{
  "id": "access-control",
  "title": "Access control",
  "url": "https://redis.io/docs/latest/operate/kubernetes/security/access-control/",
  "summary": "Manage Redis Software users, roles, ACLs, and role bindings on Kubernetes with custom resources.",
  "tags": [
    "docs",
    "operate",
    "kubernetes"
  ],
  "last_updated": "2026-07-24T10:52:10-07:00",
  "children": [
    {
      "id": "manage-users",
      "summary": "Create and update Redis Software users on Kubernetes with the RedisEnterpriseUser custom resource.",
      "title": "Manage users",
      "url": "https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-users/"
    },
    {
      "id": "manage-roles",
      "summary": "Create RedisEnterpriseRole and RedisEnterpriseClusterRole resources to grant Redis Software permissions on Kubernetes.",
      "title": "Manage roles",
      "url": "https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-roles/"
    },
    {
      "id": "manage-acls",
      "summary": "Create and update RedisEnterpriseACL resources to control Redis data-path permissions on Kubernetes.",
      "title": "Manage ACLs",
      "url": "https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-acls/"
    },
    {
      "id": "manage-bindings",
      "summary": "Assign roles to users with RedisEnterpriseRoleBinding and RedisEnterpriseClusterRoleBinding resources.",
      "title": "Manage role bindings",
      "url": "https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-bindings/"
    },
    {
      "id": "migrate-rolespermissions",
      "summary": "Move database role assignments from the deprecated RedisEnterpriseDatabase.spec.rolesPermissions field to the RBAC CRD model.",
      "title": "Migrate from REDB rolesPermissions",
      "url": "https://redis.io/docs/latest/operate/kubernetes/security/access-control/migrate-rolespermissions/"
    }
  ],
  "page_type": "content",
  "content_hash": "353b7b6c7239816bbd7222e40c50d39a4228b70989a74d3143d6d6236a56bbef",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "Access control lets you manage Redis Software users, roles, ACLs, and role bindings as Kubernetes custom resources. The operator reconciles each resource into the corresponding Redis Software object, so you can use GitOps workflows and Kubernetes Secrets instead of working only through the Redis Software REST API or Cluster Manager UI."
    },
    {
      "id": "how-access-control-works-on-redis-software-for-kubernetes",
      "title": "How access control works on Redis Software for Kubernetes",
      "role": "content",
      "text": "You declare these `app.redislabs.com/v1alpha1` custom resources:\n\n| Resource | Scope | Purpose |\n| --- | --- | --- |\n| `RedisEnterpriseUser` | — | A Redis Software user, with credentials in a Kubernetes Secret. |\n| `RedisEnterpriseACL` | — | A Redis ACL rule, mapped to a Redis Software ACL object. |\n| `RedisEnterpriseRole` | Database | A management role and/or ACL applied to one or more REDBs selected by `spec.scopes`. |\n| `RedisEnterpriseRoleBinding` | Database | Assigns a `RedisEnterpriseRole` to a user. |\n| `RedisEnterpriseClusterRole` | Cluster | A management role and/or ACL applied across every REDB in the cluster. |\n| `RedisEnterpriseClusterRoleBinding` | Cluster | Assigns a `RedisEnterpriseClusterRole` to a user. |\n\nWhen you apply one of these resources, the operator:\n\n1. Validates the spec.\n2. Creates or updates the matching object in Redis Software.\n3. Reports the resolved Redis Software UID and other state in the resource's `status`.\n4. Emits Kubernetes events on reconciliation problems."
    },
    {
      "id": "roles-and-bindings",
      "title": "Roles and bindings",
      "role": "content",
      "text": "The role and binding CRDs follow the same pattern as Kubernetes' own RBAC: a `Role` paired with a `RoleBinding` for the narrower scope, and a `ClusterRole` paired with a `ClusterRoleBinding` for cluster-wide access. The narrower scope is the unqualified default — that's why `RedisEnterpriseRole` (no qualifier) is the database-scoped kind, while `RedisEnterpriseClusterRole` carries the explicit `Cluster` prefix."
    },
    {
      "id": "database-scope-vs-cluster-scope",
      "title": "Database scope vs. cluster scope",
      "role": "content",
      "text": "| | `RedisEnterpriseRole` | `RedisEnterpriseClusterRole` |\n| --- | --- | --- |\n| Scope | One or more REDBs | Every REDB in the cluster |\n| Selects targets via | `spec.scopes` (REDB name or label selector) — required | No selector; applies cluster-wide |\n| `managementRole` values | `DBMember`, `DBViewer`, `None` | `Admin`, `ClusterMember`, `ClusterViewer`, `DBMember`, `DBViewer`, `UserManager`, `None` |\n| Binding kind | `RedisEnterpriseRoleBinding` | `RedisEnterpriseClusterRoleBinding` |\n\nA `RedisEnterpriseClusterRole` applies to every REDB in the cluster, including REDBs represented by resources in other namespaces. The operator applies the role to each REDB individually, so it doesn't reach databases created directly through the Redis Software REST API without a matching REDB resource."
    },
    {
      "id": "what-a-role-grants",
      "title": "What a role grants",
      "role": "content",
      "text": "Every role carries permissions on two independent planes. Set either, or both:\n\n- **`spec.managementRole`** — Redis Software API and Cluster Manager UI permissions, chosen from the built-in roles listed in the table above. Same set of roles you'd assign in Cluster Manager today.\n- **`spec.acl`** — a single `RedisEnterpriseACL` reference. The ACL controls Redis data-path access (commands, key patterns, categories). To apply different data-path access to different databases, create a separate role for each."
    },
    {
      "id": "how-a-user-gets-permissions",
      "title": "How a user gets permissions",
      "role": "content",
      "text": "`RedisEnterpriseUser.spec` has no role references. Permissions reach a user through a binding:\n\n1. Create a `RedisEnterpriseACL` if you need data-path access.\n2. Create a `RedisEnterpriseRole` or `RedisEnterpriseClusterRole` that sets `managementRole`, references the ACL, or both.\n3. Create a `RedisEnterpriseRoleBinding` or `RedisEnterpriseClusterRoleBinding` whose `roleRef` points at the role and whose `subjects` list includes the user.\n\nThe user's effective roles appear in `status.roles`. A user with no binding gets the Redis Software `none` role so it's never roleless, but it has zero permissions until a binding lands."
    },
    {
      "id": "end-to-end-example",
      "title": "End-to-end example",
      "role": "content",
      "text": "End-to-end: an ACL, a database-scoped role that uses it, a binding that hands the role to a user, and the user itself. All four resources live in the operator namespace.\n\n[code example]\n\nAfter applying this and a Secret named `alice-password` with a `password` key, Alice can sign in to Redis Software with `DBViewer` permissions on the `orders` REDB and run read-only Redis commands on every key in that database."
    },
    {
      "id": "what-s-the-same-as-redis-software",
      "title": "What's the same as Redis Software",
      "role": "content",
      "text": "The underlying Redis Software behavior is unchanged. For concepts and reference details, see the existing Redis Software docs:\n\n- [Cluster-scoped role definitions](https://redis.io/docs/latest/operate/rs/security/access-control/create-cluster-roles) — what `Admin`, `ClusterMember`, `ClusterViewer`, and `UserManager` grant.\n- [Database-scoped role definitions](https://redis.io/docs/latest/operate/rs/security/access-control/create-db-roles) — what `DBMember` and `DBViewer` grant.\n- [Combined cluster and database roles](https://redis.io/docs/latest/operate/rs/security/access-control/create-combined-roles) — when a role grants both planes.\n- [Redis ACL syntax](https://redis.io/docs/latest/operate/rs/security/access-control/redis-acl-overview) — rule format for `RedisEnterpriseACL` resources.\n- [Login lockout and unlock](https://redis.io/docs/latest/operate/rs/security/access-control/manage-users/login-lockout) — how locked users are recovered.\n- [Password complexity rules](https://redis.io/docs/latest/operate/rs/security/access-control/manage-passwords/password-complexity-rules) and [password expiration](https://redis.io/docs/latest/operate/rs/security/access-control/manage-passwords/password-expiration) — applied by Redis Software regardless of how the password is delivered.\n- [Default user](https://redis.io/docs/latest/operate/rs/security/access-control/manage-users/default-user) — the built-in cluster admin account."
    },
    {
      "id": "what-s-different-on-kubernetes",
      "title": "What's different on Kubernetes",
      "role": "content",
      "text": "- **Resources are declarative.** You define users, roles, ACLs, and bindings in YAML and let the operator apply them. The Cluster Manager UI and REST API still work but are no longer the source of truth.\n- **Role assignment lives on the binding, not the user.** In Redis Software, you assign roles by editing the user. On Kubernetes, you create a separate `RedisEnterpriseRoleBinding` or `RedisEnterpriseClusterRoleBinding`. See [Roles and bindings](#roles-and-bindings).\n- **Database and cluster scope are separate objects.** A `RedisEnterpriseRole` covers database scope and a `RedisEnterpriseClusterRole` covers cluster scope. In Redis Software, a single role object carries both.\n- **Passwords live in Kubernetes Secrets.** Each `RedisEnterpriseUser` references one or more Secrets. A `Rotatable` mode supports two Secrets at once for zero-downtime rotation. The operator marks Kubernetes Secrets immutable to prevent in-place edits."
    },
    {
      "id": "known-limitations",
      "title": "Known limitations",
      "role": "content",
      "text": "Access control resources are reconciled only in the operator namespace. Password Secrets must live in the same namespace, and database scopes resolve to REDBs in that namespace."
    },
    {
      "id": "in-this-section",
      "title": "In this section",
      "role": "content",
      "text": "- [Manage users](https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-users) — create `RedisEnterpriseUser` resources, rotate passwords, recover from lockouts.\n- [Manage roles](https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-roles) — create database and cluster roles with the right scope and management permissions.\n- [Manage ACLs](https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-acls) — create and update `RedisEnterpriseACL` resources used by roles.\n- [Manage role bindings](https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-bindings) — assign roles to users with `RedisEnterpriseRoleBinding` and `RedisEnterpriseClusterRoleBinding`.\n- [Migrate from REDB rolesPermissions](https://redis.io/docs/latest/operate/kubernetes/security/access-control/migrate-rolespermissions) — move from the deprecated `RedisEnterpriseDatabase.spec.rolesPermissions` field to the new CRD model."
    },
    {
      "id": "related-topics",
      "title": "Related topics",
      "role": "related",
      "text": "- [Redis Software for Kubernetes operator API reference](https://redis.io/docs/latest/operate/kubernetes/reference/api) — field-by-field specification for every CRD in the `app.redislabs.com/v1alpha1` group.\n- [Redis databases (REDB)](https://redis.io/docs/latest/operate/kubernetes/re-databases) — the resources that role scopes resolve against."
    }
  ],
  "examples": [
    {
      "id": "end-to-end-example-ex0",
      "language": "yaml",
      "code": "---\napiVersion: app.redislabs.com/v1alpha1\nkind: RedisEnterpriseACL\nmetadata:\n  name: read-only\nspec:\n  acl: \"+@read ~*\"\n---\napiVersion: app.redislabs.com/v1alpha1\nkind: RedisEnterpriseRole\nmetadata:\n  name: orders-viewer\nspec:\n  managementRole: DBViewer\n  scopes:\n  - name: orders\n  acl:\n    name: read-only\n---\napiVersion: app.redislabs.com/v1alpha1\nkind: RedisEnterpriseRoleBinding\nmetadata:\n  name: alice-orders-viewer\nspec:\n  roleRef:\n    name: orders-viewer\n  subjects:\n  - name: alice\n---\napiVersion: app.redislabs.com/v1alpha1\nkind: RedisEnterpriseUser\nmetadata:\n  name: alice\nspec:\n  email: alice@example.com\n  username: alice\n  passwordSecrets:\n  - name: alice-password",
      "section_id": "end-to-end-example"
    }
  ]
}