flower icon indicating copy to clipboard operation
flower copied to clipboard

add ssl support for redis with sentinel

Open cyberjunk opened this issue 1 year ago • 1 comments

flower can already connect to sentinel using tls by setting sentinel_kwargs in broker_options accordingly, e.g.:

'sentinel_kwargs': { 'ssl': True, 'ssl_cert_reqs': ssl.CERT_NONE }

to enable tls to sentinel without sending any client certificate or validating the server certificate. this will be passed to the Sentinel() constructor and works fine for the connection from flower to sentinel.

however, this is only one of the two connections made from flower in a sentinel+redis setup... the next connection which is made to the returned redis master was always without tls.

to make the connection to redis also use tls, one has to pass the according ssl related connection_kwargs to Sentinel() constructor.

I adapted the code from the existing encrypted redis-only case by reusing broker_use_ssl settings in the sentinel+redis setup to configure whether the connection to redis should be made using tls or not. checking if broker_use_ssl is defined, and if so, set ssl to True and inject the parameters provided in broker_use_ssl for the connection from flower to redis. this way flower can be configured to use tls on both, the sentinel AND the redis connection using existing configuration settings and it's working fine for me now...

PS: This also fixes a 500 error for redis+sentinel on /broker route with a server error 104 - Connection reset by peer indicating that connection to redis was made without tls.

cyberjunk avatar Sep 25 '23 12:09 cyberjunk

Thanks for the pull request! Can you add unit tests?

mher avatar Sep 27 '23 11:09 mher