feat(redis): add support for specifying external Redis username

charts/diode/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: diode
 description: A Helm chart for Diode
 type: application
-version: "1.9.1"
+version: "1.10.0"
 appVersion: "1.5.0"
 home: https://github.com/netboxlabs/diode
 sources:

charts/diode/README.md

@@ -2,7 +2,7 @@
 
 A Helm chart for Diode
 
-![Version: 1.9.1](https://img.shields.io/badge/Version-1.9.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.0](https://img.shields.io/badge/AppVersion-1.5.0-informational?style=flat-square)
+![Version: 1.10.0](https://img.shields.io/badge/Version-1.10.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.0](https://img.shields.io/badge/AppVersion-1.5.0-informational?style=flat-square)
 
 ## Prerequisites
 
@@ -319,6 +319,7 @@ helm show values diode/diode
 | externalRedis.tls.clientKeyPath | string | `""` | path to client private key for mutual TLS |
 | externalRedis.tls.enabled | bool | `false` | enable TLS |
 | externalRedis.tls.skipVerify | bool | `false` | skip TLS verify |
+| externalRedis.username | string | `""` | username (optional, Redis 6+) |
 | global.commonAnnotations | object | `{}` | common annotations for all resources |
 | global.commonLabels | object | `{}` | common labels for all resources |
 | global.diode | object | `{"busybox":{"image":"busybox:latest","imagePullPolicy":"IfNotPresent"},"hydra":{"waitForPostgres":true},"ingester":{"waitForRedis":true},"reconciler":{"waitForPostgres":true,"waitForRedis":true}}` | diode global configuration |

charts/diode/templates/_helpers.tpl

@@ -291,6 +291,19 @@ Create the port of the Redis database
 {{- end }}
 {{- end }}
 
+{{/*
+Create the username of the Redis database
+*/}}
+{{- define "diode.redis.username" -}}
+{{- if .Values.redis.enabled -}}
+{{- printf "" }}
+{{- else if and .Values.externalRedis (hasKey .Values.externalRedis "username") -}}
+{{- .Values.externalRedis.username }}
+{{- else -}}
+{{- fail "externalRedis.username must be defined when redis.enabled is false" }}
+{{- end }}
+{{- end }}
+
 {{/*
 Create the database name for PostgreSQL
 */}}

charts/diode/templates/diode-ingester-configmap.yaml

@@ -17,6 +17,7 @@ data:
   SENTRY_DSN: {{ $config.sentryDsn | quote }}
   REDIS_HOST: {{ include "diode.redis.hostname" . | quote }}
   REDIS_PORT: {{ include "diode.redis.port" . | quote }}
+  REDIS_USERNAME: {{ include "diode.redis.username" . | quote }}
   {{- if and .Values.externalRedis.tls .Values.externalRedis.tls.enabled }}
   REDIS_TLS_ENABLED: "true"
   REDIS_TLS_SKIP_VERIFY: {{ .Values.externalRedis.tls.skipVerify | default false | quote }}

charts/diode/templates/diode-reconciler-configmap.yaml

@@ -17,6 +17,7 @@ data:
   SENTRY_DSN: {{ $config.sentryDsn | quote }}
   REDIS_HOST: {{ include "diode.redis.hostname" . | quote }}
   REDIS_PORT: {{ include "diode.redis.port" . | quote }}
+  REDIS_USERNAME: {{ include "diode.redis.username" . | quote }}
   REDIS_DB: {{ $config.redisDb | default "0" | quote }}
   REDIS_STREAM_DB: {{ $config.redisStreamDb | default "1" | quote }}
   {{- if and .Values.externalRedis.tls .Values.externalRedis.tls.enabled }}

charts/diode/values.yaml

@@ -57,6 +57,8 @@ externalRedis:
   hostname: localhost
   # -- port
   port: 6379
+  # -- username (optional, Redis 6+)
+  username: ""
   tls:
     # -- enable TLS
     enabled: false

diode-server/cmd/ingester/main.go

@@ -68,12 +68,16 @@ func main() {
 		os.Exit(1)
 	}
 
-	redisStreamClient := redis.NewClient(&redis.Options{
+	redisOptions := redis.Options{
 		Addr:      fmt.Sprintf("%s:%s", cfg.RedisHost, cfg.RedisPort),
 		Password:  cfg.RedisPassword,
 		DB:        cfg.RedisStreamDB,
 		TLSConfig: redisTLSConfig,
-	})
+	}
+	if cfg.RedisUsername != "" {
+		redisOptions.Username = cfg.RedisUsername
+	}
+	redisStreamClient := redis.NewClient(&redisOptions)
 
 	if _, err := redisStreamClient.Ping(ctx).Result(); err != nil {
 		s.Logger().Error("failed to connect to redis stream", "redisStream", redisStreamClient.String(), "error", err)

diode-server/cmd/reconciler/main.go

@@ -84,25 +84,33 @@ func main() {
 		os.Exit(1)
 	}
 
-	redisClient := redis.NewClient(&redis.Options{
+	redisOptions := redis.Options{
 		Addr:      fmt.Sprintf("%s:%s", cfg.RedisHost, cfg.RedisPort),
 		Password:  cfg.RedisPassword,
 		DB:        cfg.RedisDB,
 		TLSConfig: redisTLSConfig,
-	})
+	}
+	if cfg.RedisUsername != "" {
+		redisOptions.Username = cfg.RedisUsername
+	}
+	redisClient := redis.NewClient(&redisOptions)
 
 	if _, err := redisClient.Ping(ctx).Result(); err != nil {
 		s.Logger().Error("failed to connect to redis", "redis", redisClient.String(), "error", err)
 		metricRecorder.RecordServiceStartupAttempt(ctx, false)
 		os.Exit(1)
 	}
 
-	redisStreamClient := redis.NewClient(&redis.Options{
+	redisStreamOptions := redis.Options{
 		Addr:      fmt.Sprintf("%s:%s", cfg.RedisHost, cfg.RedisPort),
 		Password:  cfg.RedisPassword,
 		DB:        cfg.RedisStreamDB,
 		TLSConfig: redisTLSConfig,
-	})
+	}
+	if cfg.RedisUsername != "" {
+		redisStreamOptions.Username = cfg.RedisUsername
+	}
+	redisStreamClient := redis.NewClient(&redisStreamOptions)
 
 	if _, err := redisStreamClient.Ping(ctx).Result(); err != nil {
 		s.Logger().Error("failed to connect to redis stream", "redisStream", redisStreamClient.String(), "error", err)

diode-server/docker/docker-compose.yaml

@@ -23,6 +23,7 @@ services:
       - REDIS_PASSWORD=${REDIS_PASSWORD}
       - REDIS_HOST=${REDIS_HOST}
       - REDIS_PORT=${REDIS_PORT}
+      - REDIS_USERNAME=""
       - SENTRY_DSN=${SENTRY_DSN}
       - TELEMETRY_METRICS_EXPORTER=${TELEMETRY_METRICS_EXPORTER}
       - TELEMETRY_TRACES_EXPORTER=${TELEMETRY_TRACES_EXPORTER}
@@ -40,6 +41,7 @@ services:
       - REDIS_PASSWORD=${REDIS_PASSWORD}
       - REDIS_HOST=${REDIS_HOST}
       - REDIS_PORT=${REDIS_PORT}
+      - REDIS_USERNAME=""
       - NETBOX_DIODE_PLUGIN_API_BASE_URL=${NETBOX_DIODE_PLUGIN_API_BASE_URL}
       - NETBOX_DIODE_PLUGIN_SKIP_TLS_VERIFY=${NETBOX_DIODE_PLUGIN_SKIP_TLS_VERIFY}
       - LOGGING_LEVEL=${LOGGING_LEVEL}

diode-server/docker/sample.env

@@ -2,6 +2,7 @@ DIODE_NGINX_PORT=8080
 REDIS_PASSWORD=<PLACEHOLDER_SECRET>
 REDIS_HOST=redis
 REDIS_PORT=6378
+REDIS_USERNAME=""
 NETBOX_DIODE_PLUGIN_API_BASE_URL=<http://NETBOX_HOST>/api/plugins/diode
 NETBOX_DIODE_PLUGIN_SKIP_TLS_VERIFY=false
 LOGGING_LEVEL=DEBUG

diode-server/ingester/component_test.go

@@ -45,6 +45,7 @@ func setupEnv(redisAddr string) {
 	_ = os.Setenv("GRPC_PORT", grpcPort)
 	_ = os.Setenv("REDIS_HOST", host)
 	_ = os.Setenv("REDIS_PORT", port)
+	_ = os.Setenv("REDIS_USERNAME", "")
 	_ = os.Setenv("REDIS_PASSWORD", "")
 	_ = os.Setenv("REDIS_DB", "0")
 	_ = os.Setenv("REDIS_STREAM_DB", "1")
@@ -59,6 +60,7 @@ func teardownEnv() {
 	_ = os.Unsetenv("GRPC_PORT")
 	_ = os.Unsetenv("REDIS_HOST")
 	_ = os.Unsetenv("REDIS_PORT")
+	_ = os.Unsetenv("REDIS_USERNAME")
 	_ = os.Unsetenv("REDIS_PASSWORD")
 	_ = os.Unsetenv("REDIS_DB")
 	_ = os.Unsetenv("REDIS_STREAM_DB")

diode-server/ingester/config.go

@@ -10,6 +10,7 @@ type Config struct {
 	GRPCPort      int    `envconfig:"GRPC_PORT" default:"8081"`
 	RedisHost     string `envconfig:"REDIS_HOST" default:"127.0.0.1"`
 	RedisPort     string `envconfig:"REDIS_PORT" default:"6379"`
+	RedisUsername string `envconfig:"REDIS_USERNAME" default:""`
 	RedisPassword string `envconfig:"REDIS_PASSWORD" required:"true"`
 	RedisStreamDB int    `envconfig:"REDIS_STREAM_DB" default:"1"`
 

diode-server/reconciler/config.go

@@ -10,6 +10,7 @@ type Config struct {
 	GRPCPort                      int    `envconfig:"GRPC_PORT" default:"8081"`
 	RedisHost                     string `envconfig:"REDIS_HOST" default:"127.0.0.1"`
 	RedisPort                     string `envconfig:"REDIS_PORT" default:"6379"`
+	RedisUsername                 string `envconfig:"REDIS_USERNAME" default:""`
 	RedisPassword                 string `envconfig:"REDIS_PASSWORD" required:"true"`
 	RedisDB                       int    `envconfig:"REDIS_DB" default:"0"`
 	RedisStreamDB                 int    `envconfig:"REDIS_STREAM_DB" default:"1"`

diode-server/reconciler/reconciler_test.go

@@ -26,6 +26,7 @@ func setupEnv(redisAddr string) {
 	_ = os.Setenv("GRPC_PORT", grpcPort)
 	_ = os.Setenv("REDIS_HOST", host)
 	_ = os.Setenv("REDIS_PORT", port)
+	_ = os.Setenv("REDIS_USERNAME", "")
 	_ = os.Setenv("REDIS_PASSWORD", "")
 	_ = os.Setenv("REDIS_DB", "0")
 	_ = os.Setenv("REDIS_STREAM_DB", "1")
@@ -49,6 +50,7 @@ func teardownEnv() {
 	_ = os.Unsetenv("GRPC_PORT")
 	_ = os.Unsetenv("REDIS_HOST")
 	_ = os.Unsetenv("REDIS_PORT")
+	_ = os.Unsetenv("REDIS_USERNAME")
 	_ = os.Unsetenv("REDIS_PASSWORD")
 	_ = os.Unsetenv("REDIS_DB")
 	_ = os.Unsetenv("REDIS_STREAM_DB")

diode-server/reconciler/server.go

@@ -37,12 +37,16 @@ func NewServer(ctx context.Context, logger *slog.Logger, repository Repository,
 		return nil, fmt.Errorf("failed to create TLS config for Redis: %v", err)
 	}
 
-	redisClient := redis.NewClient(&redis.Options{
+	redisOptions := redis.Options{
 		Addr:      fmt.Sprintf("%s:%s", cfg.RedisHost, cfg.RedisPort),
 		Password:  cfg.RedisPassword,
 		DB:        cfg.RedisDB,
 		TLSConfig: redisTLSConfig,
-	})
+	}
+	if cfg.RedisUsername != "" {
+		redisOptions.Username = cfg.RedisUsername
+	}
+	redisClient := redis.NewClient(&redisOptions)
 
 	if _, err := redisClient.Ping(ctx).Result(); err != nil {
 		return nil, fmt.Errorf("failed connection to %s: %v", redisClient.String(), err)