From eb9563e22fe8b1426778d830fce86e13dcc63c59 Mon Sep 17 00:00:00 2001 From: oshri barazani Date: Wed, 12 Aug 2026 14:57:55 +0300 Subject: [PATCH] K8s: Document disconnectClientsOnPasswordRemoval in REC and REDB MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Documents the operator's new disconnectClientsOnPasswordRemoval CRD fields (REC enum, REDB boolean, REAADB via globalConfigurations), canonically on the REC page, with the REDB section and a manage-users rotation cross-link pointing at it. The draft survived two structural reversals worth knowing about. It first duplicated the ownership semantics on both the REC and REDB pages, then deduplicated REDB-canonical, and finally flipped to REC-canonical because the cluster policy is the parent concept. More importantly, the first draft had the semantics backwards. Per the RS source (Bdb::disconnect_clients_on_password_removal in dmcproxy/dmc/bdb/bdb.cpp, release-8.0.2), the cluster value is a cluster-wide override — Enabled/Disabled force the behavior for every database — and a database's boolean takes effect only when the cluster is Auto. "Auto" does not mean "Redis Software decides"; it means "defer to the per-database setting". A REAADB paragraph in active-active/global-config.md was written and then removed; the REAADB field is covered by a bullet in the REC canonical section instead. Learned: cluster value is the override; per-database boolean applies only when the cluster policy is Auto Constraint: operator version X.Y.Z gates only CRD-based configuration; with RS 8.0.2+ the setting is configurable via REST on any operator version Rejected: duplicating ownership semantics on REC and REDB pages | subtle text that drifts Rejected: REDB page as canonical location | cluster policy is the parent concept, so the REC page holds the full explanation Directive: do not hand-edit reference/api pages for the new fields; they arrive with the next CRD regeneration Recheck: when the first operator release with this feature ships, replace every X.Y.Z placeholder (TODO comments mark them) Ticket: RED-197499 --- .../operate/kubernetes/re-clusters/_index.md | 54 +++++++++++++++++++ .../kubernetes/re-databases/db-controller.md | 31 +++++++++++ .../security/access-control/manage-users.md | 6 +++ 3 files changed, 91 insertions(+) diff --git a/content/operate/kubernetes/re-clusters/_index.md b/content/operate/kubernetes/re-clusters/_index.md index e7d75e1cdf..7e469750da 100644 --- a/content/operate/kubernetes/re-clusters/_index.md +++ b/content/operate/kubernetes/re-clusters/_index.md @@ -23,6 +23,60 @@ Manage your Redis Enterprise cluster lifecycle and configuration: - [Multi-namespace deployment]({{< relref "/operate/kubernetes/re-clusters/multi-namespace" >}}) - Deploy clusters across multiple Kubernetes namespaces - [Delete custom resources]({{< relref "/operate/kubernetes/re-clusters/delete-custom-resources" >}}) - Safely remove REC and related resources +### Disconnect clients on password removal + +Redis Software 8.0.2 and later can actively disconnect client connections +that authenticated with a removed, revoked, or rotated password. In Redis +Software you configure this setting through the REST API — see the +[cluster object]({{< relref "/operate/rs/references/rest-api/objects/cluster/" >}}) +and [bdb object]({{< relref "/operate/rs/references/rest-api/objects/bdb/" >}}). +Starting with operator version X.Y.Z, the operator configures it through +the custom resources instead: + + + +- Cluster-wide policy: `spec.disconnectClientsOnPasswordRemoval` on the REC + (`Enabled`, `Disabled`, or `Auto`). +- Per-database setting: `spec.disconnectClientsOnPasswordRemoval` on the + [REDB]({{< relref "/operate/kubernetes/re-databases/db-controller#disconnect-clients-on-password-removal" >}}) + (boolean; the Redis Software default is `false`). Takes effect only when + the cluster-wide policy is `Auto`. +- Active-Active databases: + `spec.globalConfigurations.disconnectClientsOnPasswordRemoval` on the + REAADB, propagated to all participating clusters — see + [Set global database configurations]({{< relref "/operate/kubernetes/active-active/global-config" >}}). + Takes effect when the cluster-wide policy on the participating clusters + is `Auto`. + +Set the cluster-wide policy in your REC specification: + +```yaml +spec: + disconnectClientsOnPasswordRemoval: Enabled +``` + +Allowed values are `Enabled`, `Disabled`, and `Auto`. `Auto` (the Redis +Software default) defers the decision to each database's own setting. +`Enabled` and `Disabled` force the behavior for all databases in the +cluster, ignoring the per-database setting. + +Whether the operator owns the setting depends on your upgrade path: + +- Resources **created by operator version X.Y.Z or later**: the operator + owns the setting from creation. Configure it only through the custom + resource — changes made through the Redis Software REST API or admin + console are reverted the next time the operator reconciles the resource. + Removing the field from the spec reverts the setting to its Redis + Software default (`Auto` for the cluster, `false` for a database); it + does not keep the last value. +- Resources **that existed before you upgraded to operator version X.Y.Z**: + values configured through the Redis Software REST API are preserved. The + operator takes ownership only once you set the field in the custom + resource. From then on, ownership is permanent — if you later remove the + field, the setting reverts to the Redis Software default, not to the + previously configured value. + ## Storage and performance Optimize storage and performance for your Redis Enterprise cluster: diff --git a/content/operate/kubernetes/re-databases/db-controller.md b/content/operate/kubernetes/re-databases/db-controller.md index d5ebae6bf9..a9f1e648e1 100644 --- a/content/operate/kubernetes/re-databases/db-controller.md +++ b/content/operate/kubernetes/re-databases/db-controller.md @@ -100,6 +100,37 @@ To modify the database: To add tags to a database and expose them as metric labels, see [Enrich database metrics with tags]({{< relref "/operate/kubernetes/re-databases/enrich-metrics-with-tags" >}}). +## Disconnect clients on password removal + +Redis Software can actively disconnect client connections that +authenticated with a removed, revoked, or rotated password. The +per-database setting applies only when the +[cluster-wide policy]({{< relref "/operate/kubernetes/re-clusters/#disconnect-clients-on-password-removal" >}}) +is `Auto`; if the cluster policy is `Enabled` or `Disabled`, that value +applies to every database in the cluster. This setting requires Redis +Software 8.0.2 or later; configuring it through the custom resource +requires operator version X.Y.Z or later. + + + +Set the per-database value in your REDB specification: + +```yaml +spec: + disconnectClientsOnPasswordRemoval: true +``` + +The Redis Software default for a database is `false`. See the +[Redis Software REST API bdb object]({{< relref "/operate/rs/references/rest-api/objects/bdb/" >}}) +for details about the underlying setting. + +For when the operator takes ownership of this setting, and how to +configure it for Active-Active databases, see +[Disconnect clients on password removal]({{< relref "/operate/kubernetes/re-clusters/#disconnect-clients-on-password-removal" >}}). +Once the operator owns the setting, configure it only through the REDB +specification; removing the field reverts the database to `false`. + ## Delete a database The database exists as long as the custom resource exists. diff --git a/content/operate/kubernetes/security/access-control/manage-users.md b/content/operate/kubernetes/security/access-control/manage-users.md index 856383c77f..1a09e2b374 100644 --- a/content/operate/kubernetes/security/access-control/manage-users.md +++ b/content/operate/kubernetes/security/access-control/manage-users.md @@ -111,6 +111,12 @@ In Rotatable mode the operator makes referenced Kubernetes Secrets immutable, so `status.passwordSecrets` lists each active Secret with its resolved version. +Whether connections that authenticated with the removed password are +actively disconnected is controlled by the cluster's +`disconnectClientsOnPasswordRemoval` setting and, when that is `Auto`, by +the database's own setting — see +[Disconnect clients on password removal]({{< relref "/operate/kubernetes/re-clusters/#disconnect-clients-on-password-removal" >}}). + ## Update the email address You can change `spec.email` only while `passwordSecrets` contains exactly one entry. If a Rotatable rotation is in progress, reduce to a single secret first, change the email, then add the second secret back.