From c61ba759dd09a098b773623b38214b8259517257 Mon Sep 17 00:00:00 2001 From: Kilian Date: Fri, 2 Oct 2020 00:25:48 +0100 Subject: [PATCH] Add redis use_tls cfg (#2311) Adding config parameter 'redis.use_tls' to enable tls communications with redis e.g. AWS ElastiCache Closes #2247 --- cmd/fleet/serve.go | 2 +- server/config/config.go | 3 +++ server/live_query/redis_live_query_test.go | 3 ++- server/pubsub/query_results_test.go | 3 ++- server/pubsub/redis_query_results.go | 4 ++-- server/sso/session_store_test.go | 3 ++- 6 files changed, 12 insertions(+), 6 deletions(-) diff --git a/cmd/fleet/serve.go b/cmd/fleet/serve.go index 359999333f..e14cad434f 100644 --- a/cmd/fleet/serve.go +++ b/cmd/fleet/serve.go @@ -176,7 +176,7 @@ the way that the Fleet server works. } } - redisPool := pubsub.NewRedisPool(config.Redis.Address, config.Redis.Password, config.Redis.Database) + redisPool := pubsub.NewRedisPool(config.Redis.Address, config.Redis.Password, config.Redis.Database, config.Redis.UseTLS) resultStore := pubsub.NewRedisQueryResults(redisPool) liveQueryStore := live_query.NewRedisLiveQuery(redisPool) ssoSessionStore := sso.NewSessionStore(redisPool) diff --git a/server/config/config.go b/server/config/config.go index 393a0c608f..e28636fb1a 100644 --- a/server/config/config.go +++ b/server/config/config.go @@ -37,6 +37,7 @@ type RedisConfig struct { Address string Password string Database int + UseTLS bool `yaml:"use_tls"` } const ( @@ -182,6 +183,7 @@ func (man Manager) addConfigs() { "Redis server password (prefer env variable for security)") man.addConfigInt("redis.database", 0, "Redis server database number") + man.addConfigBool("redis.use_tls", false, "Redis server enable TLS") // Server man.addConfigString("server.address", "0.0.0.0:8080", @@ -309,6 +311,7 @@ func (man Manager) LoadConfig() KolideConfig { Address: man.getConfigString("redis.address"), Password: man.getConfigString("redis.password"), Database: man.getConfigInt("redis.database"), + UseTLS: man.getConfigBool("redis.use_tls"), }, Server: ServerConfig{ Address: man.getConfigString("server.address"), diff --git a/server/live_query/redis_live_query_test.go b/server/live_query/redis_live_query_test.go index bf66f17e13..deffab8da5 100644 --- a/server/live_query/redis_live_query_test.go +++ b/server/live_query/redis_live_query_test.go @@ -30,13 +30,14 @@ func setupRedisLiveQuery(t *testing.T) (store *redisLiveQuery, teardown func()) addr = "127.0.0.1:6379" password = "" database = 0 + useTLS = false ) if a, ok := os.LookupEnv("REDIS_PORT_6379_TCP_ADDR"); ok { addr = fmt.Sprintf("%s:6379", a) } - store = NewRedisLiveQuery(pubsub.NewRedisPool(addr, password, database)) + store = NewRedisLiveQuery(pubsub.NewRedisPool(addr, password, database, useTLS)) _, err := store.pool.Get().Do("PING") require.NoError(t, err) diff --git a/server/pubsub/query_results_test.go b/server/pubsub/query_results_test.go index aea9c631ff..89ffc68453 100644 --- a/server/pubsub/query_results_test.go +++ b/server/pubsub/query_results_test.go @@ -65,13 +65,14 @@ func setupRedis(t *testing.T) (store *redisQueryResults, teardown func()) { addr = "127.0.0.1:6379" password = "" database = 0 + useTLS = false ) if a, ok := os.LookupEnv("REDIS_PORT_6379_TCP_ADDR"); ok { addr = fmt.Sprintf("%s:6379", a) } - store = NewRedisQueryResults(NewRedisPool(addr, password, database)) + store = NewRedisQueryResults(NewRedisPool(addr, password, database, useTLS)) _, err := store.pool.Get().Do("PING") require.Nil(t, err) diff --git a/server/pubsub/redis_query_results.go b/server/pubsub/redis_query_results.go index 9fd307358b..eff645a7a6 100644 --- a/server/pubsub/redis_query_results.go +++ b/server/pubsub/redis_query_results.go @@ -20,12 +20,12 @@ var _ kolide.QueryResultStore = &redisQueryResults{} // NewRedisPool creates a Redis connection pool using the provided server // address, password and database. -func NewRedisPool(server, password string, database int) *redis.Pool { +func NewRedisPool(server, password string, database int, useTLS bool) *redis.Pool { return &redis.Pool{ MaxIdle: 3, IdleTimeout: 240 * time.Second, Dial: func() (redis.Conn, error) { - c, err := redis.Dial("tcp", server, redis.DialDatabase(database)) + c, err := redis.Dial("tcp", server, redis.DialDatabase(database), redis.DialUseTLS(useTLS)) if err != nil { return nil, err } diff --git a/server/sso/session_store_test.go b/server/sso/session_store_test.go index 92248364a6..ed0aed77f8 100644 --- a/server/sso/session_store_test.go +++ b/server/sso/session_store_test.go @@ -18,12 +18,13 @@ func newPool(t *testing.T) *redis.Pool { addr = "127.0.0.1:6379" password = "" database = 0 + useTLS = false ) if a, ok := os.LookupEnv("REDIS_PORT_6379_TCP_ADDR"); ok { addr = fmt.Sprintf("%s:6379", a) } - p := pubsub.NewRedisPool(addr, password, database) + p := pubsub.NewRedisPool(addr, password, database, useTLS) _, err := p.Get().Do("PING") require.Nil(t, err) return p