Skip to content

Commit 0c44d46

Browse files
dmolikdmolik
authored
feat(controller): Support anonymous auth (#185)
NB: we don't currently support upgrading from anonymous auth to requirepass
1 parent ae9e443 commit 0c44d46

File tree

3 files changed

+112
-74
lines changed

3 files changed

+112
-74
lines changed

‎api/v1/valkey_types.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,10 @@ type ValkeySpec struct {
7676
// External access configuration
7777
ExternalAccess *ExternalAccess `json:"externalAccess,omitempty"`
7878

79+
// Anonymous Auth
80+
// +kubebuilder:default:=false
81+
AnonymousAuth bool `json:"anonymousAuth,omitempty"`
82+
7983
// Service Password
8084
ServicePassword *corev1.SecretKeySelector `json:"servicePassword,omitempty"`
8185
}

‎config/crd/bases/hyperspike.io_valkeys.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,10 @@ spec:
6262
spec:
6363
description: ValkeySpec defines the desired state of Valkey
6464
properties:
65+
anonymousAuth:
66+
default: false
67+
description: Anonymous Auth
68+
type: boolean
6569
certIssuer:
6670
description: Certificate Issuer
6771
type: string

‎internal/controller/valkey_controller.go

Lines changed: 104 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -186,9 +186,13 @@ func (r *ValkeyReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctr
186186
}
187187
}
188188

189-
password, err := r.upsertSecret(ctx, valkey, true)
190-
if err != nil {
191-
return ctrl.Result{}, err
189+
password := ""
190+
if !valkey.Spec.AnonymousAuth {
191+
var err error
192+
password, err = r.upsertSecret(ctx, valkey, true)
193+
if err != nil {
194+
return ctrl.Result{}, err
195+
}
192196
}
193197
if err := r.upsertPodDisruptionBudget(ctx, valkey); err != nil {
194198
return ctrl.Result{}, err
@@ -264,7 +268,9 @@ func (r *ValkeyReconciler) checkState(ctx context.Context, valkey *hyperv1.Valke
264268

265269
opt := valkeyClient.ClientOption{
266270
InitAddress: []string{valkey.Name + "." + valkey.Namespace + ".svc:6379"},
267-
Password: password,
271+
}
272+
if !valkey.Spec.AnonymousAuth {
273+
opt.Password = password
268274
}
269275
if valkey.Spec.TLS {
270276
ca, err := r.getCACertificate(ctx, valkey)
@@ -455,12 +461,6 @@ func (r *ValkeyReconciler) initCluster(ctx context.Context, valkey *hyperv1.Valk
455461

456462
logger.Info("initializing cluster")
457463

458-
password, err := r.GetPassword(ctx, valkey)
459-
if err != nil {
460-
logger.Error(err, "failed to get password")
461-
return err
462-
}
463-
464464
podNames, err := r.getPodNames(ctx, valkey)
465465
if err != nil {
466466
logger.Error(err, "failed to get pod names")
@@ -488,9 +488,17 @@ func (r *ValkeyReconciler) initCluster(ctx context.Context, valkey *hyperv1.Valk
488488
address := podName + ":6379"
489489
opt := valkeyClient.ClientOption{
490490
InitAddress: []string{address},
491-
Password: password,
492491
ForceSingleClient: true, // this is necessary to avoid failing through to another shard and setting the wrong ip
493492
}
493+
if !valkey.Spec.AnonymousAuth {
494+
var err error
495+
opt.Password, err = r.GetPassword(ctx, valkey)
496+
if err != nil {
497+
logger.Error(err, "failed to get password")
498+
return err
499+
}
500+
}
501+
494502
if valkey.Spec.TLS {
495503
ca, err := r.getCACertificate(ctx, valkey)
496504
if err != nil {
@@ -626,20 +634,26 @@ func (r *ValkeyReconciler) setClusterAnnounceIp(ctx context.Context, valkey *hyp
626634
if len(ips) == 0 {
627635
return errors.NewBadRequest("external ip is empty")
628636
}
629-
password, err := r.GetPassword(ctx, valkey)
630-
if err != nil {
631-
logger.Error(err, "failed to get password")
632-
return err
637+
password := ""
638+
if !valkey.Spec.AnonymousAuth {
639+
var err error
640+
password, err = r.GetPassword(ctx, valkey)
641+
if err != nil {
642+
logger.Error(err, "failed to get password")
643+
return err
644+
}
633645
}
634646
clients := map[string]valkeyClient.Client{}
635647
for podName, ip := range ips {
636648
address := podName + "." + valkey.Name + "-headless." + valkey.Namespace + ":6379"
637649
logger.Info("working on node", "ip", ip, "pod", podName, "address", address)
638650
opt := valkeyClient.ClientOption{
639651
InitAddress: []string{address},
640-
Password: password,
641652
ForceSingleClient: true, // this is necessary to avoid failing through to another shard and setting the wrong ip
642653
}
654+
if !valkey.Spec.AnonymousAuth {
655+
opt.Password = password
656+
}
643657
if valkey.Spec.TLS {
644658
ca, err := r.getCACertificate(ctx, valkey)
645659
if err != nil {
@@ -950,10 +964,17 @@ func (r *ValkeyReconciler) upsertExternalAccessProxySecret(ctx context.Context,
950964
trusted_ca:
951965
filename: "/etc/valkey/certs/ca.crt"`
952966
}
953-
password, err := r.GetPassword(ctx, valkey)
954-
if err != nil {
955-
logger.Error(err, "failed to get password")
956-
return err
967+
upstreamPassword := ""
968+
downstreamPassword := ""
969+
if !valkey.Spec.AnonymousAuth {
970+
password, err := r.GetPassword(ctx, valkey)
971+
if err != nil {
972+
logger.Error(err, "failed to get password")
973+
return err
974+
}
975+
downstreamPassword = ` downstream_auth_password:
976+
inline_string: "` + password + `"`
977+
upstreamPassword = ` inline_string: "` + password + `"`
957978
}
958979
proxyLabels := labels(valkey)
959980
proxyLabels["app.kubernetes.io/component"] = ValkeyProxy
@@ -984,8 +1005,7 @@ static_resources:
9841005
prefix_routes:
9851006
catch_all_route:
9861007
cluster: redis_cluster
987-
downstream_auth_password:
988-
inline_string: "` + password + `"
1008+
` + downstreamPassword + `
9891009
` + tlsServer + `
9901010
clusters:
9911011
- name: redis_cluster
@@ -1008,7 +1028,7 @@ static_resources:
10081028
"@type": type.googleapis.com/google.protobuf.Struct
10091029
value:
10101030
auth_password:
1011-
inline_string: "` + password + `"
1031+
` + upstreamPassword + `
10121032
` + tlsClient + `
10131033
admin:
10141034
address:
@@ -1486,15 +1506,16 @@ func removePort(addr string) string {
14861506
func (r *ValkeyReconciler) balanceNodes(ctx context.Context, valkey *hyperv1.Valkey) error { // nolint: gocyclo
14871507
logger := log.FromContext(ctx)
14881508

1489-
password, err := r.upsertSecret(ctx, valkey, true)
1490-
if err != nil {
1491-
return err
1492-
}
1493-
14941509
// connect to the first node!
14951510
opt := valkeyClient.ClientOption{
14961511
InitAddress: []string{valkey.Name + "-0." + valkey.Name + "-headless." + valkey.Namespace + ".svc:6379"},
1497-
Password: password,
1512+
}
1513+
if !valkey.Spec.AnonymousAuth {
1514+
var err error
1515+
opt.Password, err = r.upsertSecret(ctx, valkey, true)
1516+
if err != nil {
1517+
return err
1518+
}
14981519
}
14991520
if valkey.Spec.TLS {
15001521
ca, err := r.getCACertificate(ctx, valkey)
@@ -1836,28 +1857,6 @@ func (r *ValkeyReconciler) exporter(valkey *hyperv1.Valkey) corev1.Container {
18361857
Name: "VALKEY_ADDR",
18371858
Value: "valkey://127.0.0.1:6379",
18381859
},
1839-
{
1840-
Name: "VALKEY_PASSWORD",
1841-
ValueFrom: &corev1.EnvVarSource{
1842-
SecretKeyRef: &corev1.SecretKeySelector{
1843-
Key: "password",
1844-
LocalObjectReference: corev1.LocalObjectReference{
1845-
Name: valkey.Name,
1846-
},
1847-
},
1848-
},
1849-
},
1850-
{
1851-
Name: "REDIS_PASSWORD",
1852-
ValueFrom: &corev1.EnvVarSource{
1853-
SecretKeyRef: &corev1.SecretKeySelector{
1854-
Key: "password",
1855-
LocalObjectReference: corev1.LocalObjectReference{
1856-
Name: valkey.Name,
1857-
},
1858-
},
1859-
},
1860-
},
18611860
{
18621861
Name: "VALKEY_EXPORTER_WEB_LISTEN_ADDRESS",
18631862
Value: ":9121",
@@ -1894,6 +1893,30 @@ func (r *ValkeyReconciler) exporter(valkey *hyperv1.Valkey) corev1.Container {
18941893
},
18951894
},
18961895
}
1896+
if !valkey.Spec.AnonymousAuth {
1897+
container.Env = append(container.Env, corev1.EnvVar{
1898+
Name: "VALKEY_PASSWORD",
1899+
ValueFrom: &corev1.EnvVarSource{
1900+
SecretKeyRef: &corev1.SecretKeySelector{
1901+
Key: "password",
1902+
LocalObjectReference: corev1.LocalObjectReference{
1903+
Name: valkey.Name,
1904+
},
1905+
},
1906+
},
1907+
})
1908+
container.Env = append(container.Env, corev1.EnvVar{
1909+
Name: "REDIS_PASSWORD",
1910+
ValueFrom: &corev1.EnvVarSource{
1911+
SecretKeyRef: &corev1.SecretKeySelector{
1912+
Key: "password",
1913+
LocalObjectReference: corev1.LocalObjectReference{
1914+
Name: valkey.Name,
1915+
},
1916+
},
1917+
},
1918+
})
1919+
}
18971920
if valkey.Spec.TLS {
18981921
container.VolumeMounts = append(container.VolumeMounts, corev1.VolumeMount{
18991922
Name: "valkey-tls",
@@ -2100,7 +2123,7 @@ func (r *ValkeyReconciler) upsertStatefulSet(ctx context.Context, valkey *hyperv
21002123
Command: []string{
21012124
"valkey-server",
21022125
"/valkey/etc/valkey.conf",
2103-
"--requirepass", "$(VALKEY_PASSWORD)",
2126+
"--protected-mode", "no",
21042127
},
21052128
Env: []corev1.EnvVar{
21062129
{
@@ -2115,28 +2138,6 @@ func (r *ValkeyReconciler) upsertStatefulSet(ctx context.Context, valkey *hyperv
21152138
Name: "VALKEY_NODES",
21162139
Value: getNodeNames(valkey),
21172140
},
2118-
{
2119-
Name: "REDISCLI_AUTH",
2120-
ValueFrom: &corev1.EnvVarSource{
2121-
SecretKeyRef: &corev1.SecretKeySelector{
2122-
Key: "password",
2123-
LocalObjectReference: corev1.LocalObjectReference{
2124-
Name: valkey.Name,
2125-
},
2126-
},
2127-
},
2128-
},
2129-
{
2130-
Name: "VALKEY_PASSWORD",
2131-
ValueFrom: &corev1.EnvVarSource{
2132-
SecretKeyRef: &corev1.SecretKeySelector{
2133-
Key: "password",
2134-
LocalObjectReference: corev1.LocalObjectReference{
2135-
Name: valkey.Name,
2136-
},
2137-
},
2138-
},
2139-
},
21402141
{
21412142
Name: "VALKEY_CLUSTER_PREFERRED_ENDPOINT_TYPE",
21422143
Value: endpointType,
@@ -2334,6 +2335,35 @@ func (r *ValkeyReconciler) upsertStatefulSet(ctx context.Context, valkey *hyperv
23342335
},
23352336
})
23362337
}
2338+
if !valkey.Spec.AnonymousAuth {
2339+
sts.Spec.Template.Spec.Containers[0].Env = append(sts.Spec.Template.Spec.Containers[0].Env, corev1.EnvVar{
2340+
Name: "REDISCLI_AUTH",
2341+
ValueFrom: &corev1.EnvVarSource{
2342+
SecretKeyRef: &corev1.SecretKeySelector{
2343+
Key: "password",
2344+
LocalObjectReference: corev1.LocalObjectReference{
2345+
Name: valkey.Name,
2346+
},
2347+
},
2348+
},
2349+
})
2350+
sts.Spec.Template.Spec.Containers[0].Env = append(sts.Spec.Template.Spec.Containers[0].Env, corev1.EnvVar{
2351+
Name: "VALKEY_PASSWORD",
2352+
ValueFrom: &corev1.EnvVarSource{
2353+
SecretKeyRef: &corev1.SecretKeySelector{
2354+
Key: "password",
2355+
LocalObjectReference: corev1.LocalObjectReference{
2356+
Name: valkey.Name,
2357+
},
2358+
},
2359+
},
2360+
})
2361+
sts.Spec.Template.Spec.Containers[0].Command = []string{
2362+
"valkey-server",
2363+
"/valkey/etc/valkey.conf",
2364+
"--requirepass", "$(VALKEY_PASSWORD)",
2365+
}
2366+
}
23372367
if valkey.Spec.ExternalAccess != nil && valkey.Spec.ExternalAccess.Enabled {
23382368
sts.Spec.Template.Spec.Containers[0].Env = append(sts.Spec.Template.Spec.Containers[0].Env, corev1.EnvVar{
23392369
Name: "VALKEY_EXTERNAL_ACCESS",

0 commit comments

Comments
 (0)