Use Credentials Provider-like mechanism with Redis clients

[abutic]

Description

It would be nice to be able to use Credentials Provider-like mechanism (or something similar), available with DB data sources, with Redis clients/connections as well. This way, one could retrieve Redis password from some other source and then use it, without setting it in quarkus.redis.hosts configuration property.

Alternative?

Is there any way to configure Redis password programmatically and make a RedisClient used like this

    @Inject
    RedisClient redisClient;

pick it up?

[quarkus-bot]

/cc @cescoffier, @gsmet, @machi1990

[machi1990]

Description

It would be nice to be able to use Credentials Provider-like mechanism (or something similar), available with DB data sources, with Redis clients/connections as well. This way, one could retrieve Redis password from some other source and then use it, without setting it in quarkus.redis.hosts configuration property.

This is a good enhancement.

Alternative?

Is there any way to configure Redis password programmatically and make a RedisClient used like this

    @Inject
    RedisClient redisClient;

pick it up?

No, at the moment we do not have a programmatic way of configuring the Redis client. Why do you need this, can't the password be supplied per environment?

[abutic]

No, at the moment we do not have a programmatic way of configuring the Redis client. Why do you need this, can't the password be supplied per environment?

We'd like to be able to get and use a password from our sensitive data storage, without having to write it down either to application.properties, system property or environment variable. If you have any advice on how to do this, we'd really appreciate it.

[machi1990]

No, at the moment we do not have a programmatic way of configuring the Redis client. Why do you need this, can't the password be supplied per environment?

We'd like to be able to get and use a password from our sensitive data storage, without having to write it down either to application.properties, system property or environment variable. If you have any advice on how to do this, we'd really appreciate it.

Okay, having a Credentials Provider and store it somewhere like Vault just like datasources will be a useful addition.
As a workaround, have you tried to supply the password via ConfigSource?

[gsmet]

I think the easiest way would be to implement it in Quarkus with the credential provider contract we already have. I don't think that would be that hard.

[abutic]

As a workaround, have you tried to supply the password via ConfigSource?

Hm, in order to get the password from a sensitive data storage, we need our custom @ApplicationScoped bean, which I think is not available for injection before ConfigSource methods get called. This could be an issue for us, but your suggestion is definitely worth investigating. Thanks!

[machi1990]

As a workaround, have you tried to supply the password via ConfigSource?

Hm, in order to get the password from a sensitive data storage, we need our custom @ApplicationScoped bean, which I think is not available for injection before ConfigSource methods get called. This could be an issue for us, but your suggestion is definitely worth investigating. Thanks!

Thanks for looking. Well then, I think the CredentialsProvider is a very good is something you really need here. I'll open a PR for this enhancement. Until then, let me know how the ConfigSource option goes.

[SebaLopez94]

Is there any documentation or example about this? Thanks

[machi1990]

Is there any documentation or example about this? Thanks

We do not have an example (we should have one).

To get you going, the host provider may look like

@ApplicationScoped
@Named("hosts-provider")
public class ExampleRedisHostProvider implements RedisHostsProvider {
    @Override
    public Set<URI> getHosts() {
        // do stuff to get the host
        String host = "redis://localhost:6379/3"
        return Collections.singleton(URI.create(host));
    }
}

and in your application.properties

quarkus.redis.hosts-provider-name=hosts-provider