Skip to content

Commit 7493734

Browse files
Steffen911claude
Steffen911
and
claude
authored
fix: support passwordless Redis by conditionally building auth segment (#292)
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
1 parent cab27df commit 7493734

File tree

4 files changed

+127
-5
lines changed

4 files changed

+127
-5
lines changed

‎charts/langfuse/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -208,8 +208,8 @@ Open source LLM engineering platform - LLM observability, metrics, evaluations,
208208
| redis.auth.database | int | `0` | |
209209
| redis.auth.existingSecret | string | `""` | If you want to use an existing secret for the redis password, set the name of the secret here. (`redis.auth.password` will be ignored and picked up from this secret). |
210210
| redis.auth.existingSecretPasswordKey | string | `""` | The key in the existing secret that contains the password. |
211-
| redis.auth.password | string | `""` | Configure the password by value or existing secret reference. Use URL-encoded passwords or avoid special characters in the password. |
212-
| redis.auth.username | string | `"default"` | Username to use to connect to the redis database deployed with Langfuse. In case `redis.deploy` is set to `true`, the user will be created automatically. Set to null for an empty username in the connection string. |
211+
| redis.auth.password | string | `""` | Password for Redis authentication. Set to null to disable authentication (for passwordless Redis like AWS ElastiCache without auth). Use URL-encoded passwords or avoid special characters in the password. |
212+
| redis.auth.username | string | `"default"` | Username for Redis authentication. Set to null to omit username from connection string entirely. In case `redis.deploy` is set to `true`, the user will be created automatically. |
213213
| redis.cluster.enabled | bool | `false` | Set to `true` to enable Redis Cluster mode. When enabled, you must set `redis.deploy` to `false` and provide cluster nodes. |
214214
| redis.cluster.nodes | list | `[]` | List of Redis cluster nodes in the format "host:port". Example: ["redis-1:6379", "redis-2:6379", "redis-3:6379"] |
215215
| redis.deploy | bool | `true` | Enable valkey deployment (via Bitnami Helm Chart). If you want to use a Redis or Valkey server already deployed, set to false. |

‎charts/langfuse/templates/_helpers.tpl‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -341,7 +341,17 @@ Get value of a specific environment variable from additionalEnv if it exists
341341
- name: REDIS_TLS_ENABLED
342342
value: {{ .Values.redis.tls.enabled | quote }}
343343
- name: REDIS_CONNECTION_STRING
344-
value: "{{ if .Values.redis.tls.enabled }}rediss{{ else }}redis{{ end }}://{{ .Values.redis.auth.username }}:$(REDIS_PASSWORD)@{{ include "langfuse.redis.hostname" . }}:{{ .Values.redis.port }}/{{ .Values.redis.auth.database }}"
344+
{{- $hasPassword := or .Values.redis.auth.existingSecret .Values.redis.auth.password }}
345+
{{- $hasUsername := .Values.redis.auth.username }}
346+
{{- $authPart := "" }}
347+
{{- if and $hasUsername $hasPassword }}
348+
{{- $authPart = printf "%s:$(REDIS_PASSWORD)@" .Values.redis.auth.username }}
349+
{{- else if $hasPassword }}
350+
{{- $authPart = ":$(REDIS_PASSWORD)@" }}
351+
{{- else if $hasUsername }}
352+
{{- $authPart = printf "%s@" .Values.redis.auth.username }}
353+
{{- end }}
354+
value: "{{ if .Values.redis.tls.enabled }}rediss{{ else }}redis{{ end }}://{{ $authPart }}{{ include "langfuse.redis.hostname" . }}:{{ .Values.redis.port }}/{{ .Values.redis.auth.database }}"
345355
{{- end }}
346356
{{- if .Values.redis.tls.enabled }}
347357
{{- if .Values.redis.tls.caPath }}

‎charts/langfuse/tests/redis-cluster_test.yaml‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -438,3 +438,113 @@ tests:
438438
content:
439439
name: REDIS_TLS_CA_PATH
440440
template: web/deployment.yaml
441+
442+
# =====================================================
443+
# PASSWORDLESS REDIS TESTS (Issue #291, #273)
444+
# =====================================================
445+
446+
- it: should handle standalone mode without authentication (null password and username)
447+
values:
448+
- ../values.lint.yaml
449+
set:
450+
redis.deploy: false
451+
redis.host: "my-redis.example.com"
452+
redis.port: 6379
453+
redis.auth.password: null
454+
redis.auth.username: null
455+
asserts:
456+
# Web deployment should have REDIS_CONNECTION_STRING without auth segment
457+
- contains:
458+
path: spec.template.spec.containers[0].env
459+
content:
460+
name: REDIS_CONNECTION_STRING
461+
value: "redis://my-redis.example.com:6379/0"
462+
template: web/deployment.yaml
463+
# Web deployment should NOT have REDIS_PASSWORD when password is null
464+
- notContains:
465+
path: spec.template.spec.containers[0].env
466+
content:
467+
name: REDIS_PASSWORD
468+
template: web/deployment.yaml
469+
# Worker deployment should have same connection string
470+
- contains:
471+
path: spec.template.spec.containers[0].env
472+
content:
473+
name: REDIS_CONNECTION_STRING
474+
value: "redis://my-redis.example.com:6379/0"
475+
template: worker/deployment.yaml
476+
477+
- it: should handle standalone mode with username but no password (null password)
478+
values:
479+
- ../values.lint.yaml
480+
set:
481+
redis.deploy: false
482+
redis.host: "my-redis.example.com"
483+
redis.port: 6379
484+
redis.auth.password: null
485+
redis.auth.username: "default"
486+
asserts:
487+
# Web deployment should have REDIS_CONNECTION_STRING with username only
488+
- contains:
489+
path: spec.template.spec.containers[0].env
490+
content:
491+
name: REDIS_CONNECTION_STRING
492+
value: "redis://default@my-redis.example.com:6379/0"
493+
template: web/deployment.yaml
494+
# Web deployment should NOT have REDIS_PASSWORD when password is null
495+
- notContains:
496+
path: spec.template.spec.containers[0].env
497+
content:
498+
name: REDIS_PASSWORD
499+
template: web/deployment.yaml
500+
501+
- it: should handle standalone mode with TLS but no authentication
502+
values:
503+
- ../values.lint.yaml
504+
set:
505+
redis.deploy: false
506+
redis.host: "my-redis.example.com"
507+
redis.port: 6380
508+
redis.auth.password: null
509+
redis.auth.username: null
510+
redis.tls.enabled: true
511+
asserts:
512+
# Web deployment should have REDIS_CONNECTION_STRING with rediss:// and no auth
513+
- contains:
514+
path: spec.template.spec.containers[0].env
515+
content:
516+
name: REDIS_CONNECTION_STRING
517+
value: "rediss://my-redis.example.com:6380/0"
518+
template: web/deployment.yaml
519+
# Web deployment should have REDIS_TLS_ENABLED=true
520+
- contains:
521+
path: spec.template.spec.containers[0].env
522+
content:
523+
name: REDIS_TLS_ENABLED
524+
value: "true"
525+
template: web/deployment.yaml
526+
527+
- it: should include password segment when password is set (existing behavior)
528+
values:
529+
- ../values.lint.yaml
530+
set:
531+
redis.deploy: false
532+
redis.host: "my-redis.example.com"
533+
redis.port: 6379
534+
redis.auth.password: "testPassword123"
535+
redis.auth.username: "default"
536+
asserts:
537+
# Web deployment should have REDIS_CONNECTION_STRING with full auth
538+
- contains:
539+
path: spec.template.spec.containers[0].env
540+
content:
541+
name: REDIS_CONNECTION_STRING
542+
value: "redis://default:$(REDIS_PASSWORD)@my-redis.example.com:6379/0"
543+
template: web/deployment.yaml
544+
# Web deployment should have REDIS_PASSWORD
545+
- contains:
546+
path: spec.template.spec.containers[0].env
547+
content:
548+
name: REDIS_PASSWORD
549+
value: "testPassword123"
550+
template: web/deployment.yaml

‎charts/langfuse/values.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -475,9 +475,11 @@ redis:
475475

476476
# Authentication configuration
477477
auth:
478-
# -- Username to use to connect to the redis database deployed with Langfuse. In case `redis.deploy` is set to `true`, the user will be created automatically. Set to null for an empty username in the connection string.
478+
# -- Username for Redis authentication. Set to null to omit username from connection string entirely.
479+
# In case `redis.deploy` is set to `true`, the user will be created automatically.
479480
username: "default"
480-
# -- Configure the password by value or existing secret reference. Use URL-encoded passwords or avoid special characters in the password.
481+
# -- Password for Redis authentication. Set to null to disable authentication (for passwordless Redis like AWS ElastiCache without auth).
482+
# Use URL-encoded passwords or avoid special characters in the password.
481483
password: ""
482484
# -- If you want to use an existing secret for the redis password, set the name of the secret here. (`redis.auth.password` will be ignored and picked up from this secret).
483485
existingSecret: ""

0 commit comments

Comments
 (0)