fix(valkey): push ACL to all data pods in accountProvision (#2872)

Author: weicao

addons/valkey/scripts/account-provision.sh

@@ -2,39 +2,29 @@
 set -e
 # account-provision.sh — called by KubeBlocks to create/update a database account.
 #
-# Learning note:
-#   KubeBlocks injects three special variables before calling this action:
-#     KB_ACCOUNT_NAME      - logical account name (e.g., "default")
-#     KB_ACCOUNT_PASSWORD  - generated password (from passwordGenerationPolicy)
-#     KB_ACCOUNT_STATEMENT - the command to execute, built by KubeBlocks
+# KubeBlocks injects:
+#   KB_ACCOUNT_NAME      - logical account name (e.g., "default")
+#   KB_ACCOUNT_PASSWORD  - generated password (from passwordGenerationPolicy)
+#   KB_ACCOUNT_STATEMENT - the command to execute (ACL SETUSER ...)
 #
-#   For Redis/Valkey, KB_ACCOUNT_STATEMENT is an ACL SETUSER command:
-#     e.g. "ACL SETUSER myuser on >password ~* +@all"
-#
-#   Because Valkey's auth model is ACL-based (not SQL), the provision script
-#   simply passes KB_ACCOUNT_STATEMENT verbatim to valkey-cli and then
-#   calls ACL SAVE to persist the ACL file to disk.
-#
-#   The `initAccount: true` flag on the systemAccount means KubeBlocks
-#   calls this action once during cluster initialisation, using the
-#   "default" user.  Subsequent ACL changes go through OpsRequest.
+# With targetPodSelector: All, KubeBlocks runs this on every pod.
+# Each pod applies the ACL locally via ACL SETUSER + ACL SAVE.
+# Valkey ACL is not replicated via the native replication stream —
+# each node maintains its own users.acl, so every pod must be
+# provisioned independently.
 
 port="${SERVICE_PORT:-6379}"
 
-base_cmd=(valkey-cli --no-auth-warning -p "${port}")
+cli_cmd=(valkey-cli --no-auth-warning -h 127.0.0.1 -p "${port}")
 if [ -n "${VALKEY_DEFAULT_PASSWORD}" ]; then
-  base_cmd+=(-a "${VALKEY_DEFAULT_PASSWORD}")
+  cli_cmd+=(-a "${VALKEY_DEFAULT_PASSWORD}")
 fi
 if [ -n "${VALKEY_CLI_TLS_ARGS}" ]; then
   # shellcheck disable=SC2206
-  base_cmd+=(${VALKEY_CLI_TLS_ARGS})
+  cli_cmd+=(${VALKEY_CLI_TLS_ARGS})
 fi
 
-# Execute the statement provided by KubeBlocks.
-# Pipe via stdin so that '>' in ACL password syntax (e.g. >mypassword) is not
-# misinterpreted as a shell output-redirect operator.
-# valkey-cli exits 0 even for protocol errors; capture output and check content.
-output=$(echo "${KB_ACCOUNT_STATEMENT}" | "${base_cmd[@]}" 2>&1) || {
+output=$(echo "${KB_ACCOUNT_STATEMENT}" | "${cli_cmd[@]}" 2>&1) || {
   echo "ERROR: account statement failed: ${output}" >&2
   exit 1
 }
@@ -43,8 +33,7 @@ if [ "${output}" != "OK" ]; then
   exit 1
 fi
 
-# Persist ACL to disk so it survives pod restarts
-acl_save_out=$("${base_cmd[@]}" ACL SAVE 2>&1) || {
+acl_save_out=$("${cli_cmd[@]}" ACL SAVE 2>&1) || {
   echo "ERROR: ACL SAVE failed: ${acl_save_out}" >&2
   exit 1
 }

addons/valkey/templates/cmpd.yaml

@@ -446,8 +446,7 @@ spec:
           - sh
           - -c
           - /scripts/account-provision.sh
-        targetPodSelector: Role
-        matchingKey: primary
+        targetPodSelector: All
 
     # switchover: when Sentinel is present, delegates to SENTINEL FAILOVER.
     # When absent (standalone), performs a direct REPLICAOF NO ONE.