RedisEnterpriseCluster API Reference

Overview

apiVersion:

- [app.redislabs.com/v1](#appredislabscomv1)

# app.redislabs.com/v1

RedisEnterpriseCluster is the Schema for the redisenterpriseclusters API

            Name
            Type
            Description
            Required

      apiVersion
      string
      app.redislabs.com/v1
      true

      kind
      string
      RedisEnterpriseCluster
      true

      metadata
      object
      Refer to the Kubernetes API documentation for the fields of the `metadata` field.
      true

        spec
        object

          RedisEnterpriseClusterSpec defines the desired state of RedisEnterpriseCluster

        false

        status
        object

        false

spec

[↩ Parent](#)

RedisEnterpriseClusterSpec defines the desired state of RedisEnterpriseCluster

            Name
            Type
            Description
            Required

        activeActive
        object

          Specification for ActiveActive setup. At most one of ingressOrRouteSpec or activeActive fields can be set at the same time.

        false

        antiAffinityAdditionalTopologyKeys
        []string

          Additional antiAffinity terms in order to support installation on different zones/vcenters

        false

        auditing
        object

          Cluster-level configuration for auditing database connection and authentication events. Includes both the audit listener connection parameters and the default policy for new databases.

        false

        backup
        object

          Cluster-wide backup configurations

        false

        bootstrapperImageSpec
        object

          Specification for Bootstrapper container image

        false

        bootstrapperResources
        object

          Compute resource requirements for bootstrapper containers

        false

        certificates
        object

          RS Cluster Certificates. Used to modify the certificates used by the cluster. See the "RSClusterCertificates" struct described above to see the supported certificates.

        false

        clusterCredentialSecretName
        string

          Name or path of the secret containing cluster credentials. Defaults to the cluster name if left blank. This field can only be set upon cluster creation and cannot be changed afterward. For For Kubernetes secrets (default): Can be customized to any valid secret name, or left blank to use the cluster name. The secret can be pre-created with 'username' and 'password' fields, or otherwise it will be automatically created with a default username and auto-generated password. For Vault secrets:  Can be customized with the path of the secret within Vault. The secret must be pre-created in Vault before REC creation.

        false

        clusterCredentialSecretRole
        string

          Used only if ClusterCredentialSecretType is vault, to define vault role to be used.  If blank, defaults to "redis-enterprise-operator"

        false

        clusterCredentialSecretType
        enum

          Type of Secret to use for ClusterCredential, Vault, Kuberetes,... If left blank, will default ot kubernetes secrets

            Enum: vault, kubernetes

        false

        clusterRecovery
        boolean

          ClusterRecovery initiates cluster recovery when set to true. Note that this field is cleared automatically after the cluster is recovered

        false

        containerTimezone
        object

          Container timezone configuration. While the default timezone on all containers is UTC, this setting can be used to set the timezone on services rigger/bootstrapper/RS containers. You can either propagate the hosts timezone to RS pods or set it manually via timezoneName.

        false

        createServiceAccount
        boolean

          Creates a service account for Redis Enterprise.

        false

        dataInternodeEncryption
        boolean

          Internode encryption (INE) cluster wide policy. An optional boolean setting. Specifies if INE should be on/off for new created REDBs. May be overridden for specific REDB via similar setting, please view the similar setting for REDB for more info.

        false

        encryptPkeys
        boolean

          Private key encryption Possible values: true/false

        false

        enforceIPv4
        boolean

          Sets ENFORCE_IPV4 environment variable

        false

        extraEnvVars
        []object

          ADVANCED USAGE: use carefully. Add environment variables to RS StatefulSet's containers.

        false

        extraLabels
        map[string]string

          Labels that the user defines for their convenience

        false

        hostAliases
        []object

          Adds hostAliases entries to the Redis Enterprise pods

        false

        ingressOrRouteSpec
        object

          Access configurations for the Redis Enterprise cluster and databases. At most one of ingressOrRouteSpec or activeActive fields can be set at the same time.

        false

        ldap
        object

          Cluster-level LDAP configuration, such as server addresses, protocol, authentication and query settings.

        false

        license
        string

          Redis Enterprise License

        false

        licenseSecretName
        string

          K8s secret or Vault Secret Name/Path to use for Cluster License. When left blank, the license is read from the "license" field. Note that you can't specify non-empty values in both "license" and "licenseSecretName", only one of these fields can be used to pass the license string. The license needs to be stored under the key "license".

        false

        nodeSelector
        map[string]string

          Selector for nodes that could fit Redis Enterprise pod

        false

        nodes
        integer

          Number of Redis Enterprise nodes (pods)

            Format: int32

        false

        ocspConfiguration
        object

          An API object that represents the cluster's OCSP configuration. To enable OCSP, the cluster's proxy certificate should contain the OCSP responder URL.

        false

        ossClusterSettings
        object

          Cluster-level configuration for OSS cluster mode databases.

        false

        persistentSpec
        object

          Persistent storage configuration for Redis Enterprise cluster.

        false

        podAnnotations
        map[string]string

          annotations for the service rigger and redis enterprise pods

        false

        podAntiAffinity
        object

          Override for the default anti-affinity rules of the Redis Enterprise pods. More info: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#an-example-of-a-pod-that-uses-pod-affinity

        false

        podStartingPolicy
        object

          Mitigation setting for STS pods stuck in "ContainerCreating"

        false

        podTolerations
        []object

          Tolerations that are added to all managed pods. More information: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

        false

        priorityClassName
        string

          Adds the priority class to pods managed by the operator

        false

        pullSecrets
        []object

          PullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images. If specified, these secrets will be passed to individual puller implementations for them to use. More info: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

        false

        rackAwarenessNodeLabel
        string

          Node label that specifies rack ID - if specified, will create rack aware cluster. Rack awareness requires node label must exist on all nodes. Additionally, operator needs a special cluster role with permission to list nodes.

        false

        redisEnterpriseAdditionalPodSpecAttributes
        object

          ADVANCED USAGE USE AT YOUR OWN RISK - specify pod attributes that are required for the statefulset - Redis Enterprise pods. Pod attributes managed by the operator might override these settings. Also make sure the attributes are supported by the K8s version running on the cluster - the operator does not validate that.

        false

        redisEnterpriseIPFamily
        enum

          Reserved, future use, only for use if instructed by Redis. IPFamily dictates what IP family to choose for pods' internal and external communication.

            Enum: IPv4, IPv6

        false

        redisEnterpriseImageSpec
        object

          Specification for Redis Enterprise container image

        false

        redisEnterpriseNodeResources
        object

          Compute resource requirements for Redis Enterprise containers

        false

        redisEnterprisePodAnnotations
        map[string]string

          annotations for redis enterprise pod

        false

        redisEnterpriseServicesConfiguration
        object

          RS Cluster optional services settings

        false

        redisEnterpriseServicesRiggerImageSpec
        object

          Specification for Services Rigger container image

        false

        redisEnterpriseServicesRiggerResources
        object

          Compute resource requirements for Services Rigger pod

        false

        redisEnterpriseTerminationGracePeriodSeconds
        integer

          The TerminationGracePeriodSeconds value for the (STS created) REC pods

            Format: int64

        false

        redisEnterpriseVolumeMounts
        []object

          additional volume mounts within the redis enterprise containers. More info: https://kubernetes.io/docs/concepts/storage/volumes/

        false

        redisOnFlashSpec
        object

          Auto Tiering (Redis on Flash) configuration. When provided, the cluster can create Auto Tiering databases.

        false

        redisUpgradePolicy
        enum

          Redis upgrade policy to be set on the Redis Enterprise cluster. Possible values: major/latest This value is used by the cluster to choose the Redis version of the database when an upgrade is performed. The Redis Enterprise cluster includes multiple versions of OSS Redis that can be used for databases.

            Enum: major, latest

        false

        resp3Default
        boolean

          Whether databases will turn on RESP3 compatibility upon database upgrade. Note - Deleting this property after explicitly setting its value shall have no effect. Please view the corresponding field in RS doc for more info.

        false

        securityContext
        object

          The security configuration that will be applied to RS pods.

        false

        serviceAccountName
        string

          Name of the service account to use for Redis Enterprise.

        false

        services
        object

          Customization options for operator-managed service resources created for Redis Enterprise clusters and databases

        false

        servicesRiggerSpec
        object

          Specification for service rigger

        false

        sideContainersSpec
        []object

        false

        slaveHA
        object

          Slave high availability mechanism configuration.

        false

        sso
        object

          Cluster-level SSO configuration for authentication to the Cluster Manager UI.

        false

        uiAnnotations
        map[string]string

          Additional annotations for the Redis Enterprise UI service. These annotations override overlapping global annotations set under spec.services.servicesAnnotations. The specified annotations will not override annotations that already exist and didn't originate from the operator, except for the 'redis.io/last-keys' annotation which is reserved.

        false

        uiServiceType
        enum

          Service type for exposing the Redis Enterprise UI (https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types).

            Enum: ClusterIP, NodePort, LoadBalancer, ExternalName

        false

        upgradeSpec
        object

          Redis Enterprise upgrade configuration

        false

        usageMeter
        object

          The configuration of the usage meter.

        false

        userDefinedModules
        []object

          List of user-defined modules to be downloaded and installed during cluster bootstrap The modules on the list will be downloaded on cluster creation, upgrade, scale-out and recovery and installed on all nodes. Note that changing this field for a running cluster will trigger a rolling update.

        false

        username
        string

          Username for the admin user of Redis Enterprise

        false

        vaultCASecret
        string

          K8s secret name containing Vault's CA cert - defaults to "vault-ca-cert"

        false

        volumes
        []object

          additional volumes

        false

spec.activeActive

[↩ Parent](#spec)

Specification for ActiveActive setup. At most one of ingressOrRouteSpec or activeActive fields can be set at the same time.

            Name
            Type
            Description
            Required

        apiIngressUrl
        string

          RS API URL

        true

        dbIngressSuffix
        string

          DB ENDPOINT SUFFIX - will be used to set the db host. ingress <db name><db ingress suffix> Creates a host name so it should be unique if more than one db is created on the cluster with the same name

        true

        method
        enum

          Used to distinguish between different platforms implementation

            Enum: openShiftRoute, ingress

        true

        ingressAnnotations
        map[string]string

          Used for ingress controllers such as ha-proxy or nginx in GKE

        false

spec.auditing

[↩ Parent](#spec)

Cluster-level configuration for auditing database connection and authentication events. Includes both the audit listener connection parameters and the default policy for new databases.

            Name
            Type
            Description
            Required

        config
        object

          Configuration for the audit listener connection

        false

        dbConnsAuditing
        boolean

          Cluster-wide default policy for database connection auditing. When set to true, connection auditing will be enabled by default for all new databases. Existing databases are not affected and can override this setting individually.

        false

spec.auditing.config

[↩ Parent](#specauditing)

Configuration for the audit listener connection

            Name
            Type
            Description
            Required

        auditAddress
        string

          TCP/IP address or file path where audit notifications will be sent. For TCP protocol: IP address of the audit listener. For local protocol: file path for audit output (development/testing only).

        true

        auditProtocol
        enum

          Protocol used to send audit notifications. Valid values: "TCP" or "local". For production systems, use "TCP". "local" is for development/testing only.

            Enum: TCP, local

        true

        auditPort
        integer

          Port number where audit notifications will be sent (TCP protocol only).

        false

        auditReconnectInterval
        integer

          Interval in seconds between attempts to reconnect to the audit listener.

        false

        auditReconnectMaxAttempts
        integer

          Maximum number of attempts to reconnect to the audit listener. Set to 0 for infinite attempts.

        false

spec.backup

[↩ Parent](#spec)

Cluster-wide backup configurations

            Name
            Type
            Description
            Required

        s3
        object

          Configurations for backups to s3 and s3-compatible storage

        false

spec.backup.s3

[↩ Parent](#specbackup)

Configurations for backups to s3 and s3-compatible storage

            Name
            Type
            Description
            Required

        caCertificateSecretName
        string

          Secret name that holds the S3 CA certificate, which contains the TLS certificate mapped to the key in the secret 'cert'

        false

        url
        string

          Specifies the URL for S3 export and import

        false

spec.bootstrapperImageSpec

[↩ Parent](#spec)

Specification for Bootstrapper container image

            Name
            Type
            Description
            Required

        digestHash
        string

          The digest hash of the container image to pull. When specified, the container image is pulled according to the digest hash instead of the image tag. The versionTag field must also be specified with the image tag matching this digest hash. Note: This field is only supported for OLM deployments.

        false

        imagePullPolicy
        string

          The image pull policy to be applied to the container image. One of Always, Never, IfNotPresent.

        false

        repository
        string

          The repository (name) of the container image to be deployed.

        false

        versionTag
        string

          The tag of the container image to be deployed.

        false

spec.bootstrapperResources

[↩ Parent](#spec)

Compute resource requirements for bootstrapper containers

            Name
            Type
            Description
            Required

        claims
        []object

        false

        limits
        map[string]int or string

          Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

        false

        requests
        map[string]int or string

          Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

        false

spec.bootstrapperResources.claims[]

[↩ Parent](#specbootstrapperresources)

            Name
            Type
            Description
            Required

        name
        string

        true

spec.certificates

[↩ Parent](#spec)

RS Cluster Certificates. Used to modify the certificates used by the cluster. See the "RSClusterCertificates" struct described above to see the supported certificates.

            Name
            Type
            Description
            Required

        apiCertificateSecretName
        string

          Secret name to use for cluster's API certificate. The secret must contain the following structure - A key 'name' with the value 'api'. - A key 'certificate' with the value of the certificate in PEM format. - A key 'key' with the value of the private key. If left blank, a cluster-provided certificate will be used.

        false

        cmCertificateSecretName
        string

          Secret name to use for cluster's CM (Cluster Manager) certificate. The secret must contain the following structure - A key 'name' with the value 'cm'. - A key 'certificate' with the value of the certificate in PEM format. - A key 'key' with the value of the private key. If left blank, a cluster-provided certificate will be used.

        false

        cpInternodeEncryptionCertificateSecretName
        string

          Secret name to use for cluster's Control Plane Internode Encryption (CPINE) certificate. The secret must contain the following structure - A key 'name' with the value 'ccs_internode_encryption'. - A key 'certificate' with the value of the certificate in PEM format. - A key 'key' with the value of the private key. If left blank, a cluster-provided certificate will be used.

        false

        dpInternodeEncryptionCertificateSecretName
        string

          Secret name to use for cluster's Data Plane Internode Encryption (DPINE) certificate. The secret must contain the following structure - A key 'name' with the value 'data_internode_encryption'. - A key 'certificate' with the value of the certificate in PEM format. - A key 'key' with the value of the private key. If left blank, a cluster-provided certificate will be used.

        false

        ldapClientCertificateSecretName
        string

          Secret name to use for cluster's LDAP client certificate. The secret must contain the following structure - A key 'name' with the value 'ldap_client'. - A key 'certificate' with the value of the certificate in PEM format. - A key 'key' with the value of the private key. If left blank, LDAP client certificate authentication will be disabled.

        false

        metricsExporterCertificateSecretName
        string

          Secret name to use for cluster's Metrics Exporter certificate. The secret must contain the following structure - A key 'name' with the value 'metrics_exporter'. - A key 'certificate' with the value of the certificate in PEM format. - A key 'key' with the value of the private key. If left blank, a cluster-provided certificate will be used.

        false

        proxyCertificateSecretName
        string

          Secret name to use for cluster's Proxy certificate. The secret must contain the following structure - A key 'name' with the value 'proxy'. - A key 'certificate' with the value of the certificate in PEM format. - A key 'key' with the value of the private key. If left blank, a cluster-provided certificate will be used. Note: For Active-Active databases (REAADB), certificate updates are automatically reconciled. When you update this secret, the operator detects the change and automatically executes a CRDB force update (equivalent to 'crdb-cli crdb update --force'), which synchronizes the certificate changes to all participating clusters, eliminating the need for manual intervention.

        false

        ssoIssuerCertificateSecretName
        string

          Secret name to use for the SSO Identity Provider (IdP) certificate. This is the public certificate from your SAML Identity Provider used to verify SAML assertions. The secret must contain 'name' and 'certificate' fields (no 'key' field needed for IdP cert). This is optional - if using IdP metadata XML, the IdP certificate is included in the metadata.

        false

        ssoServiceCertificateSecretName
        string

          Secret name to use for cluster's SSO service certificate. Used for SAML-based SSO authentication to the Cluster Manager. The secret must contain 'name', 'certificate', and 'key' fields (same format as other cluster certificates). If left blank, SSO will not be configured.

        false

        syncerCertificateSecretName
        string

          Secret name to use for cluster's Syncer certificate. The secret must contain the following structure - A key 'name' with the value 'syncer'. - A key 'certificate' with the value of the certificate in PEM format. - A key 'key' with the value of the private key. If left blank, a cluster-provided certificate will be used. Note: For Active-Active databases (REAADB), certificate updates are automatically reconciled. When you update this secret, the operator detects the change and automatically executes a CRDB force update (equivalent to 'crdb-cli crdb update --force'), which synchronizes the certificate changes to all participating clusters, eliminating the need for manual intervention.

        false

spec.containerTimezone

[↩ Parent](#spec)

Container timezone configuration. While the default timezone on all containers is UTC, this setting can be used to set the timezone on services rigger/bootstrapper/RS containers. You can either propagate the hosts timezone to RS pods or set it manually via timezoneName.

            Name
            Type
            Description
            Required

        propagateHost
        object

          Identifies that container timezone should be in sync with the host, this option mounts a hostPath volume onto RS pods that could be restricted in some systems.

        false

        timezoneName
        string

          POSIX-style timezone name as a string to be passed as EnvVar to RE pods, e.g. "Europe/London".

        false

spec.extraEnvVars[]

[↩ Parent](#spec)

            Name
            Type
            Description
            Required

        name
        string

        true

        value
        string

        false

        valueFrom
        object

        false

spec.hostAliases[]

[↩ Parent](#spec)

HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the pod's hosts file.

            Name
            Type
            Description
            Required

        hostnames
        []string

          Hostnames for the above IP address.

        false

        ip
        string

          IP address of the host file entry.

        false

spec.ingressOrRouteSpec

[↩ Parent](#spec)

Access configurations for the Redis Enterprise cluster and databases. At most one of ingressOrRouteSpec or activeActive fields can be set at the same time.

            Name
            Type
            Description
            Required

        apiFqdnUrl
        string

          RS API URL

        true

        dbFqdnSuffix
        string

          DB ENDPOINT SUFFIX - will be used to set the db host ingress <db name><db fqdn suffix>. Creates a host name so it should be unique if more than one db is created on the cluster with the same name

        true

        method
        enum

          Used to distinguish between different platforms implementation.

            Enum: openShiftRoute, ingress, istio

        true

        ingressAnnotations
        map[string]string

          Additional annotations to set on ingress resources created by the operator

        false

spec.ldap

[↩ Parent](#spec)

Cluster-level LDAP configuration, such as server addresses, protocol, authentication and query settings.

            Name
            Type
            Description
            Required

        authenticationQuery
        object

          Configuration of authentication queries, mapping between the username, provided to the cluster for authentication, and the LDAP Distinguished Name.

        true

        authorizationQuery
        object

          Configuration of authorization queries, mapping between a user's Distinguished Name and its group memberships.

        true

        protocol
        enum

          Specifies the LDAP protocol to use. One of: LDAP, LDAPS, STARTTLS.

            Enum: LDAP, LDAPS, STARTTLS

        true

        servers
        []object

          One or more LDAP servers. If multiple servers are specified, they must all share an identical organization tree structure.

        true

        bindCredentialsSecretName
        string

          Name of a secret within the same namespace, holding the credentials used to communicate with the LDAP server for authentication queries. The secret must have a key named 'dn' with the Distinguished Name of the user to execute the query, and 'password' with its password. If left blank, credentials-based authentication is disabled.

        false

        caCertificateSecretName
        string

          Name of a secret within the same namespace, holding a PEM-encoded CA certificate for validating the TLS connection to the LDAP server. The secret must have a key named 'cert' with the certificate data. This field is applicable only when the protocol is LDAPS or STARTTLS.

        false

        cacheTTLSeconds
        integer

          The maximum TTL of cached entries.

        false

        directoryTimeoutSeconds
        integer

          The connection timeout to the LDAP server when authenticating a user, in seconds

        false

        enabledForControlPlane
        boolean

          Whether to enable LDAP for control plane access. Disabled by default.

        false

        enabledForDataPlane
        boolean

          Whether to enable LDAP for data plane access. Disabled by default.

        false

spec.ldap.authenticationQuery

[↩ Parent](#specldap)

Configuration of authentication queries, mapping between the username, provided to the cluster for authentication, and the LDAP Distinguished Name.

            Name
            Type
            Description
            Required

        query
        object

          Configuration for a search query. Mutually exclusive with the 'template' field. The substring '%u' in the query filter will be replaced with the username.

        false

        template
        string

          Configuration for a template query. Mutually exclusive with the 'query' field. The substring '%u' will be replaced with the username, e.g., 'cn=%u,ou=dev,dc=example,dc=com'.

        false

spec.ldap.authenticationQuery.query

[↩ Parent](#specldapauthenticationquery)

Configuration for a search query. Mutually exclusive with the 'template' field. The substring '%u' in the query filter will be replaced with the username.

            Name
            Type
            Description
            Required

        base
        string

          The Distinguished Name of the entry at which to start the search, e.g., 'ou=dev,dc=example,dc=com'.

        true

        filter
        string

          An RFC-4515 string representation of the filter to apply in the search. For an authentication query, the substring '%u' will be replaced with the username, e.g., '(cn=%u)'. For an authorization query, the substring '%D' will be replaced with the user's Distinguished Name, e.g., '(members=%D)'.

        true

        scope
        enum

          The search scope for an LDAP query. One of: BaseObject, SingleLevel, WholeSubtree

            Enum: BaseObject, SingleLevel, WholeSubtree

        true

spec.ldap.authorizationQuery

[↩ Parent](#specldap)

Configuration of authorization queries, mapping between a user's Distinguished Name and its group memberships.

            Name
            Type
            Description
            Required

        attribute
        string

          Configuration for an attribute query. Mutually exclusive with the 'query' field. Holds the name of an attribute of the LDAP user entity that contains a list of the groups that the user belongs to, e.g., 'memberOf'.

        false

        query
        object

          Configuration for a search query. Mutually exclusive with the 'attribute' field. The substring '%D' in the query filter will be replaced with the user's Distinguished Name.

        false

spec.ldap.authorizationQuery.query

[↩ Parent](#specldapauthorizationquery)

Configuration for a search query. Mutually exclusive with the 'attribute' field. The substring '%D' in the query filter will be replaced with the user's Distinguished Name.

            Name
            Type
            Description
            Required

        base
        string

          The Distinguished Name of the entry at which to start the search, e.g., 'ou=dev,dc=example,dc=com'.

        true

        filter
        string

          An RFC-4515 string representation of the filter to apply in the search. For an authentication query, the substring '%u' will be replaced with the username, e.g., '(cn=%u)'. For an authorization query, the substring '%D' will be replaced with the user's Distinguished Name, e.g., '(members=%D)'.

        true

        scope
        enum

          The search scope for an LDAP query. One of: BaseObject, SingleLevel, WholeSubtree

            Enum: BaseObject, SingleLevel, WholeSubtree

        true

spec.ldap.servers[]

[↩ Parent](#specldap)

Address of an LDAP server.

            Name
            Type
            Description
            Required

        host
        string

          Host name of the LDAP server

        true

        port
        integer

          Port number of the LDAP server. If unspecified, defaults to 389 for LDAP and STARTTLS protocols, and 636 for LDAPS protocol.

            Format: int32

        false

spec.ocspConfiguration

[↩ Parent](#spec)

An API object that represents the cluster's OCSP configuration. To enable OCSP, the cluster's proxy certificate should contain the OCSP responder URL.

            Name
            Type
            Description
            Required

        ocspFunctionality
        boolean

          Whether to enable/disable OCSP mechanism for the cluster.

        false

        queryFrequency
        integer

          Determines the interval (in seconds) in which the control plane will poll the OCSP responder for a new status for the server certificate. Minimum value is 60. Maximum value is 86400.

        false

        recoveryFrequency
        integer

          Determines the interval (in seconds) in which the control plane will poll the OCSP responder for a new status for the server certificate when the current staple is invalid. Minimum value is 60. Maximum value is 86400.

        false

        recoveryMaxTries
        integer

          Determines the maximum number for the OCSP recovery attempts. After max number of tries passed, the control plane will revert back to the regular frequency. Minimum value is 1. Maximum value is 100.

        false

        responseTimeout
        integer

          Determines the time interval (in seconds) for which the request waits for a response from the OCSP responder. Minimum value is 1. Maximum value is 60.

        false

spec.ossClusterSettings

[↩ Parent](#spec)

Cluster-level configuration for OSS cluster mode databases.

            Name
            Type
            Description
            Required

        externalAccessType
        enum

          Specifies the mechanism for enabling external access to OSS cluster databases. When unset or set to "Disabled", external access is not allowed for any OSS cluster databases. When set to a specific mechanism (e.g., "LoadBalancer"), that mechanism is used to provide external access. Note: Individual databases must still enable external access via their ossClusterSettings.enableExternalAccess field.

            Enum: LoadBalancer, Disabled

        false

        loadBalancer
        object

          Configuration for LoadBalancer services created to assign public IPs for Redis Enterprise cluster nodes.

        false

        podCIDRs
        []string

          A list of Kubernetes pod CIDR ranges from which pod IPs are allocated. Supports both IPv4 (e.g., "10.30.0.0/16") and IPv6 addresses. This field should only be configured when OSS cluster databases need to be accessed from both internal and external clients. When configured, internal communication can reach pods directly using their pod IPs, bypassing the external access mechanism (e.g., load balancer services) for improved performance. IMPORTANT: For this feature to work correctly, the entire data path must preserve the client source IP address. This is required because the Redis server uses the client's source IP to construct the CLUSTER SHARDS/SLOTS response - returning pod IPs for internal clients (matching podCIDRs) or load balancer addresses for external clients. On cloud platforms, this typically requires configuring the load balancer to preserve source IPs.

        false

spec.ossClusterSettings.loadBalancer

[↩ Parent](#specossclustersettings)

Configuration for LoadBalancer services created to assign public IPs for Redis Enterprise cluster nodes.

            Name
            Type
            Description
            Required

        externalTrafficPolicy
        enum

          ExternalTrafficPolicy specifies the externalTrafficPolicy for LoadBalancer services created for Redis Enterprise cluster nodes. Choose "Local" to configure the LoadBalancer to only route traffic to the single worker node hosting the Redis Enterprise cluster node for that service. Choose "Cluster" to route traffic to any worker node, providing a more stable behavior during failovers, but with increased overhead due to additional hop. Defaults to "Local" when podCIDRs is configured, and "Cluster" otherwise.

            Enum: Cluster, Local

        false

        serviceAnnotations
        map[string]string

          Additional annotations to set on LoadBalancer services created for Redis Enterprise cluster nodes. These annotations are merged with global service annotations from spec.services.servicesAnnotations.

        false

spec.persistentSpec

[↩ Parent](#spec)

Persistent storage configuration for Redis Enterprise cluster.

            Name
            Type
            Description
            Required

        enablePersistentVolumeResize
        boolean

          Whether to enable PersistentVolumes resize. Disabled by default. Read the instruction in pvc_expansion readme carefully before using this feature.

        false

        enabled
        boolean

          Whether to add persistent volume to Redis Enterprise pods

        false

        storageClassName
        string

          Storage class for persistent volume in Redis Enterprise pods. Leave empty to use the default. If using the default this way, make sure the Kubernetes Cluster has a default Storage Class configured. This can be done by running a `kubectl get storageclass` and see if one of the Storage Classes' names contains a `(default)` mark.

        false

        volumeSize
        int or string

          By default, if you omit spec.persistentSpec.volumeSize, the operator allocates a persistent volume that is five times (5x) the Redis Enterprise node memory request defined in spec.redisEnterpriseNodeResources.requests.memory (per node). This 5x ratio is the recommended minimum capacity. To enable resizing after creating the cluster, see the Expand PVC docs: https://redis.io/docs/latest/operate/kubernetes/re-clusters/expand-pvc/

        false

spec.podAntiAffinity

[↩ Parent](#spec)

Override for the default anti-affinity rules of the Redis Enterprise pods. More info: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#an-example-of-a-pod-that-uses-pod-affinity

            Name
            Type
            Description
            Required

        preferredDuringSchedulingIgnoredDuringExecution
        []object

        false

        requiredDuringSchedulingIgnoredDuringExecution
        []object

        false

spec.podStartingPolicy

[↩ Parent](#spec)

Mitigation setting for STS pods stuck in "ContainerCreating"

            Name
            Type
            Description
            Required

        enabled
        boolean

          Enables detection and mitigation of pod startup issues.

        true

        startingThresholdSeconds
        integer

          Time in seconds to wait before taking action on a pod stuck during startup. Set to 0 to disable.

            Format: int32

        true

spec.podTolerations[]

[↩ Parent](#spec)

            Name
            Type
            Description
            Required

        effect
        string

        false

        key
        string

        false

        operator
        string

        false

        tolerationSeconds
        integer

            Format: int64

        false

        value
        string

        false

spec.pullSecrets[]

[↩ Parent](#spec)

            Name
            Type
            Description
            Required

        name
        string

          Secret name

        false

spec.redisEnterpriseAdditionalPodSpecAttributes

[↩ Parent](#spec)

ADVANCED USAGE USE AT YOUR OWN RISK - specify pod attributes that are required for the statefulset - Redis Enterprise pods. Pod attributes managed by the operator might override these settings. Also make sure the attributes are supported by the K8s version running on the cluster - the operator does not validate that.

            Name
            Type
            Description
            Required

        activeDeadlineSeconds
        integer

            Format: int64

        false

        affinity
        object

        false

        automountServiceAccountToken
        boolean

        false

        dnsConfig
        object

        false

        dnsPolicy
        string

        false

        enableServiceLinks
        boolean

        false

        ephemeralContainers
        []object

        false

        hostAliases
        []object

        false

        hostIPC
        boolean

        false

        hostNetwork
        boolean

        false

        hostPID
        boolean

        false

        hostUsers
        boolean

        false

        hostname
        string

        false

        imagePullSecrets
        []object

        false

        initContainers
        []object

        false

        nodeName
        string

        false

        nodeSelector
        map[string]string

        false

        os
        object

        false

        overhead
        map[string]int or string

        false

        preemptionPolicy
        string

        false

        priority
        integer

            Format: int32

        false

        priorityClassName
        string

        false

        readinessGates
        []object

        false

        resourceClaims
        []object

        false

        restartPolicy
        string

        false

        runtimeClassName
        string

        false

        schedulerName
        string

        false

        schedulingGates
        []object

        false

        securityContext
        object

        false

        serviceAccount
        string

        false

        serviceAccountName
        string

        false

        setHostnameAsFQDN
        boolean

        false

        shareProcessNamespace
        boolean

        false

        subdomain
        string

        false

        terminationGracePeriodSeconds
        integer

            Format: int64

        false

        tolerations
        []object

        false

        topologySpreadConstraints
        []object

        false

        volumes
        []object

        false

spec.redisEnterpriseImageSpec

[↩ Parent](#spec)

Specification for Redis Enterprise container image

            Name
            Type
            Description
            Required

        digestHash
        string

          The digest hash of the container image to pull. When specified, the container image is pulled according to the digest hash instead of the image tag. The versionTag field must also be specified with the image tag matching this digest hash. Note: This field is only supported for OLM deployments.

        false

        imagePullPolicy
        string

          The image pull policy to be applied to the container image. One of Always, Never, IfNotPresent.

        false

        repository
        string

          The repository (name) of the container image to be deployed.

        false

        versionTag
        string

          The tag of the container image to be deployed.

        false

spec.redisEnterpriseNodeResources

[↩ Parent](#spec)

Compute resource requirements for Redis Enterprise containers

            Name
            Type
            Description
            Required

        claims
        []object

        false

        limits
        map[string]int or string

          Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

        false

        requests
        map[string]int or string

          Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

        false

spec.redisEnterpriseNodeResources.claims[]

[↩ Parent](#specredisenterprisenoderesources)

            Name
            Type
            Description
            Required

        name
        string

        true

spec.redisEnterpriseServicesConfiguration

[↩ Parent](#spec)

RS Cluster optional services settings

            Name
            Type
            Description
            Required

        cmServer
        object

        false

        crdbCoordinator
        object

        false

        crdbWorker
        object

        false

        mdnsServer
        object

        false

        pdnsServer
        object

        false

        saslauthd
        object

        false

        statsArchiver
        object

        false

spec.redisEnterpriseServicesConfiguration.cmServer

[↩ Parent](#specredisenterpriseservicesconfiguration)

            Name
            Type
            Description
            Required

        operatingMode
        enum

          Whether to enable/disable the CM server

            Enum: enabled, disabled

        true

spec.redisEnterpriseServicesConfiguration.crdbCoordinator

[↩ Parent](#specredisenterpriseservicesconfiguration)

            Name
            Type
            Description
            Required

        operatingMode
        enum

          Whether to enable/disable the crdb coordinator process

            Enum: enabled, disabled

        true

spec.redisEnterpriseServicesConfiguration.crdbWorker

[↩ Parent](#specredisenterpriseservicesconfiguration)

            Name
            Type
            Description
            Required

        operatingMode
        enum

          Whether to enable/disable the crdb worker processes

            Enum: enabled, disabled

        true

spec.redisEnterpriseServicesConfiguration.mdnsServer

[↩ Parent](#specredisenterpriseservicesconfiguration)

            Name
            Type
            Description
            Required

        operatingMode
        enum

          Whether to enable/disable the Multicast DNS server

            Enum: enabled, disabled

        true

spec.redisEnterpriseServicesConfiguration.pdnsServer

[↩ Parent](#specredisenterpriseservicesconfiguration)

            Name
            Type
            Description
            Required

        operatingMode
        enum

          Deprecated: The PDNS Server is now disabled by the operator. This field will be ignored.

            Enum: enabled, disabled

        true

spec.redisEnterpriseServicesConfiguration.saslauthd

[↩ Parent](#specredisenterpriseservicesconfiguration)

            Name
            Type
            Description
            Required

        operatingMode
        enum

          Whether to enable/disable the saslauthd service

            Enum: enabled, disabled

        true

spec.redisEnterpriseServicesConfiguration.statsArchiver

[↩ Parent](#specredisenterpriseservicesconfiguration)

            Name
            Type
            Description
            Required

        operatingMode
        enum

          Whether to enable/disable the stats archiver service

            Enum: enabled, disabled

        true

spec.redisEnterpriseServicesRiggerImageSpec

[↩ Parent](#spec)

Specification for Services Rigger container image

            Name
            Type
            Description
            Required

        digestHash
        string

          The digest hash of the container image to pull. When specified, the container image is pulled according to the digest hash instead of the image tag. The versionTag field must also be specified with the image tag matching this digest hash. Note: This field is only supported for OLM deployments.

        false

        imagePullPolicy
        string

          The image pull policy to be applied to the container image. One of Always, Never, IfNotPresent.

        false

        repository
        string

          The repository (name) of the container image to be deployed.

        false

        versionTag
        string

          The tag of the container image to be deployed.

        false

spec.redisEnterpriseServicesRiggerResources

[↩ Parent](#spec)

Compute resource requirements for Services Rigger pod

            Name
            Type
            Description
            Required

        claims
        []object

        false

        limits
        map[string]int or string

          Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

        false

        requests
        map[string]int or string

          Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

        false

spec.redisEnterpriseVolumeMounts[]

[↩ Parent](#spec)

            Name
            Type
            Description
            Required

        mountPath
        string

        true

        name
        string

        true

        mountPropagation
        string

        false

        readOnly
        boolean

        false

        subPath
        string

        false

        subPathExpr
        string

        false

spec.redisOnFlashSpec

[↩ Parent](#spec)

Auto Tiering (Redis on Flash) configuration. When provided, the cluster can create Auto Tiering databases.

            Name
            Type
            Description
            Required

        enabled
        boolean

        true

        storageClassName
        string

        true

        bigStoreDriver
        enum

            Enum: rocksdb, speedb

        false

        flashDiskSize
        int or string

        false

        flashStorageEngine
        enum

            Enum: rocksdb

        false

spec.securityContext

[↩ Parent](#spec)

The security configuration that will be applied to RS pods.

            Name
            Type
            Description
            Required

        readOnlyRootFilesystemPolicy
        object

          Policy controlling whether to enable read-only root filesystem for the Redis Enterprise software containers. Note that certain filesystem paths remain writable through mounted volumes to ensure proper functionality.

        false

        resourceLimits
        object

          Settings pertaining to resource limits management by the Redis Enterprise node container.

        false

spec.securityContext.readOnlyRootFilesystemPolicy

[↩ Parent](#specsecuritycontext)

Policy controlling whether to enable read-only root filesystem for the Redis Enterprise software containers. Note that certain filesystem paths remain writable through mounted volumes to ensure proper functionality.

            Name
            Type
            Description
            Required

        enabled
        boolean

          Whether to enable read-only root filesystem for the Redis Enterprise software containers. Default is false.

        true

spec.securityContext.resourceLimits

[↩ Parent](#specsecuritycontext)

Settings pertaining to resource limits management by the Redis Enterprise node container.

            Name
            Type
            Description
            Required

        allowAutoAdjustment
        boolean

          Allow Redis Enterprise to adjust resource limits, like max open file descriptors, of its data plane processes. When this option is enabled, the SYS_RESOURCE capability is added to the Redis Enterprise pods, and their allowPrivilegeEscalation field is set. Turned off by default.

        false

spec.services

[↩ Parent](#spec)

Customization options for operator-managed service resources created for Redis Enterprise clusters and databases

            Name
            Type
            Description
            Required

        apiService
        object

          Customization options for the REC API service.

        false

        servicesAnnotations
        map[string]string

          Global additional annotations to set on service resources created by the operator. The specified annotations will not override annotations that already exist and didn't originate from the operator.

        false

spec.services.apiService

[↩ Parent](#specservices)

Customization options for the REC API service.

            Name
            Type
            Description
            Required

        type
        enum

          Type of service to create for the REC API service. Defaults to ClusterIP service, if not specified otherwise.

            Enum: ClusterIP, NodePort, LoadBalancer

        false

spec.servicesRiggerSpec

[↩ Parent](#spec)

Specification for service rigger

            Name
            Type
            Description
            Required

        databaseServicePortPolicy
        enum

          databaseServicePortPolicy instructs how to determine the service ports for REDB services. Defaults to DatabasePortForward, if not specified otherwise. Note - Regardless whether this flag is set or not, if an REDB/REAADB configured with databaseServicePort that would be the port exposed by the Service. DatabasePortForward - The service port will be the same as the database port. RedisDefaultPort - The service port will be the default Redis port (6379).

            Enum: DatabasePortForward, RedisDefaultPort

        false

        databaseServiceType
        string

          Service types for access to databases. should be a comma separated list. The possible values are cluster_ip, headless and load_balancer.

        false

        extraEnvVars
        []object

        false

        podAnnotations
        map[string]string

          annotations for the service rigger pod

        false

        serviceNaming
        enum

          Used to determine how to name the services created automatically when a database is created. When bdb_name is used, the database name will be also used for the service name. When redis-port is used, the service will be named redis-<port>.

            Enum: bdb_name, redis-port

        false

        servicesRiggerAdditionalPodSpecAttributes
        object

          ADVANCED USAGE USE AT YOUR OWN RISK - specify pod attributes that are required for the rigger deployment pod. Pod attributes managed by the operator might override these settings (Containers, serviceAccountName, podTolerations, ImagePullSecrets, nodeSelector, PriorityClassName, PodSecurityContext). Also make sure the attributes are supported by the K8s version running on the cluster - the operator does not validate that.

        false

spec.servicesRiggerSpec.extraEnvVars[]

[↩ Parent](#specservicesriggerspec)

EnvVar represents an environment variable present in a Container. More info: https://kubernetes.io/docs/tasks/inject-data-application/environment-variable-expose-pod-information/

            Name
            Type
            Description
            Required

        name
        string

          Name of the environment variable.

        true

        value
        string

        false

        valueFrom
        object

          Source for the environment variable's value. Cannot be used if value is not empty.

        false

spec.servicesRiggerSpec.extraEnvVars[].valueFrom

[↩ Parent](#specservicesriggerspecextraenvvars)

Source for the environment variable's value. Cannot be used if value is not empty.

            Name
            Type
            Description
            Required

        configMapKeyRef
        object

          Selects a key of a ConfigMap.

        false

        fieldRef
        object

          Selects a field of the pod

        false

        resourceFieldRef
        object

          Selects a resource of the container: only resources limits and requests are currently supported.

        false

        secretKeyRef
        object

          Selects a key of a secret in the pod's namespace

        false

spec.servicesRiggerSpec.extraEnvVars[].valueFrom.configMapKeyRef

[↩ Parent](#specservicesriggerspecextraenvvarsvaluefrom)

Selects a key of a ConfigMap.

            Name
            Type
            Description
            Required

        key
        string

          The key to select.

        true

        name
        string

          Name of the referent

        false

        optional
        boolean

          Specify whether the ConfigMap or its key must be defined

        false

spec.servicesRiggerSpec.extraEnvVars[].valueFrom.fieldRef

[↩ Parent](#specservicesriggerspecextraenvvarsvaluefrom)

Selects a field of the pod

            Name
            Type
            Description
            Required

        fieldPath
        string

          Path of the field to select in the specified API version.

        true

        apiVersion
        string

          Version of the schema the FieldPath is written in terms of, defaults to "v1".

        false

spec.servicesRiggerSpec.extraEnvVars[].valueFrom.resourceFieldRef

[↩ Parent](#specservicesriggerspecextraenvvarsvaluefrom)

Selects a resource of the container: only resources limits and requests are currently supported.

            Name
            Type
            Description
            Required

        resource
        string

          Required: resource to select

        true

        containerName
        string

          Container name: required for volumes, optional for env vars

        false

        divisor
        int or string

          Specifies the output format of the exposed resources, defaults to "1"

        false

spec.servicesRiggerSpec.extraEnvVars[].valueFrom.secretKeyRef

[↩ Parent](#specservicesriggerspecextraenvvarsvaluefrom)

Selects a key of a secret in the pod's namespace

            Name
            Type
            Description
            Required

        key
        string

          The key of the secret to select from.  Must be a valid secret key.

        true

        name
        string

          Name of the referent

        false

        optional
        boolean

          Specify whether the Secret or its key must be defined

        false

spec.servicesRiggerSpec.servicesRiggerAdditionalPodSpecAttributes

[↩ Parent](#specservicesriggerspec)

ADVANCED USAGE USE AT YOUR OWN RISK - specify pod attributes that are required for the rigger deployment pod. Pod attributes managed by the operator might override these settings (Containers, serviceAccountName, podTolerations, ImagePullSecrets, nodeSelector, PriorityClassName, PodSecurityContext). Also make sure the attributes are supported by the K8s version running on the cluster - the operator does not validate that.

            Name
            Type
            Description
            Required

        activeDeadlineSeconds
        integer

            Format: int64

        false

        affinity
        object

        false

        automountServiceAccountToken
        boolean

        false

        dnsConfig
        object

        false

        dnsPolicy
        string

        false

        enableServiceLinks
        boolean

        false

        ephemeralContainers
        []object

        false

        hostAliases
        []object

        false

        hostIPC
        boolean

        false

        hostNetwork
        boolean

        false

        hostPID
        boolean

        false

        hostUsers
        boolean

        false

        hostname
        string

        false

        imagePullSecrets
        []object

        false

        initContainers
        []object

        false

        nodeName
        string

        false

        nodeSelector
        map[string]string

        false

        os
        object

        false

        overhead
        map[string]int or string

        false

        preemptionPolicy
        string

        false

        priority
        integer

            Format: int32

        false

        priorityClassName
        string

        false

        readinessGates
        []object

        false

        resourceClaims
        []object

        false

        restartPolicy
        string

        false

        runtimeClassName
        string

        false

        schedulerName
        string

        false

        schedulingGates
        []object

        false

        securityContext
        object

        false

        serviceAccount
        string

        false

        serviceAccountName
        string

        false

        setHostnameAsFQDN
        boolean

        false

        shareProcessNamespace
        boolean

        false

        subdomain
        string

        false

        terminationGracePeriodSeconds
        integer

            Format: int64

        false

        tolerations
        []object

        false

        topologySpreadConstraints
        []object

        false

        volumes
        []object

        false

spec.sideContainersSpec[]

[↩ Parent](#spec)

            Name
            Type
            Description
            Required

        name
        string

        true

        args
        []string

        false

        command
        []string

        false

        env
        []object

        false

        envFrom
        []object

        false

        image
        string

        false

        imagePullPolicy
        string

        false

        lifecycle
        object

        false

        livenessProbe
        object

        false

        ports
        []object

        false

        readinessProbe
        object

        false

        resources
        object

        false

        securityContext
        object

        false

        startupProbe
        object

        false

        stdin
        boolean

        false

        stdinOnce
        boolean

        false

        terminationMessagePath
        string

        false

        terminationMessagePolicy
        string

        false

        tty
        boolean

        false

        volumeDevices
        []object

        false

        volumeMounts
        []object

        false

        workingDir
        string

        false

spec.slaveHA

[↩ Parent](#spec)

Slave high availability mechanism configuration.

            Name
            Type
            Description
            Required

        slaveHAGracePeriod
        integer

          Grace period in seconds between node failure and when the high availability mechanism starts relocating shards. Set to 0 to not affect cluster configuration.

            Format: int32

        true

spec.sso

[↩ Parent](#spec)

Cluster-level SSO configuration for authentication to the Cluster Manager UI.

            Name
            Type
            Description
            Required

        enabled
        boolean

          Enables SSO for Cluster Manager authentication. SSO requires the following configuration - Service Provider certificate (spec.certificates.ssoServiceCertificateSecretName), Identity Provider certificate (spec.certificates.ssoIssuerCertificateSecretName), IdP metadata or manual issuer configuration (spec.sso.saml.idpMetadataSecretName or spec.sso.saml.issuer), and Base address for Service Provider URLs (auto-determined from UI service or set via spec.sso.saml.serviceProvider.baseAddress).

        true

        saml
        object

          SAML-based SSO configuration. Currently,SAML is the only supported SSO protocol.

        true

        enforceSSO
        boolean

          Enforces SSO-only authentication for the Cluster Manager. When true, local username/password authentication is disabled for non-admin users. When false (default), both SSO and local authentication are available.

        false

spec.sso.saml

[↩ Parent](#specsso)

SAML-based SSO configuration. Currently,SAML is the only supported SSO protocol.

            Name
            Type
            Description
            Required

        idpMetadataSecretName
        string

          Name of a secret in the same namespace that contains the Identity Provider (IdP) metadata XML. The secret must contain a key named 'idp_metadata' with the IdP metadata XML content. The XML can be plain text or base64-encoded; the operator handles encoding as needed. Obtain this metadata from your SAML Identity Provider (e.g., Okta or Azure AD). This is the recommended configuration method, as it's less error-prone. Either idpMetadataSecretName or issuer must be specified. If both are provided, idpMetadataSecretName takes precedence and issuer is ignored.

        false

        issuer
        object

          Manual Identity Provider (IdP) configuration. Use this when IdP metadata XML is unavailable. Either idpMetadataSecretName or issuer must be specified. If both are provided, idpMetadataSecretName takes precedence and issuer is ignored.

        false

        serviceProvider
        object

          Service Provider (SP) configuration.

        false

        spMetadataSecretName
        string

          Name of a secret where the operator stores the Service Provider (SP) metadata XML. The operator creates this secret with a key named 'sp_metadata' that contains the base64-encoded SP metadata XML. Upload this metadata to your Identity Provider. If not specified, defaults to "<cluster-name>-sso-sp-metadata". If not specified, the Service Provider metadata isn't stored in a K8s secret, but can still be obtained directly from the cluster's UI and/or API. Note: This secret is only created when the cluster is configured to use Kubernetes secrets (spec.clusterCredentialSecretType is unset or set to "kubernetes"). When using Vault secrets, the operator does not create this secret. Users can obtain the SP metadata directly from the Redis Enterprise Server API endpoint: GET /v1/cluster/sso/saml/metadata/sp and store it in Vault themselves if needed.

        false

spec.sso.saml.issuer

[↩ Parent](#specssosaml)

Manual Identity Provider (IdP) configuration. Use this when IdP metadata XML is unavailable. Either idpMetadataSecretName or issuer must be specified. If both are provided, idpMetadataSecretName takes precedence and issuer is ignored.

            Name
            Type
            Description
            Required

        entityID
        string

          Identity Provider entity ID (issuer identifier). Example: "urn:sso:example:idp" or "https://idp.example.com".

        true

        loginURL
        string

          Identity Provider SSO login URL where SAML authentication requests are sent. Example: "https://idp.example.com/sso/saml".

        true

        logoutURL
        string

          Identity Provider single logout URL where SAML logout requests are sent.

        false

spec.sso.saml.serviceProvider

[↩ Parent](#specssosaml)

Service Provider (SP) configuration.

            Name
            Type
            Description
            Required

        baseAddress
        string

          Base address used to construct Service Provider (SP) URLs, such as the ACS URL and SLO URL. Format: [<scheme>://]<hostname>[:<port>]. Examples: "https://redis-ui.example.com:9443" (recommended - explicit scheme), "redis-ui.example.com:9443" (defaults to https://), "http://redis-ui.example.com:9443" (NOT recommended for production). If the scheme is not specified, the operator automatically prepends "https://". WARNING: Using "http://" is NOT recommended for production environments as it transmits sensitive SAML assertions in plaintext. Only use "http://" for testing/development purposes. If set, this value is used to construct the SP URLs. If unset, the base address is automatically determined from the REC Cluster Manager UI service: - If the UI service type is LoadBalancer (configured via spec.uiServiceType), the load balancer address is used. - Otherwise, the cluster-internal DNS name is used (e.g., rec-ui.svc.cluster.local). - The port defaults to 8443 if not specified. Usage guidelines: - For LoadBalancer services: Leave this field blank to use the default REC UI service, or set it explicitly to the LoadBalancer address for custom services. - For Ingress: Set this to the ingress hostname and port (typically 443), e.g., "https://redis-ui.example.com:443".

        false

spec.upgradeSpec

[↩ Parent](#spec)

Redis Enterprise upgrade configuration

            Name
            Type
            Description
            Required

        autoUpgradeRedisEnterprise
        boolean

          Enables automatic Redis Enterprise upgrades when the operator is upgraded.

        true

spec.usageMeter

[↩ Parent](#spec)

The configuration of the usage meter.

            Name
            Type
            Description
            Required

        callHomeClient
        object

        false

spec.usageMeter.callHomeClient

[↩ Parent](#specusagemeter)

            Name
            Type
            Description
            Required

        disabled
        boolean

          Whether to disable the call home client. Enabled by default.

        false

        imageSpec
        object

          Image specification

        false

        proxySecretName
        string

          if needed, add proxy details in secret. the name of the proxy secret in the secret, can send the following keys: proxy-url, proxy-username, proxy-password (the url includes the proxy port).

        false

        resources
        object

          Compute resource requirements for Call Home Client pod

        false

spec.usageMeter.callHomeClient.imageSpec

[↩ Parent](#specusagemetercallhomeclient)

Image specification

            Name
            Type
            Description
            Required

        digestHash
        string

          The digest hash of the container image to pull. When specified, the container image is pulled according to the digest hash instead of the image tag. The versionTag field must also be specified with the image tag matching this digest hash. Note: This field is only supported for OLM deployments.

        false

        imagePullPolicy
        string

          The image pull policy to be applied to the container image. One of Always, Never, IfNotPresent.

        false

        repository
        string

          The repository (name) of the container image to be deployed.

        false

        versionTag
        string

          The tag of the container image to be deployed.

        false

spec.usageMeter.callHomeClient.resources

[↩ Parent](#specusagemetercallhomeclient)

Compute resource requirements for Call Home Client pod

            Name
            Type
            Description
            Required

        claims
        []object

          Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container.
 This is an alpha field and requires enabling the DynamicResourceAllocation feature gate.
 This field is immutable. It can only be set for containers.

        false

        limits
        map[string]int or string

          Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

        false

        requests
        map[string]int or string

          Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

        false

spec.usageMeter.callHomeClient.resources.claims[]

[↩ Parent](#specusagemetercallhomeclientresources)

ResourceClaim references one entry in PodSpec.ResourceClaims.

            Name
            Type
            Description
            Required

        name
        string

          Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.

        true

spec.userDefinedModules[]

[↩ Parent](#spec)

UserDefinedModule represents a user-defined Redis module to be downloaded and installed during bootstrap

            Name
            Type
            Description
            Required

        name
        string

          Name of the module

        true

        source
        object

          Source location for downloading the module

        true

spec.userDefinedModules[].source

[↩ Parent](#specuserdefinedmodules)

Source location for downloading the module

            Name
            Type
            Description
            Required

        http
        object

          HTTP source configuration for downloading the module via HTTP

        false

        https
        object

          HTTPS source configuration for downloading the module via HTTPS

        false

spec.userDefinedModules[].source.http

[↩ Parent](#specuserdefinedmodulessource)

HTTP source configuration for downloading the module via HTTP

            Name
            Type
            Description
            Required

        url
        string

          URL to download the module from (must use http:// scheme)

        true

        credentialsSecret
        string

          Name of the Kubernetes secret containing credentials for downloading the module, if needed. The secret must contain 'username' and 'password' keys.

        false

spec.userDefinedModules[].source.https

[↩ Parent](#specuserdefinedmodulessource)

HTTPS source configuration for downloading the module via HTTPS

            Name
            Type
            Description
            Required

        url
        string

          URL to download the module from (must use https:// scheme)

        true

        credentialsSecret
        string

          Name of the Kubernetes secret containing credentials for downloading the module, if needed. The secret must contain 'username' and 'password' keys.

        false

spec.volumes[]

[↩ Parent](#spec)

Volume represents a named volume in a pod that may be accessed by any container in the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes

            Name
            Type
            Description
            Required

        name
        string

        true

        awsElasticBlockStore
        object

        false

        azureDisk
        object

        false

        azureFile
        object

        false

        cephfs
        object

        false

        cinder
        object

        false

        configMap
        object

        false

        csi
        object

        false

        downwardAPI
        object

        false

        emptyDir
        object

        false

        fc
        object

        false

        flexVolume
        object

        false

        flocker
        object

        false

        gcePersistentDisk
        object

        false

        gitRepo
        object

        false

        glusterfs
        object

        false

        hostPath
        object

        false

        iscsi
        object

        false

        nfs
        object

        false

        persistentVolumeClaim
        object

        false

        photonPersistentDisk
        object

        false

        portworxVolume
        object

        false

        projected
        object

        false

        quobyte
        object

        false

        rbd
        object

        false

        scaleIO
        object

        false

        secret
        object

        false

        storageos
        object

        false

        vsphereVolume
        object

        false

status

[↩ Parent](#)

            Name
            Type
            Description
            Required

        bundledDatabaseVersions
        []object

          Versions of open source databases bundled by Redis Enterprise Software - please note that in order to use a specific version it should be supported by the ‘upgradePolicy’ - ‘major’ or ‘latest’ according to the desired version (major/minor)

        false

        certificatesStatus
        object

          Stores information about cluster certificates and their update process. In Active-Active databases, this is used to detect updates to the certificates, and trigger synchronization across the participating clusters.

        false

        clusterCredentialSecretName
        string

          The name of the secret containing cluster credentials that was set upon cluster creation. This field is used to prevent changes to ClusterCredentialSecretName after cluster creation.

        false

        ingressOrRouteMethodStatus
        string

          The ingressOrRouteSpec/ActiveActive spec method that exist

        false

        licenseStatus
        object

        false

        managedAPIs
        object

          Indicates cluster APIs that are being managed by the operator. This only applies to cluster APIs which are optionally-managed by the operator, such as cluster LDAP configuration. Most other APIs are automatically managed by the operator, and are not listed here.

        false

        modules
        []object

        false

        ocspStatus
        object

          An API object that represents the cluster's OCSP status

        false

        persistenceStatus
        object

          The status of the Persistent Volume Claims that are used for Redis Enterprise cluster persistence. The status will correspond to the status of one or more of the PVCs (failed/resizing if one of them is in resize or failed to resize)

        false

        redisEnterpriseIPFamily
        string

        false

        specStatus
        string

        false

        state
        string

        false

status.bundledDatabaseVersions[]

[↩ Parent](#status)

            Name
            Type
            Description
            Required

        dbType
        string

        true

        version
        string

        true

        major
        boolean

        false

status.certificatesStatus

[↩ Parent](#status)

Stores information about cluster certificates and their update process. In Active-Active databases, this is used to detect updates to the certificates, and trigger synchronization across the participating clusters.

            Name
            Type
            Description
            Required

        generation
        integer

          Generation stores the version of the cluster's Proxy and Syncer certificate secrets. This generation counter is automatically incremented when proxy or syncer certificates are updated. In Active-Active databases (REAADB), the operator monitors this field to detect certificate changes and automatically triggers a CRDB force update (equivalent to 'crdb-cli crdb update --force'), which synchronizes the certificate changes to all participating clusters, eliminating the need for manual intervention to maintain sync.

            Format: int64

        false

        updateStatus
        string

          The status of the cluster's certificates update

        false

status.licenseStatus

[↩ Parent](#status)

            Name
            Type
            Description
            Required

        activationDate
        string

        false

        expirationDate
        string

        false

        features
        []string

        false

        flashShards
        integer

            Format: int32

        false

        flashShardsLimit
        integer

            Format: int32

        false

        licenseState
        string

        false

        owner
        string

        false

        ramShards
        integer

            Format: int32

        false

        ramShardsLimit
        integer

            Format: int32

        false

        shardsLimit
        integer

        false

        shardsUsage
        string

        false

status.managedAPIs

[↩ Parent](#status)

Indicates cluster APIs that are being managed by the operator. This only applies to cluster APIs which are optionally-managed by the operator, such as cluster LDAP configuration. Most other APIs are automatically managed by the operator, and are not listed here.

            Name
            Type
            Description
            Required

        ldap
        boolean

          Indicate whether cluster LDAP configuration is managed by the operator. When this is enabled, the operator will reconcile the cluster LDAP configuration according to the '.spec.ldap' field in the RedisEnterpriseCluster resource.

        false

status.modules[]

[↩ Parent](#status)

            Name
            Type
            Description
            Required

        displayName
        string

        false

        name
        string

        false

        versions
        []string

        false

status.ocspStatus

[↩ Parent](#status)

An API object that represents the cluster's OCSP status

            Name
            Type
            Description
            Required

        certStatus
        string

          Indicates the proxy certificate status - GOOD/REVOKED/UNKNOWN.

        false

        nextUpdate
        string

          The time at or before which newer information will be available about the status of the certificate (if available)

        false

        producedAt
        string

          The time at which the OCSP responder signed this response.

        false

        responderUrl
        string

          The OCSP responder url from which this status came from.

        false

        revocationTime
        string

          The time at which the certificate was revoked or placed on hold.

        false

        thisUpdate
        string

          The most recent time at which the status being indicated is known by the responder to have been correct.

        false

status.persistenceStatus

[↩ Parent](#status)

The status of the Persistent Volume Claims that are used for Redis Enterprise cluster persistence. The status will correspond to the status of one or more of the PVCs (failed/resizing if one of them is in resize or failed to resize)

            Name
            Type
            Description
            Required

        status
        string

          The current status of the PVCs

        false

        succeeded
        string

          The number of PVCs that are provisioned with the expected size

        false