{
  "id": "redis_enterprise_user_api",
  "title": "RedisEnterpriseUser API Reference",
  "url": "https://redis.io/docs/latest/operate/kubernetes/reference/api/redis_enterprise_user_api/",
  "summary": "",
  "tags": [
    "docs",
    "operate",
    "kubernetes"
  ],
  "last_updated": "2026-07-24T10:52:10-07:00",
  "page_type": "content",
  "content_hash": "1bb2b3cd4fac5e0a40b10231966a2046a9425ecd1b12c5cca72daeca4df4f6fc",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "apiVersion:\n\n\n- [app.redislabs.com/v1alpha1](#appredislabscomv1alpha1)\n\n\n\n\n# app.redislabs.com/v1alpha1\n\n\n\n\nRedisEnterpriseUser represents a user definition within a Redis Enterprise Cluster.\n\n<table>\n    <thead>\n        <tr>\n            <th>Name</th>\n            <th>Type</th>\n            <th>Description</th>\n            <th>Required</th>\n        </tr>\n    </thead>\n    <tbody><tr>\n      <td>apiVersion</td>\n      <td>string</td>\n      <td>app.redislabs.com/v1alpha1</td>\n      <td>true</td>\n      </tr>\n      <tr>\n      <td>kind</td>\n      <td>string</td>\n      <td>RedisEnterpriseUser</td>\n      <td>true</td>\n      </tr>\n      <tr>\n      <td><a href=\"https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#objectmeta-v1-meta\">metadata</a></td>\n      <td>object</td>\n      <td>Refer to the Kubernetes API documentation for the fields of the `metadata` field.</td>\n      <td>true</td>\n      </tr><tr>\n        <td><a href=\"#spec\">spec</a></td>\n        <td>object</td>\n        <td>\n          RedisEnterpriseUserSpec defines the desired state of a RedisEnterpriseUser.<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td><a href=\"#status\">status</a></td>\n        <td>object</td>\n        <td>\n          RedisEnterpriseUserStatus defines the observed state of a RedisEnterpriseUser.<br/>\n        </td>\n        <td>false</td>\n      </tr></tbody>\n</table>"
    },
    {
      "id": "spec",
      "title": "spec",
      "role": "content",
      "text": "<sup><sup>[↩ Parent](#)</sup></sup>\n\nRedisEnterpriseUserSpec defines the desired state of a RedisEnterpriseUser.\n\n<table>\n    <thead>\n        <tr>\n            <th>Name</th>\n            <th>Type</th>\n            <th>Description</th>\n            <th>Required</th>\n        </tr>\n    </thead>\n    <tbody><tr>\n        <td><a href=\"#specalerts\">alerts</a></td>\n        <td>object</td>\n        <td>\n          Email alerts settings for this user. User alerts settings are effective only when cluster alerts settings are configured.<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td>authMethod</td>\n        <td>enum</td>\n        <td>\n          AuthMethod selects how the user authenticates to Redis Enterprise. 'Basic' (the default) authenticates with Basic Auth, using a password sourced from passwordSecrets. 'Certificate' authenticates with a client certificate whose subject matches certificateSubjectLine; such users carry no password (passwordSecrets must be empty). Certificate users additionally require certificate-based authentication to be configured at the cluster level.<br/>\n          <br/>\n            <i>Enum</i>: Basic, Certificate<br/>\n            <i>Default</i>: Basic<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td>certificateSubjectLine</td>\n        <td>string</td>\n        <td>\n          CertificateSubjectLine is the certificate subject line (RFC2253) used to match the client certificate for certificate-auth users. Required when authMethod is 'Certificate'; must not be set otherwise.<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td>email</td>\n        <td>string</td>\n        <td>\n          The email address for the user. Optional (Redis Enterprise accepts an empty email). For password users, changing the email after creation is permitted only while spec.passwordSecrets contains exactly one entry: to change the email of a user with two password secrets (Rotatable rotation in progress), first reduce passwordSecrets to a single entry, change the email, then add the second secret back. Certificate-auth users carry no password, so this restriction does not apply to them.<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td>passwordMode</td>\n        <td>enum</td>\n        <td>\n          Defines how passwords are managed for this user. Single: Only a single password secret can be specified at a time. Passwords changes can be done by mutating the secret in-place, or by replacing the secret reference to point to another secret. Rotatable: Allows for one or two password secrets to be specified simultaneously. The secrets are required to be immutable, and the operator automatically sets their 'immutable: true' attribute (K8s secrets only) if not already set. Vault secrets are assumed to be used as immutable and are not made immutable automatically. Password changes are typically done by adding a new password secret, and later removing the old one when it's no longer needed. When empty, Single behavior is used. Must not be set for certificate-auth users (authMethod: Certificate), which carry no password.<br/>\n          <br/>\n            <i>Enum</i>: Single, Rotatable<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td><a href=\"#specpasswordsecrets\">passwordSecrets</a></td>\n        <td>[]object</td>\n        <td>\n          List of one or more secrets holding the user's password. Each secret must have a key named 'password' with the user's desired password. If multiple secrets are specified, then the passwords from all of them can be used for authenticating as the user. When the user signin status is 'Locked', the user won't be able to authenticate with Redis Enterprise API or UI, and must be unlocked by another user with Admin-role access. To unlock the user, first set a new password via the 'passwordSecrets' field, and then follow the password reset instructions in the following link: https://redis.io/docs/latest/operate/rs/security/access-control/manage-users/login-lockout/#unlock-locked-user-accounts<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td>username</td>\n        <td>string</td>\n        <td>\n          The username associated with the user. The username must be unique within the Redis Enterprise cluster, and include only ASCII characters except &,<,>,\". If not specified, a default username is assigned and can be discovered via the status section of the RedisEnterpriseUser.<br/>\n        </td>\n        <td>false</td>\n      </tr></tbody>\n</table>"
    },
    {
      "id": "spec-alerts",
      "title": "spec.alerts",
      "role": "content",
      "text": "<sup><sup>[↩ Parent](#spec)</sup></sup>\n\nEmail alerts settings for this user. User alerts settings are effective only when cluster alerts settings are configured.\n\n<table>\n    <thead>\n        <tr>\n            <th>Name</th>\n            <th>Type</th>\n            <th>Description</th>\n            <th>Required</th>\n        </tr>\n    </thead>\n    <tbody><tr>\n        <td>enabled</td>\n        <td>boolean</td>\n        <td>\n          Master toggle for email alerts.<br/>\n        </td>\n        <td>true</td>\n      </tr><tr>\n        <td><a href=\"#specalertsclusteralerts\">clusterAlerts</a></td>\n        <td>object</td>\n        <td>\n          UserClusterAlertSettings specifies cluster alerts settings for a user.<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td><a href=\"#specalertsdatabasealerts\">databaseAlerts</a></td>\n        <td>object</td>\n        <td>\n          UserDatabaseAlertSettings specifies database alerts settings for a user.<br/>\n        </td>\n        <td>false</td>\n      </tr></tbody>\n</table>"
    },
    {
      "id": "spec-alerts-clusteralerts",
      "title": "spec.alerts.clusterAlerts",
      "role": "content",
      "text": "<sup><sup>[↩ Parent](#specalerts)</sup></sup>\n\nUserClusterAlertSettings specifies cluster alerts settings for a user.\n\n<table>\n    <thead>\n        <tr>\n            <th>Name</th>\n            <th>Type</th>\n            <th>Description</th>\n            <th>Required</th>\n        </tr>\n    </thead>\n    <tbody><tr>\n        <td>enabled</td>\n        <td>boolean</td>\n        <td>\n          Determines whether cluster alerts are enabled for the user.<br/>\n        </td>\n        <td>true</td>\n      </tr></tbody>\n</table>"
    },
    {
      "id": "spec-alerts-databasealerts",
      "title": "spec.alerts.databaseAlerts",
      "role": "content",
      "text": "<sup><sup>[↩ Parent](#specalerts)</sup></sup>\n\nUserDatabaseAlertSettings specifies database alerts settings for a user.\n\n<table>\n    <thead>\n        <tr>\n            <th>Name</th>\n            <th>Type</th>\n            <th>Description</th>\n            <th>Required</th>\n        </tr>\n    </thead>\n    <tbody><tr>\n        <td><a href=\"#specalertsdatabasealertsdatabases\">databases</a></td>\n        <td>[]object</td>\n        <td>\n          The databases for which alerts are enabled for this user. If not specified, defaults to all databases.<br/>\n        </td>\n        <td>false</td>\n      </tr></tbody>\n</table>"
    },
    {
      "id": "spec-alerts-databasealerts-databases",
      "title": "spec.alerts.databaseAlerts.databases[]",
      "role": "content",
      "text": "<sup><sup>[↩ Parent](#specalertsdatabasealerts)</sup></sup>\n\nA reference to another object.\n\n<table>\n    <thead>\n        <tr>\n            <th>Name</th>\n            <th>Type</th>\n            <th>Description</th>\n            <th>Required</th>\n        </tr>\n    </thead>\n    <tbody><tr>\n        <td>kind</td>\n        <td>string</td>\n        <td>\n          Kind of the referent.<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td>name</td>\n        <td>string</td>\n        <td>\n          Name of the referent.<br/>\n        </td>\n        <td>false</td>\n      </tr></tbody>\n</table>"
    },
    {
      "id": "spec-passwordsecrets",
      "title": "spec.passwordSecrets[]",
      "role": "content",
      "text": "<sup><sup>[↩ Parent](#spec)</sup></sup>\n\nA reference to a Secret object.\n\n<table>\n    <thead>\n        <tr>\n            <th>Name</th>\n            <th>Type</th>\n            <th>Description</th>\n            <th>Required</th>\n        </tr>\n    </thead>\n    <tbody><tr>\n        <td>name</td>\n        <td>string</td>\n        <td>\n          Name of the Secret.<br/>\n        </td>\n        <td>true</td>\n      </tr></tbody>\n</table>"
    },
    {
      "id": "status",
      "title": "status",
      "role": "content",
      "text": "<sup><sup>[↩ Parent](#)</sup></sup>\n\nRedisEnterpriseUserStatus defines the observed state of a RedisEnterpriseUser.\n\n<table>\n    <thead>\n        <tr>\n            <th>Name</th>\n            <th>Type</th>\n            <th>Description</th>\n            <th>Required</th>\n        </tr>\n    </thead>\n    <tbody><tr>\n        <td><a href=\"#statusconditions\">conditions</a></td>\n        <td>[]object</td>\n        <td>\n          Conditions represent the latest available observations of the user's state.<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td>observedGeneration</td>\n        <td>integer</td>\n        <td>\n          The most recent generation of this resource that was observed and acted upon by the controller.<br/>\n          <br/>\n            <i>Format</i>: int64<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td>passwordIssueDate</td>\n        <td>string</td>\n        <td>\n          The date in which the password was set.<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td><a href=\"#statuspasswordsecrets\">passwordSecrets</a></td>\n        <td>[]object</td>\n        <td>\n          List of secrets holding the user's password, with their versions.<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td><a href=\"#statusroles\">roles</a></td>\n        <td>[]object</td>\n        <td>\n          List of roles assigned to the user.<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td>rolesDisplay</td>\n        <td>string</td>\n        <td>\n          Formatted string representation of the roles assigned to the user.<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td>signinStatus</td>\n        <td>string</td>\n        <td>\n          Sign-in status for the user. When set to 'Locked', the user won't be able to authenticate with Redis Enterprise API or UI, and must be unlocked by another user with Admin-role access. To unlock the user, set a new password via the 'passwordSecrets' field, and then follow the password reset instructions in the following link: https://redis.io/docs/latest/operate/rs/security/access-control/manage-users/login-lockout/#unlock-locked-user-accounts<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td>uid</td>\n        <td>string</td>\n        <td>\n          The internal UID of the User object defined in the Redis Enterprise Cluster.<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td>username</td>\n        <td>string</td>\n        <td>\n          The effective username assigned for the user.<br/>\n        </td>\n        <td>false</td>\n      </tr></tbody>\n</table>"
    },
    {
      "id": "status-conditions",
      "title": "status.conditions[]",
      "role": "content",
      "text": "<sup><sup>[↩ Parent](#status)</sup></sup>\n\nCondition contains details for one aspect of the current state of this API Resource.\n\n<table>\n    <thead>\n        <tr>\n            <th>Name</th>\n            <th>Type</th>\n            <th>Description</th>\n            <th>Required</th>\n        </tr>\n    </thead>\n    <tbody><tr>\n        <td>lastTransitionTime</td>\n        <td>string</td>\n        <td>\n          lastTransitionTime is the last time the condition transitioned from one status to another.<br/>\n          <br/>\n            <i>Format</i>: date-time<br/>\n        </td>\n        <td>true</td>\n      </tr><tr>\n        <td>status</td>\n        <td>enum</td>\n        <td>\n          status of the condition, one of True, False, Unknown.<br/>\n          <br/>\n            <i>Enum</i>: True, False, Unknown<br/>\n        </td>\n        <td>true</td>\n      </tr><tr>\n        <td>type</td>\n        <td>string</td>\n        <td>\n          type of condition in CamelCase or in foo.example.com/CamelCase.<br/>\n        </td>\n        <td>true</td>\n      </tr><tr>\n        <td>message</td>\n        <td>string</td>\n        <td>\n          message is a human readable message indicating details about the transition.<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td>observedGeneration</td>\n        <td>integer</td>\n        <td>\n          observedGeneration represents the .metadata.generation that the condition was set based upon.<br/>\n          <br/>\n            <i>Format</i>: int64<br/>\n            <i>Minimum</i>: 0<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td>reason</td>\n        <td>string</td>\n        <td>\n          reason contains a programmatic identifier indicating the reason for the condition's last transition.<br/>\n        </td>\n        <td>false</td>\n      </tr></tbody>\n</table>"
    },
    {
      "id": "status-passwordsecrets",
      "title": "status.passwordSecrets[]",
      "role": "content",
      "text": "<sup><sup>[↩ Parent](#status)</sup></sup>\n\nA versioned reference to a Secret object.\n\n<table>\n    <thead>\n        <tr>\n            <th>Name</th>\n            <th>Type</th>\n            <th>Description</th>\n            <th>Required</th>\n        </tr>\n    </thead>\n    <tbody><tr>\n        <td>name</td>\n        <td>string</td>\n        <td>\n          Name of the Secret.<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td>version</td>\n        <td>string</td>\n        <td>\n          Version of the Secret.<br/>\n        </td>\n        <td>false</td>\n      </tr></tbody>\n</table>"
    },
    {
      "id": "status-roles",
      "title": "status.roles[]",
      "role": "content",
      "text": "<sup><sup>[↩ Parent](#status)</sup></sup>\n\nA reference to another object.\n\n<table>\n    <thead>\n        <tr>\n            <th>Name</th>\n            <th>Type</th>\n            <th>Description</th>\n            <th>Required</th>\n        </tr>\n    </thead>\n    <tbody><tr>\n        <td>kind</td>\n        <td>string</td>\n        <td>\n          Kind of the referent.<br/>\n        </td>\n        <td>false</td>\n      </tr><tr>\n        <td>name</td>\n        <td>string</td>\n        <td>\n          Name of the referent.<br/>\n        </td>\n        <td>false</td>\n      </tr></tbody>\n</table>"
    }
  ],
  "examples": []
}