{
  "schema_version": 2,
  "id": "operate/kubernetes/security/access-control/manage-acls",
  "title": "Manage ACLs",
  "url": "https://redis.io/docs/latest/operate/kubernetes/8.2.0/security/access-control/manage-acls/",
  "summary": "Create and update RedisEnterpriseACL resources to control Redis data-path permissions on Kubernetes.",
  "content": "\nA `RedisEnterpriseACL` resource holds a Redis ACL rule that controls which commands, keys, and categories a user can access at the Redis data path. The operator reconciles the resource into a Redis Software ACL object that roles can reference.\n\nACLs are reusable: one `RedisEnterpriseACL` can be attached to any number of `RedisEnterpriseRole` or `RedisEnterpriseClusterRole` resources. The role decides which databases the ACL applies to; the ACL itself just defines the rule.\n\nTo grant a user the permissions in an ACL, reference the ACL from a role and bind the role to the user. See [Manage roles](https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-roles) and [Manage role bindings](https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-bindings).\n\n## Before you start\n\n- Requires Redis Software for Kubernetes operator 8.2.0-12 or later.\n- The `RedisEnterpriseACL` resource must live in the operator namespace.\n- The rule string uses Redis ACL syntax — key patterns, command categories, and explicit commands. See [Redis ACL overview](https://redis.io/docs/latest/operate/rs/security/access-control/redis-acl-overview) for the full syntax.\n\n## Create an ACL\n\n`spec.acl` is a single Redis ACL rule string.\n\n```yaml\napiVersion: app.redislabs.com/v1alpha1\nkind: RedisEnterpriseACL\nmetadata:\n  name: read-only\nspec:\n  acl: \"+@read ~*\"\n```\n\nApply the resource and confirm reconciliation:\n\n```sh\nkubectl apply -f read-only-acl.yaml\nkubectl get redisenterpriseacl read-only -o yaml\n```\n\n`status.uid` holds the Redis Software ACL UID once the operator has created the object.\n\n### Common rule patterns\n\n| Use case | Rule |\n| --- | --- |\n| Read-only access to all keys | `+@read ~*` |\n| Read and write access to all keys | `+@all ~*` |\n| Read-only access to a key prefix | `+@read ~customer:*` |\n| A specific command set | `+get +set +del ~app:*` |\n| Block dangerous commands | `+@all -@dangerous ~*` |\n\nFor category names (`@read`, `@write`, `@admin`, `@dangerous`, etc.) and the full operator precedence rules, see [Redis ACL overview](https://redis.io/docs/latest/operate/rs/security/access-control/redis-acl-overview).\n\n## Update an ACL\n\nEdit `spec.acl` and re-apply. The operator updates the Redis Software ACL object in place, so the change immediately affects every database that uses the ACL through a role.\n\n```sh\nkubectl edit redisenterpriseacl read-only\n```\n\n`status.observedGeneration` reaches the resource's `metadata.generation` once the update has been applied.\n\nAn update changes effective permissions for every connected user. Treat ACL changes the same way as role changes: validate them on a non-production cluster first. For a safer rollout, create a new ACL and swap the role reference instead of editing the existing ACL in place.\n\n## Inspect ACL status\n\nThe `status` block is minimal:\n\n| Field | Meaning |\n| --- | --- |\n| `uid` | Internal Redis Software ACL UID. Present once reconciliation succeeds. |\n| `observedGeneration` | The `metadata.generation` the operator last acted on. |\n\nTo find roles that reference this ACL, scan the role resources:\n\n```sh\nkubectl get redisenterpriserole -o yaml | \\\n  yq '.items[] | select(.spec.acl.name == \"read-only\") | .metadata.name'\nkubectl get redisenterpriseclusterrole -o yaml | \\\n  yq '.items[] | select(.spec.acl.name == \"read-only\") | .metadata.name'\n```\n\n## Delete an ACL\n\nDelete or modify any roles that reference the ACL first (modify them to no longer reference it), then delete the ACL itself:\n\n```sh\nkubectl delete redisenterpriseacl read-only\n```\n\nIf a role still references the ACL, Redis Software may reject the deletion. The operator emits an `RSOperationFailed` event with the underlying message. Remove the reference (or delete the role) and retry.\n\n## Troubleshoot\n\nWatch reconciliation events with `kubectl describe redisenterpriseacl \u003cname\u003e`. Common events:\n\n| Event | Meaning |\n| --- | --- |\n| `RSObjectNotFound` | The Redis Software ACL the resource previously resolved against no longer exists. The operator will recreate it on the next reconcile. |\n| `RSOperationFailed` | A Redis Software API call failed. The message typically includes the syntax error or in-use conflict. |\n\nOther things to check:\n\n- **`status.uid` is empty** — The operator hasn't reconciled the ACL yet, or Redis Software rejected the rule. Check the events for an `RSOperationFailed` with the syntax message.\n- **Rule parses but grants nothing** — A common cause is an explicit `-@all` later in the rule overriding earlier `+` clauses. Redis ACL evaluation is order-sensitive; see the [Redis ACL overview](https://redis.io/docs/latest/operate/rs/security/access-control/redis-acl-overview).\n- **Delete is blocked** — A `RedisEnterpriseRole` or `RedisEnterpriseClusterRole` still references the ACL in `spec.acl`. Remove the reference or delete the role first.\n\nFor full field details, see the [`RedisEnterpriseACL`](https://redis.io/docs/latest/operate/kubernetes/reference/api/redis_enterprise_acl_api) API reference.\n\n## Related topics\n\n- [Redis ACL overview](https://redis.io/docs/latest/operate/rs/security/access-control/redis-acl-overview) — rule syntax, categories, and evaluation order.\n- [Manage roles](https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-roles) — attach ACLs to `RedisEnterpriseRole` and `RedisEnterpriseClusterRole` resources.\n- [Manage role bindings](https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-bindings) — grant the role to a user.\n",
  "tags": ["docs","operate","kubernetes"],
  "last_updated": "2026-10-19T14:33:15-05:00"
}