Support single endpoint architecture with SSL/TLS in cluster mode

[supercaracal]

Description

This PR will solve the following issue.

• Connecting to Azure Redis Cluster #1074

The issue is an error the client fails to verify the certificate of nodes. It is caused in a case which we use cluster feature with SSL/TLS connection. Since the client relies and depends on CLUSTER NODES and CLUSTER SLOTS, the client may fail to verify certificates if servers return IP addresses of nodes in reply to the client.

AWS ElastiCache and Redis versions since 7.* possess an ability to be able to reply FQDN of nodes by the following directives of configuration. They were added by AWS folks and have been available since Redis 7.*.

• cluster-announce-hostname
• cluster-preferred-endpoint-type

On the other hand, other architectures for cluster mode with SSL/TLS may use proxy servers such that stunnel or something like that for SSL/TLS termination. In that case, the client has to connect to the nodes via the FQDN of a single endpoint.

So this PR adds a fixed_hostname option to the client and modifying to be able to pass it to internal connector.

Redis.new(cluster: %w[rediss://foo-endpoint.example.com:6379], fixed_hostname: 'foo-endpoint.example.com')

How does cluster client work?

sequenceDiagram
    participant Client
    participant Server Shard 1
    participant Server Shard 2
    participant Server Shard 3
    Note over Client,Server Shard 3: Redis.new(cluster: %w[redis://node1:6379])
    Client->>+Server Shard 1: CLUSTER SLOTS
    Server Shard 1-->>-Client: nodes and slots data
    Client->>+Server Shard 1: GET key1
    Server Shard 1-->>-Client: value1
    Client->>+Server Shard 2: GET key2
    Server Shard 2-->>-Client: value2
    Client->>+Server Shard 3: GET key3
    Server Shard 3-->>-Client: value3
    Client->>+Server Shard 3: GET key1
    Server Shard 3-->>-Client: MOVED Server Shard 1
    Note over Client,Server Shard 3: Client needs to redirect to correct node
    Client->>+Server Shard 2: MGET key2 key3
    Server Shard 2-->>-Client: CROSSSLOTS
    Note over Client,Server Shard 2: Cannot command across shards

Loading

Architectures of Redis cluster with SSL/TLS as I can imagine

AWS

The client can connect to the nodes directly. The endpoint is just a CNAME record of DNS. It is as simple as that.

graph TB
  client(Cluster Client)

  subgraph Amazon ElastiCache for Redis
    node0(Node0)
    node1(Node1)
    node2(Node2)
  end

  node0-.-node1-.-node2-.-node0
  client--rediss://node0.example.com:6379-->node0
  client--rediss://node1.example.com:6379-->node1
  client--rediss://node2.example.com:6379-->node2

Loading

Microsoft Azure

The service provides a single IP address and multiple ports mapped to each node. The endpoint doesn't support redirection. It does only SSL/TLS termination.

graph TB
  client(Cluster Client)

  subgraph Azure Cache for Redis
    subgraph Endpoint
      endpoint(Active)
      endpoint_sb(Standby)
    end

    subgraph Cluster
      node0(Node0)
      node1(Node1)
      node2(Node2)
    end
  end

  endpoint-.-endpoint_sb
  node0-.-node1-.-node2-.-node0
  client--rediss://endpoint.example.com:15000-->endpoint--redis://node0:6379-->node0
  client--rediss://endpoint.example.com:15001-->endpoint--redis://node1:6379-->node1
  client--rediss://endpoint.example.com:15002-->endpoint--redis://node2:6379-->node2

Loading

[supercaracal]

redis-rb/lib/redis/cluster/node.rb

Lines 87 to 98 in 610c783

	def build_clients(options)
	clients = options.map do |node_key, option|
	next if replica_disabled? && slave?(node_key)
	option = option.merge(readonly: true) if slave?(node_key)
	client = Client.new(option)
	[node_key, client]
	end
	clients.compact.to_h
	end

redis-rb/lib/redis/connection/ruby.rb

Line 255 in 610c783

ssl_sock.hostname = host