[miki3421]

Redis-only restarts can remove tenant ACL users while their saved data remains on the Redis PVC. This persists the current authorized ACL state on that volume and loads it on subsequent Redis starts, without requiring an operator restart to recover access.

Related to apache/openserverless#181, including the reproduced 0.9.0 case in apache/openserverless#181 (comment).

Changes

• Existing persistent installations save their live ACLs before updating the managed Redis ConfigMap. Since Redis cannot change aclfile at runtime, account mutations atomically update the file through protected stdin until the next Redis restart activates native ACL SAVE. Preparation does not restart Redis or replay an older ACL export.
• Fresh persistent installations initialize the default-user ACL from the configured password hash only when the file is absent. Existing files are preserved; an empty existing file fails initialization.
• Tenant creation/reconciliation, quota permission changes, successful revocations and system-account changes persist ACL state. Existing credentials and permission rules are retained.
• Ephemeral Redis retains its existing nonpersistent storage behavior. No component image version, storage layout or RBAC permissions change.

Validation

• 151 Python regression tests passed, including fresh bootstrap, preservation of an existing ACL file, failed saves, revocation, quota transitions, quoted configuration directives and protected snapshot input.
• Native Kustomize output tested with Redis 8.2.1 and a new PVC in a temporary namespace: password authentication works, anonymous access is rejected, and a named identity/data survive a Redis pod replacement without overwriting the ACL file. Temporary resources were removed.
• Existing 0.9.0 baseline: original ACLs and Alpha/Beta credentials preserved during preparation; Redis-only restart with unchanged operator; operator restart followed by another Redis-only restart. Authentication, peer-read denial, Lua reads, read-only permissions, successful revocation and PVC identity verified throughout. Temporary identities/data removed and original ACLs restored and saved.
• Alpha/Beta application regression suite: 15 checks passed.

The runtime tests use the existing locally patched baseline, layering only this production diff over its exact operator image. They are not a pristine upstream-image test. The full Kind integration suite was not rerun locally and remains for CI.

RDB snapshot scheduling and shutdown/data durability are separate from ACL persistence and are unchanged.