{ "schema_version": 2, "id": "integrate/redis-data-integration/installation/disaster-recovery/gcs", "title": "Configure a GCS lease", "url": "https://redis.io/docs/latest/integrate/redis-data-integration/installation/disaster-recovery/gcs/", "summary": "Create and configure a Google Cloud Storage lease for RDI disaster recovery.", "tags": [ "docs", "integrate", "rs", "rdi" ], "last_updated": "2026-11-13T11:28:40+02:00", "page_type": "content", "content_hash": "3cbb1f6fb8990b808a2d5271a991d9bdcf79f389ac0eae51469621ef9cb3bc9f", "sections": [ { "id": "overview", "title": "Overview", "role": "overview", "text": "Use an object in a Google Cloud Storage (GCS) bucket to coordinate a leader election between\nRedis Data Integration (RDI) sites. All sites must use the same bucket and object name.\nTo use one bucket for several disaster recovery (DR) setups, see\n[Share a lease store between DR setups](https://redis.io/docs/latest/integrate/redis-data-integration/installation/disaster-recovery#share-a-lease-store-between-dr-setups).\n\nBefore you begin, [create the RDI database at both sites](https://redis.io/docs/latest/integrate/redis-data-integration/installation/disaster-recovery#prepare-both-sites).\nThe commands use the Google Cloud command-line interface (CLI), authenticated as an identity\nthat can create buckets and grant access. The RDI operator needs separate runtime permissions." }, { "id": "create-the-bucket", "title": "Create the bucket", "role": "content", "text": "Create a dual-region or multi-region bucket, so that the lease survives the loss of a region.\nChoose a location using\n[Cloud Storage bucket locations](https://cloud.google.com/storage/docs/locations).\n\n[code example]\n\nThe bucket name must be globally unique. For `--location`, use a predefined dual-region\nlocation such as `NAM4` or a multi-region location such as `US`. See\n[`gcloud storage buckets create`](https://cloud.google.com/sdk/gcloud/reference/storage/buckets/create)\nfor custom dual-region locations.\n\nRDI creates the lease object; do not create it yourself.\n\nSee [Protect the lease](https://redis.io/docs/latest/integrate/redis-data-integration/installation/disaster-recovery#protect-the-lease)\nfor the warning about deleting a lease, including through lifecycle rules." }, { "id": "grant-the-operator-access", "title": "Grant the operator access", "role": "content", "text": "The operator's Google Cloud identity needs to create, read, update, and overwrite the lease\nobject. The bucket-scoped `roles/storage.objectUser` role provides these permissions. The\n`roles/storage.legacyBucketReader` role lets RDI check the bucket's location at startup. See\n[Cloud Storage roles](https://cloud.google.com/storage/docs/access-control/iam-roles).\n\nGrant both roles to the service account used by the operator:\n\n[code example]\n\nIf the sites use different identities, run these commands for each one. Grant access on this\nbucket rather than the whole project. Allow outbound Hypertext Transfer Protocol Secure\n(HTTPS) access from both operators to Cloud Storage.\n\nChoose one of these identity options for each operator." }, { "id": "workload-identity-federation", "title": "Workload Identity Federation", "role": "content", "text": "RDI uses application default credentials when you omit a credentials file. Configure the\nidentity in the operator's environment, not only in your local shell. On Google Kubernetes\nEngine (GKE), use\n[Workload Identity Federation](https://cloud.google.com/kubernetes-engine/docs/concepts/workload-identity).\nThe operator runs as the Kubernetes service account `rdi-operator` in the RDI namespace. Set\nits annotations with `operator.serviceAccount.annotations` in each values file. For example,\nto link it to a Google service account:\n\n[code example]" }, { "id": "configure-both-instances", "title": "Configure both instances", "role": "configuration", "text": "Merge the following settings into the `operator.leaderElection` section of each site's\nvalues file. Keep the local RDI database connection and other installation settings from\n[Configure each site's values file](https://redis.io/docs/latest/integrate/redis-data-integration/installation/disaster-recovery#configure-each-sites-values-file).\n\nIn `rdi-values-site-a.yaml`:\n\n[code example]\n\nIn `rdi-values-site-b.yaml`:\n\n[code example]\n\nUse identical `bucketName` and `objectName` values at both sites. The distinct `instanceID`\nvalues identify the two RDI instances." }, { "id": "install-rdi", "title": "Install RDI", "role": "setup", "text": "1. Inspect the bucket location and access policy:\n\n [code example]\n\n Confirm the dual-region or multi-region location and the roles for each operator identity.\n\n1. With application default credentials configured for both operators, install RDI in each\n Kubernetes cluster:\n\n [code example]\n\n > [!NOTE]\n > If you use a service account key file, you must pass\n > it to the `helm upgrade` commands shown above using an extra `--set-file` option\n >\n > [code example]\n > RDI 2.2.1 and later accept only service account key files, not Workload Identity Federation\n > credential configuration files.\n >\n > After creating the lease resource and granting access, return to\n > [Prepare both sites](https://redis.io/docs/latest/integrate/redis-data-integration/installation/disaster-recovery#prepare-both-sites)\n > to complete the source, target, and network preparation.\n\n\nContinue with [Deploy pipelines and secrets](https://redis.io/docs/latest/integrate/redis-data-integration/installation/disaster-recovery#deploy-pipelines-and-secrets)\nto configure RDI CLI contexts. One leader, one follower, and no access errors in the operator\nlogs confirm that both operators can access the bucket.\n\nIn RDI 2.2.0, the lease is stored in the object's custom metadata. RDI migrates an existing\nlease object to this format during an upgrade. Review\n[Upgrade or downgrade a DR setup](https://redis.io/docs/latest/integrate/redis-data-integration/installation/disaster-recovery#upgrade-or-downgrade-a-dr-setup)\nbefore changing versions." } ], "examples": [ { "id": "create-the-bucket-ex0", "language": "bash", "code": "gcloud storage buckets create \"gs://\" \\\n --project \"\" \\\n --location \"\" \\\n --uniform-bucket-level-access", "section_id": "create-the-bucket" }, { "id": "grant-the-operator-access-ex0", "language": "bash", "code": "gcloud storage buckets add-iam-policy-binding \"gs://\" \\\n --member \"serviceAccount:\" \\\n --role roles/storage.objectUser\n\ngcloud storage buckets add-iam-policy-binding \"gs://\" \\\n --member \"serviceAccount:\" \\\n --role roles/storage.legacyBucketReader", "section_id": "grant-the-operator-access" }, { "id": "workload-identity-federation-ex0", "language": "yaml", "code": "operator:\n serviceAccount:\n annotations:\n iam.gke.io/gcp-service-account: ", "section_id": "workload-identity-federation" }, { "id": "configure-both-instances-ex0", "language": "yaml", "code": "operator:\n leaderElection:\n enabled: true\n instanceID: site-a\n leaseType: gcs\n gcsLease:\n bucketName: \n objectName: ", "section_id": "configure-both-instances" }, { "id": "configure-both-instances-ex1", "language": "yaml", "code": "operator:\n leaderElection:\n enabled: true\n instanceID: site-b\n leaseType: gcs\n gcsLease:\n bucketName: \n objectName: ", "section_id": "configure-both-instances" }, { "id": "install-rdi-ex0", "language": "bash", "code": "gcloud storage buckets describe \"gs://\" --format=json\n gcloud storage buckets get-iam-policy \"gs://\" --format=json", "section_id": "install-rdi" }, { "id": "install-rdi-ex1", "language": "bash", "code": "helm upgrade --install rdi \"rdi-.tgz\" \\\n --kube-context \"\" --namespace rdi --create-namespace \\\n --values rdi-values-site-a.yaml\n\n helm upgrade --install rdi \"rdi-.tgz\" \\\n --kube-context \"\" --namespace rdi --create-namespace \\\n --values rdi-values-site-b.yaml", "section_id": "install-rdi" }, { "id": "install-rdi-ex2", "language": "text", "code": "> --set-file operator.leaderElection.gcsLease.credentials=\"\"\n >", "section_id": "install-rdi" } ] }