redisconn: add an Azure Entra ID credentials provider for Azure Managed Redis

Abierto
  • ¿Algo no está bien?
#466 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
54/100
Tipo de issue
Nueva funcionalidad
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
azure, go
Área
authentication, backend

Línea de trabajo

Start with redisconn's DynamicAuth.CredentialsProviderContext and postgres/azuread.go, then read the existing credential-provider tests and cluster and sentinel client builders. Implement and test the Azure provider against the listed acceptance criteria, including token scope, username, token errors, and static password validation. Done means those unit tests pass and package docs cover TLS, port 10000, and access policy assignment.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

needs-triage

Summary

Add an Azure Entra ID credential provider to redisconn, so clients can authenticate to Azure Managed Redis with a short-lived Entra token instead of a static password.

Why

Azure Managed Redis does not support static Redis ACL users. Per-identity permissions (custom data access policies) are only available to Entra identities, whose "password" is an access token that expires (about an hour). A static Password stops working once the token expires, so the only static option is the instance access key, which grants full access to the whole instance.

redisconn already has the seam for this: DynamicAuth.CredentialsProviderContext is called for every new connection and is threaded through the standalone, cluster and sentinel clients. What is missing is an Azure implementation. postgres/azuread.go already does the equivalent for Azure Database for PostgreSQL and is the pattern to follow.

Proposed shape

  • A constructor (or a DynamicAuth backend field mirroring postgres.DynamicAuthConfig.AzureAD) built on azidentity.DefaultAzureCredential: workload identity, managed identity, AZURE_CLIENT_ID for a user-assigned identity.
  • Token scope https://redis.azure.com/.default.
  • Username: the object ID of the identity, which Azure Managed Redis requires. Allow an explicit override, and derive it from the token's oid claim when unset.
  • Construct the credential once; azidentity caches and refreshes the token, so the per-connection cost is a cached GetToken.
  • ConnMaxLifetime set below the token lifetime so pooled connections re-authenticate before the token expires.

Acceptance criteria

  • Unit: the provider returns the identity's object ID as username and a token minted for https://redis.azure.com/.default as password, using a fake azcore.TokenCredential. No AT because the token exchange with Azure cannot run in CI; the connection path is covered by the existing CredentialsProviderContext tests.
  • Unit: an error from GetToken surfaces as a wrapped auth error and fails the dial, never a silent fallback to no auth.
  • Unit: setting both a static Password and the Azure provider is refused by Config.Validate, as it is for any other DynamicAuth.
  • Unit: the cluster and sentinel client builders carry the Azure provider through, matching the existing CredentialsProviderContext coverage.
  • Package docs describe the Azure Managed Redis requirements: TLS, port 10000, and an access policy assignment for the identity.
Lenguaje dominante
Go
Estrellas
2
Forks
6
Merge medio
23 h 44 min
PR fusionados (30 d)
133

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de stacklok/toolhive-core

Todos los issues de stacklok/toolhive-core

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.