Reinstate "Add TLS support for Redis Sentinel"
What does this MR do and why?
Recreates Add TLS support for Redis Sentinel (!162132 - merged) with a fix.
This MR adds TLS support when configuring Redis Sentinel.
Related: Add TLS support for redis sentinel in workhorse (#421656 - closed)
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
How to set up and validate locally
The following steps set up a new Redis Sentinel cluster (with TLS and TLS replication) using https://gitlab.com/ashmckenzie/redis-sentinel and configure Workhorse to connect directly to it. It's a bit of a cheat as the Rails app won't be connecting to it, but will suffice for this MR:
- Clone https://gitlab.com/ashmckenzie/redis-sentinel locally into
/tmp
:cd /tmp git clone https://gitlab.com/ashmckenzie/redis-sentinel.git
- Run the following to ensure Redis will be built with TLS support and then
make setup
to install necessary software and create SSL certs:cd redis-sentinel make setup
- Start up the Redis Sentinel cluster by running
make run
:make run
- You can test the Redis Sentinel cluster is running correctly by running
make test
:make test
- Check out this branch
421656-add-tls-support-for-redis-sentinel-in-workhorse
- Ensure your GDK is up and running and you can sign in / projects load etc
- Change into the workhorse dir:
cd gitlab/workhorse
- Update your
config.toml
to be:[redis] # URL = "unix:/<YOUR-GDK-ROOT>/redis/redis.socket" DB = 0 Sentinel = [ "tcp://localhost:26379", "tcp://localhost:26380" ] SentinelMaster = "sentinel-cluster" [Sentinel.tls] certificate = "/tmp/redis-sentinel/certs/server.crt" key = "/tmp/redis-sentinel/certs/server.key" ca_certificate = "/tmp/redis-sentinel/certs/ca.crt"
- Build a new workhorse by running:
make && gdk restart workhorse
- Run
gdk tail workhorse
and ensure you see something similar to the following, with no errors:2024-08-08_08:07:34.81008 gitlab-workhorse : redis: 2024/08/08 18:07:34 sentinel.go:706: sentinel: new master="sentinel-cluster" addr="127.0.0.1:63791"
- Back in
/tmp/redis-sentinel
in theMakefile
there are configured targets to kill the primary/secondary and sentinels to test. There is however an issue where the primary doesn't correctly begin replicating after killed due to a TLS error? It's beyond the scope of this MR, but it would be nice to fix😉
Edited by Vasilii Iakliushin