenticates with one method, so you can move them to certificates one at a time while the others keep using passwords. + +For how certificate-based authentication works in Redis Software, see [Certificate-based authentication](/content/operate/rs/security/certificates/certificate-based-authentication.md) and [Disable basic authentication for the REST API](/content/operate/rs/security/access-control/disable-basic-authentication.md). + +## Before you start + +- Requires Redis Software for Kubernetes operator `8.2.6-21` or later. +- You need a certificate authority (CA) that signs your client certificates, and its CA certificate in PEM format. +- You need a client certificate and private key for the operator, signed by that CA. +- Disabling basic authentication requires Redis Software 8.2.0 or later. +- Create all secrets in the same namespace as the REC. + +## Enable certificate-based authentication + +1. Create a secret that holds the trusted CA certificate. The CA certificate must be under a key named `certificate`, `cert`, or `tls.crt`: + + ```sh + kubectl create secret generic \ + --from-file=cert= + ``` + +1. Create a secret that holds the operator's client certificate and private key. Use a [kubernetes.io/tls](https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets) secret, such as one cert-manager produces, or an opaque secret with the certificate under `tls.crt` or `cert` and the key under `tls.key` or `key`: + + ```sh + kubectl create secret tls \ + --cert= \ + --key= + ``` + +1. Get the certificate's subject in RFC 2253 format: + + ```sh + openssl x509 -in -noout -subject -nameopt RFC2253 + ``` + + You declare this subject in the next step, without the `subject=` prefix. It must match the certificate's subject exactly, or the operator rejects the spec. + +1. Add `apiCertificateBasedAuth` and `operatorClientAuth` to the `spec` section of your existing REC file: + + ```yaml + spec: + apiCertificateBasedAuth: + enabled: true + trustedCASecretName: + clientCertSubjectValidationType: FullSubject + operatorClientAuth: + method: Certificate + clientCertificateSecretName: + certificateSubjectLine: CN=,O= + ``` + + With `FullSubject`, only certificates whose full subject is listed in `authorizedSubjects` can authenticate. The operator adds its own subject for you. + +1. Apply the REC. This change triggers a rolling update of the cluster, because the operator updates the Redis Software pods to present the client certificate. + + ```sh + kubectl apply -f .yaml + ``` + +1. Confirm that the cluster accepts certificates and that the operator's certificate is valid: + + ```sh + kubectl get rec -o jsonpath='{.status.apiCertificateBasedAuthActive}{"\n"}{.status.operatorClientCertStatus}{"\n"}' + ``` + + The first line is `true`, and `operatorClientCertStatus.state` is `Valid`. + +### `apiCertificateBasedAuth` fields + +| Field | Description | +| --- | --- | +| `enabled` | Whether the REST API accepts client certificates. Setting it to `true` requires `trustedCASecretName`. | +| `trustedCASecretName` | Secret that holds the CA certificate used to validate client certificates. | +| `clientCertSubjectValidationType` | How the cluster validates a client certificate's subject: `Disabled` (no subject validation), `SanCn` (the Subject Alternative Name or Common Name), or `FullSubject` (the full subject). | +| `authorizedSubjects` | Certificate subjects allowed to authenticate. Each entry takes `CN` (required), `O`, `OU` (a list), `L`, `ST`, and `C`. The operator adds its own subject from `operatorClientAuth.certificateSubjectLine`, so you don't need to list it. | + +After you set `apiCertificateBasedAuth` for the first time, `status.managedAPIs.apiCertificateBasedAuth` is `true` and the operator keeps managing the setting. If you remove the block later, the operator turns certificate-based authentication off on the cluster. + +### `operatorClientAuth` fields + +| Field | Description | +| --- | --- | +| `method` | `Basic` (the default) or `Certificate`. `Certificate` requires `clientCertificateSecretName`, `certificateSubjectLine`, and `apiCertificateBasedAuth.enabled: true`. | +| `clientCertificateSecretName` | Secret that holds the operator's client certificate and private key. | +| `certificateSubjectLine` | The certificate's subject in RFC 2253 format, with no spaces after commas, for example `CN=operator,O=example`. Only `CN`, `O`, `OU`, `L`, `ST`, and `C` attributes are allowed, and `CN` is required. | + +With the `Certificate` method, the operator creates a `RedisEnterpriseUser`, a `RedisEnterpriseClusterRole` with the Admin management role, and a `RedisEnterpriseClusterRoleBinding`, all named `-operator-cert-auth`. This is the identity the operator authenticates as. The operator owns these resources and reverts changes to them. If a resource with that name already exists and the REC doesn't own it, the operator reports an error instead of taking it over. + +## Add certificate-based users + +To let a person or an app authenticate with a client certificate: + +1. Get a client certificate for the user, signed by the CA in `trustedCASecretName`. Get its subject in RFC 2253 format: + + ```sh + openssl x509 -in -noout -subject -nameopt RFC2253 + ``` + +1. [Create a `RedisEnterpriseUser`](/content/operate/kubernetes/security/access-control/manage-users.md#create-a-user) with `authMethod: Certificate` and the subject, without the `subject=` prefix, in `certificateSubjectLine`. Certificate-based users have no password, so leave out `passwordSecrets`: + + ```yaml + spec: + authMethod: Certificate + certificateSubjectLine: CN=,O= + ``` + +1. If `clientCertSubjectValidationType` is `SanCn` or `FullSubject`, add the user's subject to `apiCertificateBasedAuth.authorizedSubjects` in the REC. + +1. Grant the user permissions with a role binding. See [Manage role bindings](/content/operate/kubernetes/security/access-control/manage-bindings.md). + +For all user fields, see the [RedisEnterpriseUser API reference](/content/operate/kubernetes/reference/api/redis_enterprise_user_api.md). + +## Disable basic authentication + +Set `apiBasicAuth.enabled` to `false` after the operator authenticates with a certificate. The cluster then rejects usernames and passwords on every REST API request and accepts only client certificates and JSON Web Token (JWT) authentication. + +This setting applies only to the REST API. It doesn't change how clients authenticate to databases. + +> [!WARNING] +> Every script, tool, and user that calls the REST API with a username and password loses access when you turn off basic authentication. Move each one to certificate or JWT authentication first. + +1. While basic authentication is still on, confirm that each client's certificate works. Forward the REST API port to your machine: + + ```sh + kubectl port-forward service/ 9443:9443 + ``` + + Then, in a second terminal, call the API with the client's certificate: + + ```sh + curl --cacert --cert --key \ + https://localhost:9443/v1/cluster + ``` + + A successful request returns the cluster object. For `--cacert`, use the CA that signed the cluster's API certificate. It can differ from the CA that signs client certificates. + +1. If the cluster participates in Active-Active databases, update the local RERC secrets. See [Active-Active databases](#active-active-databases). + +1. Add `apiBasicAuth` to the `spec` section of your REC file, and keep the `apiCertificateBasedAuth` and `operatorClientAuth` settings from [Enable certificate-based authentication](#enable-certificate-based-authentication): + + ```yaml + spec: + apiBasicAuth: + enabled: false + ``` + +1. Apply the REC: + + ```sh + kubectl apply -f .yaml + ``` + +1. Confirm that the cluster rejects passwords. With the port forward still running, call the API with a username and password: + + ```sh + curl --cacert -u : \ + -o /dev/null -w '%{http_code}\n' https://localhost:9443/v1/cluster + ``` + + The request returns `401`. If it returns `200`, the operator hasn't turned off basic authentication yet. Wait for the rolling update to finish, then try again. + +The operator rejects `apiBasicAuth.enabled: false` unless `operatorClientAuth.method` is `Certificate`. + +The operator doesn't turn off basic authentication right away. It waits until every component it manages authenticates with the client certificate, including the rolled-out Redis Software pods and, if usage reporting is enabled, the call-home client. Until then, the cluster keeps accepting passwords. + +If you leave `apiBasicAuth` unset, the operator doesn't manage the setting. Removing `apiBasicAuth.enabled` from the spec leaves basic authentication in its current state on the cluster. It doesn't turn passwords back on. + +New nodes join the cluster with the operator's client certificate, so you can scale the cluster while basic authentication is off. + +### Active-Active databases + +Participating clusters connect to this cluster's REST API with the credentials in the local `RedisEnterpriseRemoteCluster` (RERC) secret. Before you turn off basic authentication, the local RERC secret for every `RedisEnterpriseActiveActiveDatabase` (REAADB) must hold a client certificate and private key instead of a username and password. + +Update the local RERC secret to hold the certificate and key of a certificate-based user. Use the same key names as the operator's client certificate secret. Optionally, add the CA bundle that verifies this cluster's API certificate under a key named `trusted_ca`: + +```sh +kubectl create secret generic \ + --from-file=cert= \ + --from-file=key= \ + --from-file=trusted_ca= \ + --dry-run=client -o yaml | kubectl replace --save-config -f - +``` + +A secret with both a username and password and certificate material is invalid. After you update the secret, return to step 3 in [Disable basic authentication](#disable-basic-authentication). + +The operator rejects `apiBasicAuth.enabled: false` if an REAADB has no local RERC, or if a local RERC secret still holds a username and password. It waits to turn off basic authentication until the new credentials reach every Active-Active database. While basic authentication is off, the operator also rejects a new or updated RERC or REAADB whose local RERC secret holds a username and password. + +For how certificate-based authentication works with Active-Active databases in Redis Software, see [Manage an Active-Active database](/content/operate/rs/security/certificates/certificate-based-authentication.md#manage-an-active-active-database). + +## Re-enable basic authentication + +Set `apiBasicAuth.enabled` to `true`. The operator applies the change right away. Deleting `apiBasicAuth.enabled` from the spec doesn't turn passwords back on. + +```yaml +spec: + apiBasicAuth: + enabled: true +``` + +To move the operator back to passwords and turn off certificate-based authentication, follow this order: + +1. Set `apiBasicAuth.enabled` to `true`, and apply the REC. +1. Set `operatorClientAuth.method` to `Basic`, and apply the REC. +1. Set `apiCertificateBasedAuth.enabled` to `false`, and apply the REC. + +The operator keeps certificate-based authentication on while basic authentication is off, because turning both off would leave no way to authenticate. + +## Monitor and rotate the client certificate + +`status.operatorClientCertStatus` reports the operator's client certificate: + +| Field | Description | +| --- | --- | +| `state` | `Valid`, `ExpiringSoon` (30 days or less until expiry), or `Expired`. | +| `expirationDate` | When the certificate expires, in RFC 3339 format. | +| `secretName` | The secret named in `operatorClientAuth.clientCertificateSecretName`. | + +From 30 days before expiry, the operator records a `ClientCertificateExpiringSoon` warning event on the REC. After expiry, it records `ClientCertificateExpired`. To list them: + +```sh +kubectl get events --field-selector involvedObject.name=,type=Warning +``` + +Rotate the certificate before it expires. If it expires while basic authentication is off, the operator loses access to the cluster until you replace the certificate or [re-enable basic authentication from a cluster node](#troubleshoot). + +To rotate the certificate, get a new certificate and key signed by the trusted CA. Then: + +- **Same subject:** replace the contents of the existing secret: + + ```sh + kubectl create secret tls \ + --cert= \ + --key= \ + --dry-run=client -o yaml | kubectl apply -f - + ``` + +- **Different subject:** create a new secret, then update `clientCertificateSecretName` and `certificateSubjectLine` together in one change. The operator rejects the spec whenever the subject line doesn't match the certificate in the secret, so updating one without the other leaves the REC invalid. + +## Use HashiCorp Vault + +When the REC uses [HashiCorp Vault](/content/operate/kubernetes/security/vault.md) for secrets (`clusterCredentialSecretType: vault`), set `clientCertificateSecretName` and `trustedCASecretName` to Vault KV paths instead of Kubernetes secret names. The operator delivers the client certificate to the components that need it through the Vault Agent Injector. + +## Troubleshoot + +**The operator can't authenticate (HTTP 401).** If basic authentication is off and `operatorClientAuth.method` is no longer `Certificate`, the REC events report that the cluster rejected the operator's credentials with HTTP 401. To recover, do one of the following: + +- Restore `operatorClientAuth.method: Certificate` with the previous client certificate secret. +- Re-enable basic authentication from a cluster node: + + ```sh + rladmin tune cluster control_plane_basic_authentication enabled + ``` + +**The REC's `status.specStatus` is `Invalid`.** The operator applies no changes until you fix the spec. Check the REC events for the reason. The operator rejects: + +- `apiCertificateBasedAuth.enabled: true` without `trustedCASecretName`. +- `operatorClientAuth.method: Certificate` without `clientCertificateSecretName`, `certificateSubjectLine`, or `apiCertificateBasedAuth.enabled: true`. +- A `certificateSubjectLine` that isn't a valid RFC 2253 subject, or that doesn't exactly match the subject of the certificate in `clientCertificateSecretName`. +- A `trustedCASecretName` secret that doesn't exist or doesn't hold a CA certificate. +- A `clientCertificateSecretName` secret that doesn't exist or doesn't hold a valid certificate and private key. +- `apiBasicAuth.enabled` on Redis Software earlier than 8.2.0. + +## Related topics + +- [Manage REC certificates](/content/operate/kubernetes/security/certificates/manage-rec-certificates.md) +- [Manage users](/content/operate/kubernetes/security/access-control/manage-users.md) +- [RedisEnterpriseCluster API reference](/content/operate/kubernetes/reference/api/redis_enterprise_cluster_api.md) +- [Certificate-based authentication in Redis Software](/content/operate/rs/security/certificates/certificate-based-authentication.md)