|
| 1 | +--- |
| 2 | +categories: |
| 3 | +- docs |
| 4 | +- operate |
| 5 | +- kubernetes |
| 6 | +description: Enable automatic system resource adjustments for Redis Enterprise to increase file descriptor limits. |
| 7 | +linkTitle: Auto resource adjustment |
| 8 | +title: Allow automatic resource adjustment |
| 9 | +weight: 98 |
| 10 | +--- |
| 11 | + |
| 12 | +Redis Enterprise for Kubernetes 7.22.0-6 introduces the ability to run with automatic resource adjustment disabled, which drops all capabilities from the Redis Enterprise container and sets `allowPrivilegeEscalation` to `false`. All other security-related settings remain the same as in automatic resource adjustment enabled. Automatic resource adjustment disabled is the default for installations and upgrades of the Redis Enterprise operator for versions 7.22.0-6 and later. |
| 13 | + |
| 14 | +## Default behavior |
| 15 | + |
| 16 | +Automatic resource adjustment is disabled by default for installations and upgrades of the Redis Enterprise operator for versions 7.22.0-6 and later. This default behavior is in effect if REC spec has `allowAutoAdjustment` set to `false` or removed. |
| 17 | + |
| 18 | +If automatic resource adjustment is disabled, the REC security context looks like this: |
| 19 | + |
| 20 | +```yaml |
| 21 | +securityContext: |
| 22 | + allowPrivilegeEscalation: false |
| 23 | + capabilities: |
| 24 | + drop: |
| 25 | + - ALL |
| 26 | + privileged: false |
| 27 | + readOnlyRootFilesystem: false |
| 28 | +``` |
| 29 | +
|
| 30 | +## Enable automatic resource adjustment |
| 31 | +
|
| 32 | +To allow the Redis Enterprise container to adjust system resource limits automatically, set `allowAutoAdjustment` to `true`. This will grant the container elevated capabilities such as `SYS_RESOURCE`. Note that changing this value on a running cluster will trigger a rolling update. |
| 33 | + |
| 34 | +```yaml |
| 35 | +spec: |
| 36 | + securityContext: |
| 37 | + resourceLimits: |
| 38 | + allowAutoAdjustment: true |
| 39 | +``` |
| 40 | + |
| 41 | +Enabling automatic resource adjustment results in the following security context: |
| 42 | + |
| 43 | +**Note:** Enabling `allowAutoAdjustment` grants the container the `SYS_RESOURCE` capability and permits privilege escalation. |
| 44 | + |
| 45 | +```yaml |
| 46 | +securityContext: |
| 47 | + allowPrivilegeEscalation: true |
| 48 | + capabilities: |
| 49 | + add: |
| 50 | + - SYS_RESOURCE |
| 51 | + drop: |
| 52 | + - ALL |
| 53 | + privileged: false |
| 54 | + readOnlyRootFilesystem: false |
| 55 | +``` |
| 56 | + |
| 57 | +## OpenShift upgrades |
| 58 | + |
| 59 | +If you're upgrading OpenShift to 7.22.0-6, update your existing SCC (security context constraint). |
| 60 | + |
| 61 | +If running with automatic resource adjustment disabled, remove the custom `redis-enterprise-scc-v2` SCC and unbind it from the REC service account after you complete the upgrade. |
| 62 | + |
| 63 | +```sh |
| 64 | +oc delete scc/redis-enterprise-scc-v2 |
| 65 | +``` |
| 66 | + |
| 67 | +```sh |
| 68 | +oc adm policy remove-scc-from-user redis-enterprise-scc-v2 -z <service-account-name> |
| 69 | +``` |
| 70 | + |
| 71 | +If running with automatic resource adjustment enabled, manually reapply the [security context constraints (SCC)](https://docs.openshift.com/container-platform/4.8/authentication/managing-security-context-constraints.html) file ([`scc.yaml`]({{< relref "/operate/kubernetes/deployment/openshift/openshift-cli#deploy-the-operator" >}})). |
| 72 | + |
| 73 | +```sh |
| 74 | +oc apply -f openshift/scc.yaml |
| 75 | +``` |
| 76 | + |
| 77 | +```sh |
| 78 | +oc adm policy add-scc-to-user redis-enterprise-scc-v2 \ |
| 79 | + system:serviceaccount:<my-project>:<rec-name> |
| 80 | +``` |
| 81 | + |
| 82 | +## New OpenShift installations |
| 83 | + |
| 84 | +New installations of Redis Enterprise for Kubernetes 7.22.0-6 and later automatically run with automatic resource adjustment disabled, using a built-in `nonroot-v2` which is more secure and less permissive. |
| 85 | + |
| 86 | +To enable automatic resource adjustment after installation, apply and grant permissions to the `redis-enterprise-scc-v2` SCC. |
| 87 | + |
| 88 | +1. Apply the `scc.yaml` file. |
| 89 | + |
| 90 | + {{<warning>}} |
| 91 | +Do not edit this file. |
| 92 | + {{</warning>}} |
| 93 | + |
| 94 | + ```sh |
| 95 | + oc apply -f openshift/scc.yaml |
| 96 | + ``` |
| 97 | + |
| 98 | + You should see the following output: |
| 99 | + |
| 100 | + ```sh |
| 101 | + securitycontextconstraints.security.openshift.io "redis-enterprise-scc-v2" configured |
| 102 | + ``` |
| 103 | + |
| 104 | +1. Provide the operator permissions for the pods. |
| 105 | + |
| 106 | + ```sh |
| 107 | + oc adm policy add-scc-to-user redis-enterprise-scc-v2 \ |
| 108 | + system:serviceaccount:<my-project>:<rec> |
| 109 | + ``` |
| 110 | + |
| 111 | +## SYS_RESOURCE |
| 112 | + |
| 113 | +Some Redis Enterprise processes may require the `SYS_RESOURCE` capability to raise resource limits, such as the maximum number of open file descriptors. |
| 114 | + |
| 115 | +Some Redis Enterprise processes require the ability to open at least 100,000 file descriptors. If the default is lower and `SYS_RESOURCE` is not enabled, these processes may fail. |
| 116 | + |
| 117 | +## Choose whether to enable automatic resource adjustment |
| 118 | + |
| 119 | +Use the following guidance to decide whether to enable automatic resource adjustment: |
| 120 | + |
| 121 | +- If you're running on a major cloud provider such as AWS, GKE, or AKS, automatic resource adjustment disabled is likely sufficient. |
| 122 | +- If you're running on-prem or using Kubespray, verify your file descriptor limits. You can: |
| 123 | + - Configure limits manually and use automatic resource adjustment disabled. |
| 124 | + - Enable automatic resource adjustment to allow Redis Enterprise to increase limits, which requires privilege escalation. |
| 125 | + |
| 126 | +If you are already running a Redis Enterprise cluster on Kubernetes, your worker nodes are likely configured correctly. In this case, it is safe to upgrade the operator and use automatic resource adjustment disabled. |
| 127 | + |
| 128 | +Based on our testing, all major cloud providers configure Kubernetes worker nodes with file descriptor limits well above the required minimum. These environments typically work without enabling automatic resource adjustment. The only known exception is clusters created with [Kubespray](https://kubespray.io/#/), which sets default file descriptor limits below the required 100,000. If you use Kubespray with default settings, you must run the operator with automatic resource adjustment enabled. |
0 commit comments