redisconn: add an Azure Entra ID credentials provider for Azure Managed Redis

Aperta
  • Qualcosa non va?
#466 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
54/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
azure, go
Ambito
authentication, backend

Direzione di ricerca

Start with redisconn's DynamicAuth.CredentialsProviderContext and postgres/azuread.go, then read the existing credential-provider tests and cluster and sentinel client builders. Implement and test the Azure provider against the listed acceptance criteria, including token scope, username, token errors, and static password validation. Done means those unit tests pass and package docs cover TLS, port 10000, and access policy assignment.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

needs-triage

Summary

Add an Azure Entra ID credential provider to redisconn, so clients can authenticate to Azure Managed Redis with a short-lived Entra token instead of a static password.

Why

Azure Managed Redis does not support static Redis ACL users. Per-identity permissions (custom data access policies) are only available to Entra identities, whose "password" is an access token that expires (about an hour). A static Password stops working once the token expires, so the only static option is the instance access key, which grants full access to the whole instance.

redisconn already has the seam for this: DynamicAuth.CredentialsProviderContext is called for every new connection and is threaded through the standalone, cluster and sentinel clients. What is missing is an Azure implementation. postgres/azuread.go already does the equivalent for Azure Database for PostgreSQL and is the pattern to follow.

Proposed shape

  • A constructor (or a DynamicAuth backend field mirroring postgres.DynamicAuthConfig.AzureAD) built on azidentity.DefaultAzureCredential: workload identity, managed identity, AZURE_CLIENT_ID for a user-assigned identity.
  • Token scope https://redis.azure.com/.default.
  • Username: the object ID of the identity, which Azure Managed Redis requires. Allow an explicit override, and derive it from the token's oid claim when unset.
  • Construct the credential once; azidentity caches and refreshes the token, so the per-connection cost is a cached GetToken.
  • ConnMaxLifetime set below the token lifetime so pooled connections re-authenticate before the token expires.

Acceptance criteria

  • Unit: the provider returns the identity's object ID as username and a token minted for https://redis.azure.com/.default as password, using a fake azcore.TokenCredential. No AT because the token exchange with Azure cannot run in CI; the connection path is covered by the existing CredentialsProviderContext tests.
  • Unit: an error from GetToken surfaces as a wrapped auth error and fails the dial, never a silent fallback to no auth.
  • Unit: setting both a static Password and the Azure provider is refused by Config.Validate, as it is for any other DynamicAuth.
  • Unit: the cluster and sentinel client builders carry the Azure provider through, matching the existing CredentialsProviderContext coverage.
  • Package docs describe the Azure Managed Redis requirements: TLS, port 10000, and an access policy assignment for the identity.
Lingua principale
Go
Stelle
2
Fork
6
Merge medio
23h 44m
PR unite (30g)
133

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di stacklok/toolhive-core

Tutte le issue di stacklok/toolhive-core

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.