K8s: RBAC yaml examples [PARKED]

content/embeds/k8s/reacl.md

@@ -0,0 +1,11 @@
+```yaml
+apiVersion: app.redislabs.com/v1alpha1
+kind: RedisEnterpriseACL
+metadata:
+  name: read-only
+  labels:
+    app: redis-enterprise
+spec:
+  # Example ACL expression granting read-only access to all keys.
+  acl: +@read ~*
+```

content/embeds/k8s/reacl_full_access.md

@@ -0,0 +1,11 @@
+```yaml
+apiVersion: app.redislabs.com/v1alpha1
+kind: RedisEnterpriseACL
+metadata:
+  name: full-access
+  labels:
+    app: redis-enterprise
+spec:
+  # Example ACL expression granting full access to all keys.
+  acl: +@all ~*
+```

content/embeds/k8s/recrole.md

@@ -0,0 +1,18 @@
+```yaml
+apiVersion: app.redislabs.com/v1alpha1
+kind: RedisEnterpriseClusterRole
+metadata:
+  name: cluster-admin
+  labels:
+    app: redis-enterprise
+spec:
+  # One of: 
+  # Admin, UserManager, ClusterMember, ClusterViewer,
+  # DBMember, DBViewer, None.
+  managementRole: Admin
+
+  # An optional ACL that applies to all databases in the cluster.
+  acl:
+    kind: RedisEnterpriseACL
+    name: full-access
+```

content/embeds/k8s/recrolebinding.md

@@ -0,0 +1,19 @@
+```yaml
+apiVersion: app.redislabs.com/v1alpha1
+kind: RedisEnterpriseClusterRoleBinding
+metadata:
+  name: cluster-admin
+  labels:
+    app: redis-enterprise
+spec:
+  # A reference to a RedisEnterpriseClusterRole object.
+  roleRef:
+    kind: RedisEnterpriseClusterRole
+    name: cluster-admin
+
+  # A reference to one or more RedisEnterpriseUser objects,
+  # or other kinds of subjects.
+  subjects:
+  - kind: RedisEnterpriseUser
+    name: some-admin-user
+```

content/embeds/k8s/rerole.md

@@ -0,0 +1,22 @@
+```yaml
+apiVersion: app.redislabs.com/v1alpha1
+kind: RedisEnterpriseRole
+metadata:
+  name: db-reader
+  labels:
+    app: redis-enterprise
+spec:
+  # One of: 
+  # DBMember, DBViewer, None.
+  managementRole: DBViewer
+
+  # The scopes (databases) for which this role grants dataplane access to.
+  scopes:
+  - kind: RedisEnterpriseDatabase
+    name: redb
+
+  # The dataplane permissions (ACL) granted by this role.
+  acl:
+    kind: RedisEnterpriseACL
+    name: read-only
+```

content/embeds/k8s/rerolebinding.md

@@ -0,0 +1,19 @@
+```yaml
+apiVersion: app.redislabs.com/v1alpha1
+kind: RedisEnterpriseRoleBinding
+metadata:
+  name: db-reader
+  labels:
+    app: redis-enterprise
+spec:
+  # A reference to a RedisEnterpriseRole object.
+  roleRef:
+    kind: RedisEnterpriseRole
+    name: db-reader
+
+  # A reference to one or more RedisEnterpriseUser objects,
+  # or other kinds of subjects.
+  subjects:
+  - kind: RedisEnterpriseUser
+    name: some-db-user
+```

content/embeds/k8s/reuser.md

@@ -0,0 +1,19 @@
+```yaml
+apiVersion: app.redislabs.com/v1alpha1
+kind: RedisEnterpriseUser
+metadata:
+  name: some-db-user
+  labels:
+    app: redis-enterprise
+spec:
+  # The email address for the user.
+  email: some-db-user@example.com
+
+  # The username associated with the user.
+  username: some-db-user
+
+  # Names of one or more secrets holding the user's password.
+  # Each secret must have a key named 'password'.
+  passwordSecrets:
+  - name: some-db-user-secret
+```

content/embeds/k8s/reuser_admin.md

@@ -0,0 +1,19 @@
+```yaml
+apiVersion: app.redislabs.com/v1alpha1
+kind: RedisEnterpriseUser
+metadata:
+  name: some-admin-user
+  labels:
+    app: redis-enterprise
+spec:
+  # The email address for the user.
+  email: some-admin-user@example.com
+
+  # The username associated with the user.
+  username: some-admin-user
+
+  # Names of one or more secrets holding the user's password.
+  # Each secret must have a key named 'password'.
+  passwordSecrets:
+  - name: some-admin-user-secret
+```

content/operate/kubernetes/reference/yaml/_index.md

@@ -72,6 +72,7 @@ kubectl get events --sort-by=.metadata.creationTimestamp
 - [Rack awareness examples]({{< relref "/operate/kubernetes/reference/yaml/rack-awareness" >}}) - Rack-aware cluster configuration and required RBAC
 - [Active-Active examples]({{< relref "/operate/kubernetes/reference/yaml/active-active" >}}) - Multi-cluster Active-Active database setup
 - [Multi-namespace examples]({{< relref "/operate/kubernetes/reference/yaml/multi-namespace" >}}) - Cross-namespace operator and cluster configurations
+- [Access control examples]({{< relref "/operate/kubernetes/reference/yaml/access-control" >}}) - Users, roles, role bindings, and ACLs for role-based access control
 - [Log collector RBAC examples]({{< relref "/operate/kubernetes/reference/yaml/log-collector-rbac" >}}) - RBAC permissions for log collection in restricted and all modes
 
 ## Best practices

content/operate/kubernetes/reference/yaml/access-control.md

@@ -0,0 +1,145 @@
+---
+Title: Access control examples
+alwaysopen: false
+categories:
+- docs
+- operate
+- kubernetes
+description: YAML examples for managing Redis Software users, roles, role bindings, and ACLs with custom resources.
+linkTitle: Access control
+weight: 50
+---
+
+This page provides YAML examples for role-based access control (RBAC) in Redis Software for Kubernetes. These custom resources let you manage users, roles, and data access permissions declaratively, instead of configuring them through the Redis Software admin console or REST API.
+
+For task instructions, see [Access control]({{< relref "/operate/kubernetes/security/access-control" >}}).
+
+## Applying the configuration
+
+Apply these resources in dependency order. Roles reference ACLs and databases, and bindings reference roles and users, so a resource that points at something not yet created stays unreconciled until it exists.
+
+1. ACLs and users, in any order
+2. Roles and cluster roles
+3. Role bindings and cluster role bindings
+
+```sh
+kubectl apply -f <filename>
+```
+
+The examples on this page form one working configuration. Together they grant a read-only user access to a single database, and an admin user full access to the cluster:
+
+| Resource | Name | Grants |
+|---|---|---|
+| `RedisEnterpriseACL` | `read-only` | Read commands on all keys |
+| `RedisEnterpriseACL` | `full-access` | All commands on all keys |
+| `RedisEnterpriseUser` | `some-db-user` | — |
+| `RedisEnterpriseUser` | `some-admin-user` | — |
+| `RedisEnterpriseRole` | `db-reader` | `DBViewer` on database `redb`, with the `read-only` ACL |
+| `RedisEnterpriseClusterRole` | `cluster-admin` | `Admin` across the cluster, with the `full-access` ACL |
+| `RedisEnterpriseRoleBinding` | `db-reader` | Binds `db-reader` to `some-db-user` |
+| `RedisEnterpriseClusterRoleBinding` | `cluster-admin` | Binds `cluster-admin` to `some-admin-user` |
+
+The role example scopes access to a database named `redb`, which the [basic deployment examples]({{< relref "/operate/kubernetes/reference/yaml/basic-deployment" >}}) create. Change the name to match your own database.
+
+## ACL examples
+
+A RedisEnterpriseACL defines data access permissions using [Redis ACL syntax]({{< relref "/operate/oss_and_stack/management/security/acl" >}}). Roles reference an ACL to grant those permissions to their subjects.
+
+`redis-enterprise-acl.yaml` grants read-only access to all keys.
+
+{{<embed-yaml "k8s/reacl.md" "redis-enterprise-acl.yaml">}}
+
+`redis-enterprise-acl-full-access.yaml` grants all commands on all keys.
+
+{{<embed-yaml "k8s/reacl_full_access.md" "redis-enterprise-acl-full-access.yaml">}}
+
+### REACL configuration
+
+- [spec.acl]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_acl_api#spec" >}}): The ACL expression that defines which commands and keys the ACL permits
+
+## User examples
+
+A RedisEnterpriseUser creates a user in the Redis Software cluster. The user has no permissions until a role binding assigns a role to it.
+
+`redis-enterprise-user.yaml` creates the database user.
+
+{{<embed-yaml "k8s/reuser.md" "redis-enterprise-user.yaml">}}
+
+`redis-enterprise-user-admin.yaml` creates the admin user.
+
+{{<embed-yaml "k8s/reuser_admin.md" "redis-enterprise-user-admin.yaml">}}
+
+### REUSER configuration
+
+- [spec.username]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_user_api#spec" >}}): The username used to connect to a database or sign in to Redis Software. Must be unique within the cluster. If you omit it, the operator assigns a default username, reported in the resource's status.
+- [spec.email]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_user_api#spec" >}}): The user's email address. Optional.
+- [spec.passwordSecrets]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_user_api#specpasswordsecrets" >}}): One or more secrets holding the user's password. Each secret must have a key named `password`.
+
+Create the referenced secret before you apply the user. When a binding's `subjects` list refers to this user, it uses the resource name in `metadata.name`, not `spec.username`.
+
+## Role examples
+
+A RedisEnterpriseRole grants database-scoped permissions. It combines a management role, the databases it applies to, and an optional ACL for data access.
+
+`redis-enterprise-role.yaml` grants read-only access to a single database.
+
+{{<embed-yaml "k8s/rerole.md" "redis-enterprise-role.yaml">}}
+
+### REROLE configuration
+
+- [spec.managementRole]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_role_api#spec" >}}): The management permissions this role grants. RedisEnterpriseRole supports only database-scoped roles: `DBMember`, `DBViewer`, or `None`. Defaults to `None` if omitted.
+- [spec.scopes]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_role_api#specscopes" >}}): The databases this role applies to. Reference them by name, or select them with a label selector.
+- [spec.acl]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_role_api#specacl" >}}): The data access permissions the role grants within those databases
+
+## Cluster role examples
+
+A RedisEnterpriseClusterRole grants permissions across the whole cluster rather than specific databases. Its ACL, if set, applies to every database in the cluster.
+
+`redis-enterprise-cluster-role.yaml` grants full administrative access.
+
+{{<embed-yaml "k8s/recrole.md" "redis-enterprise-cluster-role.yaml">}}
+
+### RECROLE configuration
+
+- [spec.managementRole]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_role_api#spec" >}}): The management permissions this role grants. Cluster roles support the full set: `Admin`, `UserManager`, `ClusterMember`, `ClusterViewer`, `DBMember`, `DBViewer`, or `None`. Defaults to `None` if omitted.
+- [spec.acl]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_role_api#specacl" >}}): The data access permissions the role grants across all databases in the cluster. Optional.
+
+## Role binding examples
+
+A RedisEnterpriseRoleBinding assigns a RedisEnterpriseRole to one or more subjects.
+
+`redis-enterprise-role-binding.yaml` binds the `db-reader` role to the database user.
+
+{{<embed-yaml "k8s/rerolebinding.md" "redis-enterprise-role-binding.yaml">}}
+
+### REROLEBINDING configuration
+
+- [spec.roleRef]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_role_binding_api#specroleref" >}}): The RedisEnterpriseRole this binding assigns
+- [spec.subjects]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_role_binding_api#specsubjects" >}}): The users the role is assigned to, referenced by resource name
+
+## Cluster role binding examples
+
+A RedisEnterpriseClusterRoleBinding assigns a RedisEnterpriseClusterRole to one or more subjects.
+
+`redis-enterprise-cluster-role-binding.yaml` binds the `cluster-admin` role to the admin user.
+
+{{<embed-yaml "k8s/recrolebinding.md" "redis-enterprise-cluster-role-binding.yaml">}}
+
+### RECROLEBINDING configuration
+
+- [spec.roleRef]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_role_binding_api#specroleref" >}}): The RedisEnterpriseClusterRole this binding assigns
+- [spec.subjects]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_role_binding_api#specsubjects" >}}): The users the role is assigned to, referenced by resource name
+
+## Related documentation
+
+- [Access control]({{< relref "/operate/kubernetes/security/access-control" >}})
+- [Manage users]({{< relref "/operate/kubernetes/security/access-control/manage-users" >}})
+- [Manage roles]({{< relref "/operate/kubernetes/security/access-control/manage-roles" >}})
+- [Manage ACLs]({{< relref "/operate/kubernetes/security/access-control/manage-acls" >}})
+- [Manage bindings]({{< relref "/operate/kubernetes/security/access-control/manage-bindings" >}})
+- [REACL API reference]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_acl_api" >}})
+- [REUSER API reference]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_user_api" >}})
+- [REROLE API reference]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_role_api" >}})
+- [RECROLE API reference]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_role_api" >}})
+- [REROLEBINDING API reference]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_role_binding_api" >}})
+- [RECROLEBINDING API reference]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_role_binding_api" >}})

content/operate/kubernetes/reference/yaml/log-collector-rbac.md

@@ -7,7 +7,7 @@ categories:
 - kubernetes
 description: YAML examples for configuring RBAC permissions for the Redis Enterprise log collector tool in `restricted` and `all` modes.
 linkTitle: Log collector RBAC
-weight: 50
+weight: 60
 ---
 
 This page provides YAML examples for configuring RBAC permissions for the Redis Enterprise log collector tool. The log collector requires different permission levels depending on the collection mode you choose.