RS: Document JWT token invalidation on upgrade to 8.0.22 and later

content/operate/rs/release-notes/rs-8-2-releases/rs-8-2-0-25.md

@@ -177,6 +177,10 @@ Redis Software version 8.2.0 introduces the following breaking changes:
 
     - Existing functionality for listing, deleting, and loading modules is unchanged.
 
+### JWT token invalidation on upgrade
+
+To improve system security, the JWT signing secret has changed in version 8.0.22 and later. As a result, upgrading invalidates all previously issued JWT tokens, which must be regenerated. Tokens used programmatically within the cluster are regenerated automatically. Cluster Manager users must sign out and sign in again, or wait for their session or token to expire.
+
 ### Reserved ports
 
 Make sure the following ports are open before upgrading Redis Software.
@@ -312,6 +316,14 @@ For Active-Active databases running Redis database version 8.4, the `ACKED` opti
 
 Due to module handling changes introduced in Redis Software version 8.0, upgrading a cluster that contains custom or deprecated modules, such as RedisGraph and RedisGears v2, can become stuck when adding a new node to the cluster during a rolling upgrade.
 
+#### Cluster Manager sign-outs and false "down" status during an Active-Active upgrade
+
+While an Active-Active database has participating clusters running different Redis Software versions, the Cluster Manager UI on an upgraded cluster can sign users out intermittently and show a participating cluster as down, even though replication is active and the syncers are connected.
+
+This affects the Cluster Manager UI only. It's caused by a JWT signing-key mismatch between nodes running different versions during the upgrade window (see [JWT token invalidation on upgrade](#jwt-token-invalidation-on-upgrade)). The data path and replication are not affected.
+
+To resolve it, upgrade the remaining participating clusters. The issue clears after every participating cluster runs the same version. If you're signed out, sign in again.
+
 #### Module commands limitation during Active-Active database upgrades to Redis 8.0
 
 When upgrading an Active-Active database to Redis version 8.0, you cannot use module commands until all Active-Active database instances have been upgraded. Currently, these commands are not blocked automatically.

content/operate/rs/release-notes/rs-8-2-releases/rs-8-2-0-46.md

@@ -71,6 +71,10 @@ The following table shows which Redis modules are compatible with each Redis dat
 
 ## Version changes
 
+### JWT token invalidation on upgrade
+
+To improve system security, the JWT signing secret has changed in version 8.0.22 and later. As a result, upgrading invalidates all previously issued JWT tokens, which must be regenerated. Tokens used programmatically within the cluster are regenerated automatically. Cluster Manager users must sign out and sign in again, or wait for their session or token to expire.
+
 ### Reserved ports
 
 Make sure the following ports are open before upgrading Redis Software.
@@ -192,6 +196,14 @@ For Active-Active databases running Redis database version 8.4, the `ACKED` opti
 
 Due to module handling changes introduced in Redis Software version 8.0, upgrading a cluster that contains custom or deprecated modules, such as RedisGraph and RedisGears v2, can become stuck when adding a new node to the cluster during a rolling upgrade.
 
+#### Cluster Manager sign-outs and false "down" status during an Active-Active upgrade
+
+While an Active-Active database has participating clusters running different Redis Software versions, the Cluster Manager UI on an upgraded cluster can sign users out intermittently and show a participating cluster as down, even though replication is active and the syncers are connected.
+
+This affects the Cluster Manager UI only. It's caused by a JWT signing-key mismatch between nodes running different versions during the upgrade window (see [JWT token invalidation on upgrade](#jwt-token-invalidation-on-upgrade)). The data path and replication are not affected.
+
+To resolve it, upgrade the remaining participating clusters. The issue clears after every participating cluster runs the same version. If you're signed out, sign in again.
+
 #### Module commands limitation during Active-Active database upgrades to Redis 8.0
 
 When upgrading an Active-Active database to Redis version 8.0, you cannot use module commands until all Active-Active database instances have been upgraded. Currently, these commands are not blocked automatically.