Kvindo™ Cloud Docs
A Valkey User is an ACL user inside a specific Valkey Cluster's own identity space. It is the only credential mechanism for that cluster — the cluster resource itself has no user-facing password, so a Valkey User is how you hand out scoped, revocable credentials to an application or team.
• Belongs to one cluster forever — spec.valkeyId is required and immutable; a user cannot move between clusters
• Write-only password — spec.password is never echoed back by the API, same as every other credential field on this platform. Omit it on a modify to keep the current password
• Enabled toggles authentication, not deletion — spec.enabled is an on/off switch; disabling a user keeps every ACL grant intact for when it's re-enabled
• Three independent, default-deny ACL dimensions — keyPatterns, categories, and channels each grant access separately; leaving all three empty means the user can authenticate but has zero data-plane access, a common first-time gotcha
• Some ACL inputs are validated here, some only by Valkey itself — Kvindo Cloud rejects the reserved categories values all/admin/dangerous/slow, the reserved user name default, and enabled: true with no password set. A categories entry that is simply misspelled or not a real Valkey category is not caught by any of those checks — it is only caught by Valkey's own ACL SETUSER at apply time
| UI Name | API / kc name | Terraform name | Optional | Format | Default | Is read only | Description |
|---|---|---|---|---|---|---|---|
| Valkey cluster | spec.valkeyId |
spec.valkey_id |
No | ULID — references a Valkey cluster | — | No | Immutable after creation |
| Password | spec.password |
spec.password |
Yes | string (sensitive, write-only) | — | No | Never returned in status. Required on creation when enabled is true; not required when enabled is false. On a modify, omitting it keeps the current password regardless of enabled |
| Enabled | spec.enabled |
spec.enabled |
Yes | boolean | true | No | Whether the user can authenticate; disabling keeps ACL grants intact |
| Key patterns | spec.keyPatterns |
spec.key_patterns |
Yes | list of strings — Valkey ACL key-pattern globs, e.g. cache:* |
[] (no key access) | No | Entered without the leading ~; empty/null denies all key access |
| Categories | spec.categories |
spec.categories |
Yes | list of strings — Valkey ACL command categories, e.g. read, write |
[] (no command access) | No | Entered without the leading +@; the reserved values all/admin/dangerous/slow are rejected by Kvindo Cloud, but a misspelled or otherwise invalid category is only caught by Valkey's own ACL SETUSER at apply time |
| Channels | spec.channels |
spec.channels |
Yes | list of strings — Valkey ACL pub/sub channel globs, e.g. notify:* |
[] (no channel access) | No | Entered without the leading &; empty/null denies all pub/sub access |
A user on an existing cluster with read/write key access and a notification channel.
Terraform
Python SDK
kc CLI
Resource docs
Examples
More in this section