Support Sentinel usernames
Currently we support Redis Sentinel passwords (set via requirepass
), but Redis Sentinels (and Redis) support ACLs via custom usernames (https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/).
We currently have global.redis.sentinelAuth
that should be extended to provide a Sentinel username. Then we need to update the config files for all the components:
-
Workhorse uses SentinelUsername
: gitlab-org/gitlab!155209 (merged) -
GitLab Exporter has the redis_sentinel_username
config option: gitlab-org/ruby/gems/gitlab-exporter!208 (merged) -
GitLab Rails uses redis-rb
andredis-client
. This uses thesentinel_username
config option (https://github.com/redis-rb/redis-client?tab=readme-ov-file#sentinel-support, https://github.com/redis-rb/redis-client/blob/6d55f61cac62af91aebbd5a1d00eae7a8d940b9e/lib/redis_client/sentinel_config.rb#L12-L32). We may also consider supporting Sentinel URLs to cover TLS support at the same time. -
KAS allows specifying a redis.username
that is used in Sentinel. This might be fine as a first iteration, but we might want to support an explicit Sentinel username so people can roll out Sentinel ACLs independently of Redis ACLs: gitlab-org/cluster-integration/gitlab-agent#597 (closed) -
Container Registry supports sentinelusername
: gitlab-org/container-registry!1642 (merged)
Other references:
Edited by Stan Hu