Deployment with OpenShift CLI for Redis Enterprise for Kubernetes

Redis Enterprise for Kubernetes and cluster can be installed via CLI tools OpenShift

Use these steps to set up a Redis Enterprise Software cluster with OpenShift.

Prerequisites

• OpenShift cluster with at least 3 nodes (each meeting the minimum requirements for a development installation)
• OpenShift CLI

To see which version of Redis Enterprise for Kubernetes supports your OpenShift version, see Supported Kubernetes distributions.

Deploy the operator

1. Create a new project.

   oc new-project <your-project-name> 
   

2. Verify the newly created project.

   oc project <your-project-name>
   

3. Get the deployment files.

   git clone https://github.com/RedisLabs/redis-enterprise-k8s-docs
   

4. Deploy the OpenShift operator bundle.

   If you are using version 6.2.18-41 or earlier, you must apply the security context constraint before the operator bundle.

   oc apply -f openshift.bundle.yaml
   

   Warning:

   Changes to the openshift.bundle.yaml file can cause unexpected results.

5. Verify that your redis-enterprise-operator deployment is running.

   oc get deployment
   

   A typical response looks like this:

   NAME                        READY   UP-TO-DATE   AVAILABLE   AGE
   redis-enterprise-operator   1/1     1            1           0m36s
   

   Warning:

   DO NOT modify or delete the StatefulSet created during the deployment process. Doing so could destroy your Redis Enterprise cluster (REC).

Security context constraints

Upgrades to versions 7.22.0-6 and later run in unprivileged mode without any additional permissions or capabilities. If you don't specifally require additional capabilities, we recommend you maintain the default unprivileged mode, as its more secure. After upgrading, remove the existing redis-enterprise-scc-v2 SCC and unbind it from the REC service account.

To enable privileged mode, see Enable privileged mode > OpenShift upgrades.

Create a Redis Enterprise cluster custom resource

1. Apply the RedisEnterpriseCluster resource file (rec_rhel.yaml).

   You can rename the file to <your_cluster_name>.yaml, but it is not required. Examples below use <rec_rhel>.yaml. Options for Redis Enterprise clusters has more info about the Redis Enterprise cluster (REC) custom resource, or see the Redis Enterprise cluster API for a full list of options.

   The REC name cannot be changed after cluster creation.

   Note:

   Each Redis Enterprise cluster requires at least 3 nodes. Single-node RECs are not supported.

2. Apply the custom resource file to create your Redis Enterprise cluster.

   oc apply -f <rec_rhel>.yaml
   

   The operator typically creates the REC within a few minutes.

3. Check the cluster status.

   oc get pod
   

   You should receive a response similar to the following:

    NAME                             | READY | STATUS  | RESTARTS | AGE |
   | -------------------------------- | ----- | ------- | -------- | --- |
   | rec-name-0              | 2/2   | Running | 0        | 1m  |
   | rec-name-1              | 2/2   | Running | 0        | 1m  |
   | rec-name-2              | 2/2   | Running | 0        | 1m  |
   | rec-name-controller-x-x | 1/1   | Running | 0        | 1m  |
   | Redis-enterprise-operator-x-x    | 1/1   | Running | 0        | 5m  |
   

Configure the admission controller

1. Verify the admission-tls secret exists.

   kubectl get secret admission-tls
   

   The output should look similar to

   NAME            TYPE     DATA   AGE
   admission-tls   Opaque   2      2m43s
   

2. Save the certificate to a local environment variable.

   CERT=`kubectl get secret admission-tls -o jsonpath='{.data.cert}'`
   

3. Create a Kubernetes validating webhook, replacing <namespace> with the namespace where the REC was installed.

   The webhook.yaml template can be found in redis-enterprise-k8s-docs/admission

   sed 's/OPERATOR_NAMESPACE/<namespace>/g' webhook.yaml | kubectl create -f -
   

4. Create a patch file for the Kubernetes validating webhook.

   cat > modified-webhook.yaml <<EOF
   webhooks:
   - name: redisenterprise.admission.redislabs
     clientConfig:
      caBundle: $CERT
   EOF
   

5. Patch the webhook with the certificate.

   kubectl patch ValidatingWebhookConfiguration \
       redis-enterprise-admission --patch "$(cat modified-webhook.yaml)"
   

Limit the webhook to relevant namespaces

If not limited, the webhook intercepts requests from all namespaces. If you have several REC objects in your Kubernetes cluster, limit the webhook to the relevant namespaces. If you aren't using multiple namespaces, skip this step.

1. Verify your namespace is labeled and the label is unique to this namespace, as shown in the next example.

   apiVersion: v1
   kind: Namespace
   metadata:
     labels:
      namespace-name: staging
   name: staging
   

2. Patch the webhook spec with the namespaceSelector field.

   cat > modified-webhook.yaml <<EOF
   webhooks:
   - name: redisenterprise.admission.redislabs
     namespaceSelector:
      matchLabels:
        namespace-name: staging
   EOF
   

3. Apply the patch.

   oc patch ValidatingWebhookConfiguration \
     redis-enterprise-admission --patch "$(cat modified-webhook.yaml)"
   

   Note:

   For releases before 6.4.2-4, use this command instead:

   oc patch ValidatingWebhookConfiguration \
     redb-admission --patch "$(cat modified-webhook.yaml)"
   

   The 6.4.2-4 release introduces a new ValidatingWebhookConfiguration to replace redb-admission. See the 6.4.2-4 release notes.

Verify admission controller installation

Apply an invalid resource as shown below to force the admission controller to reject it. If it applies successfully, the admission controller is not installed correctly.

oc apply -f - << EOF
apiVersion: app.redislabs.com/v1alpha1
kind: RedisEnterpriseDatabase
metadata:
  name: redis-enterprise-database
spec:
  evictionPolicy: illegal
EOF

You should see this error from the admission controller webhook redisenterprise.admission.redislabs.

Error from server: error when creating "STDIN": admission webhook "redisenterprise.admission.redislabs" denied the request: eviction_policy: u'illegal' is not one of [u'volatile-lru', u'volatile-ttl', u'volatile-random', u'allkeys-lru', u'allkeys-random', u'noeviction', u'volatile-lfu', u'allkeys-lfu']

Create a Redis Enterprise database custom resource

The operator uses the instructions in the Redis Enterprise database (REDB) custom resources to manage databases on the Redis Enterprise cluster.

1. Create a RedisEnterpriseDatabase custom resource.

   This example creates a test database. For production databases, see create a database and RedisEnterpriseDatabase API reference.

   cat << EOF > /tmp/redis-enterprise-database.yml
   apiVersion: app.redislabs.com/v1alpha1
   kind: RedisEnterpriseDatabase
   metadata:
     name: redis-enterprise-database
   spec:
     memorySize: 100MB
   EOF
   

2. Apply the newly created REDB resource.

   oc apply -f /tmp/redis-enterprise-database.yml
   

More info

• Redis Enterprise cluster API
• Redis Enterprise database API