docker-redis-cluster
docker-redis-cluster copied to clipboard
Add TLS support.
This is a continuation of #99 and #103 to attempt to add support of TLS to docker-redis-cluster. Its basically the same as #103 with some small changes, and the cert files are removed from the PR.
- When TLS is enabled, the regular TCP port is disabled (binded to port 0) and the configured port is used as a TLS only port.
- This change has been tested by building all versions (
invoke build all
, i.e currently 3.0.0 to 6.2.1), and the BUILD_TLS flag only effects Redis 6 and forward. - Each built container has been tested OK when connecting using
redis-cli
both from within the container and from outside container. - Enabling TLS using the env.
-e TLS=true
only works for Redis 6. Older version will not handle theredis-cli
flag-tls
- Since there was problems regarding cert handling pre-6.0.6, TLS only works fine from Redis 6.0.6
This PR requires additional files to be created by the maintainer using the following steps
# Generate Certificate Authority's private key and cert
mkdir -p tls-certs
openssl genrsa -out tls-certs/ca.key 4096
openssl req \
-x509 -new -nodes -sha256 \
-key tls-certs/ca.key \
-days 3650 \
-subj '/O=Redis Cluster Test/CN=Certificate Authority' \
-out tls-certs/ca.crt
# Generate Redis Cluster private key and a cert signed by CA
openssl genrsa -out tls-certs/redis.key 2048
openssl req \
-new -sha256 \
-key tls-certs/redis.key \
-subj '/O=Redis Cluster Test/CN=Server' | \
openssl x509 \
-req -sha256 \
-CA tls-certs/ca.crt \
-CAkey tls-certs/ca.key \
-CAserial tls-certs/ca.txt \
-CAcreateserial \
-days 3650 \
-out tls-certs/redis.crt
# Adding needed files
git add tls-certs/ca.crt tls-certs/ca.key tls-certs/redis.crt tls-certs/redis.key
CI fails due to the required files are not existing yet, i.e: tls-certs/ca.crt tls-certs/ca.key tls-certs/redis.crt tls-certs/redis.key