mirror of
https://github.com/hanzokv/go.git
synced 2026-09-24 00:31:51 +00:00
f25343d281
* chore(tests): add tls tests * fix: Use ShardPicker for keyless commands instead of random slot - cmdSlot now returns -1 for keyless commands instead of RandomSlot() - This allows cmdNodeWithShardPicker to use the configured ShardPicker (default: RoundRobinPicker) for keyless command routing - Updated mapCmdsByNode to handle slot == -1 by using ShardPicker - Updated test to verify round robin distribution works correctly * chore(image): update clients-test-lib image * chore(tests): enable tls user auth test * chore(docker): use proper envs for test image * chore(image): use latest build * chore(image): use latest build * fix(tests): use the correct root cert * feat(tls): add example app * chore(docker): address pr comments * chore(tests): address pr comments * chore(doc): add README.md in the example app * fix(tests): do not skip tests * fix(tests): skip only because of redis version * Extracts default image name in a var (including osscluster-tls) Signed-off-by: Elena Kolevska <[email protected]> * fix(tlstests): remove redundent test --------- Signed-off-by: Elena Kolevska <[email protected]> Co-authored-by: Elena Kolevska <[email protected]>
2.3 KiB
2.3 KiB
TLS Connection Examples
Shows different ways to connect to Redis over TLS.
Running
Start Redis with TLS:
cd ../..
docker compose --profile standalone up -d
Then run the example:
go run .
Connection Methods
1. InsecureSkipVerify (for testing)
Quick way to test with self-signed certs:
client := redis.NewClient(&redis.Options{
Addr: "localhost:6666",
TLSConfig: &tls.Config{
InsecureSkipVerify: true,
},
})
Don't use this in production.
2. With CA certificate
Proper way for production:
caCert, _ := os.ReadFile("path/to/ca.crt")
caCertPool := x509.NewCertPool()
caCertPool.AppendCertsFromPEM(caCert)
client := redis.NewClient(&redis.Options{
Addr: "localhost:6666",
TLSConfig: &tls.Config{
RootCAs: caCertPool,
ServerName: "localhost",
},
})
3. Mutual TLS
If Redis requires client certs:
caCert, _ := os.ReadFile("path/to/ca.crt")
caCertPool := x509.NewCertPool()
caCertPool.AppendCertsFromPEM(caCert)
cert, _ := tls.LoadX509KeyPair("path/to/client.crt", "path/to/client.key")
client := redis.NewClient(&redis.Options{
Addr: "localhost:6666",
TLSConfig: &tls.Config{
RootCAs: caCertPool,
Certificates: []tls.Certificate{cert},
ServerName: "localhost",
},
})
4. Using rediss:// URL
opt, _ := redis.ParseURL("rediss://localhost:6666")
opt.TLSConfig = &tls.Config{
InsecureSkipVerify: true, // for testing only
}
client := redis.NewClient(opt)
5. Certificate-based auth
Redis 6.2+ can authenticate users based on the certificate CN field. You need to configure Redis with:
tls-auth-clients optional
tls-auth-clients-user CN
Then the CN in your client cert becomes your username - no password needed.
Check ../../tls_cert_auth_test.go for a working example that:
- Generates a client cert with a specific CN
- Connects to Redis with that cert
- Verifies auth based on the CN
Note: Current Redis test build doesn't support this yet, so the test skips gracefully.
Tests
Run the TLS tests:
go test -v -run "^TestTLS" -timeout 30s
Notes
- Always verify certs in production (don't use InsecureSkipVerify)
- Keep your private keys safe
- Use TLS 1.2 or higher