{
  "id": "log-collector-rbac",
  "title": "Log collector RBAC examples",
  "url": "https://redis.io/docs/latest/operate/kubernetes/8.0.18/reference/yaml/log-collector-rbac/",
  "summary": "YAML examples for configuring RBAC permissions for the Redis Enterprise log collector tool in `restricted` and `all` modes.",
  "content": "\nThis page provides YAML examples for configuring RBAC permissions for the Redis Enterprise log collector tool. The log collector requires different permission levels depending on the collection mode you choose.\n\nFor complete log collection instructions, see [Collect logs](https://redis.io/docs/latest/operate/kubernetes/logs/collect-logs).\n\n## Prerequisites\n\n- Install the [Redis Enterprise operator](https://redis.io/docs/latest/operate/kubernetes/deployment)\n- Appropriate permissions to create RBAC resources in target namespaces\n- Understanding of your deployment model (single namespace, multi-namespace, etc.)\n\n## Collection modes\n\nThe log collector has two collection modes that require different RBAC permissions:\n\n- **`restricted` mode** (recommended): Collects only Redis Enterprise resources with minimal security exposure. Default for versions 6.2.18-3+.\n- **`all` mode**: Collects comprehensive cluster information including nodes, storage classes, and operator resources. Use when specifically requested by Redis Support.\n\n## `restricted` mode RBAC\n\nThe `restricted` mode configuration provides minimal permissions for collecting Redis Enterprise resources only.\n\n\n\n`restricted` mode configuration:\n\n- `Role`: Namespace-scoped permissions for Redis Enterprise resources\n- `ClusterRole`: Cluster-wide permissions for CRDs and basic cluster resources\n- `rules`: Minimal permissions for Redis Enterprise diagnostics\n\nKey permissions:\n\n- `pods, pods/log, pods/exec`: Access to pod information and logs\n- `app.redislabs.com/*`: All Redis Enterprise custom resources\n- `persistentvolumes`: Storage information for troubleshooting\n\n## `all` mode RBAC\n\nThe `all` mode configuration provides comprehensive permissions for collecting detailed cluster information.\n\n\n\n`all` mode configuration:\n\n- `Role`: Extended namespace permissions including operator resources\n- `ClusterRole`: Additional cluster-wide permissions for nodes and storage\n- `rules`: Comprehensive permissions for full cluster diagnostics\n\nAdditional permissions in `all` mode:\n\n- `nodes`: Node information and status\n- `storageclasses, volumeattachments`: Storage system details\n- `operators.coreos.com/*`: OpenShift operator information\n- `networking.istio.io/*`: Istio service mesh resources\n\n## Apply the configuration\n\n### Namespace requirements\n\nCreate the Role and RoleBinding in every namespace where you need to collect logs:\n\n- Single namespace: Apply to the namespace where Redis Enterprise runs\n- Multi-namespace with single REC: Apply to the REC namespace plus each REDB namespace  \n- Multi-namespace with multiple RECs: Apply to each REC namespace\n\nThe ClusterRole and ClusterRoleBinding need to be created only once per cluster.\n\nEdit the values in the downloaded YAML file for your specific setup, updating the namespace references and role binding subjects to match your environment.\n\n### Role binding configuration\n\nThe RBAC configurations include both roles and role bindings. The role bindings must reference the user or service account that will execute the log collector:\n\n- User subject: If running the log collector as a specific user, update the `subjects` section in the RoleBinding and ClusterRoleBinding to reference your username\n- Service account: If using a service account, create or reference the appropriate service account in the role bindings\n\n### Manual deployment\n\nTo apply the RBAC configurations manually:\n\n```bash\n# Apply restricted mode RBAC\nkubectl apply -f log-collector-restricted-rbac.yaml --namespace \u003cnamespace\u003e\n\n# Apply all mode RBAC\nkubectl apply -f log-collector-all-rbac.yaml --namespace \u003cnamespace\u003e\n```\n\n## Usage\n\nAfter applying the RBAC configuration, run the log collector:\n\n```bash\n# Restricted mode (default for 6.2.18-3+)\npython log_collector.py -m restricted -n \u003cnamespace\u003e\n\n# All mode\npython log_collector.py -m all -n \u003cnamespace\u003e\n```\n\n## Security considerations\n\n### Best practices\n\n- Use `restricted` mode unless you specifically need additional cluster information\n- Limit namespace access to only where log collection is needed\n- Handle collected data according to your organization's security policies\n\n### Secrets permission explanation\n\nThe RBAC configurations request read access to secrets in the collected namespaces. **Secrets are not collected or included in the log package sent to Redis Support.** This permission is required because:\n\n- The log collector uses Helm commands (`helm list`, `helm get all`) to gather Redis Enterprise Helm chart deployment information\n- Helm stores its deployment metadata in Kubernetes secrets\n- This metadata contains only deployment configuration (not sensitive data)\n\nIf your security policies prohibit secrets access, you can remove the secrets permission from the Role, but this will limit the log collector's ability to gather Helm deployment information.\n\n## Troubleshooting\n\n### Permission errors\n\n- Verify that roles and bindings are applied correctly in the target namespaces\n- Check that the ClusterRole is applied cluster-wide\n- Ensure the service account has proper role bindings\n\n### Missing resources\n\n- Consider switching to `all` mode if additional cluster resources are needed\n- Verify that custom resource definitions are installed\n- Check that the operator has proper permissions\n\n## Next steps\n\n- [Collect logs guide](https://redis.io/docs/latest/operate/kubernetes/logs/collect-logs)\n- [Basic deployment examples](https://redis.io/docs/latest/operate/kubernetes/reference/yaml/basic-deployment)\n- [Multi-namespace deployment](https://redis.io/docs/latest/operate/kubernetes/reference/yaml/multi-namespace)\n\n## Related documentation\n\n- [Kubernetes RBAC documentation](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)\n- [Redis Enterprise troubleshooting](https://redis.io/docs/latest/operate/kubernetes/logs)\n- [Operator deployment guide](https://redis.io/docs/latest/operate/kubernetes/deployment)\n",
  "tags": ["docs","operate","kubernetes"],
  "last_updated": "2026-06-04T14:49:57+01:00"
}