From f929b6354ba50601752294315b491b4fc9add5b4 Mon Sep 17 00:00:00 2001 From: Zvi Cahana Date: Mon, 2 Nov 2026 11:59:23 +0200 Subject: [PATCH 1/3] Clarify usage of cluster-scoped roles/bindings in multi-namespace setup --- .../kubernetes/re-clusters/multi-namespace.md | 49 +++++++++++++++---- 1 file changed, 39 insertions(+), 10 deletions(-) diff --git a/content/operate/kubernetes/re-clusters/multi-namespace.md b/content/operate/kubernetes/re-clusters/multi-namespace.md index e07499c6aa..cd4c286cc5 100644 --- a/content/operate/kubernetes/re-clusters/multi-namespace.md +++ b/content/operate/kubernetes/re-clusters/multi-namespace.md @@ -25,7 +25,17 @@ Before configuring a multi-namespace deployment, you must have a running [Redis ## Create role and role binding for managed namespaces -Both the operator and the RedisEnterpriseCluster (REC) resource need access to each namespace the REC will manage. For each **managed** namespace, create a `consumer_role.yaml` and `consumer_role_binding.yaml` file within the managed namespace, as shown in the examples below. +Both the operator and the RedisEnterpriseCluster (REC) resource need access to each namespace the REC will manage. There are two ways to grant it: + +- **Namespace-scoped roles**: Create a `Role` and `RoleBinding` in each managed namespace. Use this method to limit the operator's permissions to specific namespaces. +- **Cluster-scoped roles**: Create a `ClusterRole` and `ClusterRoleBinding` once for all namespaces. Use this method to simplify multi-namespace management. + +> [!NOTE] +> If the REC is configured to watch a namespace without setting the role and role binding permissions, or a namespace that is not yet created, the operator will fail and halt normal operations. + +### Namespace-scoped roles + +For each **managed** namespace, create a `consumer_role.yaml` and `consumer_role_binding.yaml` file within the managed namespace, as shown in the examples below. > [!NOTE] > These will need to be reapplied each time you [upgrade](/content/operate/kubernetes/upgrade/upgrade-redis-cluster.md). @@ -41,14 +51,6 @@ Replace `` with your own value (defaults to the REC name). {{}} -> [!NOTE] -> **Alternative approach**: Instead of creating individual `Role` objects for each namespace, you can create a single `ClusterRole` and bind it with multiple `RoleBinding` objects. This reduces the number of objects and simplifies role management. -> -> To use this approach: -> 1. Change `kind: Role` to `kind: ClusterRole` in the role definition above -> 2. Change `roleRef.kind: Role` to `roleRef.kind: ClusterRole` in the role binding definition above -> 3. Apply the ClusterRole once globally, then apply a RoleBinding in each managed namespace - Apply the files, replacing `` with your own values: ```sh @@ -57,7 +59,34 @@ kubectl apply -f consumer_role_binding.yaml -n ``` > [!NOTE] -> If the REC is configured to watch a namespace without setting the role and role binding permissions, or a namespace that is not yet created, the operator will fail and halt normal operations. +> Deleting a managed namespace deletes its `Role` and `RoleBinding`, which revokes the operator's access before it can remove the finalizers on the namespace's REDBs. The REDBs and the namespace then stay in the `Terminating` state. Delete the REDBs before you delete the namespace, or use [cluster-scoped roles](#cluster-scoped-roles). + +> [!NOTE] +> To define the rules once and still grant access per namespace, create a single `ClusterRole` and bind it with a `RoleBinding` in each managed namespace. Set `kind: ClusterRole` in the role definition and `roleRef.kind: ClusterRole` in the role binding, apply the `ClusterRole` once without a namespace, and apply the `RoleBinding` in each managed namespace. + +### Cluster-scoped roles + +A `ClusterRoleBinding` grants the operator access to all namespaces in the Kubernetes cluster, so you create it once instead of in each managed namespace. The operator still acts only on the namespaces you configure it to manage. + +When you delete a managed namespace, the operator retains access to it through the `ClusterRoleBinding`. The operator removes the finalizers on the namespace's REDBs and deletes their databases, and the namespace deletion completes. + +> [!WARNING] +> Deleting a managed namespace deletes its REDBs, including the databases and their data. Back up any data you need first. + +1. Create `consumer_cluster_role.yaml`. Start from the `consumer_role.yaml` example in [Namespace-scoped roles](#namespace-scoped-roles) and change `kind: Role` to `kind: ClusterRole`. + +1. Create `consumer_cluster_role_binding.yaml`. Start from the `consumer_role_binding.yaml` example in [Namespace-scoped roles](#namespace-scoped-roles) and make these changes: + + - Change `kind: RoleBinding` to `kind: ClusterRoleBinding`. + - Change `roleRef.kind: Role` to `roleRef.kind: ClusterRole`. + - Replace the placeholders as described in [Namespace-scoped roles](#namespace-scoped-roles). + +1. Apply the files once, without specifying a namespace: + + ```sh + kubectl apply -f consumer_cluster_role.yaml + kubectl apply -f consumer_cluster_role_binding.yaml + ``` ## Update Redis Enterprise operator ConfigMap From 3ebfa34e5d20fc57955df61b694fd642657e9fe4 Mon Sep 17 00:00:00 2001 From: Kaitlyn Michael Date: Wed, 4 Nov 2026 16:37:09 -0600 Subject: [PATCH 2/3] Consolidate namespace deletion guidance and tighten page - Compare namespace-scoped and cluster-scoped roles in a table, including how each behaves when a managed namespace is deleted. - Add a "Delete a managed namespace" procedure that replaces the deletion notes split across the role sections. It covers REDBs stuck in Terminating with a RoleBinding, and removing the namespace from REDB_NAMESPACES afterward. - Add the managed namespace as a prerequisite, and reword the watch warnings to say to create the namespace and grant access first. - Rename the ConfigMap method headings to "Namespace label" and "Explicit namespace list". - Make the REAADB single-cluster rule step 5, add a lead-in to the Active-Active steps, and turn background notes into plain text. --- .../kubernetes/re-clusters/multi-namespace.md | 76 +++++++++++-------- 1 file changed, 43 insertions(+), 33 deletions(-) diff --git a/content/operate/kubernetes/re-clusters/multi-namespace.md b/content/operate/kubernetes/re-clusters/multi-namespace.md index cd4c286cc5..798f755bb6 100644 --- a/content/operate/kubernetes/re-clusters/multi-namespace.md +++ b/content/operate/kubernetes/re-clusters/multi-namespace.md @@ -12,30 +12,35 @@ linktitle: Manage multiple namespaces weight: 17 --- -Multiple Redis Enterprise database resources (REDBs) can be associated with a single Redis Enterprise cluster resource (REC) even if they reside in different namespaces. +Multiple Redis Software for Kubernetes database resources (REDBs) can be associated with a single RedisEnterpriseCluster (REC) resource even if they reside in different namespaces. To learn more about designing a multi-namespace Redis Enterprise cluster, see [flexible deployment options](/content/operate/kubernetes/architecture/deployment-options.md). -> [!NOTE] -> Multi-namespace installations now support Active-Active databases (REAADB) with certain configuration requirements. For details, see [Multi-namespace Active-Active databases](#multi-namespace-active-active-databases). +Multi-namespace installations support Active-Active databases (REAADB) with certain configuration requirements. For details, see [Multi-namespace Active-Active databases](#multi-namespace-active-active-databases). ## Prerequisites -Before configuring a multi-namespace deployment, you must have a running [Redis Enterprise cluster (REC)](/content/operate/kubernetes/deployment/quick-start.md). See more information in the [deployment](/content/operate/kubernetes/deployment/_index.md) section. +Before configuring a multi-namespace deployment, you must have: + +- A running [Redis Enterprise cluster (REC)](/content/operate/kubernetes/deployment/quick-start.md). See more information in the [deployment](/content/operate/kubernetes/deployment/_index.md) section. +- Each namespace you want the REC to manage. Create it before you configure the operator to watch it. ## Create role and role binding for managed namespaces -Both the operator and the RedisEnterpriseCluster (REC) resource need access to each namespace the REC will manage. There are two ways to grant it: +Both the operator and the RedisEnterpriseCluster (REC) resource need access to each namespace managed by the REC. There are two ways to grant it: -- **Namespace-scoped roles**: Create a `Role` and `RoleBinding` in each managed namespace. Use this method to limit the operator's permissions to specific namespaces. -- **Cluster-scoped roles**: Create a `ClusterRole` and `ClusterRoleBinding` once for all namespaces. Use this method to simplify multi-namespace management. +| | Namespace-scoped roles | Cluster-scoped roles | +| --- | --- | --- | +| Use it to | Limit the operator's permissions to specific namespaces | Simplify multi-namespace management | +| Setup | Create a `Role` and `RoleBinding` in each managed namespace | Create a `ClusterRole` and `ClusterRoleBinding` once for all namespaces | +| [Deleting a managed namespace](#delete-a-managed-namespace) | Delete its REDBs first, or the REDBs and the namespace stay in the `Terminating` state | The operator deletes the REDBs and their databases, and the namespace deletion completes | -> [!NOTE] -> If the REC is configured to watch a namespace without setting the role and role binding permissions, or a namespace that is not yet created, the operator will fail and halt normal operations. +> [!WARNING] +> If the operator is configured to watch a namespace that hasn't been created, or a namespace without role and role binding permissions, it will fail and halt normal operations. ### Namespace-scoped roles -For each **managed** namespace, create a `consumer_role.yaml` and `consumer_role_binding.yaml` file within the managed namespace, as shown in the examples below. +For each managed namespace, create a `consumer_role.yaml` and `consumer_role_binding.yaml` file within the managed namespace, as shown in the examples below. > [!NOTE] > These will need to be reapplied each time you [upgrade](/content/operate/kubernetes/upgrade/upgrade-redis-cluster.md). @@ -43,7 +48,7 @@ For each **managed** namespace, create a `consumer_role.yaml` and `consumer_role Replace `` with the namespace the REC resides in. Replace `` with your own value (defaults to the REC name). -`consumer_role.yaml` example: +`consumer_role.yaml` example: {{}} @@ -58,20 +63,11 @@ kubectl apply -f consumer_role.yaml -n kubectl apply -f consumer_role_binding.yaml -n ``` -> [!NOTE] -> Deleting a managed namespace deletes its `Role` and `RoleBinding`, which revokes the operator's access before it can remove the finalizers on the namespace's REDBs. The REDBs and the namespace then stay in the `Terminating` state. Delete the REDBs before you delete the namespace, or use [cluster-scoped roles](#cluster-scoped-roles). - -> [!NOTE] -> To define the rules once and still grant access per namespace, create a single `ClusterRole` and bind it with a `RoleBinding` in each managed namespace. Set `kind: ClusterRole` in the role definition and `roleRef.kind: ClusterRole` in the role binding, apply the `ClusterRole` once without a namespace, and apply the `RoleBinding` in each managed namespace. +To define the rules once and still grant access per namespace, create a single `ClusterRole` and bind it with a `RoleBinding` in each managed namespace. Set `kind: ClusterRole` in the role definition and `roleRef.kind: ClusterRole` in the role binding, apply the `ClusterRole` once without a namespace, and apply the `RoleBinding` in each managed namespace. ### Cluster-scoped roles -A `ClusterRoleBinding` grants the operator access to all namespaces in the Kubernetes cluster, so you create it once instead of in each managed namespace. The operator still acts only on the namespaces you configure it to manage. - -When you delete a managed namespace, the operator retains access to it through the `ClusterRoleBinding`. The operator removes the finalizers on the namespace's REDBs and deletes their databases, and the namespace deletion completes. - -> [!WARNING] -> Deleting a managed namespace deletes its REDBs, including the databases and their data. Back up any data you need first. +A `ClusterRoleBinding` grants the operator access to all namespaces in the Kubernetes cluster. You create it once instead of in each managed namespace. The operator still manages only the namespaces you configure. 1. Create `consumer_cluster_role.yaml`. Start from the `consumer_role.yaml` example in [Namespace-scoped roles](#namespace-scoped-roles) and change `kind: Role` to `kind: ClusterRole`. @@ -92,15 +88,17 @@ When you delete a managed namespace, the operator retains access to it through t There are two methods of updating the operator ConfigMap (`operator-environment-config`) to specify which namespaces to manage. -- Method 1: Configure the operator to watch for a namespace label and add this label to managed namespaces (available in versions 6.4.2-4 or later). -- Method 2: Configure the operator with an explicit list of namespaces to manage. +- Namespace label: Configure the operator to watch for a namespace label and add this label to managed namespaces (available in versions 6.4.2-4 or later). +- Explicit namespace list: Configure the operator with an explicit list of namespaces to manage. You can create this ConfigMap manually before deployment, or it will be created automatically after the operator was deployed. > [!WARNING] -> Only configure the operator to watch a namespace after the namespace is created and configured with the role/role_binding as explained above. If configured to watch a namespace without setting those permissions or a namespace that is not created yet, the operator will fail and not perform normal operations. +> Create the namespace and give the operator access to it **before** you configure the operator to watch it. See [Create role and role binding for managed namespaces](#create-role-and-role-binding-for-managed-namespaces). If the operator is configured to watch a namespace that doesn't exist or that it can't access, it will fail and halt normal operations. + +### Namespace label -### Method 1: Namespace label (available in versions 6.4.2-4 or later) +This method is only in versions 6.4.2-4 or later. 1. Create the `cluster_role_binding.yaml` and `cluster_role.yaml` files. Replace the `` with the namespace the Redis Enterprise cluster (REC) resides in. @@ -130,7 +128,6 @@ You can create this ConfigMap manually before deployment, or it will be created 4. For each managed namespace, apply the same label. Replace `` with the namespace the REC will manage. Replace `` with the value used in the previous step. If you specify a value for ``, both the label name and value in managed namespaces must match to be detected by the operator. If the `` is empty, only the label name needs to match on managed namespaces and the value is disregarded. - ```sh kubectl label namespace = ``` @@ -138,7 +135,7 @@ You can create this ConfigMap manually before deployment, or it will be created > [!NOTE] > The operator restarts when it detects a namespace label was added or removed. -### Method 2: Explicit namespace list +### Explicit namespace list Patch the `operator-environment-config` in the REC namespace with a new environment variable (`REDB_NAMESPACES`). @@ -149,19 +146,32 @@ kubectl patch ConfigMap/operator-environment-config \ -p '{"data":{"REDB_NAMESPACES": " [!WARNING] +> This procedure deletes the namespace's REDBs, including their databases and data. + +1. Back up any data you need from the namespace's databases. + +1. If you use [namespace-scoped roles](#namespace-scoped-roles), or a `ClusterRole` bound with a `RoleBinding`, delete the REDBs in the namespace. + + Deleting the namespace deletes its role binding, which revokes the operator's access before it can remove the finalizers on the namespace's REDBs. If the REDBs still exist, they and the namespace stay in the `Terminating` state. + +1. Delete the namespace. + +1. If you configured the operator with an [explicit namespace list](#explicit-namespace-list), remove the namespace from `REDB_NAMESPACES` after the namespace deletion completes. With cluster-scoped roles, the operator restarts repeatedly until you remove it. + ## Multi-namespace Active-Active databases You can also deploy `RedisEnterpriseActiveActiveDatabase` (REAADB) objects in consumer namespaces separate from the Redis Enterprise operator or cluster (REC) namespace. -To do this: +To deploy a REAADB in a consumer namespace: 1. Configure each participating cluster’s operator to watch the relevant consumer namespace. See [multi-namespace operator setup](#update-redis-enterprise-operator-configmap). 2. Ensure all Active-Active prerequisites are met as described in [Configure Active-Active](/content/operate/kubernetes/active-active/create-reaadb.md). 3. In your REAADB custom resource, specify the target consumer namespace using `metadata.namespace`. For each participating cluster, use the `namespace` field under `spec.participatingClusters` to indicate the namespace where the REAADB should be deployed. 4. If you are using a [global database secret](/content/operate/kubernetes/active-active/global-db-secret.md), deploy the secret in each consumer namespace. - -> [!NOTE] -> Apply the REAADB object to only one Kubernetes cluster. Based on the specified participating clusters and namespaces, the operator automatically creates the necessary resources in the other clusters. +5. Apply the REAADB object to only one Kubernetes cluster. Based on the specified participating clusters and namespaces, the operator automatically creates the necessary resources in the other clusters. For example: @@ -181,4 +191,4 @@ spec: ``` > [!WARNING] -> Configure the operator to watch a namespace only after the namespace exists and the required `Role` and `RoleBinding` resources have been applied. If the operator is configured to watch a namespace that lacks these permissions or does not exist, it will fail and halt normal operations. +> On each participating cluster, create the consumer namespace and give the operator access to it **before** you configure the operator to watch it. See [Create role and role binding for managed namespaces](#create-role-and-role-binding-for-managed-namespaces). If the operator is configured to watch a namespace that doesn't exist or that it can't access, it will fail and halt normal operations. From b174b12b5502d831fc602527183b8743103c449a Mon Sep 17 00:00:00 2001 From: Kaitlyn Michael Date: Thu, 5 Nov 2026 10:15:59 -0600 Subject: [PATCH 3/3] RED-125920: Apply review suggestions --- content/operate/kubernetes/re-clusters/multi-namespace.md | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/content/operate/kubernetes/re-clusters/multi-namespace.md b/content/operate/kubernetes/re-clusters/multi-namespace.md index 798f755bb6..d806037ea8 100644 --- a/content/operate/kubernetes/re-clusters/multi-namespace.md +++ b/content/operate/kubernetes/re-clusters/multi-namespace.md @@ -33,10 +33,6 @@ Both the operator and the RedisEnterpriseCluster (REC) resource need access to e | --- | --- | --- | | Use it to | Limit the operator's permissions to specific namespaces | Simplify multi-namespace management | | Setup | Create a `Role` and `RoleBinding` in each managed namespace | Create a `ClusterRole` and `ClusterRoleBinding` once for all namespaces | -| [Deleting a managed namespace](#delete-a-managed-namespace) | Delete its REDBs first, or the REDBs and the namespace stay in the `Terminating` state | The operator deletes the REDBs and their databases, and the namespace deletion completes | - -> [!WARNING] -> If the operator is configured to watch a namespace that hasn't been created, or a namespace without role and role binding permissions, it will fail and halt normal operations. ### Namespace-scoped roles @@ -88,7 +84,7 @@ A `ClusterRoleBinding` grants the operator access to all namespaces in the Kuber There are two methods of updating the operator ConfigMap (`operator-environment-config`) to specify which namespaces to manage. -- Namespace label: Configure the operator to watch for a namespace label and add this label to managed namespaces (available in versions 6.4.2-4 or later). +- Namespace label: Configure the operator to watch for a namespace label and add this label to managed namespaces. - Explicit namespace list: Configure the operator with an explicit list of namespaces to manage. You can create this ConfigMap manually before deployment, or it will be created automatically after the operator was deployed. @@ -98,8 +94,6 @@ You can create this ConfigMap manually before deployment, or it will be created ### Namespace label -This method is only in versions 6.4.2-4 or later. - 1. Create the `cluster_role_binding.yaml` and `cluster_role.yaml` files. Replace the `` with the namespace the Redis Enterprise cluster (REC) resides in. `operator_cluster_role.yaml` example: