#用户管理

Redis 实例（版本 6.0+）使用 RedisUser Custom Resource（CR）管理用户帐户。要列出与特定实例关联的所有用户：

$ kubectl -n default get redisuser -l middleware.instance/name=<instance_name>

例如，要列出名为 s6 的实例的所有用户：

$ kubectl -n test get redisuser -l middleware.instance/name=s6
NAME                  INSTANCE   USERNAME   PHASE     AGE
rfr-acl-s6-admin      s6         admin      Success   22s
rfr-acl-s6-app-a      s6         app-a      Success   45s
rfr-acl-s6-app-b      s6         app-b      Success   6s
rfr-acl-s6-default    s6         default    Success   3m17s
rfr-acl-s6-operator   s6         operator   Success   3m17s

输出字段提供以下信息：

1. 从 RedisUser 列表中确定目标用户。

   在此示例中，我们将更新实例 s6 的 default 用户的密码。

2. 获取 RedisUser 资源，以确定关联的密码 Secret：

   $ kubectl -n default get RedisUser rfr-acl-s6-default -o yaml
   apiVersion: redis.middleware.alauda.io/v1
   kind: RedisUser
   metadata:
     annotations:
       middleware.alauda.io/acl-supported-version: "6.0"
     creationTimestamp: "2025-02-28T02:07:26Z"
     finalizers:
     - redisusers.redis.middleware.alauda.io/finalizer
     generation: 1
     labels:
       managed-by: redis-operator
       middleware.instance/name: s6
     name: rfr-acl-s6-default
     namespace: default
     ownerReferences:
     - apiVersion: databases.spotahome.com/v1
       blockOwnerDeletion: true
       controller: true
       kind: RedisFailover
       name: s6
       uid: 56596fa0-4a42-408b-ba26-d61b3a42b60c
     - apiVersion: middleware.alauda.io/v1
       blockOwnerDeletion: true
       kind: Redis
       name: s6
       uid: 80d2e7b0-02d2-490f-bec4-f145f2c738fc
     resourceVersion: "1014064"
     uid: aae888f3-86ba-48bd-9376-710070bf07e0
   spec:
     accountType: default
     aclRules: +@all -acl -flushall -flushdb -keys ~*
     arch: sentinel
     passwordSecrets:
     - redis-s6-2hqxb
     redisName: s6
     username: default
   status:
     Phase: Success
     lastUpdateSuccess: "2025-02-28T02:16:28Z"

   从 spec.passwordSecrets[0] 字段可以看到，密码存储在 Secret redis-s6-2hqxb 中。

3. 检查当前密码 Secret：

   $ kubectl -n default get secret redis-s6-2hqxb -o yaml
   apiVersion: v1
   data:
     password: YWRtaW5AMTIz
   kind: Secret
   metadata:
     annotations:
       cpaas.io/creator: admin
       cpaas.io/operator: admin
       cpaas.io/updated-at: "2025-02-28T08:49:38Z"
     creationTimestamp: "2025-02-28T02:07:24Z"
     generateName: redis-s6-
     labels:
       managed-by: redis-operator
       middleware.instance/name: s6
     name: redis-s6-2hqxb
     namespace: default
     ownerReferences:
     - apiVersion: redis.middleware.alauda.io/v1
       blockOwnerDeletion: true
       controller: true
       kind: RedisUser
       name: rfr-acl-s6-default
       uid: aae888f3-86ba-48bd-9376-710070bf07e0
     resourceVersion: "1183397"
     uid: 45a5faa7-5b47-4a6a-a4e4-c614feccb806
   type: Opaque

   注意：password 键是 Redis Operator 使用的保留字段名。其值以 base64 编码字符串的形式存储。

4. 使用新密码更新 Secret：

   $ kubectl -n default patch secret redis-s6-2hqxb --type=merge --patch='{"stringData": {"password": "admin@12345"}}'

5. 验证密码更新：

   $ kubectl -n default get secret redis-s6-2hqxb -o jsonpath='{.data.password}' | base64 -d
   admin@12345

   更新密码后，RedisUser 资源将在更改传播到所有 Redis 节点期间暂时进入 Pending 状态。同步完成后，状态将恢复为 Success。

$ kubectl -n default patch RedisUser s56 --type=merge --patch='{"spec": {"aclRules": "+@all ~*"}}'

创建成功后，用户将随机进入 Pending 状态。请等待其变为 Success 状态，这表示更新已成功。

为 Redis 集群实例创建用户。

$ cat << EOF | kubectl -n default create -f -
apiVersion: redis.middleware.alauda.io/v1
kind: RedisUser
metadata:
  name: rfr-acl-s6-app-a
spec:
  accountType: custom
  aclRules: +@all -acl ~*
  passwordSecrets:
  - new-redis-password
  redisName: s6
  username: app-a
EOF

Once the resource status changes to `Success`, you can connect with the new password for debugging.