Problem
There is no way to validate ACL configuration files offline before loading them into a running server. Invalid ACL rules are only discovered at runtime when ACL LOAD fails, which can cause service disruptions.
External systems (e.g., ElastiCache) maintain hand-rolled reimplementations of Valkey's ACL validation logic. Each new Valkey version requires updating these external validators to match new commands and categories. A canonical validation tool shipped with Valkey would eliminate this duplication.
Proposed Solution
A new valkey-check-acl tool that validates ACL files offline, similar in spirit to valkey-check-rdb and valkey-check-aof. The tool reuses Valkey's actual ACL parsing code (ACLStringSetUser, ACLSetSelector, etc.) so validation results are guaranteed to match server behavior.
Features
- Input modes: ACL file, valkey.conf (auto-detected), stdin
- Version-gated validation (
--version): Reject syntax and commands not available in a target version (e.g., selectors require 7.0, db= requires 9.1)
- Validation levels (
--level): syntax (structure only), semantic (default, validates command names), full (adds warnings for risky patterns)
- Simplification (
--simplify): Output minimal canonical ACL rules (removes redundancies, normalizes keys/channels/dbs)
- External commands (
--commands-file): Load module command definitions for validation
- Machine-parseable output (
--json)
- Strict by default: Unknown commands are errors (use
--ignore-unknown-commands to relax)
- Duplicate user detection: Matches Valkey's behavior
- Distinct exit codes: 0=OK, 1=syntax errors, 2=semantic errors, 3=warnings only
Examples
# Basic validation
valkey-check-acl /etc/valkey/users.acl
# Validate against Redis 7.0 syntax
valkey-check-acl --version 7.0 acl.conf
# Simplify rules to canonical form
valkey-check-acl --simplify acl.conf
# Validate with module commands
valkey-check-acl --commands-file search-module.conf acl.conf
# Pipe from stdin
echo "user alice on >pass ~* +@all" | valkey-check-acl -
Implementation
Built as a multi-call binary (symlink to valkey-server), following the established pattern. Includes Redis compatibility symlink (redis-check-acl).
Problem
There is no way to validate ACL configuration files offline before loading them into a running server. Invalid ACL rules are only discovered at runtime when
ACL LOADfails, which can cause service disruptions.External systems (e.g., ElastiCache) maintain hand-rolled reimplementations of Valkey's ACL validation logic. Each new Valkey version requires updating these external validators to match new commands and categories. A canonical validation tool shipped with Valkey would eliminate this duplication.
Proposed Solution
A new
valkey-check-acltool that validates ACL files offline, similar in spirit tovalkey-check-rdbandvalkey-check-aof. The tool reuses Valkey's actual ACL parsing code (ACLStringSetUser,ACLSetSelector, etc.) so validation results are guaranteed to match server behavior.Features
--version): Reject syntax and commands not available in a target version (e.g., selectors require 7.0,db=requires 9.1)--level): syntax (structure only), semantic (default, validates command names), full (adds warnings for risky patterns)--simplify): Output minimal canonical ACL rules (removes redundancies, normalizes keys/channels/dbs)--commands-file): Load module command definitions for validation--json)--ignore-unknown-commandsto relax)Examples
Implementation
Built as a multi-call binary (symlink to
valkey-server), following the established pattern. Includes Redis compatibility symlink (redis-check-acl).