Skip to content

Commit b81322d

Browse files
rrelledgerrelledge
authored
RS 7.22.2 minor release docs (#2121)
* DOC-5565 RS 7.22.2 release notes draft * DOC-5565 Added resolved issues and more details about customer-managed internode encryption certs to RS 7.22.2 release notes * RS: Customer-managed certificates for internode encryption (#2010) * DOC-5210 RS: Added ccs_internode_encryption and data_internode_encryption to certificates table * DOC-5210 Added more details to the INE certificate descriptions * DOC-5210 Added new section for customer-managed internode encryption certificates * DOC-5210 Copy edits * Add <img> handling to show full size image on click, similar to image shortcode * DOC-5210 More copy edits * Reduce top margin when headers immediately follow other headers with no regular text in between * DOC-5564 Added link to customer-provided internode encryption certs in release notes * DOC-5210 Updated rladmin and REST API examples for customer-provided INE certs * DOC-5210 Updated rladmin cluster certificate reference for customer-provided INE certs * DOC-5210 Updated certificate REST API requests reference for customer-provided INE certs * Added deprecation of PUT /v1/cluster/update_cert to RS 7.22.2 release notes * DOC-5210 Added new customer_managed_ine_certificates to v2 Prometheus metrics * DOC-5210 Added new PUT /v1/cluster/certificates examples for updating certs in RS 7.22.2 and later * Attempting to fix broken img in RS update certs * DOC-5210 Feedback update to clarify when new certs are used * DOC-5210 Feedback update to clarify rladmin cluster certificate reference - divided command options into 2 sections * DOC-5210 Feedback update for auto-copying certs to new nodes * DOC-5210 Feedback update to add shared and separate INE cert examples for rladmin and REST API * DOC-5210 Fixed typo * DOC-5210 Fixed multitabs IDs * DOC-5210 Updated screenshot for cluster certs screen that includes INE certs section * DOC-5566 Added build number and checksums to 7.22.2 Sept release notes, removed bug fix that will be in a future maintenance release, mentioned bug fixes in highlights/description * DOC-5210 Feedback update to add RSA key requirement for customer-provided INE certs * DOC-5564 Updated RS 7.22.2 release notes build number and checksums
1 parent 0d3fc08 commit b81322d

File tree

12 files changed

+614
-37
lines changed

12 files changed

+614
-37
lines changed

‎assets/css/index.css‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,25 @@ section.prose {
101101
@apply mt-16 scroll-mt-6;
102102
}
103103

104+
/* Reduce top margin when headers immediately follow other headers */
105+
.prose h1[id] + h2[id],
106+
.prose h1[id] + h3[id],
107+
.prose h1[id] + h4[id],
108+
.prose h1[id] + h5[id],
109+
.prose h1[id] + h6[id],
110+
.prose h2[id] + h3[id],
111+
.prose h2[id] + h4[id],
112+
.prose h2[id] + h5[id],
113+
.prose h2[id] + h6[id],
114+
.prose h3[id] + h4[id],
115+
.prose h3[id] + h5[id],
116+
.prose h3[id] + h6[id],
117+
.prose h4[id] + h5[id],
118+
.prose h4[id] + h6[id],
119+
.prose h5[id] + h6[id] {
120+
@apply mt-6;
121+
}
122+
104123
.prose p:empty,
105124
.prose li:empty {
106125
@apply hidden;

‎content/embeds/rs-prometheus-metrics-v2.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@
5151
| <span class="break-all">node_available_memory_no_overbooking_bytes</span> | gauge | Available RAM in the node (bytes) without taking into account overbooking |
5252
| node_bigstore_free_bytes | gauge | Sum of free space of back-end flash (used by flash database's [BigRedis]) on all cluster nodes (bytes); returned only when BigRedis is enabled |
5353
| <span class="break-all">node_cert_expires_in_seconds</span> | gauge | Certificate expiration (in seconds) per given node; read more about [certificates in Redis Enterprise]({{< relref "/operate/rs/security/certificates" >}}) and [monitoring certificates]({{< relref "/operate/rs/security/certificates/monitor-certificates" >}}) |
54+
| <span class="break-all">customer_managed_ine_certificates</span> | gauge | Indicates whether customer-provided internode encryption certificates are in use<br />0=No<br />1=Yes |
5455
| <span class="break-all">node_ephemeral_storage_avail_bytes</span> | gauge | Disk space available to RLEC processes on configured ephemeral disk (bytes) |
5556
| <span class="break-all">node_ephemeral_storage_free_bytes</span> | gauge | Free disk space on configured ephemeral disk (bytes) |
5657
| node_memory_MemFree_bytes | gauge | Free memory in the node (bytes) |

‎content/operate/rs/references/cli-utilities/rladmin/cluster/certificate.md‎

Lines changed: 46 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ categories:
55
- docs
66
- operate
77
- rs
8-
description: Sets the cluster certificate.
8+
description: Sets cluster certificates.
99
headerRange: '[1-2]'
1010
linkTitle: certificate
1111
tags:
@@ -14,13 +14,14 @@ toc: 'true'
1414
weight: $weight
1515
---
1616

17+
## `cluster certificate set <certificate_name>`
18+
1719
Sets a cluster certificate to a specified PEM file.
1820

1921
```sh
20-
rladmin cluster certificate
21-
set <certificate name>
22-
certificate_file <certificate filepath>
23-
[ key_file <key filepath> ]
22+
rladmin cluster certificate set <certificate_name>
23+
certificate_file <filepath>
24+
[ key_file <filepath> ]
2425
```
2526

2627
To set a certificate for a specific service, use the corresponding certificate name. See the [certificates table]({{< relref "/operate/rs/security/certificates" >}}) for the list of cluster certificates and their descriptions.
@@ -29,7 +30,7 @@ To set a certificate for a specific service, use the corresponding certificate n
2930

3031
| Parameter | Type/Value | Description |
3132
|-----------|------------|-------------|
32-
| certificate name | 'cm'<br /> 'api'<br /> 'proxy'<br /> 'syncer'<br /> 'metrics_exporter' | Name of the certificate to update |
33+
| certificate_name | 'cm'<br /> 'api'<br /> 'proxy'<br /> 'syncer'<br /> 'metrics_exporter' | Name of the certificate to update. See the [certificates table]({{< relref "/operate/rs/security/certificates" >}}) for descriptions. |
3334
| certificate_file | filepath | Path to the certificate file |
3435
| key_file | filepath | Path to the key file (optional) |
3536

@@ -39,8 +40,47 @@ Reports that the certificate was set to the specified file. Returns an error mes
3940

4041
### Example
4142

43+
Update the proxy certificate:
44+
4245
```sh
4346
$ rladmin cluster certificate set proxy \
4447
certificate_file /tmp/proxy.pem
4548
Set proxy certificate to contents of file /tmp/proxy.pem
4649
```
50+
51+
## `cluster certificate set internal`
52+
53+
Sets [customer-provided internode encryption certificates]({{<relref "/operate/rs/security/encryption/internode-encryption#customer-provided-certificates">}}).
54+
55+
```sh
56+
rladmin cluster certificate set internal
57+
dpine_certificate_file <filepath>
58+
dpine_key_file <filepath>
59+
cpine_certificate_file <filepath>
60+
cpine_key_file <filepath>
61+
```
62+
63+
### Parameters
64+
65+
| Parameter | Type/Value | Description |
66+
|-----------|------------|-------------|
67+
| dpine_certificate_file | filepath | Path to the data plane internode encryption (DPINE) certificate file |
68+
| dpine_key_file | filepath | Path to the data plane internode encryption (DPINE) key file |
69+
| cpine_certificate_file | filepath | Path to the control plane internode encryption (CPINE) certificate file |
70+
| cpine_key_file | filepath | Path to the control plane internode encryption (CPINE) key file |
71+
72+
### Returns
73+
74+
Reports that the internal certificates were set to the specified files. Returns an error message if the certificates fail to update.
75+
76+
### Example
77+
78+
Set up [customer-provided internode encryption certificates]({{<relref "/operate/rs/security/encryption/internode-encryption#customer-provided-certificates">}}):
79+
80+
```sh
81+
$ rladmin cluster certificate set internal \
82+
dpine_certificate_file /tmp/dpine_cert.pem \
83+
dpine_key_file /tmp/dpine_key.pem \
84+
cpine_certificate_file /tmp/cpine_cert.pem \
85+
cpine_key_file /tmp/cpine_key.pem
86+
```

‎content/operate/rs/references/rest-api/objects/certificates.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
Title: Certificates object
3+
alwaysopen: false
4+
categories:
5+
- docs
6+
- operate
7+
- rs
8+
description: An object that represents a certificate
9+
linkTitle: certificates
10+
weight: $weight
11+
---
12+
13+
An API object that represents a certificate used by a Redis Enterprise Software cluster.
14+
15+
| Name | Type/Value | Description |
16+
|------|------------|-------------|
17+
| name | `cm`<br />`api`<br />`mtls_trusted_ca`<br />`proxy`<br />`metrics_exporter`<br />`syncer`<br />`ldap_client`<br />`ccs_internode_encryption`<br />`data_internode_encryption` | Certificate type.<br />See the [certificates table]({{< relref "/operate/rs/security/certificates" >}}) for the list of cluster certificates and their descriptions. |
18+
| certificate | string | The certificate in PEM format |
19+
| key | string | The private key in PEM format |

‎content/operate/rs/references/rest-api/requests/cluster/certificates/_index.md‎

Lines changed: 81 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,8 @@ weight: $weight
1515
| Method | Path | Description |
1616
|--------|------|-------------|
1717
| [GET](#get-cluster-certificates) | `/v1/cluster/certificates` | Get cluster certificates |
18-
| [PUT](#put-cluster-update_cert) | `/v1/cluster/update_cert` | Update a cluster certificate |
18+
| [PUT](#put-cluster-certificates) | `/v1/cluster/certificates` | Update cluster certificates |
19+
| [PUT](#put-cluster-update_cert) | `/v1/cluster/update_cert` | Update a cluster certificate (deprecated as of Redis Enterprise Software version 7.22.2) |
1920
| [DELETE](#delete-cluster-certificate) | `/v1/cluster/certificates/{certificate_name}` | Delete cluster certificate |
2021

2122
## Get cluster certificates {#get-cluster-certificates}
@@ -62,15 +63,83 @@ Returns a JSON object that contains the cluster's certificates and keys.
6263

6364
| Code | Description |
6465
|------|-------------|
65-
| [200 OK](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.2.1) | No error |
66+
| [200 OK](https://www.rfc-editor.org/rfc/rfc9110.html#name-200-ok) | No error |
6667

6768

69+
## Update cluster certificates {#put-cluster-certificates}
70+
71+
```sh
72+
PUT /v1/cluster/certificates
73+
```
74+
75+
Replaces multiple cluster certificates with the provided certificates on all nodes within the cluster. This endpoint validates all provided certificates before actually updating the cluster.
76+
77+
See the [certificates table]({{< relref "/operate/rs/security/certificates" >}}) for the list of cluster certificates and their descriptions.
78+
79+
### Request {#put-certificates-request}
80+
81+
#### Example HTTP request
82+
83+
```sh
84+
PUT /v1/cluster/certificates
85+
```
86+
87+
#### Example JSON body
88+
89+
```json
90+
{
91+
"certificates": [
92+
{
93+
"name": "proxy",
94+
"certificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
95+
"key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
96+
},
97+
{
98+
"name": "api",
99+
"certificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
100+
"key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
101+
}
102+
]
103+
}
104+
```
105+
106+
#### Request headers
107+
108+
| Key | Value | Description |
109+
|-----|-------|-------------|
110+
| Host | cnm.cluster.fqdn | Domain name |
111+
| Accept | application/json | Accepted media type |
112+
113+
#### Request body
114+
115+
Include an array of [certificate objects]({{<relref "/operate/rs/references/rest-api/objects/certificates">}}) in the request body.
116+
117+
### Response {#put-certificates-response}
118+
119+
Returns a `200 OK` status code if all certificates are successfully replaced across the entire cluster.
120+
121+
If the response returns a failed status code, you should retry updating the certificates in case the cluster is no longer in an optimal state.
122+
123+
### Status codes {#put-certificates-status-codes}
124+
125+
| Code | Description |
126+
|------|-------------|
127+
| [200 OK](https://www.rfc-editor.org/rfc/rfc9110.html#name-200-ok) | No error |
128+
| [400 Bad Request](https://www.rfc-editor.org/rfc/rfc9110.html#name-400-bad-request) | Failed, invalid certificate(s) |
129+
| [403 Forbidden](https://www.rfc-editor.org/rfc/rfc9110.html#name-403-forbidden) | Failed, unknown certificate(s) |
130+
| [406 Not Acceptable](https://www.rfc-editor.org/rfc/rfc9110.html#name-406-not-acceptable) | Failed, expired certificate(s) |
131+
| [409 Conflict](https://www.rfc-editor.org/rfc/rfc9110.html#name-409-conflict) | Failed, not all nodes have been updated |
132+
68133
## Update cluster certificate {#put-cluster-update_cert}
69134

70135
```sh
71136
PUT /v1/cluster/update_cert
72137
```
73138

139+
{{<note>}}
140+
This REST API path is deprecated as of Redis Enterprise Software 7.22.2 and will be removed in a future version. Use [`PUT /v1/cluster/certificates`](#put-cluster-certificates) instead.
141+
{{</note>}}
142+
74143
Replaces an existing certificate on all nodes within the cluster with a new certificate. The new certificate must pass validation before it can replace the old certificate.
75144

76145
See the [certificates table]({{< relref "/operate/rs/security/certificates" >}}) for the list of cluster certificates and their descriptions.
@@ -105,12 +174,12 @@ Otherwise, retry the certificate update in case the failure was due to a tempora
105174

106175
| Code | Description |
107176
|------|-------------|
108-
| [200 OK](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.2.1) | No error |
109-
| [400 Bad Request](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.1) | Failed, invalid certificate. |
110-
| [403 Forbidden](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.4) | Failed, unknown certificate. |
111-
| [404 Not Found](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.5) | Failed, invalid certificate. |
112-
| [406 Not Acceptable](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.7) | Failed, expired certificate. |
113-
| [409 Conflict](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.10) | Failed, not all nodes have been updated. |
177+
| [200 OK](https://www.rfc-editor.org/rfc/rfc9110.html#name-200-ok) | No error |
178+
| [400 Bad Request](https://www.rfc-editor.org/rfc/rfc9110.html#name-400-bad-request) | Failed, invalid certificate. |
179+
| [403 Forbidden](https://www.rfc-editor.org/rfc/rfc9110.html#name-403-forbidden) | Failed, unknown certificate. |
180+
| [404 Not Found](https://www.rfc-editor.org/rfc/rfc9110.html#name-404-not-found) | Failed, invalid certificate. |
181+
| [406 Not Acceptable](https://www.rfc-editor.org/rfc/rfc9110.html#name-406-not-acceptable) | Failed, expired certificate. |
182+
| [409 Conflict](https://www.rfc-editor.org/rfc/rfc9110.html#name-409-conflict) | Failed, not all nodes have been updated. |
114183

115184

116185
## Delete cluster certificate {#delete-cluster-certificate}
@@ -143,7 +212,7 @@ Returns a status code that indicates the certificate deletion success or failure
143212

144213
| Code | Description |
145214
|------|-------------|
146-
| [200 OK](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.2.1) | Operation successful |
147-
| [404 Not Found](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.5) | Failed, requested deletion of an unknown certificate |
148-
| [403 Forbidden](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.4) | Failed, requested deletion of a required certificate |
149-
| [500 Internal Server Error](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.5.1) | Failed, error while deleting certificate from disk |
215+
| [200 OK](https://www.rfc-editor.org/rfc/rfc9110.html#name-200-ok) | Operation successful |
216+
| [404 Not Found](https://www.rfc-editor.org/rfc/rfc9110.html#name-404-not-found) | Failed, requested deletion of an unknown certificate |
217+
| [403 Forbidden](https://www.rfc-editor.org/rfc/rfc9110.html#name-403-forbidden) | Failed, requested deletion of a required certificate |
218+
| [500 Internal Server Error](https://www.rfc-editor.org/rfc/rfc9110.html#name-500-internal-server-error) | Failed, error while deleting certificate from disk |

‎content/operate/rs/release-notes/rs-7-22-releases/_index.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ For more detailed release notes, select a build version from the following table
5555

5656
- Deprecated the `data_files` option for the `recovery_plan` specified in [`POST /v2/bdbs`]({{<relref "/operate/rs/references/rest-api/requests/bdbs#post-bdbs-v2">}}) requests. Use the new `original_bdb_shards` option to recover a database from the provided list of shards instead.
5757

58+
- Deprecated [`PUT /v1/cluster/update_cert`]({{<relref "/operate/rs/references/rest-api/requests/cluster/certificates#put-cluster-update_cert">}}) REST API requests as of Redis Enterprise Software version 7.22.2. Use [`PUT /v1/cluster/certificates`]({{<relref "/operate/rs/references/rest-api/requests/cluster/certificates#put-cluster-certificates">}}) to update cluster certificates instead.
59+
5860
#### Internal monitoring and v1 Prometheus metrics deprecation
5961

6062
The existing [internal monitoring engine]({{<relref "/operate/rs/monitoring/v1_monitoring">}}) is deprecated. We recommend transitioning to the new [metrics stream engine]({{<relref "/operate/rs/monitoring/metrics_stream_engine">}}) for improved performance, enhanced integration capabilities, and modernized metrics streaming.

0 commit comments

Comments
 (0)