Repository navigation
Conversation
|
|
- Compare namespace-scoped and cluster-scoped roles in a table, including how each behaves when a managed namespace is deleted. - Add a "Delete a managed namespace" procedure that replaces the deletion notes split across the role sections. It covers REDBs stuck in Terminating with a RoleBinding, and removing the namespace from REDB_NAMESPACES afterward. - Add the managed namespace as a prerequisite, and reword the watch warnings to say to create the namespace and grant access first. - Rename the ConfigMap method headings to "Namespace label" and "Explicit namespace list". - Make the REAADB single-cluster rule step 5, add a lead-in to the Active-Active steps, and turn background notes into plain text.
kaitlynmichael
left a comment
kaitlynmichael
left a comment
There was a problem hiding this comment.
I've pushed a commit with some page changes, please review for accuracy. Thanks!
zcahana
left a comment
zcahana
left a comment
There was a problem hiding this comment.
I left a few additional suggestions in comments, all of which are optional.
| ### Namespace label | ||
|
|
||
| ### Method 1: Namespace label (available in versions 6.4.2-4 or later) | ||
| This method is only in versions 6.4.2-4 or later. |
There was a problem hiding this comment.
Do we still need to mention the version? 6.4.2-4 is from March 2023...long unsupported.
| | --- | --- | --- | | ||
| | Use it to | Limit the operator's permissions to specific namespaces | Simplify multi-namespace management | | ||
| | Setup | Create a `Role` and `RoleBinding` in each managed namespace | Create a `ClusterRole` and `ClusterRoleBinding` once for all namespaces | | ||
| | [Deleting a managed namespace](#delete-a-managed-namespace) | Delete its REDBs first, or the REDBs and the namespace stay in the `Terminating` state | The operator deletes the REDBs and their databases, and the namespace deletion completes | |
There was a problem hiding this comment.
I'm not sure the "Deleting" row is important enough to appear in this "introductory" table. The two first rows provide the main decision-supporting info (when to use each method, and what it largely involves (roles vs clusterroles)). The "Deleting" is more of a side-effect worthy of being aware of, but I think the mention of it below (in the new "Deleting a namespace" section) is sufficient for that.
WDYT?
| > [!WARNING] | ||
| > If the operator is configured to watch a namespace that hasn't been created, or a namespace without role and role binding permissions, it will fail and halt normal operations. |
There was a problem hiding this comment.
Flow-wise, this particular warning might better belong just above the "Update Redis Enterprise operator ConfigMap" section, where the operator is actually configured to watch a namespace.
| kubectl apply -f consumer_cluster_role_binding.yaml | ||
| ``` | ||
|
|
||
| ## Update Redis Enterprise operator ConfigMap |
There was a problem hiding this comment.
Since we're already revising this page, let's consider renaming this section to something like "Configure the operator to watch additional namespaces" or "Configure the namespaces watched by the operator". This frames it around the "what" (namespace configuration) instead of the "how" (configmap), which I think can help the reader to understand where this step fits within the larger picture.
Splits the role setup on the multi-namespace page into namespace-scoped and cluster-scoped options.
Note
Low Risk
Documentation-only edits to Kubernetes multi-namespace guidance; no runtime or security logic changes in the repository.
Overview
Updates Manage multiple namespaces to present namespace-scoped vs cluster-scoped RBAC as two first-class paths, with a comparison table (setup, intent, and behavior when deleting a managed namespace).
Adds a dedicated Cluster-scoped roles procedure (
ClusterRole+ClusterRoleBinding, apply once cluster-wide) and keeps the hybrid ClusterRole + per-namespace RoleBinding under namespace-scoped setup. Prerequisites now require creating managed namespaces before the operator watches them; operator ConfigMap sections drop "Method 1/2" naming in favor of Namespace label and Explicit namespace list.New Delete a managed namespace section covers backup, when to delete REDBs first (namespace-scoped / RoleBinding-bound access vs cluster-scoped cleanup), and removing entries from
REDB_NAMESPACESafter deletion. Active-Active and warning copy are aligned with the same ordering: grant access before configuring the watch list.Reviewed by Cursor Bugbot for commit 3ebfa34. Bugbot is set up for automated code reviews on this repo. Configure here.