Redis¶

Redis is an in-memory key-value store, normally used as a cache or a session store rather than as a system of record.

Unlike the databases on this platform, Redis is not shared: creating one starts a Redis server of its own inside your project, with its own disk.

For the same steps in the console, see the console walkthrough.

Create¶

Redis reads its password from a Secret, so there are two objects. Create the Secret first, or the server starts and fails.

redis-secret.yaml

apiVersion: v1
kind: Secret
metadata:
  name: redis-<instance>
  namespace: <project>
type: Opaque
stringData:
  password: <password>

redis.yaml

apiVersion: redis.redis.opstreelabs.in/v1beta2
kind: Redis
metadata:
  name: <instance>
  namespace: <project>
spec:
  kubernetesConfig:
    image: quay.io/opstree/redis:v7.0.12
    imagePullPolicy: IfNotPresent
    redisSecret:
      name: redis-<instance>
      key: password
    resources:
      limits:
        cpu: 250m
        memory: 256Mi
      requests:
        cpu: 100m
        memory: 128Mi
    service:
      serviceType: ClusterIP
  redisConfig: {}
  storage:
    volumeClaimTemplate:
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 1Gi
        storageClassName: berry-storage-block

oc apply -f redis-secret.yaml -f redis.yaml

The Secret name redis-<instance> is the convention the console uses. Nothing enforces it, but keeping to it means the Secret is obvious from the instance name.

The password schema changed in v1beta2

In v1beta2 the password comes from a Secret. Older examples that set it inline in the spec are v1beta1 and will not apply against this schema.

List¶

oc get redis.redis.redis.opstreelabs.in -n <project>

The Redis operator does not populate a status on the object, so there is no readiness field to read. Check the pod instead - it is named after the instance:

oc get pods -n <project> -l app=<instance>
oc get pvc -n <project>

A pod stuck Pending is normally the disk: check the volume claim bound. A pod that starts and restarts is usually the Secret - confirm one named redis-<instance> exists and holds a password key.

Change¶

The disk cannot be shrunk, and growing it means editing the volume claim directly rather than the Redis object. CPU and memory can be changed in place:

oc patch redis.redis.redis.opstreelabs.in <instance> -n <project> --type=merge -p '
spec:
  kubernetesConfig:
    resources:
      limits:
        memory: 512Mi
'

The operator restarts the pod to apply it. Redis holds its data in memory, so anything not yet written to disk is lost on that restart - treat a resize as a cache flush.

To rotate the password, update the Secret and delete the pod so it is read again:

oc patch secret redis-<instance> -n <project> --type=merge \
  -p '{"stringData":{"password":"<new-password>"}}'
oc delete pod -n <project> -l app=<instance>

Delete¶

oc delete redis.redis.redis.opstreelabs.in <instance> -n <project>
oc delete secret redis-<instance> -n <project>

The Secret is a separate object and is not deleted with the instance. The volume claim may also outlive the instance - check and remove it if you do not want to keep paying for the disk:

oc get pvc -n <project>

Connect¶

Workloads in the project connect to the Service named after the instance, on port 6379, and read the password from the Secret rather than carrying a copy:

env:
  - name: REDIS_PASSWORD
    valueFrom:
      secretKeyRef:
        name: redis-<instance>
        key: password

The operator creates three Services for each instance: <instance> is the one to connect to, <instance>-headless addresses the pod directly, and <instance>-additional is used by the operator itself. All three are ClusterIP, so nothing outside the project can reach them.

Databases - what the managed database offering covers
Volumes - how storage is provisioned
Firewalls - restricting what may reach a service