{
  "schema_version": 2,
  "id": "operate/kubernetes/deployment/openshift/openshift-cli",
  "title": "Deployment with OpenShift CLI for Redis Enterprise for Kubernetes",
  "url": "https://redis.io/docs/latest/operate/kubernetes/deployment/openshift/openshift-cli/",
  "summary": "Redis Enterprise for Kubernetes and cluster can be installed via CLI tools OpenShift",
  "tags": [
    "docs",
    "operate",
    "kubernetes"
  ],
  "last_updated": "2026-09-28T16:14:52+01:00",
  "page_type": "content",
  "content_hash": "e683b67a5ace8046dc21237e8d6f8023bd9a839517b2f1cf0de0235449516cc1",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "Use these steps to set up a Redis Enterprise Software cluster with OpenShift."
    },
    {
      "id": "prerequisites",
      "title": "Prerequisites",
      "role": "content",
      "text": "- [OpenShift cluster](https://docs.openshift.com/container-platform/4.8/installing/index.html) with at least 3 nodes (each meeting the [minimum requirements for a development installation](https://redis.io/docs/latest/operate/rs/installing-upgrading/install/plan-deployment/hardware-requirements))\n- [OpenShift CLI](https://docs.openshift.com/container-platform/latest/cli_reference/openshift_cli/getting-started-cli.html)\n\nTo see which version of Redis Enterprise for Kubernetes supports your OpenShift version, see [Supported Kubernetes distributions](https://redis.io/docs/latest/operate/kubernetes/reference/supported_k8s_distributions).\n\n> [!NOTE]\n> If you suspect your file descriptor limits are below 100,000, you must either manually increase limits or [Allow automatic resource adjustment](https://redis.io/docs/latest/operate/kubernetes/security/allow-resource-adjustment). Most major cloud providers and standard container runtime configurations set default file descriptor limits well above the minimum required by Redis Enterprise. In these environments, you can safely run without enabling automatic resource adjustment."
    },
    {
      "id": "deploy-the-operator",
      "title": "Deploy the operator",
      "role": "content",
      "text": "1. Create a new project.\n\n    [code example]\n\n1. Verify the newly created project. \n\n    [code example]\n\n1. Get the deployment files.\n\n    [code example]\n\n1. Deploy the OpenShift operator bundle.\n\n    If you are using version 6.2.18-41 or earlier, you must [apply the security context constraint](#install-security-context-constraint) before the operator bundle.\n\n    [code example]\n\n    > [!WARNING]\n    > Changes to the `openshift.bundle.yaml` file can cause unexpected results.\n    >\n\n1. Verify that your `redis-enterprise-operator` deployment is running.\n\n    [code example]\n\n    A typical response looks like this:\n\n    [code example]\n\n    > [!WARNING]\n    > DO NOT modify or delete the StatefulSet created during the deployment process. Doing so could destroy your Redis Enterprise cluster (REC).\n    >"
    },
    {
      "id": "security-context-constraints",
      "title": "Security context constraints",
      "role": "security",
      "text": "Versions 7.22.0-6 and later run in without permissions to [allow automatic resource adjustment](https://redis.io/docs/latest/operate/kubernetes/security/allow-resource-adjustment). If you use the recommended default security constraints, remove the existing `redis-enterprise-scc-v2` SCC and unbind it from the REC service account after upgrading."
    },
    {
      "id": "create-a-redis-enterprise-cluster-custom-resource",
      "title": "Create a Redis Enterprise cluster custom resource",
      "role": "content",
      "text": "1. Download the `RedisEnterpriseCluster` resource file ([rec.yaml](https://github.com/RedisLabs/redis-enterprise-k8s-docs/blob/master/examples/v1/rec.yaml)).\n\n    You can rename the file to `<your_cluster_name>.yaml`, but it is not required. Examples below use `rec.yaml`. [Options for Redis Enterprise clusters](https://redis.io/docs/latest/operate/kubernetes/reference/api/redis_enterprise_cluster_api) has more info about the Redis Enterprise cluster (REC) custom resource, or see the [Redis Enterprise cluster API](https://redis.io/docs/latest/operate/kubernetes/reference/api/redis_enterprise_cluster_api) for a full list of options.\n\n    > [!NOTE]\n    > If you suspect your file descriptor limits are below 100,000, you must either manually increase limits or [Allow automatic resource adjustment](https://redis.io/docs/latest/operate/kubernetes/security/allow-resource-adjustment). Most major cloud providers and standard container runtime configurations set default file descriptor limits well above the minimum required by Redis Enterprise. In these environments, you can safely run without enabling automatic resource adjustment.\n    >\n\n    The REC name cannot be changed after cluster creation.\n\n    > [!NOTE]\n    > Each Redis Enterprise cluster requires at least 3 nodes. Single-node RECs are not supported.\n    >\n\n2. Apply the custom resource file to create your Redis Enterprise cluster.\n\n    > [!NOTE]\n    > If you enabled automatic resource adjustment in your configuration, this step will trigger the operator to apply elevated capabilities. Ensure your security context allows it.\n    >\n\n    [code example]\n\n    The operator typically creates the REC within a few minutes.\n\n1. Check the cluster status.\n\n    [code example]\n\n    You should receive a response similar to the following:\n\n    [code example]"
    },
    {
      "id": "configure-the-admission-controller",
      "title": "Configure the admission controller",
      "role": "configuration",
      "text": "1. Verify the `admission-tls` secret exists.\n\n    [code example]\n  \n    The output should look similar to\n  \n    [code example]\n\n1. Save the certificate to a local environment variable.\n\n    [code example]\n\n1. Create a Kubernetes validating webhook, replacing `<namespace>` with the namespace where the REC was installed.\n\n    The `webhook.yaml` template can be found in [redis-enterprise-k8s-docs/admission](https://github.com/RedisLabs/redis-enterprise-k8s-docs/tree/master/admission)\n\n    [code example]\n\n1. Create a patch file for the Kubernetes validating webhook.\n\n    [code example]\n\n1. Patch the webhook with the certificate.\n\n    [code example]"
    },
    {
      "id": "limit-the-webhook-to-relevant-namespaces",
      "title": "Limit the webhook to relevant namespaces",
      "role": "limits",
      "text": "If not limited, the webhook intercepts requests from all namespaces. If you have several REC objects in your Kubernetes cluster, limit the webhook to the relevant namespaces. If you aren't using multiple namespaces, skip this step.\n\n1. Verify your namespace is labeled and the label is unique to this namespace, as shown in the next example.\n\n    [code example]\n\n1. Patch the webhook spec with the `namespaceSelector` field.\n\n    [code example]\n\n1. Apply the patch.\n\n    [code example]\n\n    > [!NOTE]\n    > For releases before 6.4.2-4, use this command instead:\n    >\n    > [code example]\n    >\n    > The 6.4.2-4 release introduces a new `ValidatingWebhookConfiguration` to replace `redb-admission`. See the [6.4.2-4 release notes](https://redis.io/docs/latest/operate/kubernetes/release-notes/previous-releases).\n    >"
    },
    {
      "id": "verify-admission-controller-installation",
      "title": "Verify admission controller installation",
      "role": "content",
      "text": "Apply an invalid resource as shown below to force the admission controller to reject it. If it applies successfully, the admission controller is not installed correctly.\n\n[code example]\n\nYou should see this error from the admission controller webhook `redisenterprise.admission.redislabs`.\n  \n[code example]"
    },
    {
      "id": "create-a-redis-enterprise-database-custom-resource",
      "title": "Create a Redis Enterprise database custom resource",
      "role": "content",
      "text": "The operator uses the instructions in the Redis Enterprise database (REDB) custom resources to manage databases on the Redis Enterprise cluster.\n\n1. Create a `RedisEnterpriseDatabase` custom resource.\n\n    This example creates a test database. For production databases, see [create a database](https://redis.io/docs/latest/operate/kubernetes/re-databases/db-controller#create-a-database) and [RedisEnterpriseDatabase API reference](https://redis.io/docs/latest/operate/kubernetes/reference/api/redis_enterprise_database_api).\n\n    [code example]\n\n1. Apply the newly created REDB resource.\n\n    [code example]"
    },
    {
      "id": "more-info",
      "title": "More info",
      "role": "content",
      "text": "- [Redis Enterprise cluster API](https://redis.io/docs/latest/operate/kubernetes/reference/api/redis_enterprise_cluster_api)\n- [Redis Enterprise database API](https://redis.io/docs/latest/operate/kubernetes/reference/api/redis_enterprise_database_api)"
    }
  ],
  "examples": [
    {
      "id": "deploy-the-operator-ex0",
      "language": "sh",
      "code": "oc new-project <your-project-name>",
      "section_id": "deploy-the-operator"
    },
    {
      "id": "deploy-the-operator-ex1",
      "language": "sh",
      "code": "oc project <your-project-name>",
      "section_id": "deploy-the-operator"
    },
    {
      "id": "deploy-the-operator-ex2",
      "language": "sh",
      "code": "git clone https://github.com/RedisLabs/redis-enterprise-k8s-docs",
      "section_id": "deploy-the-operator"
    },
    {
      "id": "deploy-the-operator-ex3",
      "language": "sh",
      "code": "oc apply -f openshift.bundle.yaml",
      "section_id": "deploy-the-operator"
    },
    {
      "id": "deploy-the-operator-ex4",
      "language": "sh",
      "code": "oc get deployment",
      "section_id": "deploy-the-operator"
    },
    {
      "id": "deploy-the-operator-ex5",
      "language": "sh",
      "code": "NAME                        READY   UP-TO-DATE   AVAILABLE   AGE\n    redis-enterprise-operator   1/1     1            1           0m36s",
      "section_id": "deploy-the-operator"
    },
    {
      "id": "create-a-redis-enterprise-cluster-custom-resource-ex0",
      "language": "sh",
      "code": "oc apply -f rec.yaml",
      "section_id": "create-a-redis-enterprise-cluster-custom-resource"
    },
    {
      "id": "create-a-redis-enterprise-cluster-custom-resource-ex1",
      "language": "sh",
      "code": "oc get pod",
      "section_id": "create-a-redis-enterprise-cluster-custom-resource"
    },
    {
      "id": "create-a-redis-enterprise-cluster-custom-resource-ex2",
      "language": "sh",
      "code": "NAME                             | READY | STATUS  | RESTARTS | AGE |\n    | -------------------------------- | ----- | ------- | -------- | --- |\n    | rec-name-0              | 2/2   | Running | 0        | 1m  |\n    | rec-name-1              | 2/2   | Running | 0        | 1m  |\n    | rec-name-2              | 2/2   | Running | 0        | 1m  |\n    | rec-name-controller-x-x | 1/1   | Running | 0        | 1m  |\n    | Redis-enterprise-operator-x-x    | 1/1   | Running | 0        | 5m  |",
      "section_id": "create-a-redis-enterprise-cluster-custom-resource"
    },
    {
      "id": "configure-the-admission-controller-ex0",
      "language": "sh",
      "code": "kubectl get secret admission-tls",
      "section_id": "configure-the-admission-controller"
    },
    {
      "id": "configure-the-admission-controller-ex1",
      "language": "sh",
      "code": "NAME            TYPE     DATA   AGE\n    admission-tls   Opaque   2      2m43s",
      "section_id": "configure-the-admission-controller"
    },
    {
      "id": "configure-the-admission-controller-ex2",
      "language": "sh",
      "code": "CERT=`kubectl get secret admission-tls -o jsonpath='{.data.cert}'`",
      "section_id": "configure-the-admission-controller"
    },
    {
      "id": "configure-the-admission-controller-ex3",
      "language": "sh",
      "code": "sed 's/OPERATOR_NAMESPACE/<namespace>/g' webhook.yaml | kubectl create -f -",
      "section_id": "configure-the-admission-controller"
    },
    {
      "id": "configure-the-admission-controller-ex4",
      "language": "sh",
      "code": "cat > modified-webhook.yaml <<EOF\n    webhooks:\n    - name: redisenterprise.admission.redislabs\n      clientConfig:\n       caBundle: $CERT\n    EOF",
      "section_id": "configure-the-admission-controller"
    },
    {
      "id": "configure-the-admission-controller-ex5",
      "language": "sh",
      "code": "kubectl patch ValidatingWebhookConfiguration \\\n        redis-enterprise-admission --patch \"$(cat modified-webhook.yaml)\"",
      "section_id": "configure-the-admission-controller"
    },
    {
      "id": "limit-the-webhook-to-relevant-namespaces-ex0",
      "language": "sh",
      "code": "apiVersion: v1\n    kind: Namespace\n    metadata:\n      labels:\n       namespace-name: staging\n    name: staging",
      "section_id": "limit-the-webhook-to-relevant-namespaces"
    },
    {
      "id": "limit-the-webhook-to-relevant-namespaces-ex1",
      "language": "sh",
      "code": "cat > modified-webhook.yaml <<EOF\n    webhooks:\n    - name: redisenterprise.admission.redislabs\n      namespaceSelector:\n       matchLabels:\n         namespace-name: staging\n    EOF",
      "section_id": "limit-the-webhook-to-relevant-namespaces"
    },
    {
      "id": "limit-the-webhook-to-relevant-namespaces-ex2",
      "language": "sh",
      "code": "oc patch ValidatingWebhookConfiguration \\\n      redis-enterprise-admission --patch \"$(cat modified-webhook.yaml)\"",
      "section_id": "limit-the-webhook-to-relevant-namespaces"
    },
    {
      "id": "limit-the-webhook-to-relevant-namespaces-ex3",
      "language": "sh",
      "code": "> oc patch ValidatingWebhookConfiguration \\\n    >   redb-admission --patch \"$(cat modified-webhook.yaml)\"\n    >",
      "section_id": "limit-the-webhook-to-relevant-namespaces"
    },
    {
      "id": "verify-admission-controller-installation-ex0",
      "language": "sh",
      "code": "oc apply -f - << EOF\napiVersion: app.redislabs.com/v1alpha1\nkind: RedisEnterpriseDatabase\nmetadata:\n  name: redis-enterprise-database\nspec:\n  evictionPolicy: illegal\nEOF",
      "section_id": "verify-admission-controller-installation"
    },
    {
      "id": "verify-admission-controller-installation-ex1",
      "language": "sh",
      "code": "Error from server: error when creating \"STDIN\": admission webhook \"redisenterprise.admission.redislabs\" denied the request: eviction_policy: u'illegal' is not one of [u'volatile-lru', u'volatile-ttl', u'volatile-random', u'allkeys-lru', u'allkeys-random', u'noeviction', u'volatile-lfu', u'allkeys-lfu']",
      "section_id": "verify-admission-controller-installation"
    },
    {
      "id": "create-a-redis-enterprise-database-custom-resource-ex0",
      "language": "sh",
      "code": "cat << EOF > /tmp/redis-enterprise-database.yml\n    apiVersion: app.redislabs.com/v1alpha1\n    kind: RedisEnterpriseDatabase\n    metadata:\n      name: redis-enterprise-database\n    spec:\n      memorySize: 100MB\n    EOF",
      "section_id": "create-a-redis-enterprise-database-custom-resource"
    },
    {
      "id": "create-a-redis-enterprise-database-custom-resource-ex1",
      "language": "sh",
      "code": "oc apply -f /tmp/redis-enterprise-database.yml",
      "section_id": "create-a-redis-enterprise-database-custom-resource"
    }
  ]
}