ACL conflict: +@all -@admin still blocks CLUSTER NODES when using Redisson

[mappei]

Hi all,

I’m facing a confusing Redis ACL behavior when using Redisson with a restricted Redis user, and I’d appreciate any clarification or insights.

Background

I configured a Redis ACL user with the following access string:on ~* &* +@all -@admin. This will allow all commands, except commands in the @admin category.

According to Redis documentation, the ACL category of cluster nodes is @slow, not @admin. ref: https://redis.io/docs/latest/commands/cluster-nodes//
So based on my understanding, CLUSTER NODES should still be allowed.

Problem

When starting my application using Redisson, I get this error:NOPERM this user has no permissions to run the 'cluster|nodes' command. channel:

So based on my access string it should be permitted. But it raise an error. This creates a conflict with my understanding of ACL category behavior.

Temporary Workaround

Allowing cluster explicitly fixes the issue: +@all -@admin +cluster.
But this seems overly broad, and I want to understand the correct minimal permission set.

Questions

1. Why does Redis block CLUSTER NODES when using:+@all -@admin
2. Is CLUSTER treated specially by Redis ACL internally?
3. Does Redisson internally rely on cluster-related commands that are considered admin-level?
4. Is there a recommended minimal ACL policy for Redisson in cluster mode?

[dvkashapov]

I assume this is an issue in Redis, not in Valkey because for those rules Valkey allows CLUSTER NODES:

127.0.0.1:6379> ACL SETUSER bob on nopass ~* &* +@all -@admin
OK
127.0.0.1:6379> ACL LIST
1) "user bob on nopass sanitize-payload ~* &* alldbs +@all -@admin"
2) "user default on nopass sanitize-payload ~* &* alldbs +@all"
127.0.0.1:6379> AUTH bob nopass
OK
127.0.0.1:6379> CLUSTER NODES
32055e5d5c02cf5e6829b332671aecc7a94f2a3e :6379@16379 myself,master - 0 0 0 connected 0-16383
127.0.0.1:6379>

[mappei]

Thank you very much for your prompt response. To clarify, I am currently using AWS ElastiCache for Redis. I verified the behavior using a Redis Docker and confirmed that the cluster nodes command does have the required permission there. However, when switching to AWS ElastiCache, the same command results in an error.

I also compared the outputs of ACL CAT admin and noticed that the available command sets differ between native Redis and ElastiCache.

I have post a question to AWS for further confirmation.

Thanks again for your kind help and support!