{
  "id": "manage-acls",
  "title": "Manage ACLs",
  "url": "https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-acls/",
  "summary": "Create and update RedisEnterpriseACL resources to control Redis data-path permissions on Kubernetes.",
  "tags": [
    "docs",
    "operate",
    "kubernetes"
  ],
  "last_updated": "2026-07-24T10:52:10-07:00",
  "page_type": "content",
  "content_hash": "a2265865f0553e8c7d4a6bbd80b1dbca872d4caf1e7d00d605bc261ccc6557c6",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "A `RedisEnterpriseACL` resource holds a Redis ACL rule that controls which commands, keys, and categories a user can access at the Redis data path. The operator reconciles the resource into a Redis Software ACL object that roles can reference.\n\nACLs are reusable: one `RedisEnterpriseACL` can be attached to any number of `RedisEnterpriseRole` or `RedisEnterpriseClusterRole` resources. The role decides which databases the ACL applies to; the ACL itself just defines the rule.\n\nTo grant a user the permissions in an ACL, reference the ACL from a role and bind the role to the user. See [Manage roles](https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-roles) and [Manage role bindings](https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-bindings)."
    },
    {
      "id": "before-you-start",
      "title": "Before you start",
      "role": "content",
      "text": "- Requires Redis Software for Kubernetes operator 8.2.0-12 or later.\n- The `RedisEnterpriseACL` resource must live in the operator namespace.\n- The rule string uses Redis ACL syntax — key patterns, command categories, and explicit commands. See [Redis ACL overview](https://redis.io/docs/latest/operate/rs/security/access-control/redis-acl-overview) for the full syntax."
    },
    {
      "id": "create-an-acl",
      "title": "Create an ACL",
      "role": "content",
      "text": "`spec.acl` is a single Redis ACL rule string.\n\n[code example]\n\nApply the resource and confirm reconciliation:\n\n[code example]\n\n`status.uid` holds the Redis Software ACL UID once the operator has created the object."
    },
    {
      "id": "common-rule-patterns",
      "title": "Common rule patterns",
      "role": "content",
      "text": "| Use case | Rule |\n| --- | --- |\n| Read-only access to all keys | `+@read ~*` |\n| Read and write access to all keys | `+@all ~*` |\n| Read-only access to a key prefix | `+@read ~customer:*` |\n| A specific command set | `+get +set +del ~app:*` |\n| Block dangerous commands | `+@all -@dangerous ~*` |\n\nFor category names (`@read`, `@write`, `@admin`, `@dangerous`, etc.) and the full operator precedence rules, see [Redis ACL overview](https://redis.io/docs/latest/operate/rs/security/access-control/redis-acl-overview)."
    },
    {
      "id": "update-an-acl",
      "title": "Update an ACL",
      "role": "content",
      "text": "Edit `spec.acl` and re-apply. The operator updates the Redis Software ACL object in place, so the change immediately affects every database that uses the ACL through a role.\n\n[code example]\n\n`status.observedGeneration` reaches the resource's `metadata.generation` once the update has been applied.\n\nAn update changes effective permissions for every connected user. Treat ACL changes the same way as role changes: validate them on a non-production cluster first. For a safer rollout, create a new ACL and swap the role reference instead of editing the existing ACL in place."
    },
    {
      "id": "inspect-acl-status",
      "title": "Inspect ACL status",
      "role": "content",
      "text": "The `status` block is minimal:\n\n| Field | Meaning |\n| --- | --- |\n| `uid` | Internal Redis Software ACL UID. Present once reconciliation succeeds. |\n| `observedGeneration` | The `metadata.generation` the operator last acted on. |\n\nTo find roles that reference this ACL, scan the role resources:\n\n[code example]"
    },
    {
      "id": "delete-an-acl",
      "title": "Delete an ACL",
      "role": "content",
      "text": "Delete or modify any roles that reference the ACL first (modify them to no longer reference it), then delete the ACL itself:\n\n[code example]\n\nIf a role still references the ACL, Redis Software may reject the deletion. The operator emits an `RSOperationFailed` event with the underlying message. Remove the reference (or delete the role) and retry."
    },
    {
      "id": "troubleshoot",
      "title": "Troubleshoot",
      "role": "errors",
      "text": "Watch reconciliation events with `kubectl describe redisenterpriseacl <name>`. Common events:\n\n| Event | Meaning |\n| --- | --- |\n| `RSObjectNotFound` | The Redis Software ACL the resource previously resolved against no longer exists. The operator will recreate it on the next reconcile. |\n| `RSOperationFailed` | A Redis Software API call failed. The message typically includes the syntax error or in-use conflict. |\n\nOther things to check:\n\n- **`status.uid` is empty** — The operator hasn't reconciled the ACL yet, or Redis Software rejected the rule. Check the events for an `RSOperationFailed` with the syntax message.\n- **Rule parses but grants nothing** — A common cause is an explicit `-@all` later in the rule overriding earlier `+` clauses. Redis ACL evaluation is order-sensitive; see the [Redis ACL overview](https://redis.io/docs/latest/operate/rs/security/access-control/redis-acl-overview).\n- **Delete is blocked** — A `RedisEnterpriseRole` or `RedisEnterpriseClusterRole` still references the ACL in `spec.acl`. Remove the reference or delete the role first.\n\nFor full field details, see the [`RedisEnterpriseACL`](https://redis.io/docs/latest/operate/kubernetes/reference/api/redis_enterprise_acl_api) API reference."
    },
    {
      "id": "related-topics",
      "title": "Related topics",
      "role": "related",
      "text": "- [Redis ACL overview](https://redis.io/docs/latest/operate/rs/security/access-control/redis-acl-overview) — rule syntax, categories, and evaluation order.\n- [Manage roles](https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-roles) — attach ACLs to `RedisEnterpriseRole` and `RedisEnterpriseClusterRole` resources.\n- [Manage role bindings](https://redis.io/docs/latest/operate/kubernetes/security/access-control/manage-bindings) — grant the role to a user."
    }
  ],
  "examples": [
    {
      "id": "create-an-acl-ex0",
      "language": "yaml",
      "code": "apiVersion: app.redislabs.com/v1alpha1\nkind: RedisEnterpriseACL\nmetadata:\n  name: read-only\nspec:\n  acl: \"+@read ~*\"",
      "section_id": "create-an-acl"
    },
    {
      "id": "create-an-acl-ex1",
      "language": "sh",
      "code": "kubectl apply -f read-only-acl.yaml\nkubectl get redisenterpriseacl read-only -o yaml",
      "section_id": "create-an-acl"
    },
    {
      "id": "update-an-acl-ex0",
      "language": "sh",
      "code": "kubectl edit redisenterpriseacl read-only",
      "section_id": "update-an-acl"
    },
    {
      "id": "inspect-acl-status-ex0",
      "language": "sh",
      "code": "kubectl get redisenterpriserole -o yaml | \\\n  yq '.items[] | select(.spec.acl.name == \"read-only\") | .metadata.name'\nkubectl get redisenterpriseclusterrole -o yaml | \\\n  yq '.items[] | select(.spec.acl.name == \"read-only\") | .metadata.name'",
      "section_id": "inspect-acl-status"
    },
    {
      "id": "delete-an-acl-ex0",
      "language": "sh",
      "code": "kubectl delete redisenterpriseacl read-only",
      "section_id": "delete-an-acl"
    }
  ]
}