K8s: RBAC yaml examples [PARKED]

[kaitlynmichael]

Adds a YAML examples page for RBAC access control, covering all six RBAC custom resources (REACL, REUSER, REROLE, RECROLE, REROLEBINDING, RECROLEBINDING).

The reference/yaml/ section is the established home for generated CRD example embeds — no API reference page carries examples, so this follows the existing pattern rather than making the RBAC reference pages an exception.

Changes

• New page reference/yaml/access-control.md (weight 50), structured in dependency order: ACLs → users → roles → cluster roles → role bindings → cluster role bindings.
• Eight embeds in content/embeds/k8s/, generated with the sync workflow's own formatYamlSnippet function so they are byte-identical to what the next API sync will emit.
• reference/yaml/_index.md — added to the example-categories list.
• log-collector-rbac.md — weight 50 → 60 to make room.

Not in this PR, deliberately: the eight formatYamlSnippet lines for .github/workflows/k8s_apis_sync.yaml. See the manifest checklist — landing them before the upstream change ships would silently corrupt the embeds.

---

⛔ Do not merge yet

This page's examples depend on redis-enterprise-operator#6768, which is open and unmerged. That PR makes the RBAC example manifests reference resources that actually exist; before it, four cross-references dangle (some-db, some-db-user, some-admin-user, full-access), and two of the files embedded here don't exist upstream at all.

Merging to main auto-publishes. Hold until #6768 has merged and shipped in a released operator tag.

Park manifest

Ticket: DOC-6865
Parked at: 2026-07-28
Trigger to pick up: operator PR redislabsdev/redis-enterprise-operator#6768 merged into master and present in a released operator tag newer than v8.2.0-12 — testably, a tag where deploy/examples/v1alpha1/reacl_full_access.yaml and reuser_admin.yaml both exist.
Labels: parked, do not merge yet

Pinned sources (state observed at park time)

Source	URL	State at park time	Re-fetch
Operator PR (the blocker)	https://github.com/redislabsdev/redis-enterprise-operator/pull/6768	state: open, merged: false, draft: false, head_sha: 45a6f85e2a49385f350927724510ffb1a2d4aa67, base: master, milestone: null, mergeable_state: blocked, changed_files: 5, updated_at: 2026-07-28T19:49:25Z	gh api repos/RedisLabsDev/redis-enterprise-operator/pulls/6768 --jq '{state, merged, head_sha: .head.sha, base: .base.ref, milestone: .milestone.title, updated_at}'
Operator released baseline	tag v8.2.0-12 (Duckburg GA)	Newest v8.2.* tag at park time. Contains the pre-fix examples with the four dangling references.	git -C <operator> fetch --tags && git tag | grep -E '^v8\.2\.' | sort -V | tail -1

Example-file blob SHAs at v8.2.0-12 — the pre-change baseline. On unpark, diff the shipped tag's files against these; any row that changed needs its embed regenerated.

File (deploy/examples/v1alpha1/)	blob SHA at v8.2.0-12
reacl.yaml	1d4022de7513866f4eefadecd2ff88c06c3ebe02
reacl_full_access.yaml	absent (added by #6768)
reuser.yaml	e9bdb984a9231236a1a745efe356e9c535fcfa5d (modified by #6768)
reuser_admin.yaml	absent (added by #6768)
rerole.yaml	ebe22de6726d2faf56cb388c0d5adf1a908faa71 (modified by #6768)
recrole.yaml	ee92bba9c4e32c54f2f3f43d8fb114573d3863b6 (unchanged by #6768)
rerolebinding.yaml	bbc9dbb4c6126a03e2ba30ac82dc629daa99392c (unchanged by #6768)
recrolebinding.yaml	e9146383d267582381241e0b2c609334d2c42c90 (unchanged by #6768)

Re-fetch a single blob: git -C <operator> rev-parse <tag>:deploy/examples/v1alpha1/<file>

Observed shape the page assumes

Two different confidence levels apply here, and conflating them would mislead unpark.

CRD field shape and semantics — HIGH. All six RBAC CRDs are GA in Duckburg 8.2.0; nothing on this page documents unreleased behavior. Verified directly against deploy/crds/*_crd.yaml at v8.2.0-12 and the generated API reference pages:

• RedisEnterpriseRole.spec.managementRole enum is database-scoped only: DBMember, DBViewer, None; defaults to None when omitted.
• RedisEnterpriseClusterRole.spec.managementRole enum is the full set: Admin, ClusterMember, ClusterViewer, DBMember, DBViewer, UserManager, None.
• RedisEnterpriseUser.spec has no required fields; email and username are both optional, and an omitted username is assigned by the operator and surfaced in status.
• Bindings reference users by resource name (metadata.name), not spec.username.
• Anchors used in field links (#spec, #specacl, #specscopes, #specroleref, #specsubjects, #specpasswordsecrets) all exist on the generated pages; npx hugo exits 0.

Example manifest content (names, filenames, values) — LOW. #6768 is unmerged and its content has already shifted once during drafting (user emails changed from @some-company.com to @example.com, and a password-key comment was added). Specifically provisional:

• Filenames reacl_full_access.yaml and reuser_admin.yaml — the embed filenames and the future workflow lines both hard-code these.
• Resource names full-access, some-db-user, some-admin-user, and rerole's scope target redb.
• The +@all ~* ACL expression (the integration suite uses the equivalent ~* +@all).

Deliberate decision — no bannerText on the page. The park skill suggests a "not yet released / subject to change" banner, and this page intentionally does not have one. Every manifest embedded here is valid against the current GA release, and all six CRDs shipped in 8.2.0 — what's pending is only whether the operator repo ships two of them as example files. A "not yet released" banner would misinform readers about GA functionality and conflicts with documenting current behavior only. Do not add one on unpark.

Re-check checklist

Note: the branch's single commit carries no /reflect trailers (no body), so this checklist is seeded from the drafting analysis rather than harvested trailers.

• HIGHEST RISK — Add the eight formatYamlSnippet lines to .github/workflows/k8s_apis_sync.yaml, and only once the change is in a released tag. The step has no set -e, so formatYamlSnippet on a missing file exits 0 and writes an empty ```yaml fence. Landing the lines early would blank reacl_full_access.md and `reuser_admin.md`, and revert `reuser.md`/`rerole.md` to the dangling names — with CI green.
• HIGH RISK — Re-diff all eight embeds in content/embeds/k8s/ against the shipped tag. If any blob SHA differs from the table above (beyond the predicted changes), regenerate that embed with the workflow's formatYamlSnippet, not by hand.
• HIGH RISK — Confirm #6768 merged without renaming reacl_full_access.yaml or reuser_admin.yaml. Both embed filenames and the workflow lines hard-code them.
• HIGH RISK — open SME question (@zcahana, asked in #docs-k8s 2026-07-28). Does Redis Software reject creating a redis_acl whose rule duplicates a built-in ACL? The new full-access example uses +@all ~*, which matches the built-in Full Access. Not verifiable without a live cluster. If it does reject: the fix widens beyond #6768 — the pre-existing read-only example (+@read ~*) has the same problem, and on the docs side this page's prose plus the reacl.md and reacl_full_access.md embeds all change. Resolve before unparking.
• Confirm the four previously-dangling references resolve in the shipped examples: rerole → redb + read-only; recrole → full-access; rerolebinding → some-db-user; recrolebinding → some-admin-user.
• Confirm user emails are still @example.com (already changed once mid-draft).
• Verify the OLM CSV alm-examples still matches deploy/examples/ — no tooling syncs the two, and that drift is the root cause of the original bug. Note redb.yaml sets replication: false while the CSV sets replication: true; pre-existing, left alone.
• Re-verify the page's dependency/apply-order claim and the cross-reference summary table against the shipped examples.
• Re-run npx hugo — confirm exit 0, all eight embeds render, and no empty code fences.
• Check whether the operator team asked for a RED ticket on #6768; if so, note it on DOC-6865.
• Decide separately whether the 22 hand-authored YAML blocks in security/access-control/ should switch to these embeds. Out of scope here; they're pedagogically sequenced for their procedures and may be better hand-maintained.

On unpark, then

Run /unpark 3724. It re-fetches each pinned source, diffs against the snapshots above, reports what changed versus what was predicted, reconciles the docs, and then takes this PR through the normal /reflect → /finalize pipeline. /finalize is deferred until then — the episodic notes must survive until the source settles. The do not merge yet guard holds until /finalize completes.

[github-actions]

Staging links:
https://redis.io/docs/staging/DOC-6865/operate/kubernetes/reference/yaml/
https://redis.io/docs/staging/DOC-6865/operate/kubernetes/reference/yaml/access-control
https://redis.io/docs/staging/DOC-6865/operate/kubernetes/reference/yaml/access-control/
https://redis.io/docs/staging/DOC-6865/operate/kubernetes/reference/yaml/log-collector-rbac/

[github-actions]

🧠 Redis Memory

No related prior context found — this looks new to the repository's memory.

Memory updated at ab8d3f7

[github-actions]

DOC-6865

[zcahana]

LGTM