Redis for Opstella Installation

🟢 Management

Redis is a Pub/Sub Service and In-Memory Cache for Opstella

Prerequisites

• 💿Persistence Storage Access for Redis for Opstella
  • On Kubernetes when requesting for a PVC, will request with Storage Class specified.

Preparation

Kubernetes Cluster Preparation

1. Connect to 🟢 Management Kubernetes Cluster ; i.e w/ Kubeconfig File

2. Prepare 🟢 Management Kubernetes Cluster Information

   Ensure K8S_INTERNAL_DOMAIN, K8S_STORAGECLASS_NAME are defined as per the Shell Variables guide.

---

Redis Preparation

1. Set Redis Authentication Password

   Recommended to enabled authentication for Redis (You can optionally disable it)

   export OPSTELLA_REDIS_PASSWORD="CHANGEME"

   The variable name must be OPSTELLA_REDIS_PASSWORD

   The manifest below reads ${OPSTELLA_REDIS_PASSWORD}. A different name (such as REDIS_PASSWORD) is not an error: the unset variable expands to an empty string, the Secret is created with an empty redis-password, and every Pod still starts. The failure only shows up later, when Opstella Core cannot authenticate — on a Redis that is in fact unauthenticated.

   Verify after applying the manifest:

   kubectl get secret opstella-redis-credentials -n opstella-system -o jsonpath='{.data.redis-password}' | base64 -d | wc -c

   💡 Must be greater than 0.

2. Create Redis manifest and secret

   You will be creating Kubernetes Secret named opstella-redis-credentials, RedisReplication CR named redis-opstella, and RedisSentinel CR named redis-sentinel-opstella

   cat <<EOF > $BASE_WORKING_DIR/kubernetes-manifests/redis-opstella-platform-full.yaml
   apiVersion: v1
   kind: Secret
   metadata:
     name: opstella-redis-credentials
     namespace: opstella-system
   type: Opaque
   stringData:
     redis-password: "${OPSTELLA_REDIS_PASSWORD}"
   ---
   apiVersion: redis.redis.opstreelabs.in/v1beta2
   kind: RedisReplication
   metadata:
     name: redis-opstella
     namespace: opstella-system
   spec:
     clusterSize: 3
     # Pod-level security context
     podSecurityContext:
       fsGroup: 1000
       fsGroupChangePolicy: "OnRootMismatch"
       runAsUser: 1000
       runAsNonRoot: true
       seccompProfile:
         type: RuntimeDefault
     # Container-level security context
     securityContext:
       runAsUser: 1000
       runAsGroup: 1000
       runAsNonRoot: true
       privileged: false
       allowPrivilegeEscalation: false
       capabilities:
         drop: ["ALL"]
       seccompProfile:
         type: RuntimeDefault
     kubernetesConfig:
       image: quay.io/opstree/redis:v7.4.7
       imagePullPolicy: IfNotPresent
       resources:
         requests:
           cpu: 100m
           memory: 128Mi
         limits:
           cpu: 250m
           memory: 512Mi
       redisSecret:
         name: opstella-redis-credentials
         key: redis-password
     storage:
       volumeClaimTemplate:
         spec:
           storageClassName: "${K8S_STORAGECLASS_NAME}"
           accessModes: ["ReadWriteOnce"]
           resources:
             requests:
               storage: 2Gi
     redisExporter:
       enabled: false
       image: quay.io/opstree/redis-exporter:v1.44.0
       resources:
         requests:
           cpu: 50m
           memory: 64Mi
         limits:
           cpu: 100m
           memory: 128Mi
   ---
   apiVersion: redis.redis.opstreelabs.in/v1beta2
   kind: RedisSentinel
   metadata:
     name: redis-sentinel-opstella
     namespace: opstella-system
   spec:
     clusterSize: 3
     # Pod-level security context
     podSecurityContext:
       fsGroup: 1000
       fsGroupChangePolicy: "OnRootMismatch"
       runAsUser: 1000
       runAsNonRoot: true
       seccompProfile:
         type: RuntimeDefault
     # Container-level security context
     securityContext:
       runAsUser: 1000
       runAsGroup: 1000
       runAsNonRoot: true
       privileged: false
       allowPrivilegeEscalation: false
       capabilities:
         drop: ["ALL"]
       seccompProfile:
         type: RuntimeDefault
     redisSentinelConfig:
       redisReplicationName: redis-opstella
       redisReplicationPassword:
         secretKeyRef:
           name: opstella-redis-credentials
           key: redis-password
       masterGroupName: redis-opstella
       downAfterMilliseconds: "10000"
       failoverTimeout: "10000"
     kubernetesConfig:
       image: quay.io/opstree/redis-sentinel:v8.4.0
       imagePullPolicy: IfNotPresent
       resources:
         requests:
           cpu: 50m
           memory: 64Mi
         limits:
           cpu: 100m
           memory: 128Mi
   
   EOF

Installation

1. Install Redis

   kubectl apply -n opstella-system -f $BASE_WORKING_DIR/kubernetes-manifests/redis-opstella-platform-full.yaml

Post-Installation

Redis for Opstella Testing

1. Get Pod Status - Redis for Opstella

   kubectl get pods -n opstella-system

   Redis for Opstella should be Running

   NAME                        READY   STATUS    RESTARTS   AGE
   ... (deducted)
   redis-opstella-0                   1/1     Running   0          XdXh
   redis-opstella-1                   1/1     Running   0          XdXh
   redis-opstella-2                   1/1     Running   0          XdXh
   redis-sentinel-opstella-sentinel-0   1/1     Running   0          XdXh
   redis-sentinel-opstella-sentinel-1   1/1     Running   0          XdXh
   redis-sentinel-opstella-sentinel-2   1/1     Running   0          XdXh

   💡 The Operator appends -sentinel to the CR name, so the Sentinel Pods and Services are redis-sentinel-opstella-sentinel-* (verified with Redis Operator 0.25.0).

2. Verify that replication actually formed

   Running Pods are not enough: the Operator reads the roles once, and if it does so before the Pods have an IP it backs off silently, leaving all three replicas as master with no replication at all.

   kubectl exec -n opstella-system redis-opstella-0 -- \
     redis-cli -a "$OPSTELLA_REDIS_PASSWORD" --no-auth-warning info replication | grep -E 'role|connected_slaves'

   💡 One Pod must report role:master with connected_slaves:2, the other two role:slave.

   kubectl exec -n opstella-system redis-sentinel-opstella-sentinel-0 -- \
     redis-cli -p 26379 sentinel master redis-opstella | head -n 12

   💡 flags must be master, num-slaves 2 and num-other-sentinels 2.

   If all three report role:master, restart the Operator to make it re-read the CR — editing or annotating the CR does not bring it out of backoff:

   kubectl rollout restart deploy/redis-operator -n ot-operators