Skip to content

Commit 4784e5c

Browse files
cloudjumpercatcloudjumpercat
authored
feat(gateway): Redis Cloud AuthN (#3552)
* Plugin examples for ACME and AI RL advanced Signed-off-by: Diana <75819066+cloudjumpercat@users.noreply.github.com> * Fix failing build Signed-off-by: Diana <75819066+cloudjumpercat@users.noreply.github.com> * Fix build for real Signed-off-by: Diana <75819066+cloudjumpercat@users.noreply.github.com> * Add redis auth section to relevant plugins Signed-off-by: Diana <75819066+cloudjumpercat@users.noreply.github.com> * Apply feedback from devs Signed-off-by: Diana <75819066+cloudjumpercat@users.noreply.github.com> * Remove OSS cluster examples, add OSS cluster note. Signed-off-by: Diana <75819066+cloudjumpercat@users.noreply.github.com> * Fix cluster examples Signed-off-by: Diana <75819066+cloudjumpercat@users.noreply.github.com> * Add more permission details Signed-off-by: Diana <75819066+cloudjumpercat@users.noreply.github.com> * fix vale Signed-off-by: Diana <75819066+cloudjumpercat@users.noreply.github.com> --------- Signed-off-by: Diana <75819066+cloudjumpercat@users.noreply.github.com>
1 parent 962e86f commit 4784e5c

File tree

31 files changed

+928
-3
lines changed

31 files changed

+928
-3
lines changed

‎.github/styles/base/Dictionary.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -935,6 +935,7 @@ Valero
935935
Valero
936936
validator
937937
validators
938+
Valkey
938939
vararg
939940
vc
940941
viewport

‎app/_includes/plugins/redis-cloud-auth.md‎

Lines changed: 224 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,224 @@
1+
## Using cloud authentication with Redis {% new_in 3.13 %}
2+
3+
Starting in {{site.base_gateway}} 3.13, you can authenticate with a cloud Redis provider for your Redis strategy. This allows you to seamlessly rotate credentials without relying on static passwords.
4+
5+
The following providers are supported:
6+
* AWS ElastiCache
7+
* Azure Managed Redis
8+
* Google Cloud Memorystore (with or without Valkey)
9+
10+
Each provider also supports an instance and cluster configuration.
11+
12+
{:.warning}
13+
> **Important:** {{site.base_gateway}} open source plugins do not support any Redis cloud provider cluster configurations.
14+
15+
To configure cloud authentication with Redis, add the following parameters to your plugin configuration:
16+
17+
{% navtabs "providers" %}
18+
{% navtab "AWS instance" %}
19+
20+
You need:
21+
* A running Redis instance on an [AWS ElastiCache instance](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/auth-iam.html) for Valkey 7.2 or later or ElastiCache for Redis OSS version 7.0 or later
22+
* The [ElastiCache user needs to set "Authentication mode" to "IAM"](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/auth-iam.html#auth-iam-setup)
23+
* The following policy assigned to the IAM user/IAM role that is used to connect to the ElastiCache:
24+
```json
25+
{
26+
"Version": "2012-10-17",
27+
"Statement": [
28+
{
29+
"Effect": "Allow",
30+
"Action": [
31+
"elasticache:Connect"
32+
],
33+
"Resource": [
34+
"arn:aws:elasticache:ARN_OF_THE_ELASTICACHE",
35+
"arn:aws:elasticache:ARN_OF_THE_ELASTICACHE_USER"
36+
]
37+
}
38+
]
39+
}
40+
```
41+
42+
```yaml
43+
config:
44+
storage: redis
45+
storage_config:
46+
redis:
47+
host: $INSTANCE_ADDRESS
48+
username: $INSTANCE_USERNAME
49+
port: 6379
50+
cloud_authentication:
51+
auth_provider: aws
52+
aws_cache_name: $AWS_CACHE_NAME
53+
aws_is_serverless: false
54+
aws_region: $AWS_REGION
55+
aws_access_key_id: $AWS_ACCESS_KEY_ID
56+
aws_secret_access_key: $AWS_ACCESS_SECRET_KEY
57+
```
58+
59+
Replace the following with your actual values:
60+
* `$INSTANCE_ADDRESS`: The ElastiCache instance address.
61+
* `$INSTANCE_USERNAME`: The ElastiCache username with [IAM Auth mode configured](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/auth-iam.html#auth-iam-setup).
62+
* `$AWS_CACHE_NAME`: Name of your AWS ElastiCache instance.
63+
* `$AWS_REGION`: Your AWS ElastiCache instance region.
64+
* `$AWS_ACCESS_KEY_ID`: (Optional) Your AWS access key ID.
65+
* `$AWS_ACCESS_SECRET_KEY`: (Optional) Your AWS secret access key.
66+
{% endnavtab %}
67+
{% navtab "AWS cluster" %}
68+
69+
You need:
70+
* A running Redis instance on an [AWS ElastiCache cluster](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/auth-iam.html) for Valkey 7.2 or later or ElastiCache for Redis OSS version 7.0 or later
71+
* The [ElastiCache user needs to set "Authentication mode" to "IAM"](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/auth-iam.html#auth-iam-setup)
72+
* The following policy assigned to the IAM user/IAM role that is used to connect to the ElastiCache:
73+
```json
74+
{
75+
"Version": "2012-10-17",
76+
"Statement": [
77+
{
78+
"Effect": "Allow",
79+
"Action": [
80+
"elasticache:Connect"
81+
],
82+
"Resource": [
83+
"arn:aws:elasticache:ARN_OF_THE_ELASTICACHE",
84+
"arn:aws:elasticache:ARN_OF_THE_ELASTICACHE_USER"
85+
]
86+
}
87+
]
88+
}
89+
```
90+
91+
```yaml
92+
config:
93+
storage: redis
94+
storage_config:
95+
redis:
96+
cluster_nodes:
97+
- ip: $CLUSTER_ADDRESS
98+
port: 6379
99+
username: $CLUSTER_USERNAME
100+
port: 6379
101+
cloud_authentication:
102+
auth_provider: aws
103+
aws_cache_name: $AWS_CACHE_NAME
104+
aws_is_serverless: false
105+
aws_region: $AWS_REGION
106+
aws_access_key_id: $AWS_ACCESS_KEY_ID
107+
aws_secret_access_key: $AWS_ACCESS_SECRET_KEY
108+
```
109+
110+
Replace the following with your actual values:
111+
* `$CLUSTER_ADDRESS`: The ElastiCache cluster address.
112+
* `$CLUSTER_USERNAME`: The ElastiCache username with [IAM Auth mode configured](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/auth-iam.html#auth-iam-setup).
113+
* `$AWS_CACHE_NAME`: Name of your AWS ElastiCache cluster.
114+
* `$AWS_REGION`: Your AWS ElastiCache cluster region.
115+
* `$AWS_ACCESS_KEY_ID`: (Optional) Your AWS access key ID.
116+
* `$AWS_ACCESS_SECRET_KEY`: (Optional) Your AWS secret access key.
117+
{% endnavtab %}
118+
{% navtab "Azure instance" %}
119+
120+
You need:
121+
* A running Redis instance on an [Azure Managed Redis instance](https://learn.microsoft.com/en-us/azure/redis/entra-for-authentication) with Entra authentication configured
122+
* Add the [user/service principal/identity to the "Microsoft Entra Authentication Redis user" list](https://learn.microsoft.com/en-us/azure/redis/entra-for-authentication#add-users-or-system-principal-to-your-cache) for the Azure Managed Redis instance
123+
124+
```yaml
125+
config:
126+
storage: redis
127+
storage_config:
128+
redis:
129+
host: $INSTANCE_ADDRESS
130+
username: $INSTANCE_USERNAME
131+
port: 6379
132+
cloud_authentication:
133+
auth_provider: azure
134+
azure_client_id: $AZURE_CLIENT_ID
135+
azure_client_secret: $AZURE_CLIENT_SECRET
136+
azure_tenant_id: $AZURE_TENANT_ID
137+
```
138+
Replace the following with your actual values:
139+
* `$INSTANCE_ADDRESS`: The Azure Managed Redis instance address.
140+
* `$INSTANCE_USERNAME`: The object (principal) ID of the Principal/Identity with essential access.
141+
* `$AZURE_CLIENT_ID`: The client ID of the Principal/Identity.
142+
* `$AZURE_CLIENT_SECRET`: (Optional) The client secret of the Principal/Identity.
143+
* `$AZURE_TENANT_ID`: (Optional) The tenant ID of the Principal/Identity.
144+
145+
{% endnavtab %}
146+
{% navtab "Azure cluster" %}
147+
148+
You need:
149+
* A running Redis instance on an [Azure Managed Redis cluster](https://learn.microsoft.com/en-us/azure/redis/entra-for-authentication) with Entra authentication configured
150+
* Add the [user/service principal/identity to the "Microsoft Entra Authentication Redis user" list](https://learn.microsoft.com/en-us/azure/redis/entra-for-authentication#add-users-or-system-principal-to-your-cache) for the Azure Managed Redis instance
151+
152+
```yaml
153+
config:
154+
storage: redis
155+
storage_config:
156+
redis:
157+
cluster_nodes:
158+
- ip: $CLUSTER_ADDRESS
159+
port: 6379
160+
username: $CLUSTER_USERNAME
161+
port: 6379
162+
cloud_authentication:
163+
auth_provider: azure
164+
azure_client_id: $AZURE_CLIENT_ID
165+
azure_client_secret: $AZURE_CLIENT_SECRET
166+
azure_tenant_id: $AZURE_TENANT_ID
167+
```
168+
Replace the following with your actual values:
169+
* `$CLUSTER_ADDRESS`: The Azure Managed Redis cluster address.
170+
* `$CLUSTER_USERNAME`: The object (principal) ID of the Principal/Identity with essential access.
171+
* `$AZURE_CLIENT_ID`: The client ID of the Principal/Identity.
172+
* `$AZURE_CLIENT_SECRET`: (Optional) The client secret of the Principal/Identity.
173+
* `$AZURE_TENANT_ID`: (Optional) The tenant ID of the Principal/Identity.
174+
175+
{% endnavtab %}
176+
{% navtab "GCP instance" %}
177+
178+
You need:
179+
* A running Redis instance on an [Google Cloud Memorystore instance](https://cloud.google.com/memorystore/docs/cluster/about-iam-auth)
180+
* Assign the principal to the corresponding role:
181+
* [Cloud Memorystore Redis DB Connection User(`roles/redis.dbConnectionUser`)](https://docs.cloud.google.com/memorystore/docs/cluster/about-iam-auth) for Memorystore for Redis Cluster
182+
* [Memorystore DB Connector User (`roles/memorystore.dbConnectionUser`)](https://docs.cloud.google.com/memorystore/docs/valkey/about-iam-auth) for Memorystore for Valkey
183+
184+
```yaml
185+
config:
186+
storage: redis
187+
storage_config:
188+
redis:
189+
host: $INSTANCE_ADDRESS
190+
port: 6379
191+
cloud_authentication:
192+
auth_provider: gcp
193+
gcp_service_account_json: $GCP_SERVICE_ACCOUNT
194+
```
195+
Replace the following with your actual values:
196+
* `$INSTANCE_ADDRESS`: The Memorystore instance address.
197+
* `$GCP_SERVICE_ACCOUNT`: (Optional) The GCP service account JSON.
198+
{% endnavtab %}
199+
{% navtab "GCP cluster" %}
200+
201+
You need:
202+
* A running Redis instance on an [Google Cloud Memorystore cluster](https://cloud.google.com/memorystore/docs/cluster/about-iam-auth)
203+
* Assign the principal to the corresponding role:
204+
* [Cloud Memorystore Redis DB Connection User(`roles/redis.dbConnectionUser`)](https://docs.cloud.google.com/memorystore/docs/cluster/about-iam-auth) for Memorystore for Redis Cluster
205+
* [Memorystore DB Connector User (`roles/memorystore.dbConnectionUser`)](https://docs.cloud.google.com/memorystore/docs/valkey/about-iam-auth) for Memorystore for Valkey
206+
207+
```yaml
208+
config:
209+
storage: redis
210+
storage_config:
211+
redis:
212+
cluster_nodes:
213+
- ip: $CLUSTER_ADDRESS
214+
port: 6379
215+
port: 6379
216+
cloud_authentication:
217+
auth_provider: gcp
218+
gcp_service_account_json: $GCP_SERVICE_ACCOUNT
219+
```
220+
Replace the following with your actual values:
221+
* `$CLUSTER_ADDRESS`: The Memorystore cluster address.
222+
* `$GCP_SERVICE_ACCOUNT`: The GCP service account JSON.
223+
{% endnavtab %}
224+
{% endnavtabs %}

‎app/_kong_plugins/acme/examples/redis-aws-instance.yaml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
title: ACME with Redis storage and AWS ElastiCache instance auth
2+
description: |
3+
Configure the ACME plugin with Redis as a storage backend using AWS ElastiCache instance auth
4+
5+
weight: 860
6+
7+
requirements:
8+
- A public IP and a resolvable DNS
9+
- '{{site.base_gateway}} accepts proxy traffic on port 80'
10+
- A running Redis instance on an [AWS ElastiCache instance](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/auth-iam.html) for Valkey 7.2 or later or ElastiCache for Redis OSS version 7.0 or later
11+
- The [ElastiCache user needs to set "Authentication mode" to "IAM"](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/auth-iam.html#auth-iam-setup)
12+
- |
13+
The following policy assigned to the IAM user/IAM role that is used to connect to the ElastiCache:
14+
```json
15+
{
16+
"Version": "2012-10-17",
17+
"Statement": [
18+
{
19+
"Effect": "Allow",
20+
"Action": [
21+
"elasticache:Connect"
22+
],
23+
"Resource": [
24+
"arn:aws:elasticache:ARN_OF_THE_ELASTICACHE",
25+
"arn:aws:elasticache:ARN_OF_THE_ELASTICACHE_USER"
26+
]
27+
}
28+
]
29+
}
30+
```
31+
32+
config:
33+
account_email: ${email}
34+
account_key:
35+
key_id: ${key_id}
36+
key_set: ${key_set}
37+
domains:
38+
- ${domain}
39+
tos_accepted: true
40+
storage: redis
41+
storage_config:
42+
redis:
43+
host: ${instance_address}
44+
username: ${instance_username}
45+
port: 6379
46+
cloud_authentication:
47+
auth_provider: aws
48+
aws_cache_name: ${aws_cache}
49+
aws_is_serverless: false
50+
aws_region: ${aws_region}
51+
aws_access_key_id: ${aws_key_id}
52+
aws_secret_access_key: ${aws_secret_key}
53+
54+
variables:
55+
email:
56+
value: $EMAIL
57+
description: The account identifier.
58+
key_id:
59+
value: $KEY_ID
60+
description: The kid of a [Key](/gateway/entities/key/).
61+
key_set:
62+
value: $KEY_SET
63+
description: The name of a [Key Set](/gateway/entities/key-set/) to associate the Key ID with.
64+
domain:
65+
value: $DOMAIN
66+
description: An array of strings representing hosts.
67+
instance_address:
68+
value: $INSTANCE_ADDRESS
69+
description: The ElastiCache instance address.
70+
instance_username:
71+
value: $INSTANCE_USERNAME
72+
description: The ElastiCache username with [IAM Auth mode configured](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/auth-iam.html#auth-iam-setup).
73+
aws_cache:
74+
value: $AWS_CACHE_NAME
75+
description: Name of your AWS ElastiCache instance.
76+
aws_region:
77+
value: $AWS_REGION
78+
description: Your AWS ElastiCache instance region.
79+
aws_key_id:
80+
value: $AWS_ACCESS_KEY_ID
81+
description: (Optional) Your AWS access key ID.
82+
aws_secret_key:
83+
value: $AWS_ACCESS_SECRET_KEY
84+
description: (Optional) Your AWS secret access key.
85+
86+
tools:
87+
- deck
88+
- admin-api
89+
- konnect-api
90+
- kic
91+
- terraform

‎app/_kong_plugins/acme/examples/redis-azure-instance.yaml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
title: ACME with Redis storage and Azure Managed Redis instance auth
2+
description: |
3+
Configure the ACME plugin with Redis as a storage backend using Azure Managed Redis instance auth
4+
5+
weight: 860
6+
7+
requirements:
8+
- A public IP and a resolvable DNS
9+
- '{{site.base_gateway}} accepts proxy traffic on port 80'
10+
- A running Redis instance on an [Azure Managed Redis instance](https://learn.microsoft.com/en-us/azure/redis/entra-for-authentication) with Entra authentication configured
11+
- Add the [user/service principal/identity to the "Microsoft Entra Authentication Redis user" list](https://learn.microsoft.com/en-us/azure/redis/entra-for-authentication#add-users-or-system-principal-to-your-cache) for the Azure Managed Redis instance
12+
13+
config:
14+
account_email: ${email}
15+
account_key:
16+
key_id: ${key_id}
17+
key_set: ${key_set}
18+
domains:
19+
- ${domain}
20+
tos_accepted: true
21+
storage: redis
22+
storage_config:
23+
redis:
24+
host: ${instance_address}
25+
username: ${instance_username}
26+
port: 6379
27+
cloud_authentication:
28+
auth_provider: azure
29+
azure_client_id: ${azure_client_id}
30+
azure_client_secret: ${azure_client_secret}
31+
azure_tenant_id: ${azure_tenant_id}
32+
33+
variables:
34+
email:
35+
value: $EMAIL
36+
description: The account identifier.
37+
key_id:
38+
value: $KEY_ID
39+
description: The kid of a [Key](/gateway/entities/key/).
40+
key_set:
41+
value: $KEY_SET
42+
description: The name of a [Key Set](/gateway/entities/key-set/) to associate the Key ID with.
43+
domain:
44+
value: $DOMAIN
45+
description: An array of strings representing hosts.
46+
instance_address:
47+
value: $INSTANCE_ADDRESS
48+
description: The Azure Managed Redis instance address.
49+
instance_username:
50+
value: $INSTANCE_USERNAME
51+
description: The object (principal) ID of the Principal/Identity with essential access.
52+
azure_client_id:
53+
value: $AZURE_CLIENT_ID
54+
description: The client ID of the Principal/Identity.
55+
azure_client_secret:
56+
value: $AZURE_CLIENT_SECRET
57+
description: (Optional) The client secret of the Principal/Identity.
58+
azure_tenant_id:
59+
value: $AZURE_TENANT_ID
60+
description: (Optional) The tenant ID of the Principal/Identity.
61+
62+
tools:
63+
- deck
64+
- admin-api
65+
- konnect-api
66+
- kic
67+
- terraform

0 commit comments

Comments
 (0)