(feat): Support user creation on cluster init

api/v1alpha1/valkeycluster_types.go

@@ -73,6 +73,46 @@ type ValkeyClusterSpec struct {
 	// +kubebuilder:default:={enabled:true}
 	// +optional
 	Exporter ExporterSpec `json:"exporter,omitempty"`
+
+	// Options, or config which are specific to Valkey server
+	// +optional
+	ValkeySpec ValkeySpec `json:"valkeyConfig,omitempty"`
+}
+
+// ValkeySpec defines any options, or configuration that is specific to valkey-server
+type ValkeySpec struct {
+
+	// Auth-related structure for handling users, and acls
+	Auth AuthSpec `json:"auth,omitempty"`
+}
+
+// AuthSpec contains authorization, user, and ACL-related configurations
+type AuthSpec struct {
+
+	// Users ACL Secret
+	// A reference name to a Secret containing raw user:permission entries, which will be processed first
+	// Defaults to clusterName-secret
+	// +optional
+	UsersSecretRef string `json:"usersSecretRef,omitempty"`
+
+	// Array of users with raw ACL, or reference to a key in the UsersSecretRef
+	Users map[string]UserAcl `json:"users,omitempty"`
+}
+
+type UserAcl struct {
+
+	// Raw ACL line, including password
+	Permissions string `json:"permissions,omitempty"`
+
+	// sha256 password
+	// kubebuilder:validation:MinLength=64
+	// kubebuilder:validation:MaxLength=65
+	// kubebuilder:XValidation:message="Password should be a sha256 hash"
+	Password string `json:"password,omitempty"`
+
+	// Reference to a key in UsersSecretRef containing the password for this user
+	// Defaults to the username
+	PasswordKeyRef string `json:"passwordKeyRef,omitempty"`
 }
 
 type ExporterSpec struct {
@@ -154,6 +194,7 @@ const (
 	ReasonSlotsUnassigned   = "SlotsUnassigned"
 	ReasonPrimaryLost       = "PrimaryLost"
 	ReasonNoSlots           = "NoSlotsAvailable"
+	ReasonUsersAclError     = "UsersACLError"
 )
 
 // +kubebuilder:object:root=true

config/crd/bases/valkey.io_valkeyclusters.yaml

@@ -1163,6 +1163,42 @@ spec:
                       type: string
                   type: object
                 type: array
+              valkeyConfig:
+                description: Options, or config which are specific to Valkey server
+                properties:
+                  auth:
+                    description: Auth-related structure for handling users, and acls
+                    properties:
+                      users:
+                        additionalProperties:
+                          properties:
+                            password:
+                              description: |-
+                                sha256 password
+                                kubebuilder:validation:MinLength=64
+                                kubebuilder:validation:MaxLength=65
+                                kubebuilder:XValidation:message="Password should be a sha256 hash"
+                              type: string
+                            passwordKeyRef:
+                              description: |-
+                                Reference to a key in UsersSecretRef containing the password for this user
+                                Defaults to the username
+                              type: string
+                            permissions:
+                              description: Raw ACL line, including password
+                              type: string
+                          type: object
+                        description: Array of users with raw ACL, or reference to
+                          a key in the UsersSecretRef
+                        type: object
+                      usersSecretRef:
+                        description: |-
+                          Users ACL Secret
+                          A reference name to a Secret containing raw user:permission entries, which will be processed first
+                          Defaults to clusterName-secret
+                        type: string
+                    type: object
+                type: object
             type: object
           status:
             default:

config/rbac/role.yaml

@@ -8,6 +8,7 @@ rules:
   - ""
   resources:
   - configmaps
+  - secrets
   - services
   verbs:
   - create

config/samples/v1alpha1_valkeycluster.yaml

@@ -1,10 +1,33 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: valkeycluster-sample-users
+data:
+  alicepw: M21wdHlQQHNzdzByZA==
+  bob: YjFjMzY4OTZkMzk5MjMwNDU5NTVjMzczZjM2NWVkNjg2Y2I5N2RiNTA1NGE0NTJjN2EzZmQ5MjAwZTMzNGYxZAo=
+---
 apiVersion: valkey.io/v1alpha1
 kind: ValkeyCluster
 metadata:
   name: valkeycluster-sample
 spec:
   shards: 3
   replicas: 1
+  valkeyConfig:
+    auth:
+      usersSecretRef: valkeycluster-sample-users
+      users:
+        alice:
+          permissions: +@list +@connection ~jobs:*
+          passwordKeyRef: alicepw
+        bob:
+          permissions: ~* +@all
+        charlie:
+          permissions: -@all +get ~secretkey ~valkey:*
+          password: sup3rS3cr3t
+        david:
+          permissions: -@all +@admin
   resources:
     requests:
       memory: "256Mi"

internal/controller/deployment.go

@@ -89,6 +89,11 @@ func generateContainersDef(cluster *valkeyiov1alpha1.ValkeyCluster) []corev1.Con
 					MountPath: "/config",
 					ReadOnly:  true,
 				},
+				{
+					Name:      "users-acl",
+					MountPath: "/config/users",
+					ReadOnly:  true,
+				},
 			},
 		},
 	}
@@ -141,6 +146,14 @@ func createClusterDeployment(cluster *valkeyiov1alpha1.ValkeyCluster) *appsv1.De
 								},
 							},
 						},
+						{
+							Name: "users-acl",
+							VolumeSource: corev1.VolumeSource{
+								Secret: &corev1.SecretVolumeSource{
+									SecretName: getInternalSecretName(cluster.Name),
+								},
+							},
+						},
 					},
 				},
 			},