Skip to content

Commit 4696b1f

Browse files
wangyeleiwangyelei
committed
chore: redis support tls (#2368)
(cherry picked from commit ce73cc3)
1 parent 5b0e216 commit 4696b1f

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+606
-232
lines changed

‎addons-cluster/redis/templates/_helpers.tpl‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,17 @@
1+
{{- define "redis-cluster.tls" }}
2+
tls: {{ .Values.tlsEnable }}
3+
{{- if .Values.tlsEnable }}
4+
issuer:
5+
name: UserProvided
6+
secretRef:
7+
name: {{ include "kblib.clusterName" . }}-tls
8+
namespace: {{ .Release.Namespace }}
9+
ca: ca.crt
10+
cert: tls.crt
11+
key: tls.key
12+
{{- end }}
13+
{{- end }}
14+
115
{{/*
216
Define redis cluster shardingSpec with ComponentDefinition.
317
*/}}
@@ -6,6 +20,7 @@ Define redis cluster shardingSpec with ComponentDefinition.
620
shards: {{ .Values.redisCluster.shardCount }}
721
template:
822
name: redis
23+
{{- include "redis-cluster.tls" . | indent 4 }}
924
componentDef: redis-cluster
1025
replicas: {{ .Values.replicas }}
1126
{{- if .Values.podAntiAffinityEnabled }}
@@ -111,13 +126,15 @@ Define redis ComponentSpec with ComponentDefinition.
111126
{{- end }}
112127
{{- include "kblib.componentResources" . | indent 2 }}
113128
{{- include "kblib.componentStorages" . | indent 2 }}
129+
{{- include "redis-cluster.tls" . | indent 2 }}
114130
{{- end }}
115131

116132
{{/*
117133
Define redis sentinel ComponentSpec with ComponentDefinition.
118134
*/}}
119135
{{- define "redis-cluster.sentinelComponentSpec" }}
120136
- name: redis-sentinel
137+
{{- include "redis-cluster.tls" . | indent 2 }}
121138
replicas: {{ .Values.sentinel.replicas }}
122139
{{- if .Values.podAntiAffinityEnabled }}
123140
{{- include "redis-cluster.sentinelschedulingPolicy" . | indent 2 }}

‎addons-cluster/redis/templates/secret.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{{- if .Values.tlsEnable }}
2+
{{- $cn := (printf "%s-%s" (include "kblib.clusterName" .) .Release.Namespace) }}
3+
{{- $ca := genCA "KubeBlocks" 36500 -}}
4+
{{- $cert := genSignedCert $cn (list "127.0.0.1" "::1") (list "localhost" "*.svc.cluster.local") 36500 $ca -}}
5+
apiVersion: v1
6+
kind: Secret
7+
metadata:
8+
name: {{ include "kblib.clusterName" . }}-tls
9+
labels: {{ include "kblib.clusterLabels" . | nindent 4 }}
10+
annotations:
11+
self-signed-cert: "true"
12+
type: kubernetes.io/tls
13+
data:
14+
tls.key: {{ $cert.Key | b64enc }}
15+
tls.crt: {{ $cert.Cert | b64enc }}
16+
ca.crt: {{ $ca.Cert | b64enc }}
17+
{{- end }}

‎addons-cluster/redis/values.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,3 +105,5 @@ extra:
105105

106106
prometheus:
107107
enabled: false
108+
109+
tlsEnable: false

‎addons/redis/config/redis-cluster6-config-constraint.cue‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -366,6 +366,41 @@
366366
"aof-use-rdb-preamble": string & "yes" | "no" | *"yes"
367367

368368
"activerehashing": string & "yes" | "no" | *"yes"
369+
370+
// By default, TLS/SSL is disabled. To enable it, the "tls-port" configuration
371+
// directive can be used to define TLS-listening ports. To enable TLS on the
372+
// default port, use 7379 and set port to 0
373+
"tls-port": int | *0
374+
375+
// Configure a X.509 certificate and private key to use for authenticating the server to connected clients, masters or cluster peers. These files should be PEM formatted.
376+
"tls-cert-file": string | *"redis.crt"
377+
378+
"tls-key-file": string | *"redis.key"
379+
380+
"tls-ca-cert-file": string | *""
381+
382+
"tls-ca-cert-dir": string | *""
383+
384+
"tls-auth-clients": string & "optional" | "no" | *""
385+
386+
"tls-replication": string & "yes" | "no" | *"no"
387+
388+
// By default, TLS session caching is enabled to allow faster and less expensive
389+
// reconnections by clients that support it. Use the following directive to disable
390+
// caching.
391+
"tls-session-caching": string & "yes" | "no" | *"yes"
392+
393+
// Change the default number of TLS sessions cached. A zero value sets the cache
394+
// to unlimited size. The default size is 20480.
395+
"tls-session-cache-size": int | *20480
396+
397+
// Change the default timeout of cached TLS sessions. The default timeout is 300
398+
// seconds.
399+
"tls-session-cache-timeout": int | *300
400+
401+
"tls-cluster": string & "yes" | "no" | *"no"
402+
403+
"cluster-announce-tls-port": int | *0
369404
...
370405
}
371406

‎addons/redis/config/redis-cluster6-config.tpl‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,3 +86,13 @@ cluster-replica-validity-factor 0
8686
cluster-require-full-coverage yes
8787
cluster-allow-reads-when-down no
8888

89+
{{- if eq (index $ "TLS_ENABLED") "true" }}
90+
tls-cert-file {{ $.TLS_MOUNT_PATH }}/tls.crt
91+
tls-key-file {{ $.TLS_MOUNT_PATH }}/tls.key
92+
tls-ca-cert-file {{ $.TLS_MOUNT_PATH }}/ca.crt
93+
tls-auth-clients no
94+
tls-replication yes
95+
tls-cluster yes
96+
port 0
97+
{{- end -}}
98+

‎addons/redis/config/redis-cluster7-config-constraint.cue‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -383,6 +383,42 @@
383383
"aof-use-rdb-preamble": string & "yes" | "no" | *"yes"
384384

385385
"activerehashing": string & "yes" | "no" | *"yes"
386+
387+
// By default, TLS/SSL is disabled. To enable it, the "tls-port" configuration
388+
// directive can be used to define TLS-listening ports. To enable TLS on the
389+
// default port, use 7379 and set port to 0
390+
"tls-port": int | *0
391+
392+
// Configure a X.509 certificate and private key to use for authenticating the server to connected clients, masters or cluster peers. These files should be PEM formatted.
393+
"tls-cert-file": string | *"redis.crt"
394+
395+
"tls-key-file": string | *"redis.key"
396+
397+
"tls-ca-cert-file": string | *""
398+
399+
"tls-ca-cert-dir": string | *""
400+
401+
"tls-auth-clients": string & "optional" | "no" | *""
402+
403+
"tls-replication": string & "yes" | "no" | *"no"
404+
405+
// By default, TLS session caching is enabled to allow faster and less expensive
406+
// reconnections by clients that support it. Use the following directive to disable
407+
// caching.
408+
"tls-session-caching": string & "yes" | "no" | *"yes"
409+
410+
// Change the default number of TLS sessions cached. A zero value sets the cache
411+
// to unlimited size. The default size is 20480.
412+
"tls-session-cache-size": int | *20480
413+
414+
// Change the default timeout of cached TLS sessions. The default timeout is 300
415+
// seconds.
416+
"tls-session-cache-timeout": int | *300
417+
418+
"tls-cluster": string & "yes" | "no" | *"no"
419+
420+
"cluster-announce-tls-port": int | *0
421+
386422
...
387423
}
388424

‎addons/redis/config/redis-cluster7-config.tpl‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,4 +90,14 @@ maxmemory-policy volatile-lru
9090
{{- $request_memory := default 0 $.PHY_MEMORY | int }}
9191
{{- if gt $request_memory 0 }}
9292
maxmemory {{ mulf $request_memory 0.8 | int }}
93-
{{- end }}
93+
{{- end }}
94+
95+
{{- if eq (index $ "TLS_ENABLED") "true" }}
96+
tls-cert-file {{ $.TLS_MOUNT_PATH }}/tls.crt
97+
tls-key-file {{ $.TLS_MOUNT_PATH }}/tls.key
98+
tls-ca-cert-file {{ $.TLS_MOUNT_PATH }}/ca.crt
99+
tls-auth-clients no
100+
tls-replication yes
101+
tls-cluster yes
102+
port 0
103+
{{- end -}}

‎addons/redis/config/redis-cluster8-config-constraint.cue‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -687,6 +687,42 @@
687687
"aof-use-rdb-preamble": string & "yes" | "no" | *"yes"
688688

689689
"activerehashing": string & "yes" | "no" | *"yes"
690+
691+
// By default, TLS/SSL is disabled. To enable it, the "tls-port" configuration
692+
// directive can be used to define TLS-listening ports. To enable TLS on the
693+
// default port, use 7379 and set port to 0
694+
"tls-port": int | *0
695+
696+
// Configure a X.509 certificate and private key to use for authenticating the server to connected clients, masters or cluster peers. These files should be PEM formatted.
697+
"tls-cert-file": string | *"redis.crt"
698+
699+
"tls-key-file": string | *"redis.key"
700+
701+
"tls-ca-cert-file": string | *""
702+
703+
"tls-ca-cert-dir": string | *""
704+
705+
"tls-auth-clients": string & "optional" | "no" | *""
706+
707+
"tls-replication": string & "yes" | "no" | *"no"
708+
709+
// By default, TLS session caching is enabled to allow faster and less expensive
710+
// reconnections by clients that support it. Use the following directive to disable
711+
// caching.
712+
"tls-session-caching": string & "yes" | "no" | *"yes"
713+
714+
// Change the default number of TLS sessions cached. A zero value sets the cache
715+
// to unlimited size. The default size is 20480.
716+
"tls-session-cache-size": int | *20480
717+
718+
// Change the default timeout of cached TLS sessions. The default timeout is 300
719+
// seconds.
720+
"tls-session-cache-timeout": int | *300
721+
722+
"tls-cluster": string & "yes" | "no" | *"no"
723+
724+
"cluster-announce-tls-port": int | *0
725+
690726
...
691727
}
692728

‎addons/redis/config/redis-cluster8-config.tpl‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,3 +91,13 @@ maxmemory-policy volatile-lru
9191
{{- if gt $request_memory 0 }}
9292
maxmemory {{ mulf $request_memory 0.8 | int }}
9393
{{- end }}
94+
95+
{{- if eq (index $ "TLS_ENABLED") "true" }}
96+
tls-cert-file {{ $.TLS_MOUNT_PATH }}/tls.crt
97+
tls-key-file {{ $.TLS_MOUNT_PATH }}/tls.key
98+
tls-ca-cert-file {{ $.TLS_MOUNT_PATH }}/ca.crt
99+
tls-auth-clients no
100+
tls-replication yes
101+
tls-cluster yes
102+
port 0
103+
{{- end -}}

‎addons/redis/config/redis6-config-constraint.cue‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -376,6 +376,38 @@
376376
"aof-use-rdb-preamble": string & "yes" | "no" | *"yes"
377377

378378
"activerehashing": string & "yes" | "no" | *"yes"
379+
380+
// By default, TLS/SSL is disabled. To enable it, the "tls-port" configuration
381+
// directive can be used to define TLS-listening ports. To enable TLS on the
382+
// default port, use 7379 and set port to 0
383+
"tls-port": int | *0
384+
385+
// Configure a X.509 certificate and private key to use for authenticating the server to connected clients, masters or cluster peers. These files should be PEM formatted.
386+
"tls-cert-file": string | *"redis.crt"
387+
388+
"tls-key-file": string | *"redis.key"
389+
390+
"tls-ca-cert-file": string | *""
391+
392+
"tls-ca-cert-dir": string | *""
393+
394+
"tls-auth-clients": string & "optional" | "no" | *""
395+
396+
"tls-replication": string & "yes" | "no" | *"no"
397+
398+
// By default, TLS session caching is enabled to allow faster and less expensive
399+
// reconnections by clients that support it. Use the following directive to disable
400+
// caching.
401+
"tls-session-caching": string & "yes" | "no" | *"yes"
402+
403+
// Change the default number of TLS sessions cached. A zero value sets the cache
404+
// to unlimited size. The default size is 20480.
405+
"tls-session-cache-size": int | *20480
406+
407+
// Change the default timeout of cached TLS sessions. The default timeout is 300
408+
// seconds.
409+
"tls-session-cache-timeout": int | *300
410+
379411
...
380412
}
381413

0 commit comments

Comments
 (0)