Skip to content

Commit 02d9e3f

Browse files
aalexandruaalexand
aalexandru
and
aalexand
authored
fix: add TLS config to redis client (#254)
* Add TLS config to redis client * Add flag to enable TLS for redis connection --------- Co-authored-by: aalexand <[email protected]>
1 parent 4991e6a commit 02d9e3f

File tree

5 files changed

+121
-94
lines changed

5 files changed

+121
-94
lines changed

‎cmd/apiserver/apiserver.go‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ package main
1414

1515
import (
1616
"context"
17+
"crypto/tls"
1718
"github.com/adobe/cluster-registry/pkg/apiserver/docs"
1819
"github.com/adobe/cluster-registry/pkg/apiserver/event"
1920
"github.com/adobe/cluster-registry/pkg/apiserver/web"
@@ -32,6 +33,8 @@ import (
3233
"github.com/labstack/gommon/log"
3334
"github.com/redis/go-redis/v9"
3435
echoSwagger "github.com/swaggo/echo-swagger"
36+
"net"
37+
"strings"
3538
)
3639

3740
// Version it's passed as ldflags in the build process
@@ -82,9 +85,21 @@ func main() {
8285
return
8386
}
8487

85-
redisClient := redis.NewClient(&redis.Options{
88+
redisOptions := &redis.Options{
8689
Addr: appConfig.ApiCacheRedisHost,
87-
})
90+
}
91+
92+
if appConfig.ApiCacheRedisTLSEnabled {
93+
redisOptions.TLSConfig = &tls.Config{
94+
MinVersion: tls.VersionTLS12,
95+
}
96+
redisHost := strings.Split(appConfig.ApiCacheRedisHost, ":")[0]
97+
if ipAddr := net.ParseIP(redisHost); ipAddr == nil {
98+
redisOptions.TLSConfig.ServerName = redisHost
99+
}
100+
}
101+
102+
redisClient := redis.NewClient(redisOptions)
88103
cmd := redisClient.Info(context.Background())
89104
if cmd.Err() != nil {
90105
log.Fatalf("Cannot connect to redis: %s", cmd.Err().Error())

‎local/.env.local‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,5 +46,6 @@ export IMAGE_REDIS="redis/redis-stack-server:latest"
4646
export CONTAINER_REDIS="redis"
4747
export API_CACHE_TTL=1h
4848
export API_CACHE_REDIS_HOST="localhost:6379"
49+
export API_CACHE_REDIS_TLS_ENABLED="false"
4950
export CONTAINER_SYNC_MANAGER="cluster-registry-sync-manager"
5051
export IMAGE_SYNC_MANAGER="ghcr.io/adobe/cluster-registry-sync-manager"

‎local/setup.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,7 @@ if [[ "${RUN_APISERVER}" == 1 ]]; then
179179
-e API_AUTHORIZED_GROUP_ID="${API_AUTHORIZED_GROUP_ID}" \
180180
-e API_CACHE_TTL \
181181
-e API_CACHE_REDIS_HOST=${CONTAINER_REDIS}:6379 \
182+
-e API_CACHE_REDIS_TLS_ENABLED \
182183
--network "${NETWORK}" \
183184
"${IMAGE_APISERVER}":"${TAG}" || die "Failed to create $CONTAINER_API container."
184185
fi

‎pkg/config/config.go‎

Lines changed: 54 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -22,29 +22,30 @@ import (
2222
)
2323

2424
type AppConfig struct {
25-
ApiRateLimiterEnabled bool
26-
ApiHost string
27-
AwsRegion string
28-
DbEndpoint string
29-
DbAwsRegion string
30-
DbTableName string
31-
DbIndexName string
32-
LogLevel log.Lvl
33-
OidcClientId string
34-
OidcIssuerUrl string
35-
SqsEndpoint string
36-
SqsAwsRegion string
37-
SqsQueueName string
38-
SqsBatchSize int64
39-
SqsWaitSeconds int64
40-
SqsRunInterval int
41-
K8sResourceId string
42-
ApiTenantId string
43-
ApiClientId string
44-
ApiClientSecret string
45-
ApiAuthorizedGroupId string
46-
ApiCacheTTL time.Duration
47-
ApiCacheRedisHost string
25+
ApiRateLimiterEnabled bool
26+
ApiHost string
27+
AwsRegion string
28+
DbEndpoint string
29+
DbAwsRegion string
30+
DbTableName string
31+
DbIndexName string
32+
LogLevel log.Lvl
33+
OidcClientId string
34+
OidcIssuerUrl string
35+
SqsEndpoint string
36+
SqsAwsRegion string
37+
SqsQueueName string
38+
SqsBatchSize int64
39+
SqsWaitSeconds int64
40+
SqsRunInterval int
41+
K8sResourceId string
42+
ApiTenantId string
43+
ApiClientId string
44+
ApiClientSecret string
45+
ApiAuthorizedGroupId string
46+
ApiCacheTTL time.Duration
47+
ApiCacheRedisHost string
48+
ApiCacheRedisTLSEnabled bool
4849
}
4950

5051
func LoadApiConfig() (*AppConfig, error) {
@@ -174,30 +175,37 @@ func LoadApiConfig() (*AppConfig, error) {
174175
return nil, fmt.Errorf("environment variable API_CACHE_REDIS_HOST is not set")
175176
}
176177

178+
apiCacheRedisTLSEnabled := getEnv("API_CACHE_REDIS_TLS_ENABLED", "true")
179+
apiCacheRedisTLSEnabledBool, err := strconv.ParseBool(apiCacheRedisTLSEnabled)
180+
if err != nil {
181+
return nil, fmt.Errorf("error parsing API_CACHE_REDIS_TLS_ENABLED: %v", err)
182+
}
183+
177184
return &AppConfig{
178-
AwsRegion: awsRegion,
179-
DbEndpoint: dbEndpoint,
180-
DbAwsRegion: dbAwsRegion,
181-
DbTableName: dbTableName,
182-
DbIndexName: dbIndexName,
183-
SqsEndpoint: sqsEndpoint,
184-
SqsAwsRegion: sqsAwsRegion,
185-
SqsQueueName: sqsQueueName,
186-
SqsBatchSize: sqsBatchSizeInt,
187-
SqsWaitSeconds: sqsWaitSecondsInt,
188-
SqsRunInterval: sqsRunIntervalInt,
189-
OidcClientId: oidcClientId,
190-
OidcIssuerUrl: oidcIssuerUrl,
191-
ApiRateLimiterEnabled: apiRateLimiterEnabled,
192-
LogLevel: logLevel,
193-
ApiHost: apiHost,
194-
K8sResourceId: k8sResourceId,
195-
ApiTenantId: apiTenantId,
196-
ApiClientId: apiClientId,
197-
ApiClientSecret: apiClientSecret,
198-
ApiAuthorizedGroupId: authorizedGroupId,
199-
ApiCacheTTL: apiCacheTTL,
200-
ApiCacheRedisHost: apiCacheRedisHost,
185+
AwsRegion: awsRegion,
186+
DbEndpoint: dbEndpoint,
187+
DbAwsRegion: dbAwsRegion,
188+
DbTableName: dbTableName,
189+
DbIndexName: dbIndexName,
190+
SqsEndpoint: sqsEndpoint,
191+
SqsAwsRegion: sqsAwsRegion,
192+
SqsQueueName: sqsQueueName,
193+
SqsBatchSize: sqsBatchSizeInt,
194+
SqsWaitSeconds: sqsWaitSecondsInt,
195+
SqsRunInterval: sqsRunIntervalInt,
196+
OidcClientId: oidcClientId,
197+
OidcIssuerUrl: oidcIssuerUrl,
198+
ApiRateLimiterEnabled: apiRateLimiterEnabled,
199+
LogLevel: logLevel,
200+
ApiHost: apiHost,
201+
K8sResourceId: k8sResourceId,
202+
ApiTenantId: apiTenantId,
203+
ApiClientId: apiClientId,
204+
ApiClientSecret: apiClientSecret,
205+
ApiAuthorizedGroupId: authorizedGroupId,
206+
ApiCacheTTL: apiCacheTTL,
207+
ApiCacheRedisHost: apiCacheRedisHost,
208+
ApiCacheRedisTLSEnabled: apiCacheRedisTLSEnabledBool,
201209
}, nil
202210
}
203211

‎pkg/config/config_test.go‎

Lines changed: 48 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -72,54 +72,56 @@ func TestLoadApiConfig(t *testing.T) {
7272
{
7373
name: "valid api config",
7474
envVars: map[string]string{
75-
"AWS_REGION": "aws-region",
76-
"DB_ENDPOINT": "http://localhost:8000",
77-
"DB_AWS_REGION": "db-aws-region",
78-
"DB_TABLE_NAME": "cluster-registry-local",
79-
"DB_INDEX_NAME": "search-index-local",
80-
"SQS_ENDPOINT": "http://localhost:9324",
81-
"SQS_AWS_REGION": "sqs-aws-region",
82-
"SQS_QUEUE_NAME": "cluster-registry-local",
83-
"OIDC_CLIENT_ID": "oidc-client-id",
84-
"OIDC_ISSUER_URL": "http://fake-oidc-provider",
85-
"API_RATE_LIMITER": "enabled",
86-
"LOG_LEVEL": "DEBUG",
87-
"SQS_BATCH_SIZE": "10",
88-
"SQS_WAIT_SECONDS": "5",
89-
"SQS_RUN_INTERVAL": "30",
90-
"API_HOST": "custom-host:8080",
91-
"K8S_RESOURCE_ID": "k8s-resource-id",
92-
"API_TENANT_ID": "api-tenant-id",
93-
"API_CLIENT_ID": "api-client-id",
94-
"API_CLIENT_SECRET": "api-client-secret",
95-
"API_AUTHORIZED_GROUP_ID": "api-authorized-group-id",
96-
"API_CACHE_TTL": "1h",
97-
"API_CACHE_REDIS_HOST": "localhost:6379",
75+
"AWS_REGION": "aws-region",
76+
"DB_ENDPOINT": "http://localhost:8000",
77+
"DB_AWS_REGION": "db-aws-region",
78+
"DB_TABLE_NAME": "cluster-registry-local",
79+
"DB_INDEX_NAME": "search-index-local",
80+
"SQS_ENDPOINT": "http://localhost:9324",
81+
"SQS_AWS_REGION": "sqs-aws-region",
82+
"SQS_QUEUE_NAME": "cluster-registry-local",
83+
"OIDC_CLIENT_ID": "oidc-client-id",
84+
"OIDC_ISSUER_URL": "http://fake-oidc-provider",
85+
"API_RATE_LIMITER": "enabled",
86+
"LOG_LEVEL": "DEBUG",
87+
"SQS_BATCH_SIZE": "10",
88+
"SQS_WAIT_SECONDS": "5",
89+
"SQS_RUN_INTERVAL": "30",
90+
"API_HOST": "custom-host:8080",
91+
"K8S_RESOURCE_ID": "k8s-resource-id",
92+
"API_TENANT_ID": "api-tenant-id",
93+
"API_CLIENT_ID": "api-client-id",
94+
"API_CLIENT_SECRET": "api-client-secret",
95+
"API_AUTHORIZED_GROUP_ID": "api-authorized-group-id",
96+
"API_CACHE_TTL": "1h",
97+
"API_CACHE_REDIS_HOST": "localhost:6379",
98+
"API_CACHE_REDIS_TLS_ENABLED": "true",
9899
},
99100
expectedAppConfig: &AppConfig{
100-
ApiRateLimiterEnabled: true,
101-
ApiHost: "custom-host:8080",
102-
AwsRegion: "aws-region",
103-
DbEndpoint: "http://localhost:8000",
104-
DbAwsRegion: "db-aws-region",
105-
DbTableName: "cluster-registry-local",
106-
DbIndexName: "search-index-local",
107-
LogLevel: log.DEBUG,
108-
OidcClientId: "oidc-client-id",
109-
OidcIssuerUrl: "http://fake-oidc-provider",
110-
SqsEndpoint: "http://localhost:9324",
111-
SqsAwsRegion: "sqs-aws-region",
112-
SqsQueueName: "cluster-registry-local",
113-
SqsBatchSize: 10,
114-
SqsWaitSeconds: 5,
115-
SqsRunInterval: 30,
116-
K8sResourceId: "k8s-resource-id",
117-
ApiTenantId: "api-tenant-id",
118-
ApiClientId: "api-client-id",
119-
ApiClientSecret: "api-client-secret",
120-
ApiAuthorizedGroupId: "api-authorized-group-id",
121-
ApiCacheTTL: time.Hour,
122-
ApiCacheRedisHost: "localhost:6379",
101+
ApiRateLimiterEnabled: true,
102+
ApiHost: "custom-host:8080",
103+
AwsRegion: "aws-region",
104+
DbEndpoint: "http://localhost:8000",
105+
DbAwsRegion: "db-aws-region",
106+
DbTableName: "cluster-registry-local",
107+
DbIndexName: "search-index-local",
108+
LogLevel: log.DEBUG,
109+
OidcClientId: "oidc-client-id",
110+
OidcIssuerUrl: "http://fake-oidc-provider",
111+
SqsEndpoint: "http://localhost:9324",
112+
SqsAwsRegion: "sqs-aws-region",
113+
SqsQueueName: "cluster-registry-local",
114+
SqsBatchSize: 10,
115+
SqsWaitSeconds: 5,
116+
SqsRunInterval: 30,
117+
K8sResourceId: "k8s-resource-id",
118+
ApiTenantId: "api-tenant-id",
119+
ApiClientId: "api-client-id",
120+
ApiClientSecret: "api-client-secret",
121+
ApiAuthorizedGroupId: "api-authorized-group-id",
122+
ApiCacheTTL: time.Hour,
123+
ApiCacheRedisHost: "localhost:6379",
124+
ApiCacheRedisTLSEnabled: true,
123125
},
124126
expectedError: nil,
125127
},

0 commit comments

Comments
 (0)