create users on cluster init

Signed-off-by: utdrmac <matthew.boehm@percona.com>

Author: utdrmac

Makefile

@@ -105,7 +105,7 @@ lint-config: golangci-lint ## Verify golangci-lint linter configuration
 ##@ Build
 
 .PHONY: build
-build: manifests generate fmt vet ## Build manager binary.
+build: manifests generate fmt vet lint ## Build manager binary.
 	go build -o bin/manager cmd/main.go
 
 .PHONY: run

api/v1alpha1/valkeyacls_types.go

@@ -0,0 +1,102 @@
+/*
+Copyright 2025 Valkey Contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+// An UserAclSpec contains user, authorization, and permissions-related configurations
+type UserAclSpec struct {
+
+	// Username
+	// +kubebuilder:required:message=A username is required
+	Name string `json:"name"`
+
+	// If the user is enabled or not
+	// +kubebuilder:default=true
+	Enabled bool `json:"enabled,omitempty"`
+
+	// Reference information to a Secret containing user passwords
+	// +optional
+	PasswordSecret PasswordSecretSpec `json:"passwordSecret,omitempty"`
+
+	// Do not apply a password to this user
+	// +kubebuilder:default=false
+	NoPassword bool `json:"nopass,omitempty"`
+
+	// Valkey command categories, commands, and subcommands restrictions for this user
+	// +optional
+	Commands CommandsAclSpec `json:"commands,omitempty"`
+
+	// Key restrictions
+	// +optional
+	Keys KeysAclSpec `json:"keys,omitempty"`
+
+	// Channel restrictions
+	// +optional
+	Channels ChannelsAclSpec `json:"channels,omitempty"`
+
+	// Raw ACL for (additional) permissions. Appended to anything generated.
+	// +optional
+	RawAcl string `json:"permissions,omitempty"`
+}
+
+type PasswordSecretSpec struct {
+
+	// Name of the referencing Secret; Defaults to clustername-users
+	// +optional
+	Name string `json:"name,omitempty"`
+
+	// An array of keys inside the referencing Secret to find passwords; defaults to username
+	// Valkey supports multiple passwords per user for rotation
+	// +optional
+	Keys []string `json:"keys,omitempty"`
+}
+
+type CommandsAclSpec struct {
+
+	// Command categories (@all, @read, @write, @admin, etc.)
+	// Individual commands (get, set, ping, etc.)
+	// Subcommands (client|setname, config|get, etc.)
+
+	// Allowed commands for this user
+	// +kubebuilder:validation:Items:Pattern=^[@a-z|]+$}
+	Allow []string `json:"allow,omitempty"`
+
+	// Denied commands for this user
+	// +kubebuilder:validation:Items:Pattern=^[@a-z|]+$}
+	Deny []string `json:"deny,omitempty"`
+}
+
+type KeysAclSpec struct {
+
+	// Keys on which this user can read, and write; maps to Valkey: ~pattern
+	// +optional
+	ReadWrite []string `json:"readWrite,omitempty"`
+
+	// Keys restricted to read-only; maps to Valkey: %R~pattern
+	// +optional
+	ReadOnly []string `json:"readOnly,omitempty"`
+
+	// Keys restricted to write-only; maps to Valkey: %W~pattern
+	// +optional
+	WriteOnly []string `json:"writeOnly,omitempty"`
+}
+
+type ChannelsAclSpec struct {
+
+	// Pub/Sub channel patterns - maps to Valkey: &pattern
+	// +optional
+	Patterns []string `json:"patterns,omitempty"`
+}

api/v1alpha1/valkeycluster_types.go

@@ -73,6 +73,11 @@ type ValkeyClusterSpec struct {
 	// +kubebuilder:default:={enabled:true}
 	// +optional
 	Exporter ExporterSpec `json:"exporter,omitempty"`
+
+	// Users, and ACL-related configuration; see valkeyacls_types.go
+	// +listType=map
+	// +listMapKey=name
+	Users []UserAclSpec `json:"users,omitempty"`
 }
 
 type ExporterSpec struct {
@@ -154,6 +159,7 @@ const (
 	ReasonSlotsUnassigned   = "SlotsUnassigned"
 	ReasonPrimaryLost       = "PrimaryLost"
 	ReasonNoSlots           = "NoSlotsAvailable"
+	ReasonUsersAclError     = "UsersACLError"
 )
 
 // +kubebuilder:object:root=true

api/v1alpha1/zz_generated.deepcopy.go

@@ -1164,6 +1164,97 @@ spec:
                       type: string
                   type: object
                 type: array
+              users:
+                description: Users, and ACL-related configuration; see valkeyacls_types.go
+                items:
+                  description: An UserAclSpec contains user, authorization, and permissions-related
+                    configurations
+                  properties:
+                    channels:
+                      description: Channel restrictions
+                      properties:
+                        patterns:
+                          description: 'Pub/Sub channel patterns - maps to Valkey:
+                            &pattern'
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                    commands:
+                      description: Valkey command categories, commands, and subcommands
+                        restrictions for this user
+                      properties:
+                        allow:
+                          description: Allowed commands for this user
+                          items:
+                            type: string
+                          type: array
+                        deny:
+                          description: Denied commands for this user
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                    enabled:
+                      default: true
+                      description: If the user is enabled or not
+                      type: boolean
+                    keys:
+                      description: Key restrictions
+                      properties:
+                        readOnly:
+                          description: 'Keys restricted to read-only; maps to Valkey:
+                            %R~pattern'
+                          items:
+                            type: string
+                          type: array
+                        readWrite:
+                          description: 'Keys on which this user can read, and write;
+                            maps to Valkey: ~pattern'
+                          items:
+                            type: string
+                          type: array
+                        writeOnly:
+                          description: 'Keys restricted to write-only; maps to Valkey:
+                            %W~pattern'
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                    name:
+                      description: Username
+                      type: string
+                    nopass:
+                      default: false
+                      description: Do not apply a password to this user
+                      type: boolean
+                    passwordSecret:
+                      description: Reference information to a Secret containing user
+                        passwords
+                      properties:
+                        keys:
+                          description: |-
+                            An array of keys inside the referencing Secret to find passwords; defaults to username
+                            Valkey supports multiple passwords per user for rotation
+                          items:
+                            type: string
+                          type: array
+                        name:
+                          description: Name of the referencing Secret; Defaults to
+                            clustername-users
+                          type: string
+                      type: object
+                    permissions:
+                      description: Raw ACL for (additional) permissions. Appended
+                        to anything generated.
+                      type: string
+                  required:
+                  - name
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - name
+                x-kubernetes-list-type: map
             type: object
           status:
             default:

config/crd/bases/valkey.io_valkeyclusters.yaml

@@ -8,6 +8,7 @@ rules:
   - ""
   resources:
   - configmaps
+  - secrets
   - services
   verbs:
   - create