RedisEnterpriseCluster API Reference

Redis Enterprise for Kubernetes

apiVersion:

app.redislabs.com/v1

app.redislabs.com/v1

RedisEnterpriseCluster is the Schema for the redisenterpriseclusters API

Name	Type	Description	Required
apiVersion	string	app.redislabs.com/v1	true
kind	string	RedisEnterpriseCluster	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	RedisEnterpriseClusterSpec defines the desired state of RedisEnterpriseCluster	false
status	object		false

spec

^{^{↩ Parent}}

RedisEnterpriseClusterSpec defines the desired state of RedisEnterpriseCluster

Name	Type	Description	Required
accessControl	object	Access control configuration for the cluster.	false
activeActive	object	Specification for ActiveActive setup. At most one of ingressOrRouteSpec or activeActive fields can be set at the same time.	false
antiAffinityAdditionalTopologyKeys	[]string	Additional antiAffinity terms in order to support installation on different zones/vcenters	false
apiBasicAuth	object	Configures basic (username/password) authentication for the Redis Enterprise REST API.	false
apiCertificateBasedAuth	object	Configures Certificate-Based Authentication (CBA), i.e. mutual TLS client certificate authentication, for the Redis Enterprise control-plane REST API. This setting is additive on the server side: enabling it makes client certificates an accepted authentication method for connecting to the control plane, in addition to basic/digest authentication, unless basic authentication is explicitly turned off via apiBasicAuth.	false
auditing	object	Cluster-level configuration for auditing database connection and authentication events. Includes both the audit listener connection parameters and the default policy for new databases.	false
backup	object	Cluster-wide backup configurations	false
bootstrapperImageSpec	object	Specification for Bootstrapper container image	false
bootstrapperResources	object	Compute resource requirements for bootstrapper containers	false
certificates	object	RS Cluster Certificates. Used to modify the certificates used by the cluster. See the "RSClusterCertificates" struct described above to see the supported certificates.	false
clientMaintenanceNotifications	object	Controls proactive client maintenance notification settings.	false
clusterCredentialSecretName	string	Name or path of the secret containing cluster credentials. Defaults to the cluster name if left blank. For Kubernetes secrets (default): Can be customized to any valid secret name, or left blank to use the cluster name. The secret can be pre-created with 'username' and 'password' fields, or otherwise it will be automatically created with a default username and auto-generated password. On running clusters, this field can be changed to point to a different existing secret. The new secret must exist, contain valid 'username' and 'password' fields, and the credentials must work with the RS cluster. For Vault secrets: Can be customized with the path of the secret within Vault. The secret must be pre-created in Vault.	false
clusterCredentialSecretRole	string	Used only if ClusterCredentialSecretType is vault, to define vault role to be used. If blank, defaults to "redis-enterprise-operator"	false
clusterCredentialSecretType	enum	Type of Secret to use for ClusterCredential, Vault, Kuberetes,... If left blank, will default ot kubernetes secrets Enum: vault, kubernetes	false
clusterRecovery	boolean	ClusterRecovery initiates cluster recovery when set to true. Note that this field is cleared automatically after the cluster is recovered	false
containerTimezone	object	Container timezone configuration. While the default timezone on all containers is UTC, this setting can be used to set the timezone on services rigger/bootstrapper/RS containers. You can either propagate the hosts timezone to RS pods or set it manually via timezoneName.	false
createServiceAccount	boolean	Creates a service account for Redis Enterprise.	false
dataInternodeEncryption	boolean	Internode encryption (INE) cluster wide policy. An optional boolean setting. Specifies if INE should be on/off for new created REDBs. May be overridden for specific REDB via similar setting, please view the similar setting for REDB for more info.	false
disconnectClientsOnPasswordRemoval	enum	Controls whether the proxy disconnects clients whose password was removed. Tri-state; the operator only writes this value when status.managedAPIs.disconnectClientsOnPasswordRemoval is true (it flips true the first time this field is set). On new clusters the operator manages this field from creation and enforces the Auto default until the spec is set. Enum: Enabled, Disabled, Auto	false
dmcExternalCBAAuthentication	boolean	Whether Certificate-Based Authentication (CBA) for client connections to databases is delegated to an external gRPC authentication service, instead of being handled locally inside DMC (the data-path management proxy). If omitted, this field is evaluated as false. Possible values: true/false	false
encryptPkeys	boolean	Private key encryption Possible values: true/false	false
enforceIPv4	boolean	Sets ENFORCE_IPV4 environment variable	false
extraEnvVars	[]object	ADVANCED USAGE: use carefully. Add environment variables to RS StatefulSet's containers.	false
extraLabels	map[string]string	Labels that the user defines for their convenience	false
gateway	object	Configures exposure of cluster service endpoints and Active-Active databases via the Kubernetes Gateway API.	false
hostAliases	[]object	Adds hostAliases entries to the Redis Enterprise pods	false
ingressOrRouteSpec	object	Access configurations for the Redis Enterprise cluster and databases. At most one of ingressOrRouteSpec or activeActive fields can be set at the same time.	false
ldap	object	Cluster-level LDAP configuration, such as server addresses, protocol, authentication and query settings.	false
license	string	Redis Enterprise License	false
licenseSecretName	string	K8s secret or Vault Secret Name/Path to use for Cluster License. When left blank, the license is read from the "license" field. Note that you can't specify non-empty values in both "license" and "licenseSecretName", only one of these fields can be used to pass the license string. The license needs to be stored under the key "license".	false
metricsConfig	object	Cluster-level configuration for metrics. Currently controls which database tag keys may be exposed as labels on Redis Enterprise metrics.	false
nodeSelector	map[string]string	Node selector for scheduling pods on specific nodes. This applies to all pods managed by the operator: Redis Enterprise nodes, Services Rigger, and Call Home Client.	false
nodes	integer	Number of Redis Enterprise nodes (pods) Format: int32	false
ocspConfiguration	object	An API object that represents the cluster's OCSP configuration. To enable OCSP, the cluster's proxy certificate should contain the OCSP responder URL.	false
operatorClientAuth	object	Selects which credential the operator presents to the control-plane REST API. This is a client-side concern: it does not, by itself, configure the cluster to accept certificates (see apiCertificateBasedAuth).	false
ossClusterSettings	object	Cluster-level configuration for OSS cluster mode databases.	false
persistentSpec	object	Persistent storage configuration for Redis Enterprise cluster.	false
podAnnotations	map[string]string	annotations for the service rigger and redis enterprise pods	false
podAntiAffinity	object	Override for the default anti-affinity rules of the Redis Enterprise pods. More info: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#an-example-of-a-pod-that-uses-pod-affinity	false
podStartingPolicy	object	Mitigation setting for STS pods stuck in "ContainerCreating"	false
podTolerations	[]object	Tolerations that are added to all managed pods. More information: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/	false
priorityClassName	string	Adds the priority class to pods managed by the operator	false
pullSecrets	[]object	PullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images. If specified, these secrets will be passed to individual puller implementations for them to use. More info: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/	false
rackAwarenessNodeLabel	string	Node label that specifies rack ID - if specified, will create rack aware cluster. Rack awareness requires node label must exist on all nodes. Additionally, operator needs a special cluster role with permission to list nodes.	false
redisEnterpriseAdditionalPodSpecAttributes	object	ADVANCED USAGE USE AT YOUR OWN RISK - specify pod attributes that are required for the statefulset - Redis Enterprise pods. Pod attributes managed by the operator might override these settings. Also make sure the attributes are supported by the K8s version running on the cluster - the operator does not validate that.	false
redisEnterpriseIPFamily	enum	Reserved, future use, only for use if instructed by Redis. IPFamily dictates what IP family to choose for pods' internal and external communication. Enum: IPv4, IPv6	false
redisEnterpriseImageSpec	object	Specification for Redis Enterprise container image	false
redisEnterpriseNodeResources	object	Compute resource requirements for Redis Enterprise containers	false
redisEnterprisePodAnnotations	map[string]string	annotations for redis enterprise pod	false
redisEnterpriseServicesConfiguration	object	RS Cluster optional services settings	false
redisEnterpriseServicesRiggerImageSpec	object	Specification for Services Rigger container image	false
redisEnterpriseServicesRiggerResources	object	Compute resource requirements for Services Rigger pod	false
redisEnterpriseTerminationGracePeriodSeconds	integer	The TerminationGracePeriodSeconds value for the (STS created) REC pods Format: int64	false
redisEnterpriseVolumeMounts	[]object	additional volume mounts within the redis enterprise containers. More info: https://kubernetes.io/docs/concepts/storage/volumes/	false
redisOnFlashSpec	object	Auto Tiering (Redis on Flash) configuration. When provided, the cluster can create Auto Tiering databases.	false
redisUpgradePolicy	enum	Redis upgrade policy to be set on the Redis Enterprise cluster. Possible values: major/latest This value is used by the cluster to choose the Redis version of the database when an upgrade is performed. The Redis Enterprise cluster includes multiple versions of OSS Redis that can be used for databases. Enum: major, latest	false
resp3Default	boolean	Whether databases will turn on RESP3 compatibility upon database upgrade. Note - Deleting this property after explicitly setting its value shall have no effect. Please view the corresponding field in RS doc for more info.	false
securityContext	object	The security configuration that will be applied to RS pods.	false
serviceAccountName	string	Name of the service account to use for Redis Enterprise.	false
services	object	Customization options for operator-managed service resources created for Redis Enterprise clusters and databases	false
servicesRiggerSpec	object	Specification for service rigger	false
sideContainersSpec	[]object		false
slaveHA	object	Slave high availability mechanism configuration.	false
sso	object	Cluster-level SSO configuration for authentication to the Cluster Manager UI.	false
uiAnnotations	map[string]string	Additional annotations for the Redis Enterprise UI service. These annotations override overlapping global annotations set under spec.services.servicesAnnotations. The specified annotations will not override annotations that already exist and didn't originate from the operator, except for the 'redis.io/last-keys' annotation which is reserved.	false
uiServiceType	enum	Service type for exposing the Redis Enterprise UI (https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types). Enum: ClusterIP, NodePort, LoadBalancer, ExternalName	false
upgradeSpec	object	Redis Enterprise upgrade configuration	false
usageMeter	object	The configuration of the usage meter.	false
usageReportFields	enum	Controls which fields are included in the usage (call-home) report. "all" also includes node count and hostname; "restricted" sends the reduced report. Default is "restricted". Should not be changed unless instructed by Redis support. Enum: all, restricted	false
userDefinedModules	[]object	List of user-defined modules to be downloaded and installed during cluster bootstrap The modules on the list will be downloaded on cluster creation, upgrade, scale-out and recovery and installed on all nodes. Note that changing this field for a running cluster will trigger a rolling update.	false
username	string	Username for the admin user of Redis Enterprise	false
vaultCASecret	string	K8s secret name containing Vault's CA cert - defaults to "vault-ca-cert"	false
volumes	[]object	additional volumes	false

spec.accessControl

^{^{↩ Parent}}

Access control configuration for the cluster.

Name	Type	Description	Required
policy	object	Policy settings for access control behavior.	false

spec.accessControl.policy

^{^{↩ Parent}}

Policy settings for access control behavior.

Name	Type	Description	Required
allowREDBRolesPermissions	boolean	Controls whether the deprecated REDB spec.rolesPermissions field is reconciled. When enabled (default): both spec.rolesPermissions and RedisEnterpriseRole objects are reconciled. When disabled: only RedisEnterpriseRole objects are reconciled, spec.rolesPermissions is ignored.	false

spec.activeActive

^{^{↩ Parent}}

Specification for ActiveActive setup. At most one of ingressOrRouteSpec or activeActive fields can be set at the same time.

Name	Type	Description	Required
apiIngressUrl	string	RS API URL	true
dbIngressSuffix	string	DB ENDPOINT SUFFIX - will be used to set the db host. ingress Creates a host name so it should be unique if more than one db is created on the cluster with the same name	true
method	enum	Used to distinguish between different platforms implementation Enum: openShiftRoute, ingress	true
ingressAnnotations	map[string]string	Used for ingress controllers such as ha-proxy or nginx in GKE	false

spec.apiBasicAuth

^{^{↩ Parent}}

Configures basic (username/password) authentication for the Redis Enterprise REST API.

Name	Type	Description	Required
enabled	boolean	Whether the Redis Enterprise cluster accepts basic (username/password) authentication on its REST API. Maps to the cluster's 'control_plane_basic_authentication' setting and requires Redis Enterprise 8.2.0 or newer. When set to false, the cluster rejects passwords on all REST API requests; only certificate-based (mTLS) and JWT authentication are accepted, and the operator itself must be configured to use certificate authentication (operatorClientAuth.method: Certificate). The operator applies this setting only after verifying that certificate authentication is fully in effect, to avoid losing access to the cluster. When unset, the operator does not manage this cluster setting.	false

spec.apiCertificateBasedAuth

^{^{↩ Parent}}

Configures Certificate-Based Authentication (CBA), i.e. mutual TLS client certificate authentication, for the Redis Enterprise control-plane REST API. This setting is additive on the server side: enabling it makes client certificates an accepted authentication method for connecting to the control plane, in addition to basic/digest authentication, unless basic authentication is explicitly turned off via apiBasicAuth.

Name	Type	Description	Required
authorizedSubjects	[]object	The list of certificate subjects authorized to authenticate to the control-plane REST API using client certificates. Maps to the cluster's 'mtls_authorized_subjects' setting. The subject declared in operatorClientAuth.certificateSubjectLine is added automatically and need not be listed here.	false
clientCertSubjectValidationType	enum	Determines how the Redis Enterprise cluster validates the subject of client certificates presented for authentication. Maps to the cluster's 'mtls_client_cert_subject_validation_type' setting. 'Disabled' performs no subject validation; 'SanCn' validates the Subject Alternative Name / Common Name; 'FullSubject' validates the full certificate subject. Enum: Disabled, SanCn, FullSubject	false
enabled	boolean	Whether the control-plane REST API accepts client certificate authentication. Maps to the Redis Enterprise cluster's 'mtls_certificate_authentication' setting. Evaluated as false when omitted while the operator manages CBA (see status.managedAPIs); if CBA was never configured through this block, the cluster setting is left unchanged. Possible values: true/false	false
trustedCASecretName	string	Name or path of the secret containing the trusted CA used to validate client certificates presented to the control-plane REST API. The CA certificate is pushed to the Redis Enterprise cluster as 'mtls_trusted_ca'. The secret must contain the CA certificate in PEM format under a key named 'certificate', 'cert', or 'tls.crt'.	false

spec.apiCertificateBasedAuth.authorizedSubjects[]

^{^{↩ Parent}}

CertificateSubject identifies an X.509 certificate subject (distinguished name) that is authorized to authenticate to the control plane using a client certificate. Field names follow standard X.509 distinguished name (DN) component abbreviations.

Name	Type	Description	Required
CN	string	Common Name (CN) component of the certificate subject. Required.	true
C	string	Country (C) component of the certificate subject.	false
L	string	Locality (L) component of the certificate subject.	false
O	string	Organization (O) component of the certificate subject.	false
OU	[]string	Organizational Unit (OU) components of the certificate subject.	false
ST	string	State or province (ST) component of the certificate subject.	false

spec.auditing

^{^{↩ Parent}}

Cluster-level configuration for auditing database connection and authentication events. Includes both the audit listener connection parameters and the default policy for new databases.

Name	Type	Description	Required
config	object	Configuration for the audit listener connection	false
dbConnsAuditing	boolean	Cluster-wide default policy for database connection auditing. When set to true, connection auditing will be enabled by default for all new databases. Existing databases are not affected and can override this setting individually.	false

spec.auditing.config

^{^{↩ Parent}}

Configuration for the audit listener connection

Name	Type	Description	Required
auditAddress	string	TCP/IP address or file path where audit notifications will be sent. For TCP protocol: IP address of the audit listener. For local protocol: file path for audit output (development/testing only).	true
auditProtocol	enum	Protocol used to send audit notifications. Valid values: "TCP" or "local". For production systems, use "TCP". "local" is for development/testing only. Enum: TCP, local	true
auditPort	integer	Port number where audit notifications will be sent (TCP protocol only).	false
auditReconnectInterval	integer	Interval in seconds between attempts to reconnect to the audit listener.	false
auditReconnectMaxAttempts	integer	Maximum number of attempts to reconnect to the audit listener. Set to 0 for infinite attempts.	false

spec.backup

^{^{↩ Parent}}

Cluster-wide backup configurations

Name	Type	Description	Required
s3	object	Configurations for backups to s3 and s3-compatible storage	false

spec.backup.s3

^{^{↩ Parent}}

Configurations for backups to s3 and s3-compatible storage

Name	Type	Description	Required
caCertificateSecretName	string	Secret name that holds the S3 CA certificate, which contains the TLS certificate mapped to the key in the secret 'cert'	false
url	string	Specifies the URL for S3 export and import	false

spec.bootstrapperImageSpec

^{^{↩ Parent}}

Specification for Bootstrapper container image

Name	Type	Description	Required
digestHash	string	The digest hash of the container image to pull. When specified, the container image is pulled according to the digest hash instead of the image tag. The versionTag field must also be specified with the image tag matching this digest hash. Note: This field is only supported for OLM deployments.	false
imagePullPolicy	string	The image pull policy to be applied to the container image. One of Always, Never, IfNotPresent.	false
repository	string	The repository (name) of the container image to be deployed.	false
versionTag	string	The tag of the container image to be deployed.	false

spec.bootstrapperResources

^{^{↩ Parent}}

Compute resource requirements for bootstrapper containers

Name	Type	Description	Required
claims	[]object		false
limits	map[string]int or string	Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/	false
requests	map[string]int or string	Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/	false

spec.bootstrapperResources.claims[]

^{^{↩ Parent}}

Name	Type	Description	Required
name	string		true

spec.certificates

^{^{↩ Parent}}

RS Cluster Certificates. Used to modify the certificates used by the cluster. See the "RSClusterCertificates" struct described above to see the supported certificates.

Name	Type	Description	Required
apiCertificateSecretName	string	Secret name to use for cluster's API certificate. The secret must have the following keys - A key named 'certificate'/'cert'/'tls.crt' with the value of the certificate in PEM format. A key named 'key'/'tls.key' with the value of the private key. Optionally, a key named 'ca.crt', containing the public certificate of the root CA. If present, the root CA certificate is appended to the certificate provided in the 'tls.crt' (or equivalent) key, to form a full certificate chain. Otherwise, the certificate in 'tls.crt' must include a full certificate chain inline. This key is typically populated by the cert-manager when it has access to the root certificate. Otherwise, it could be added manually. If left blank, a cluster-provided certificate will be used.	false
cmCertificateSecretName	string	Secret name to use for cluster's CM (Cluster Manager) certificate. The secret must have the following keys - A key named 'certificate'/'cert'/'tls.crt' with the value of the certificate in PEM format. A key named 'key'/'tls.key' with the value of the private key. Optionally, a key named 'ca.crt', containing the public certificate of the root CA. If present, the root CA certificate is appended to the certificate provided in the 'tls.crt' (or equivalent) key, to form a full certificate chain. Otherwise, the certificate in 'tls.crt' must include a full certificate chain inline. This key is typically populated by the cert-manager when it has access to the root certificate. Otherwise, it could be added manually. If left blank, a cluster-provided certificate will be used.	false
cpInternodeEncryptionCertificateSecretName	string	Secret name to use for cluster's Control Plane Internode Encryption (CPINE) certificate. The secret must have the following keys - A key named 'certificate'/'cert'/'tls.crt' with the value of the certificate in PEM format. A key named 'key'/'tls.key' with the value of the private key. Optionally, a key named 'ca.crt', containing the public certificate of the root CA. If present, the root CA certificate is appended to the certificate provided in the 'tls.crt' (or equivalent) key, to form a full certificate chain. Otherwise, the certificate in 'tls.crt' must include a full certificate chain inline. This key is typically populated by the cert-manager when it has access to the root certificate. Otherwise, it could be added manually. If left blank and dpInternodeEncryptionCertificateSecretName is set, the DPINE certificate is used for CPINE as well. If both are left blank, cluster-provided certificates are used.	false
dpInternodeEncryptionCertificateSecretName	string	Secret name to use for cluster's Data Plane Internode Encryption (DPINE) certificate. The secret must have the following keys - A key named 'certificate'/'cert'/'tls.crt' with the value of the certificate in PEM format. A key named 'key'/'tls.key' with the value of the private key. Optionally, a key named 'ca.crt', containing the public certificate of the root CA. If present, the root CA certificate is appended to the certificate provided in the 'tls.crt' (or equivalent) key, to form a full certificate chain. Otherwise, the certificate in 'tls.crt' must include a full certificate chain inline. This key is typically populated by the cert-manager when it has access to the root certificate. Otherwise, it could be added manually. If left blank and cpInternodeEncryptionCertificateSecretName is set, the CPINE certificate is used for DPINE as well. If both are left blank, cluster-provided certificates are used.	false
ldapClientCertificateSecretName	string	Secret name to use for cluster's LDAP client certificate. The secret must have the following keys - A key named 'certificate'/'cert'/'tls.crt' with the value of the certificate in PEM format. A key named 'key'/'tls.key' with the value of the private key. Optionally, a key named 'ca.crt', containing the public certificate of the root CA. If present, the root CA certificate is appended to the certificate provided in the 'tls.crt' (or equivalent) key, to form a full certificate chain. Otherwise, the certificate in 'tls.crt' must include a full certificate chain inline. This key is typically populated by the cert-manager when it has access to the root certificate. Otherwise, it could be added manually. If left blank, LDAP client certificate authentication will be disabled.	false
metricsExporterCertificateSecretName	string	Secret name to use for cluster's Metrics Exporter certificate. The secret must have the following keys - A key named 'certificate'/'cert'/'tls.crt' with the value of the certificate in PEM format. A key named 'key'/'tls.key' with the value of the private key. Optionally, a key named 'ca.crt', containing the public certificate of the root CA. If present, the root CA certificate is appended to the certificate provided in the 'tls.crt' (or equivalent) key, to form a full certificate chain. Otherwise, the certificate in 'tls.crt' must include a full certificate chain inline. This key is typically populated by the cert-manager when it has access to the root certificate. Otherwise, it could be added manually. If left blank, a cluster-provided certificate will be used.	false
proxyCertificateSecretName	string	Secret name to use for cluster's Proxy certificate. The secret must have the following keys - A key named 'certificate'/'cert'/'tls.crt' with the value of the certificate in PEM format. A key named 'key'/'tls.key' with the value of the private key. Optionally, a key named 'ca.crt', containing the public certificate of the root CA. If present, the root CA certificate is appended to the certificate provided in the 'tls.crt' (or equivalent) key, to form a full certificate chain. Otherwise, the certificate in 'tls.crt' must include a full certificate chain inline. This key is typically populated by the cert-manager when it has access to the root certificate. Otherwise, it could be added manually. If left blank, a cluster-provided certificate will be used. Note - For Active-Active databases (REAADB), certificate updates are automatically reconciled. When you update this secret, the operator detects the change and automatically executes a CRDB force update (equivalent to 'crdb-cli crdb update --force'), which synchronizes the certificate changes to all participating clusters, eliminating the need for manual intervention.	false
ssoIssuerCertificateSecretName	string	Secret name to use for the SSO Identity Provider (IdP) certificate. This is the public certificate from your SAML Identity Provider used to verify SAML assertions. The secret must contain a single field named 'certificate'/'cert'/'tls.crt' (no 'key' field needed for IdP cert). This certificate must be configured as part of the SSO setup, before SSO can be enabled for the cluster. Note - While IdP metadata XML may contain the certificate, Redis Enterprise Server does not use it from there, so the certificate must be provided separately via this secret.	false
ssoServiceCertificateSecretName	string	Secret name to use for the SSO Service Provider (SP) certificate. This certificate is used by the cluster to sign SAML requests and encrypt SAML responses, and it must be configured as part of the SSO setup, before SSO can be enabled for the cluster. The secret must have the following keys - A key named 'certificate'/'cert'/'tls.crt' with the value of the certificate in PEM format. A key named 'key'/'tls.key' with the value of the private key. Optionally, a key named 'ca.crt', containing the public certificate of the root CA. If present, the root CA certificate is appended to the certificate provided in the 'tls.crt' (or equivalent) key, to form a full certificate chain. Otherwise, the certificate in 'tls.crt' must include a full certificate chain inline. This key is typically populated by the cert-manager when it has access to the root certificate. Otherwise, it could be added manually. If left blank, SSO will not be configured.	false
syncerCertificateSecretName	string	Secret name to use for cluster's Syncer certificate. The secret must have the following keys - A key named 'certificate'/'cert'/'tls.crt' with the value of the certificate in PEM format. A key named 'key'/'tls.key' with the value of the private key. Optionally, a key named 'ca.crt', containing the public certificate of the root CA. If present, the root CA certificate is appended to the certificate provided in the 'tls.crt' (or equivalent) key, to form a full certificate chain. Otherwise, the certificate in 'tls.crt' must include a full certificate chain inline. This key is typically populated by the cert-manager when it has access to the root certificate. Otherwise, it could be added manually. If left blank, a cluster-provided certificate will be used. Note - For Active-Active databases (REAADB), certificate updates are automatically reconciled. When you update this secret, the operator detects the change and automatically executes a CRDB force update (equivalent to 'crdb-cli crdb update --force'), which synchronizes the certificate changes to all participating clusters, eliminating the need for manual intervention.	false

spec.clientMaintenanceNotifications

^{^{↩ Parent}}

Controls proactive client maintenance notification settings.

Name	Type	Description	Required
ossMode	object	Client maintenance notifications settings for clients connected to databases with OSS cluster API enabled.	false
proxyMode	object	Client maintenance notifications settings for clients connected to databases running in enterprise (proxy) mode.	false

spec.clientMaintenanceNotifications.ossMode

^{^{↩ Parent}}

Client maintenance notifications settings for clients connected to databases with OSS cluster API enabled.

Name	Type	Description	Required
enabled	boolean	Whether client maintenance notifications are enabled for OSS clusters. Defaults to False.	false

spec.clientMaintenanceNotifications.proxyMode

^{^{↩ Parent}}

Client maintenance notifications settings for clients connected to databases running in enterprise (proxy) mode.

Name	Type	Description	Required
enabled	boolean	Whether client maintenance notifications are enabled for DBs with no OSS cluster API enabled (a.k.a. Proxy/Enterprise mode). Defaults to False.	false

spec.containerTimezone

^{^{↩ Parent}}

Container timezone configuration. While the default timezone on all containers is UTC, this setting can be used to set the timezone on services rigger/bootstrapper/RS containers. You can either propagate the hosts timezone to RS pods or set it manually via timezoneName.

Name	Type	Description	Required
propagateHost	object	Identifies that container timezone should be in sync with the host, this option mounts a hostPath volume onto RS pods that could be restricted in some systems.	false
timezoneName	string	POSIX-style timezone name as a string to be passed as EnvVar to RE pods, e.g. "Europe/London".	false

spec.extraEnvVars[]

^{^{↩ Parent}}

Name	Type	Required
name	string	true
value	string	false
valueFrom	object	false

spec.gateway

^{^{↩ Parent}}

Configures exposure of cluster service endpoints and Active-Active databases via the Kubernetes Gateway API.

Name	Type	Description	Required
activeActiveDatabases	object	Exposes Active-Active databases via Gateway. REC-scoped only; per-database overrides are not supported for Active-Active databases.	false
api	object	Exposes the RS API endpoint via Gateway.	false
default	object	Shared fallbacks (gatewayRef, fqdnSuffix) used by endpoints that do not set their own.	false
metrics	object	Exposes the metrics exporter endpoint via Gateway.	false
ui	object	Exposes the CM UI endpoint via Gateway.	false

spec.gateway.activeActiveDatabases

^{^{↩ Parent}}

Exposes Active-Active databases via Gateway. REC-scoped only; per-database overrides are not supported for Active-Active databases.

Name	Type	Description	Required
autoEnable	enum	Controls which Active-Active databases are Gateway-enabled by default: None (default), All, or Selector (only those matching selector). Enum: None, All, Selector	false
fqdnSuffix	string	FQDN suffix for Active-Active endpoints; the per-database FQDN defaults to ..	false
gatewayRef	object	Overrides default.gatewayRef for this endpoint.	false
listenerName	string	Gateway listener name; maps to the Route's parentRef.sectionName. If omitted, the Gateway implementation selects a compatible listener.	false
listenerPort	integer	Gateway listener port; maps to the Route's parentRef.port. Minimum: 1 Maximum: 65535	false
routeAnnotations	map[string]string	Annotations for this endpoint's TLSRoute (e.g. for external-dns), merged over gateway.default.routeAnnotations (these win on key conflicts).	false
routeLabels	map[string]string	Labels for this endpoint's TLSRoute, merged over gateway.default.routeLabels (these win on key conflicts). Operator-managed labels always take precedence.	false
selector	object	Label selector over Active-Active databases. Used only when autoEnable=Selector.	false

spec.gateway.activeActiveDatabases.gatewayRef

^{^{↩ Parent}}

Overrides default.gatewayRef for this endpoint.

Name	Type	Description	Required
name	string	Name of the Gateway.	true
namespace	string	Namespace of the Gateway. Defaults to the resource's namespace if omitted.	false

spec.gateway.activeActiveDatabases.selector

^{^{↩ Parent}}

Label selector over Active-Active databases. Used only when autoEnable=Selector.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

spec.gateway.activeActiveDatabases.selector.matchExpressions[]

^{^{↩ Parent}}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

spec.gateway.api

^{^{↩ Parent}}

Exposes the RS API endpoint via Gateway.

Name	Type	Description	Required
enabled	boolean	Whether this endpoint is exposed via Gateway. Defaults to false.	false
fqdn	string	Explicit FQDN for this endpoint. Defaults to ..	false
gatewayRef	object	Overrides default.gatewayRef for this endpoint.	false
listenerName	string	Gateway listener name; maps to the Route's parentRef.sectionName. If omitted, the Gateway implementation selects a compatible listener.	false
listenerPort	integer	Gateway listener port; maps to the Route's parentRef.port. Minimum: 1 Maximum: 65535	false
routeAnnotations	map[string]string	Annotations for this endpoint's TLSRoute (e.g. for external-dns), merged over gateway.default.routeAnnotations (these win on key conflicts).	false
routeLabels	map[string]string	Labels for this endpoint's TLSRoute, merged over gateway.default.routeLabels (these win on key conflicts). Operator-managed labels always take precedence.	false

spec.gateway.api.gatewayRef

^{^{↩ Parent}}

Overrides default.gatewayRef for this endpoint.

Name	Type	Description	Required
name	string	Name of the Gateway.	true
namespace	string	Namespace of the Gateway. Defaults to the resource's namespace if omitted.	false

spec.gateway.default

^{^{↩ Parent}}

Shared fallbacks (gatewayRef, fqdnSuffix) used by endpoints that do not set their own.

Name	Type	Description	Required
fqdnSuffix	string	Base FQDN suffix used to derive endpoint hostnames when an explicit FQDN is not set. Defaults: api., ui., metrics., .db. (database), .crdb. (Active-Active).	false
gatewayRef	object	Default Gateway referenced by endpoints that do not specify their own gatewayRef.	false
routeAnnotations	map[string]string	Default annotations applied to the TLSRoutes the operator creates (e.g. for external-dns). A per-endpoint routeAnnotations entry overrides the matching default key.	false
routeLabels	map[string]string	Default labels applied to the TLSRoutes the operator creates. A per-endpoint routeLabels entry overrides the matching default key; operator-managed labels always take precedence.	false

spec.gateway.default.gatewayRef

^{^{↩ Parent}}

Default Gateway referenced by endpoints that do not specify their own gatewayRef.

Name	Type	Description	Required
name	string	Name of the Gateway.	true
namespace	string	Namespace of the Gateway. Defaults to the resource's namespace if omitted.	false

spec.gateway.metrics

^{^{↩ Parent}}

Exposes the metrics exporter endpoint via Gateway.

Name	Type	Description	Required
enabled	boolean	Whether this endpoint is exposed via Gateway. Defaults to false.	false
fqdn	string	Explicit FQDN for this endpoint. Defaults to ..	false
gatewayRef	object	Overrides default.gatewayRef for this endpoint.	false
listenerName	string	Gateway listener name; maps to the Route's parentRef.sectionName. If omitted, the Gateway implementation selects a compatible listener.	false
listenerPort	integer	Gateway listener port; maps to the Route's parentRef.port. Minimum: 1 Maximum: 65535	false
routeAnnotations	map[string]string	Annotations for this endpoint's TLSRoute (e.g. for external-dns), merged over gateway.default.routeAnnotations (these win on key conflicts).	false
routeLabels	map[string]string	Labels for this endpoint's TLSRoute, merged over gateway.default.routeLabels (these win on key conflicts). Operator-managed labels always take precedence.	false

spec.gateway.metrics.gatewayRef

^{^{↩ Parent}}

Overrides default.gatewayRef for this endpoint.

Name	Type	Description	Required
name	string	Name of the Gateway.	true
namespace	string	Namespace of the Gateway. Defaults to the resource's namespace if omitted.	false

spec.gateway.ui

^{^{↩ Parent}}

Exposes the CM UI endpoint via Gateway.

Name	Type	Description	Required
enabled	boolean	Whether this endpoint is exposed via Gateway. Defaults to false.	false
fqdn	string	Explicit FQDN for this endpoint. Defaults to ..	false
gatewayRef	object	Overrides default.gatewayRef for this endpoint.	false
listenerName	string	Gateway listener name; maps to the Route's parentRef.sectionName. If omitted, the Gateway implementation selects a compatible listener.	false
listenerPort	integer	Gateway listener port; maps to the Route's parentRef.port. Minimum: 1 Maximum: 65535	false
routeAnnotations	map[string]string	Annotations for this endpoint's TLSRoute (e.g. for external-dns), merged over gateway.default.routeAnnotations (these win on key conflicts).	false
routeLabels	map[string]string	Labels for this endpoint's TLSRoute, merged over gateway.default.routeLabels (these win on key conflicts). Operator-managed labels always take precedence.	false

spec.gateway.ui.gatewayRef

^{^{↩ Parent}}

Overrides default.gatewayRef for this endpoint.

Name	Type	Description	Required
name	string	Name of the Gateway.	true
namespace	string	Namespace of the Gateway. Defaults to the resource's namespace if omitted.	false

spec.hostAliases[]

^{^{↩ Parent}}

HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the pod's hosts file.

Name	Type	Description	Required
hostnames	[]string	Hostnames for the above IP address.	false
ip	string	IP address of the host file entry.	false

spec.ingressOrRouteSpec

^{^{↩ Parent}}

Access configurations for the Redis Enterprise cluster and databases. At most one of ingressOrRouteSpec or activeActive fields can be set at the same time.

Name	Type	Description	Required
apiFqdnUrl	string	RS API URL	true
dbFqdnSuffix	string	DB ENDPOINT SUFFIX - will be used to set the db host ingress . Creates a host name so it should be unique if more than one db is created on the cluster with the same name	true
method	enum	Used to distinguish between different platforms implementation. Enum: openShiftRoute, ingress, istio	true
ingressAnnotations	map[string]string	Additional annotations to set on ingress resources created by the operator	false

spec.ldap

^{^{↩ Parent}}

Cluster-level LDAP configuration, such as server addresses, protocol, authentication and query settings.

Name	Type	Description	Required
authenticationQuery	object	Configuration of authentication queries, mapping between the username, provided to the cluster for authentication, and the LDAP Distinguished Name.	true
authorizationQuery	object	Configuration of authorization queries, mapping between a user's Distinguished Name and its group memberships.	true
protocol	enum	Specifies the LDAP protocol to use. One of: LDAP, LDAPS, STARTTLS. Enum: LDAP, LDAPS, STARTTLS	true
servers	[]object	One or more LDAP servers. If multiple servers are specified, they must all share an identical organization tree structure.	true
bindCredentialsSecretName	string	Name of a secret within the same namespace, holding the credentials used to communicate with the LDAP server for authentication queries. The secret must have a key named 'dn' with the Distinguished Name of the user to execute the query, and 'password' with its password. If left blank, credentials-based authentication is disabled.	false
caCertificateSecretName	string	Name of a secret within the same namespace, holding a PEM-encoded CA certificate for validating the TLS connection to the LDAP server. The secret must have a key named 'cert' with the certificate data. This field is applicable only when the protocol is LDAPS or STARTTLS.	false
cacheTTLSeconds	integer	The maximum TTL of cached entries.	false
cba	boolean	Whether to allow LDAP as an identity source for certificate-based authentication. Disabled by default.	false
cbaIdentityOid	string	The certificate subject OID to use when CBA identity source is set to SubjectOID.	false
cbaIdentitySource	enum	The certificate subject identity source to use for LDAP lookup. Applicable only when CBA is enabled. One of SubjectCN, SubjectOID. Enum: SubjectCN, SubjectOID	false
directoryTimeoutSeconds	integer	The connection timeout to the LDAP server when authenticating a user, in seconds	false
enabledForControlPlane	boolean	Whether to enable LDAP for control plane access. Disabled by default.	false
enabledForDataPlane	boolean	Whether to enable LDAP for data plane access. Disabled by default.	false

spec.ldap.authenticationQuery

^{^{↩ Parent}}

Configuration of authentication queries, mapping between the username, provided to the cluster for authentication, and the LDAP Distinguished Name.

Name	Type	Description	Required
query	object	Configuration for a search query. Mutually exclusive with the 'template' field. The substring '%u' in the query filter will be replaced with the username.	false
template	string	Configuration for a template query. Mutually exclusive with the 'query' field. The substring '%u' will be replaced with the username, e.g., 'cn=%u,ou=dev,dc=example,dc=com'.	false

spec.ldap.authenticationQuery.query

^{^{↩ Parent}}

Configuration for a search query. Mutually exclusive with the 'template' field. The substring '%u' in the query filter will be replaced with the username.

Name	Type	Description	Required
base	string	The Distinguished Name of the entry at which to start the search, e.g., 'ou=dev,dc=example,dc=com'.	true
filter	string	An RFC-4515 string representation of the filter to apply in the search. For an authentication query, the substring '%u' will be replaced with the username, e.g., '(cn=%u)'. For an authorization query, the substring '%D' will be replaced with the user's Distinguished Name, e.g., '(members=%D)'.	true
scope	enum	The search scope for an LDAP query. One of: BaseObject, SingleLevel, WholeSubtree Enum: BaseObject, SingleLevel, WholeSubtree	true

spec.ldap.authorizationQuery

^{^{↩ Parent}}

Configuration of authorization queries, mapping between a user's Distinguished Name and its group memberships.

Name	Type	Description	Required
attribute	string	Configuration for an attribute query. Mutually exclusive with the 'query' field. Holds the name of an attribute of the LDAP user entity that contains a list of the groups that the user belongs to, e.g., 'memberOf'.	false
query	object	Configuration for a search query. Mutually exclusive with the 'attribute' field. The substring '%D' in the query filter will be replaced with the user's Distinguished Name.	false

spec.ldap.authorizationQuery.query

^{^{↩ Parent}}

Configuration for a search query. Mutually exclusive with the 'attribute' field. The substring '%D' in the query filter will be replaced with the user's Distinguished Name.

Name	Type	Description	Required
base	string	The Distinguished Name of the entry at which to start the search, e.g., 'ou=dev,dc=example,dc=com'.	true
filter	string	An RFC-4515 string representation of the filter to apply in the search. For an authentication query, the substring '%u' will be replaced with the username, e.g., '(cn=%u)'. For an authorization query, the substring '%D' will be replaced with the user's Distinguished Name, e.g., '(members=%D)'.	true
scope	enum	The search scope for an LDAP query. One of: BaseObject, SingleLevel, WholeSubtree Enum: BaseObject, SingleLevel, WholeSubtree	true

spec.ldap.servers[]

^{^{↩ Parent}}

Address of an LDAP server.

Name	Type	Description	Required
host	string	Host name of the LDAP server	true
port	integer	Port number of the LDAP server. If unspecified, defaults to 389 for LDAP and STARTTLS protocols, and 636 for LDAPS protocol. Format: int32	false

spec.metricsConfig

^{^{↩ Parent}}

Cluster-level configuration for metrics. Currently controls which database tag keys may be exposed as labels on Redis Enterprise metrics.

Name	Type	Description	Required
exposeDatabaseTags	boolean	Master switch for tag-derived metrics. When true, database tag keys listed in metricsTagKeysExposed may be used as labels by metrics consumers. When false, no database tag keys are exposed as metric labels, even if listed in metricsTagKeysExposed. Defaults to false if unset.	false
keyDistributionEnabled	boolean	When true, emit Prometheus classic histogram metrics for key size/items distributions. Defaults to false if unset.	false
keyItemsBuckets	string	Comma-separated bucket boundaries for key items distribution histograms (e.g., "1M,8M"). Defaults to empty string if unset.	false
keySizeBuckets	string	Comma-separated bucket boundaries for key size distribution histograms (e.g., "128M,512M"). Defaults to empty string if unset.	false
localStorageMaxSizeMb	integer	Maximum size in MB for local metrics storage. Defaults to 1024 if unset.	false
localStorageRetentionDays	integer	Number of days to retain local metrics data. Defaults to 8 if unset.	false
maxRequestsInFlight	integer	Maximum number of concurrent master_aggregator scrape requests. Set to 0 to disable the limit. Defaults to 2 if unset.	false
metricsTagKeysExposed	[]string	Allowlist of database tag keys that may be exposed as metric labels when exposeDatabaseTags is true. Keys not listed here are never exposed as metric labels even if they appear on a database. Keys are lowercased on the cluster, must be 1-64 characters and not whitespace-only, and may contain ASCII letters, digits, spaces, '-', '_', '.', '+', '@', and ':'. At most 50 keys are allowed. Defaults to empty list if unset.	false

spec.ocspConfiguration

^{^{↩ Parent}}

An API object that represents the cluster's OCSP configuration. To enable OCSP, the cluster's proxy certificate should contain the OCSP responder URL.

Name	Type	Description	Required
ocspFunctionality	boolean	Whether to enable/disable OCSP mechanism for the cluster.	false
queryFrequency	integer	Determines the interval (in seconds) in which the control plane will poll the OCSP responder for a new status for the server certificate. Minimum value is 60. Maximum value is 86400.	false
recoveryFrequency	integer	Determines the interval (in seconds) in which the control plane will poll the OCSP responder for a new status for the server certificate when the current staple is invalid. Minimum value is 60. Maximum value is 86400.	false
recoveryMaxTries	integer	Determines the maximum number for the OCSP recovery attempts. After max number of tries passed, the control plane will revert back to the regular frequency. Minimum value is 1. Maximum value is 100.	false
responseTimeout	integer	Determines the time interval (in seconds) for which the request waits for a response from the OCSP responder. Minimum value is 1. Maximum value is 60.	false

spec.operatorClientAuth

^{^{↩ Parent}}

Selects which credential the operator presents to the control-plane REST API. This is a client-side concern: it does not, by itself, configure the cluster to accept certificates (see apiCertificateBasedAuth).

Name	Type	Description	Required
certificateSubjectLine	string	CertificateSubjectLine is the subject line of the client certificate the operator presents; never derived from the certificate itself. Required when Method is 'Certificate'; CN/O/OU/L/ST/C attributes only, CN mandatory. Must exactly match the certificate's RFC2253 subject string, no spaces after commas (e.g. 'CN=operator,O=redis'): the cluster matches certificate-auth users by the literal string. The operator adds this subject to the cluster's 'mtls_authorized_subjects'.	false
clientCertificateSecretName	string	Name or path of the secret containing the client certificate/key the operator presents to the control-plane REST API. Required when Method is 'certificate'. The secret must be in the same format as other operator-managed certificate secrets (cert-manager TLS secret, or legacy opaque secret with 'tls.crt'/'cert' and 'tls.key'/'key'). When ClusterCredentialSecretType is 'vault', this is a Vault KV path (same naming rules as ClusterCredentialSecretName); the services rigger, bootstrapper, node hook scripts and call-home client receive the cert via Vault Agent inject.	false
method	enum	Method selects how the operator authenticates to the control-plane REST API. If omitted, this field is evaluated as 'Basic'. Enum: Basic, Certificate	false

spec.ossClusterSettings

^{^{↩ Parent}}

Cluster-level configuration for OSS cluster mode databases.

Name	Type	Description	Required
externalAccessType	enum	Specifies the mechanism for enabling external access to OSS cluster databases. When unset or set to "Disabled", external access is not allowed for any OSS cluster databases. When set to a specific mechanism (e.g., "LoadBalancer"), that mechanism is used to provide external access. Note: Individual databases must still enable external access via their ossClusterSettings.enableExternalAccess field. Enum: LoadBalancer, Disabled	false
loadBalancer	object	Configuration for LoadBalancer services created to assign public IPs for Redis Enterprise cluster nodes.	false
podCIDRs	[]string	A list of Kubernetes pod CIDR ranges from which pod IPs are allocated. Supports both IPv4 (e.g., "10.30.0.0/16") and IPv6 addresses. This field should only be configured when OSS cluster databases need to be accessed from both internal and external clients. When configured, internal communication can reach pods directly using their pod IPs, bypassing the external access mechanism (e.g., load balancer services) for improved performance. IMPORTANT: For this feature to work correctly, the entire data path must preserve the client source IP address. This is required because the Redis server uses the client's source IP to construct the CLUSTER SHARDS/SLOTS response - returning pod IPs for internal clients (matching podCIDRs) or load balancer addresses for external clients. On cloud platforms, this typically requires configuring the load balancer to preserve source IPs.	false

spec.ossClusterSettings.loadBalancer

^{^{↩ Parent}}

Configuration for LoadBalancer services created to assign public IPs for Redis Enterprise cluster nodes.

Name	Type	Description	Required
externalTrafficPolicy	enum	ExternalTrafficPolicy specifies the externalTrafficPolicy for LoadBalancer services created for Redis Enterprise cluster nodes. Choose "Local" to configure the LoadBalancer to only route traffic to the single worker node hosting the Redis Enterprise cluster node for that service. Choose "Cluster" to route traffic to any worker node, providing a more stable behavior during failovers, but with increased overhead due to additional hop. Defaults to "Local" when podCIDRs is configured, and "Cluster" otherwise. Enum: Cluster, Local	false
serviceAnnotations	map[string]string	Additional annotations to set on LoadBalancer services created for Redis Enterprise cluster nodes. These annotations are merged with global service annotations from spec.services.servicesAnnotations.	false

spec.persistentSpec

^{^{↩ Parent}}

Persistent storage configuration for Redis Enterprise cluster.

Name	Type	Description	Required
enablePersistentVolumeResize	boolean	Whether to enable PersistentVolumes resize. Disabled by default. Read the instruction in pvc_expansion readme carefully before using this feature.	false
enabled	boolean	Whether to add persistent volume to Redis Enterprise pods	false
storageClassName	string	Storage class for persistent volume in Redis Enterprise pods. Leave empty to use the default. If using the default this way, make sure the Kubernetes Cluster has a default Storage Class configured. This can be done by running a `kubectl get storageclass` and see if one of the Storage Classes' names contains a `(default)` mark.	false
volumeSize	int or string	By default, if you omit spec.persistentSpec.volumeSize, the operator allocates a persistent volume that is five times (5x) the Redis Enterprise node memory request defined in spec.redisEnterpriseNodeResources.requests.memory (per node). This 5x ratio is the recommended minimum capacity. To enable resizing after creating the cluster, see the Expand PVC docs: https://redis.io/docs/latest/operate/kubernetes/re-clusters/expand-pvc/	false

spec.podAntiAffinity

^{^{↩ Parent}}

Override for the default anti-affinity rules of the Redis Enterprise pods. More info: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#an-example-of-a-pod-that-uses-pod-affinity

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object		false
requiredDuringSchedulingIgnoredDuringExecution	[]object		false

spec.podStartingPolicy

^{^{↩ Parent}}

Mitigation setting for STS pods stuck in "ContainerCreating"

Name	Type	Description	Required
enabled	boolean	Enables detection and mitigation of pod startup issues.	true
startingThresholdSeconds	integer	Time in seconds to wait before taking action on a pod stuck during startup. Set to 0 to disable. Format: int32	true

spec.podTolerations[]

^{^{↩ Parent}}

Name	Type	Description	Required
effect	string		false
key	string		false
operator	string		false
tolerationSeconds	integer	Format: int64	false
value	string		false

spec.pullSecrets[]

^{^{↩ Parent}}

Name	Type	Description	Required
name	string	Secret name	false

spec.redisEnterpriseAdditionalPodSpecAttributes

^{^{↩ Parent}}

ADVANCED USAGE USE AT YOUR OWN RISK - specify pod attributes that are required for the statefulset - Redis Enterprise pods. Pod attributes managed by the operator might override these settings. Also make sure the attributes are supported by the K8s version running on the cluster - the operator does not validate that.

Name	Type	Description	Required
activeDeadlineSeconds	integer	Format: int64	false
affinity	object		false
automountServiceAccountToken	boolean		false
dnsConfig	object		false
dnsPolicy	string		false
enableServiceLinks	boolean		false
ephemeralContainers	[]object		false
hostAliases	[]object		false
hostIPC	boolean		false
hostNetwork	boolean		false
hostPID	boolean		false
hostUsers	boolean		false
hostname	string		false
hostnameOverride	string		false
imagePullSecrets	[]object		false
initContainers	[]object		false
nodeName	string		false
nodeSelector	map[string]string		false
os	object		false
overhead	map[string]int or string		false
preemptionPolicy	string		false
priority	integer	Format: int32	false
priorityClassName	string		false
readinessGates	[]object		false
resourceClaims	[]object		false
resources	object		false
restartPolicy	string		false
runtimeClassName	string		false
schedulerName	string		false
schedulingGates	[]object		false
securityContext	object		false
serviceAccount	string		false
serviceAccountName	string		false
setHostnameAsFQDN	boolean		false
shareProcessNamespace	boolean		false
subdomain	string		false
terminationGracePeriodSeconds	integer	Format: int64	false
tolerations	[]object		false
topologySpreadConstraints	[]object		false
volumes	[]object		false
workloadRef	object		false

spec.redisEnterpriseImageSpec

^{^{↩ Parent}}

Specification for Redis Enterprise container image

Name	Type	Description	Required
digestHash	string	The digest hash of the container image to pull. When specified, the container image is pulled according to the digest hash instead of the image tag. The versionTag field must also be specified with the image tag matching this digest hash. Note: This field is only supported for OLM deployments.	false
imagePullPolicy	string	The image pull policy to be applied to the container image. One of Always, Never, IfNotPresent.	false
repository	string	The repository (name) of the container image to be deployed.	false
versionTag	string	The tag of the container image to be deployed.	false

spec.redisEnterpriseNodeResources

^{^{↩ Parent}}

Compute resource requirements for Redis Enterprise containers

Name	Type	Description	Required
claims	[]object		false
limits	map[string]int or string	Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/	false
requests	map[string]int or string	Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/	false

spec.redisEnterpriseNodeResources.claims[]

^{^{↩ Parent}}

Name	Type	Description	Required
name	string		true

spec.redisEnterpriseServicesConfiguration

^{^{↩ Parent}}

RS Cluster optional services settings

Name	Type	Required
cmServer	object	false
crdbCoordinator	object	false
crdbWorker	object	false
mdnsServer	object	false
pdnsServer	object	false
saslauthd	object	false
statsArchiver	object	false

spec.redisEnterpriseServicesConfiguration.cmServer

^{^{↩ Parent}}

Name	Type	Description	Required
operatingMode	enum	Whether to enable/disable the CM server Enum: enabled, disabled	true

spec.redisEnterpriseServicesConfiguration.crdbCoordinator

^{^{↩ Parent}}

Name	Type	Description	Required
operatingMode	enum	Whether to enable/disable the crdb coordinator process Enum: enabled, disabled	true

spec.redisEnterpriseServicesConfiguration.crdbWorker

^{^{↩ Parent}}

Name	Type	Description	Required
operatingMode	enum	Whether to enable/disable the crdb worker processes Enum: enabled, disabled	true

spec.redisEnterpriseServicesConfiguration.mdnsServer

^{^{↩ Parent}}

Name	Type	Description	Required
operatingMode	enum	Whether to enable/disable the Multicast DNS server Enum: enabled, disabled	true

spec.redisEnterpriseServicesConfiguration.pdnsServer

^{^{↩ Parent}}

Name	Type	Description	Required
operatingMode	enum	Deprecated: The PDNS Server is now disabled by the operator. This field will be ignored. Enum: enabled, disabled	true

spec.redisEnterpriseServicesConfiguration.saslauthd

^{^{↩ Parent}}

Name	Type	Description	Required
operatingMode	enum	Whether to enable/disable the saslauthd service Enum: enabled, disabled	true

spec.redisEnterpriseServicesConfiguration.statsArchiver

^{^{↩ Parent}}

Name	Type	Description	Required
operatingMode	enum	Whether to enable/disable the stats archiver service Enum: enabled, disabled	true

spec.redisEnterpriseServicesRiggerImageSpec

^{^{↩ Parent}}

Specification for Services Rigger container image

Name	Type	Description	Required
digestHash	string	The digest hash of the container image to pull. When specified, the container image is pulled according to the digest hash instead of the image tag. The versionTag field must also be specified with the image tag matching this digest hash. Note: This field is only supported for OLM deployments.	false
imagePullPolicy	string	The image pull policy to be applied to the container image. One of Always, Never, IfNotPresent.	false
repository	string	The repository (name) of the container image to be deployed.	false
versionTag	string	The tag of the container image to be deployed.	false

spec.redisEnterpriseServicesRiggerResources

^{^{↩ Parent}}

Compute resource requirements for Services Rigger pod

Name	Type	Description	Required
claims	[]object		false
limits	map[string]int or string	Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/	false
requests	map[string]int or string	Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/	false

spec.redisEnterpriseVolumeMounts[]

^{^{↩ Parent}}

Name	Type	Required
mountPath	string	true
name	string	true
mountPropagation	string	false
readOnly	boolean	false
subPath	string	false
subPathExpr	string	false

spec.redisOnFlashSpec

^{^{↩ Parent}}

Auto Tiering (Redis on Flash) configuration. When provided, the cluster can create Auto Tiering databases.

Name	Type	Description	Required
enabled	boolean		true
storageClassName	string		true
bigStoreDriver	enum	Enum: rocksdb, speedb	false
flashDiskSize	int or string		false
flashStorageEngine	enum	Enum: rocksdb	false

spec.securityContext

^{^{↩ Parent}}

The security configuration that will be applied to RS pods.

Name	Type	Description	Required
fips	object	FIPS-140 compliance mode settings.	false
readOnlyRootFilesystemPolicy	object	Policy controlling whether to enable read-only root filesystem for the Redis Enterprise software containers. Note that certain filesystem paths remain writable through mounted volumes to ensure proper functionality.	false
resourceLimits	object	Settings pertaining to resource limits management by the Redis Enterprise node container.	false

spec.securityContext.fips

^{^{↩ Parent}}

FIPS-140 compliance mode settings.

Name	Type	Description	Required
enabled	boolean	Toggles whether FIPS-140 compliance mode is enabled or not. Defaults to false.	false

spec.securityContext.readOnlyRootFilesystemPolicy

^{^{↩ Parent}}

Policy controlling whether to enable read-only root filesystem for the Redis Enterprise software containers. Note that certain filesystem paths remain writable through mounted volumes to ensure proper functionality.

Name	Type	Description	Required
enabled	boolean	Whether to enable read-only root filesystem for the Redis Enterprise software containers. Default is false.	true

spec.securityContext.resourceLimits

^{^{↩ Parent}}

Settings pertaining to resource limits management by the Redis Enterprise node container.

Name	Type	Description	Required
allowAutoAdjustment	boolean	Allow Redis Enterprise to adjust resource limits, like max open file descriptors, of its data plane processes. When this option is enabled, the SYS_RESOURCE capability is added to the Redis Enterprise pods, and their allowPrivilegeEscalation field is set. Turned off by default.	false

spec.services

^{^{↩ Parent}}

Customization options for operator-managed service resources created for Redis Enterprise clusters and databases

Name	Type	Description	Required
apiService	object	Customization options for the REC API service.	false
servicesAnnotations	map[string]string	Global additional annotations to set on service resources created by the operator. The specified annotations will not override annotations that already exist and didn't originate from the operator.	false

spec.services.apiService

^{^{↩ Parent}}

Customization options for the REC API service.

Name	Type	Description	Required
type	enum	Type of service to create for the REC API service. Defaults to ClusterIP service, if not specified otherwise. Enum: ClusterIP, NodePort, LoadBalancer	false

spec.servicesRiggerSpec

^{^{↩ Parent}}

Specification for service rigger

Name	Type	Description	Required
databaseServicePortPolicy	enum	databaseServicePortPolicy instructs how to determine the service ports for REDB services. Defaults to DatabasePortForward, if not specified otherwise. Note - Regardless whether this flag is set or not, if an REDB/REAADB configured with databaseServicePort that would be the port exposed by the Service. DatabasePortForward - The service port will be the same as the database port. RedisDefaultPort - The service port will be the default Redis port (6379). Enum: DatabasePortForward, RedisDefaultPort	false
databaseServiceType	string	Service types for access to databases. should be a comma separated list. The possible values are cluster_ip, headless and load_balancer.	false
extraEnvVars	[]object		false
podAnnotations	map[string]string	annotations for the service rigger pod	false
serviceNaming	enum	Used to determine how to name the services created automatically when a database is created. When bdb_name is used, the database name will be also used for the service name. When redis-port is used, the service will be named redis-. Enum: bdb_name, redis-port	false
servicesRiggerAdditionalPodSpecAttributes	object	ADVANCED USAGE USE AT YOUR OWN RISK - specify pod attributes that are required for the rigger deployment pod. Pod attributes managed by the operator might override these settings (Containers, serviceAccountName, ImagePullSecrets, nodeSelector, PriorityClassName, PodSecurityContext). podTolerations are merged with tolerations defined here. Also make sure the attributes are supported by the K8s version running on the cluster - the operator does not validate that.	false

spec.servicesRiggerSpec.extraEnvVars[]

^{^{↩ Parent}}

EnvVar represents an environment variable present in a Container. More info: https://kubernetes.io/docs/tasks/inject-data-application/environment-variable-expose-pod-information/

Name	Type	Description	Required
name	string	Name of the environment variable.	true
value	string		false
valueFrom	object	Source for the environment variable's value. Cannot be used if value is not empty.	false

spec.servicesRiggerSpec.extraEnvVars[].valueFrom

^{^{↩ Parent}}

Source for the environment variable's value. Cannot be used if value is not empty.

Name	Type	Description	Required
configMapKeyRef	object	Selects a key of a ConfigMap.	false
fieldRef	object	Selects a field of the pod	false
resourceFieldRef	object	Selects a resource of the container: only resources limits and requests are currently supported.	false
secretKeyRef	object	Selects a key of a secret in the pod's namespace	false

spec.servicesRiggerSpec.extraEnvVars[].valueFrom.configMapKeyRef

^{^{↩ Parent}}

Selects a key of a ConfigMap.

Name	Type	Description	Required
key	string	The key to select.	true
name	string	Name of the referent	false
optional	boolean	Specify whether the ConfigMap or its key must be defined	false

spec.servicesRiggerSpec.extraEnvVars[].valueFrom.fieldRef

^{^{↩ Parent}}

Selects a field of the pod

Name	Type	Description	Required
fieldPath	string	Path of the field to select in the specified API version.	true
apiVersion	string	Version of the schema the FieldPath is written in terms of, defaults to "v1".	false

spec.servicesRiggerSpec.extraEnvVars[].valueFrom.resourceFieldRef

^{^{↩ Parent}}

Selects a resource of the container: only resources limits and requests are currently supported.

Name	Type	Description	Required
resource	string	Required: resource to select	true
containerName	string	Container name: required for volumes, optional for env vars	false
divisor	int or string	Specifies the output format of the exposed resources, defaults to "1"	false

spec.servicesRiggerSpec.extraEnvVars[].valueFrom.secretKeyRef

^{^{↩ Parent}}

Selects a key of a secret in the pod's namespace

Name	Type	Description	Required
key	string	The key of the secret to select from. Must be a valid secret key.	true
name	string	Name of the referent	false
optional	boolean	Specify whether the Secret or its key must be defined	false

spec.servicesRiggerSpec.servicesRiggerAdditionalPodSpecAttributes

^{^{↩ Parent}}

ADVANCED USAGE USE AT YOUR OWN RISK - specify pod attributes that are required for the rigger deployment pod. Pod attributes managed by the operator might override these settings (Containers, serviceAccountName, ImagePullSecrets, nodeSelector, PriorityClassName, PodSecurityContext). podTolerations are merged with tolerations defined here. Also make sure the attributes are supported by the K8s version running on the cluster - the operator does not validate that.

Name	Type	Description	Required
activeDeadlineSeconds	integer	Format: int64	false
affinity	object		false
automountServiceAccountToken	boolean		false
dnsConfig	object		false
dnsPolicy	string		false
enableServiceLinks	boolean		false
ephemeralContainers	[]object		false
hostAliases	[]object		false
hostIPC	boolean		false
hostNetwork	boolean		false
hostPID	boolean		false
hostUsers	boolean		false
hostname	string		false
hostnameOverride	string		false
imagePullSecrets	[]object		false
initContainers	[]object		false
nodeName	string		false
nodeSelector	map[string]string		false
os	object		false
overhead	map[string]int or string		false
preemptionPolicy	string		false
priority	integer	Format: int32	false
priorityClassName	string		false
readinessGates	[]object		false
resourceClaims	[]object		false
resources	object		false
restartPolicy	string		false
runtimeClassName	string		false
schedulerName	string		false
schedulingGates	[]object		false
securityContext	object		false
serviceAccount	string		false
serviceAccountName	string		false
setHostnameAsFQDN	boolean		false
shareProcessNamespace	boolean		false
subdomain	string		false
terminationGracePeriodSeconds	integer	Format: int64	false
tolerations	[]object		false
topologySpreadConstraints	[]object		false
volumes	[]object		false
workloadRef	object		false

spec.sideContainersSpec[]

^{^{↩ Parent}}

Name	Type	Required
name	string	true
args	[]string	false
command	[]string	false
env	[]object	false
envFrom	[]object	false
image	string	false
imagePullPolicy	string	false
lifecycle	object	false
livenessProbe	object	false
ports	[]object	false
readinessProbe	object	false
resources	object	false
securityContext	object	false
startupProbe	object	false
stdin	boolean	false
stdinOnce	boolean	false
terminationMessagePath	string	false
terminationMessagePolicy	string	false
tty	boolean	false
volumeDevices	[]object	false
volumeMounts	[]object	false
workingDir	string	false

spec.slaveHA

^{^{↩ Parent}}

Slave high availability mechanism configuration.

Name	Type	Description	Required
slaveHAGracePeriod	integer	Grace period in seconds between node failure and when the high availability mechanism starts relocating shards. Set to 0 to not affect cluster configuration. Format: int32	true

spec.sso

^{^{↩ Parent}}

Cluster-level SSO configuration for authentication to the Cluster Manager UI.

Name	Type	Description	Required
enabled	boolean	Enables SSO for Cluster Manager authentication. SSO requires the following configuration - Service Provider certificate (spec.certificates.ssoServiceCertificateSecretName), Identity Provider certificate (spec.certificates.ssoIssuerCertificateSecretName), IdP metadata or manual issuer configuration (spec.sso.saml.idpMetadataSecretName or spec.sso.saml.issuer), and Base address for Service Provider URLs (auto-determined from UI service or set via spec.sso.saml.serviceProvider.baseAddress).	true
saml	object	SAML-based SSO configuration. Currently,SAML is the only supported SSO protocol.	true
enforceSSO	boolean	Enforces SSO-only authentication for the Cluster Manager. When true, local username/password authentication is disabled for non-admin users. When false (default), both SSO and local authentication are available.	false

spec.sso.saml

^{^{↩ Parent}}

SAML-based SSO configuration. Currently,SAML is the only supported SSO protocol.

Name	Type	Description	Required
idpMetadataSecretName	string	Name of a secret in the same namespace that contains the Identity Provider (IdP) metadata XML. The secret must contain a key named 'idp_metadata' with the IdP metadata XML content. The XML can be plain text or base64-encoded; the operator handles encoding as needed. Obtain this metadata from your SAML Identity Provider (e.g., Okta or Azure AD). This is the recommended configuration method, as it's less error-prone. Either idpMetadataSecretName or issuer must be specified. If both are provided, idpMetadataSecretName takes precedence and issuer is ignored.	false
issuer	object	Manual Identity Provider (IdP) configuration. Use this when IdP metadata XML is unavailable. Either idpMetadataSecretName or issuer must be specified. If both are provided, idpMetadataSecretName takes precedence and issuer is ignored.	false
serviceProvider	object	Service Provider (SP) configuration.	false
spMetadataSecretName	string	Name of a secret where the operator stores the Service Provider (SP) metadata XML. The operator creates this secret with a key named 'sp_metadata' that contains the base64-encoded SP metadata XML. Upload this metadata to your Identity Provider. If not specified, defaults to "-sso-sp-metadata". If not specified, the Service Provider metadata isn't stored in a K8s secret, but can still be obtained directly from the cluster's UI and/or API. Note: This secret is only created when the cluster is configured to use Kubernetes secrets (spec.clusterCredentialSecretType is unset or set to "kubernetes"). When using Vault secrets, the operator does not create this secret. Users can obtain the SP metadata directly from the Redis Enterprise Server API endpoint: GET /v1/cluster/sso/saml/metadata/sp and store it in Vault themselves if needed.	false

spec.sso.saml.issuer

^{^{↩ Parent}}

Manual Identity Provider (IdP) configuration. Use this when IdP metadata XML is unavailable. Either idpMetadataSecretName or issuer must be specified. If both are provided, idpMetadataSecretName takes precedence and issuer is ignored.

Name	Type	Description	Required
entityID	string	Identity Provider entity ID (issuer identifier). Example: "urn:sso:example:idp" or "https://idp.example.com".	true
loginURL	string	Identity Provider SSO login URL where SAML authentication requests are sent. Example: "https://idp.example.com/sso/saml".	true
logoutURL	string	Identity Provider single logout URL where SAML logout requests are sent.	false

spec.sso.saml.serviceProvider

^{^{↩ Parent}}

Service Provider (SP) configuration.

Name	Type	Description	Required
baseAddress	string	Base address used to construct Service Provider (SP) URLs, such as the ACS URL and SLO URL. Format: [://][:]. Examples: "https://redis-ui.example.com:9443" (recommended - explicit scheme), "redis-ui.example.com:9443" (defaults to https://), "http://redis-ui.example.com:9443" (NOT recommended for production). If the scheme is not specified, the operator automatically prepends "https://". WARNING: Using "http://" is NOT recommended for production environments as it transmits sensitive SAML assertions in plaintext. Only use "http://" for testing/development purposes. If set, this value is used to construct the SP URLs. If unset, the base address is automatically determined from the REC Cluster Manager UI service: - If the UI service type is LoadBalancer (configured via spec.uiServiceType), the load balancer address is used. - Otherwise, the cluster-internal DNS name is used (e.g., rec-ui.svc.cluster.local). - The port defaults to 8443 if not specified. Usage guidelines: - For LoadBalancer services: Leave this field blank to use the default REC UI service, or set it explicitly to the LoadBalancer address for custom services. - For Ingress: Set this to the ingress hostname and port (typically 443), e.g., "https://redis-ui.example.com:443".	false

spec.upgradeSpec

^{^{↩ Parent}}

Redis Enterprise upgrade configuration

Name	Type	Description	Required
autoUpgradeRedisEnterprise	boolean	Enables automatic Redis Enterprise upgrades when the operator is upgraded.	true

spec.usageMeter

^{^{↩ Parent}}

The configuration of the usage meter.

Name	Type	Description	Required
callHomeClient	object		false

spec.usageMeter.callHomeClient

^{^{↩ Parent}}

Name	Type	Description	Required
cronExpression	string	Cron expression for scheduling the call home CronJob (e.g., "0 /6 * "). If not specified, the CALL_HOME_CLIENT_CRON_SCHEDULE environment variable is used, or the default value of "0 23 * *" (23:00 UTC daily). Changing defaults is not recommended.	false
disabled	boolean	Whether to disable the call home client. Enabled by default.	false
imageSpec	object	Image specification	false
interval	string	Interval between call home reports (e.g., "1h", "30m"). Passed as --interval flag to the call home client binary. If not specified, the CALL_HOME_CLIENT_INTERVAL environment variable is used, or the default value of 24h. Changing defaults is not recommended.	false
proxySecretName	string	if needed, add proxy details in secret. the name of the proxy secret in the secret, can send the following keys: proxy-url, proxy-username, proxy-password (the url includes the proxy port).	false
resources	object	Compute resource requirements for Call Home Client pod	false
s3Target	object	S3-compatible storage target for call home data upload. When enabled, call home data will be uploaded to this S3 target only. Before using this feature, please coordinate with Redis.	false

spec.usageMeter.callHomeClient.imageSpec

^{^{↩ Parent}}

Image specification

Name	Type	Description	Required
digestHash	string	The digest hash of the container image to pull. When specified, the container image is pulled according to the digest hash instead of the image tag. The versionTag field must also be specified with the image tag matching this digest hash. Note: This field is only supported for OLM deployments.	false
imagePullPolicy	string	The image pull policy to be applied to the container image. One of Always, Never, IfNotPresent.	false
repository	string	The repository (name) of the container image to be deployed.	false
versionTag	string	The tag of the container image to be deployed.	false

spec.usageMeter.callHomeClient.resources

^{^{↩ Parent}}

Compute resource requirements for Call Home Client pod

Name	Type	Description	Required
claims	[]object	Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers.	false
limits	map[string]int or string	Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	false
requests	map[string]int or string	Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	false

spec.usageMeter.callHomeClient.resources.claims[]

^{^{↩ Parent}}

ResourceClaim references one entry in PodSpec.ResourceClaims.

Name	Type	Description	Required
name	string	Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.	true

spec.usageMeter.callHomeClient.s3Target

^{^{↩ Parent}}

S3-compatible storage target for call home data upload. When enabled, call home data will be uploaded to this S3 target only. Before using this feature, please coordinate with Redis.

Name	Type	Description	Required
bucket	string	S3 bucket name. Required when S3Target is enabled.	false
credentialsSecretName	string	Name of the Kubernetes secret containing S3 credentials. The secret must contain keys "access-key" and "secret-key". Optional keys - "session-token" (for AWS STS), "ca-cert" (for custom CA). The credentials must have s3:PutObject permission on the target bucket.	false
enabled	boolean	Whether S3 upload is enabled. When true, call home data will be uploaded to the specified S3 target only.	false
endpoint	string	S3-compatible endpoint URL.	false
prefix	string	S3 object key prefix/subfolder for uploaded files (e.g., "reports/2025"). If specified, files will be uploaded to s3://bucket/prefix/filename.	false
region	string	AWS region for the S3 bucket (e.g., "us-east-1").	false
url	string	Full S3 URL including bucket (e.g., "https://bucket.s3.region.amazonaws.com" or "s3://bucket/prefix").	false

spec.userDefinedModules[]

^{^{↩ Parent}}

UserDefinedModule represents a user-defined Redis module to be downloaded and installed during bootstrap

Name	Type	Description	Required
name	string	Name of the module	true
source	object	Source location for downloading the module	true

spec.userDefinedModules[].source

^{^{↩ Parent}}

Source location for downloading the module

Name	Type	Description	Required
http	object	HTTP source configuration for downloading the module via HTTP	false
https	object	HTTPS source configuration for downloading the module via HTTPS	false

spec.userDefinedModules[].source.http

^{^{↩ Parent}}

HTTP source configuration for downloading the module via HTTP

Name	Type	Description	Required
url	string	URL to download the module from (must use http:// scheme)	true
credentialsSecret	string	Name of the Kubernetes secret containing credentials for downloading the module, if needed. The secret must contain 'username' and 'password' keys.	false

spec.userDefinedModules[].source.https

^{^{↩ Parent}}

HTTPS source configuration for downloading the module via HTTPS

Name	Type	Description	Required
url	string	URL to download the module from (must use https:// scheme)	true
credentialsSecret	string	Name of the Kubernetes secret containing credentials for downloading the module, if needed. The secret must contain 'username' and 'password' keys.	false

spec.volumes[]

^{^{↩ Parent}}

Volume represents a named volume in a pod that may be accessed by any container in the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes

Name	Type	Required
name	string	true
awsElasticBlockStore	object	false
azureDisk	object	false
azureFile	object	false
cephfs	object	false
cinder	object	false
configMap	object	false
csi	object	false
downwardAPI	object	false
emptyDir	object	false
fc	object	false
flexVolume	object	false
flocker	object	false
gcePersistentDisk	object	false
gitRepo	object	false
glusterfs	object	false
hostPath	object	false
iscsi	object	false
nfs	object	false
persistentVolumeClaim	object	false
photonPersistentDisk	object	false
portworxVolume	object	false
projected	object	false
quobyte	object	false
rbd	object	false
scaleIO	object	false
secret	object	false
storageos	object	false
vsphereVolume	object	false

status

^{^{↩ Parent}}

Name	Type	Description	Required
apiCertificateBasedAuthActive	boolean	Whether control-plane certificate authentication (mtls_certificate_authentication) was last observed enabled on the cluster. The operator and services rigger present client certificates only while this is true.	false
bundledDatabaseVersions	[]object	Versions of open source databases bundled by Redis Enterprise Software - please note that in order to use a specific version it should be supported by the ‘upgradePolicy’ - ‘major’ or ‘latest’ according to the desired version (major/minor)	false
certificatesStatus	object	Stores information about cluster certificates and their update process. In Active-Active databases, this is used to detect updates to the certificates, and trigger synchronization across the participating clusters.	false
clusterCredentialSecretName	string	The name of the secret containing cluster credentials currently in use by the cluster. This field tracks the current credential secret name and is updated when the secret name changes.	false
gateway	object	Status of cluster service endpoints exposed through the Kubernetes Gateway API.	false
ingressOrRouteMethodStatus	string	The ingressOrRouteSpec/ActiveActive spec method that exist	false
initContainerFailures	[]object	Failures of operator-managed init containers (such as the read-only root filesystem setup), one entry per failing pod and container; empty when all such init containers are healthy.	false
licenseStatus	object		false
managedAPIs	object	Indicates cluster APIs that are being managed by the operator. This only applies to cluster APIs which are optionally-managed by the operator, such as cluster LDAP configuration. Most other APIs are automatically managed by the operator, and are not listed here.	false
modules	[]object		false
ocspStatus	object	An API object that represents the cluster's OCSP status	false
operatorClientCertStatus	object	Status of the operator's control-plane client certificate when spec.operatorClientAuth.method is Certificate. Cleared when certificate authentication is not in use.	false
persistenceStatus	object	The status of the Persistent Volume Claims that are used for Redis Enterprise cluster persistence. The status will correspond to the status of one or more of the PVCs (failed/resizing if one of them is in resize or failed to resize)	false
redisEnterpriseIPFamily	string		false
specStatus	string		false
state	string		false

status.bundledDatabaseVersions[]

^{^{↩ Parent}}

Name	Type	Description	Required
dbType	string		true
version	string		true
featureSupport	object	Feature support flags for this database version	false
major	boolean		false

status.bundledDatabaseVersions[].featureSupport

^{^{↩ Parent}}

Feature support flags for this database version

Name	Type	Description	Required
activeActive	boolean	Indicates whether this version supports Active-Active (CRDB) databases	true
flex	boolean	Indicates whether this version supports Redis on Flash (Flex)	true

status.certificatesStatus

^{^{↩ Parent}}

Stores information about cluster certificates and their update process. In Active-Active databases, this is used to detect updates to the certificates, and trigger synchronization across the participating clusters.

Name	Type	Description	Required
generation	integer	Generation stores the version of the cluster's Proxy and Syncer certificate secrets. This generation counter is automatically incremented when proxy or syncer certificates are updated. In Active-Active databases (REAADB), the operator monitors this field to detect certificate changes and automatically triggers a CRDB force update (equivalent to 'crdb-cli crdb update --force'), which synchronizes the certificate changes to all participating clusters, eliminating the need for manual intervention to maintain sync. Format: int64	false
updateStatus	string	The status of the cluster's certificates update	false

status.gateway

^{^{↩ Parent}}

Status of cluster service endpoints exposed through the Kubernetes Gateway API.

Name	Type	Required
api	object	false
metrics	object	false
ui	object	false

status.gateway.api

^{^{↩ Parent}}

Name	Type	Required
conditions	[]object	false
fqdn	string	false
routeName	string	false

status.gateway.api.conditions[]

^{^{↩ Parent}}

Name	Type	Description	Required
lastTransitionTime	string	Format: date-time	true
message	string		true
reason	string		true
status	enum	Enum: True, False, Unknown	true
type	string		true
observedGeneration	integer	Format: int64 Minimum: 0	false

status.gateway.metrics

^{^{↩ Parent}}

Name	Type	Required
conditions	[]object	false
fqdn	string	false
routeName	string	false

status.gateway.metrics.conditions[]

^{^{↩ Parent}}

Name	Type	Description	Required
lastTransitionTime	string	Format: date-time	true
message	string		true
reason	string		true
status	enum	Enum: True, False, Unknown	true
type	string		true
observedGeneration	integer	Format: int64 Minimum: 0	false

status.gateway.ui

^{^{↩ Parent}}

Name	Type	Required
conditions	[]object	false
fqdn	string	false
routeName	string	false

status.gateway.ui.conditions[]

^{^{↩ Parent}}

Name	Type	Description	Required
lastTransitionTime	string	Format: date-time	true
message	string		true
reason	string		true
status	enum	Enum: True, False, Unknown	true
type	string		true
observedGeneration	integer	Format: int64 Minimum: 0	false

status.initContainerFailures[]

^{^{↩ Parent}}

InitContainerFailure describes a failed operator-managed init container detected in one of the cluster's pods.

Name	Type	Description	Required
containerName	string	Name of the init container that failed.	false
exitCode	integer	Exit code of the failed init container, when known. Format: int32	false
message	string	Human-readable description of the failure, including the command to inspect the init container logs for the underlying cause.	false
podName	string	Name of the pod whose init container failed.	false
reason	string	Reason reported by Kubernetes for the failure (for example, "Error" or "CrashLoopBackOff").	false

status.licenseStatus

^{^{↩ Parent}}

Name	Type	Description	Required
activationDate	string		false
expirationDate	string		false
features	[]string		false
flashShards	integer	Format: int32	false
flashShardsLimit	integer	Format: int32	false
licenseState	string		false
owner	string		false
ramShards	integer	Format: int32	false
ramShardsLimit	integer	Format: int32	false
shardsLimit	integer		false
shardsUsage	string		false

status.managedAPIs

^{^{↩ Parent}}

Indicates cluster APIs that are being managed by the operator. This only applies to cluster APIs which are optionally-managed by the operator, such as cluster LDAP configuration. Most other APIs are automatically managed by the operator, and are not listed here.

Name	Type	Description	Required
apiCertificateBasedAuth	boolean	Indicate whether control-plane certificate-based authentication (CBA) is managed by the operator. Enabled once spec.apiCertificateBasedAuth is set for the first time. Once enabled, the operator keeps reconciling the cluster's mtls_certificate_authentication setting even if the spec block is removed; in that case the operator disables it.	false
clientMaintenanceNotificationsOssMode	boolean	Indicate whether OSS cluster client maintenance notifications are managed by the operator. Enabled once spec.clientMaintenanceNotifications.ossMode.enabled is set for the first time, and stays enabled if the field is later removed; in that case the operator disables the setting.	false
clientMaintenanceNotificationsProxyMode	boolean	Indicate whether proxy-mode client maintenance notifications are managed by the operator. Enabled once spec.clientMaintenanceNotifications.proxyMode.enabled is set for the first time, and stays enabled if the field is later removed; in that case the operator disables the setting.	false
disconnectClientsOnPasswordRemoval	boolean	Indicate whether disconnect-clients-on-password-removal is managed by the operator. Enabled automatically for new clusters. Once enabled, the operator keeps reconciling the cluster value even if the user removes spec.disconnectClientsOnPasswordRemoval; in that case the operator writes the auto default.	false
ldap	boolean	Indicate whether cluster LDAP configuration is managed by the operator. When this is enabled, the operator will reconcile the cluster LDAP configuration according to the '.spec.ldap' field in the RedisEnterpriseCluster resource.	false

status.modules[]

^{^{↩ Parent}}

Name	Type	Required
displayName	string	false
name	string	false
versions	[]string	false

status.ocspStatus

^{^{↩ Parent}}

An API object that represents the cluster's OCSP status

Name	Type	Description	Required
certStatus	string	Indicates the proxy certificate status - GOOD/REVOKED/UNKNOWN.	false
nextUpdate	string	The time at or before which newer information will be available about the status of the certificate (if available)	false
producedAt	string	The time at which the OCSP responder signed this response.	false
responderUrl	string	The OCSP responder url from which this status came from.	false
revocationTime	string	The time at which the certificate was revoked or placed on hold.	false
thisUpdate	string	The most recent time at which the status being indicated is known by the responder to have been correct.	false

status.operatorClientCertStatus

^{^{↩ Parent}}

Status of the operator's control-plane client certificate when spec.operatorClientAuth.method is Certificate. Cleared when certificate authentication is not in use.

Name	Type	Description	Required
expirationDate	string	When the leaf client certificate expires (RFC3339).	false
secretName	string	Name of the secret referenced by spec.operatorClientAuth.clientCertificateSecretName.	false
state	string	State of the client certificate: Valid, ExpiringSoon, or Expired.	false

status.persistenceStatus

^{^{↩ Parent}}

The status of the Persistent Volume Claims that are used for Redis Enterprise cluster persistence. The status will correspond to the status of one or more of the PVCs (failed/resizing if one of them is in resize or failed to resize)

Name	Type	Description	Required
status	string	The current status of the PVCs	false
succeeded	string	The number of PVCs that are provisioned with the expected size	false