K8s: RBAC feature#3385
Conversation
🛡️ Jit Security Scan Results
✅ No security findings were detected in this PR
Security scan by Jit
|
There was a problem hiding this comment.
I reviewed this PR last night while it was a draft with no reviewers assigned. I guess I was bored. Anyway, language LGTM. Therre are, however, a few bad links. Here's the output from hugo serve on your branch:
WARN [en] REF_NOT_FOUND: Ref "/operate/kubernetes/security/access-control/manage-users": "/Users/david.dougherty/src/docs/content/operate/kubernetes/security/access-control/_index.md:63:18": page not found
WARN [en] REF_NOT_FOUND: Ref "/operate/kubernetes/security/access-control/manage-roles": "/Users/david.dougherty/src/docs/content/operate/kubernetes/security/access-control/_index.md:64:18": page not found
WARN [en] REF_NOT_FOUND: Ref "/operate/kubernetes/security/access-control/manage-acls": "/Users/david.dougherty/src/docs/content/operate/kubernetes/security/access-control/_index.md:65:17": page not found
WARN [en] REF_NOT_FOUND: Ref "/operate/kubernetes/security/access-control/manage-bindings": "/Users/david.dougherty/src/docs/content/operate/kubernetes/security/access-control/_index.md:66:26": page not found
WARN [en] REF_NOT_FOUND: Ref "/operate/kubernetes/security/access-control/migrate-rolespermissions": "/Users/david.dougherty/src/docs/content/operate/kubernetes/security/access-control/_index.md:67:40": page not found
I'll go ahead and approve so you're not held up.
Postscript: You'll probably want to add the other two reviewers back now that I've approved. Sorry!
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 69897e2. Configure here.
|
|
zcahana
left a comment
zcahana
left a comment
There was a problem hiding this comment.
Thanks @kaitlynmichael. This documentation looks great.
I've made a partial review so far - I still have a couple of more pages to go through - but figured I'll already send the first batch of comments. I'll make sure to complete this soon.
|
|
||
| ## Before you start | ||
|
|
||
| - Requires Redis Software for Kubernetes operator 8.0.24-TBD or later. |
There was a problem hiding this comment.
Do we have a mechanism (or a Jira) to un-TBD this?
There was a problem hiding this comment.
We will once I know the version number for Duckburg
| kubectl get redisenterpriseuser alice -o jsonpath='{.status.username}' | ||
| ``` | ||
|
|
||
| Use that value when you reference the user from a binding's `subjects` list or when you sign in to Redis Software. |
There was a problem hiding this comment.
"when you sign in to Redis Software" - yes.
"when you reference the user from a binding's subjects list" - no. In that case, the CR name (RedisEnterpriseUser.metadata.name) should be used.
There was a problem hiding this comment.
Being a primary use case, maybe we should extend this to also mention that the username is what you use when authenticating to a database connection. Something like: "Use that value when you connect to a database or sign in to Redis Software".
| | `RedisEnterpriseRole` | `DBMember`, `DBViewer`, `None` | | ||
| | `RedisEnterpriseClusterRole` | `Admin`, `ClusterMember`, `ClusterViewer`, `DBMember`, `DBViewer`, `UserManager`, `None` | | ||
|
|
||
| `None` grants no management permissions and is the default when `managementRole` is omitted. For what each Redis Software role grants, see [Cluster-scoped role definitions]({{< relref "/operate/rs/security/access-control/create-cluster-roles" >}}) and [Database-scoped role definitions]({{< relref "/operate/rs/security/access-control/create-db-roles" >}}). |
There was a problem hiding this comment.
The Database-scoped role definitions link is more about datapath-access to databases; It is not really about database-scoped management roles (new upcoming feature, also in RS). I'm not sure whether these already have docs... but if it does, then this should probably link to it.
There was a problem hiding this comment.
@kaitlynmichael do you think we should keep the current link?
There was a problem hiding this comment.
Another migration aspect (besides migrating from the deprecated rolesPermissions), is the use of "internal object references". See here for relevant information about this. Let's consider expanding the scope of this page to cover both migration aspects (and/or, maybe, mention in each of the role/binding pages?)
zcahana
left a comment
zcahana
left a comment
There was a problem hiding this comment.
Approved, although I've made a few additional suggestions - please take a look at the comments.
|
|
||
| You don't have to recreate every database, ACL, and role as a custom resource. When an object was created directly through the Redis Software REST API or Cluster Manager UI, a CRD reference can point at it by name using an internal kind, so you can bring it under CRD-managed bindings without redefining it: | ||
|
|
||
| | Field | Internal kind | References | |
There was a problem hiding this comment.
Might be useful to add another (leftmost?) column, specifying for which CRD(s) this applies:
RedisEnterpriseRole|scopes[].kind|bdb|RedisEnterpriseRoleandRedisEnterpriseClusterRole|acl.kind|redis_acl|RedisEnterpriseRoleBindingandRedisEnterpriseClusterRoleBinding|roleRef.kind|role|
| | `acl.kind` | `redis_acl` | An internal Redis Software ACL by name. | | ||
| | `roleRef.kind` | `role` | An internal Redis Software role by name, from a binding. | | ||
|
|
||
| The reference resolves by name against the existing Redis Software object. Use internal references to migrate assignments incrementally, then replace them with full `RedisEnterpriseDatabase`, `RedisEnterpriseACL`, and `RedisEnterpriseRole` resources as you bring each object under the CRD model. |
There was a problem hiding this comment.
Also consider adding an example; See some here: https://github.com/redis-rnd-sandbox/k8s-operator-rbac-demo/tree/main/07-migration
|
|
||
| You can run both sources in parallel during migration. Once every database is completely migrated, disable the deprecated field cluster-wide (see [Disable the deprecated field](#disable-the-deprecated-field)). | ||
|
|
||
| ## Reference existing Redis Software objects |
There was a problem hiding this comment.
Do you think this page merits a rename (and possibly a slight restructure), given that it now describes two separate migration aspects - referencing existing RS objects, and migrating from REDB RolesPermissions?
Maybe could be titled "Migrate to CRD-based access control".
|
|
||
| Watch reconciliation events with `kubectl describe redisenterpriserole <name>` (or `redisenterpriseclusterrole`). Common issues: | ||
|
|
||
| - **`status.uid` is empty** — The role hasn't reconciled. Check the events. Common causes: an ACL reference points to a non-existent `RedisEnterpriseACL`, or admission rejected the spec (missing scopes, scope with both `name` and `selector`, wrong `kind`). |
There was a problem hiding this comment.
These "Common causes" are incorrect or inaccurate.
I'd just rephrase to something like:
The role hasn't reconciled, or Redis Software rejected the role. Check events and/or logs.
|
Merging as-is for the Redis Software for Kubernetes 8.2.0 GA, per the sprint-review decision (2026-07-20) that the remaining review threads are non-blocking. The 11 open review threads on this PR (all from @zcahana) are tracked for post-GA resolution in DOC-6869: https://redislabs.atlassian.net/browse/DOC-6869 They cover:
No action needed before merge; these are deferred to DOC-6869. |
4 participants
Note
Low Risk
Documentation-only changes (new pages, moved paths, relrefs); no application code or runtime behavior.
Overview
Adds Kubernetes-native RBAC documentation for Redis Software on Kubernetes: users, ACLs, database- and cluster-scoped roles, and role bindings as
app.redislabs.com/v1alpha1CRDs, plus a migration guide from deprecatedRedisEnterpriseDatabase.spec.rolesPermissions(includingallowREDBRolesPermissionson the REC).Reorganizes the security section into Access control, Authentication (
manage-rec-credentials, LDAP, SSO, configuration secrets), and Certificates and encryption (cert-manager, client certs, internode encryption). Moved pages keep Hugo aliases so old URLs still resolve; cross-links are updated across operate/kubernetes and the operate product comparison table.Reviewed by Cursor Bugbot for commit afd3434. Bugbot is set up for automated code reviews on this repo. Configure here.