Alerting: Add options to configure TLS for HA using Redis (#87567)

* Add Alerting HA Redis Client TLS configs * Add test to ping miniredis with mTLS * Update .ini files and docs * Add tests for unified alerting ha redis TLS settings * Fix malformed go.sum * Add modowner * Fix lint error * Update docs and use dstls config
2024-05-14 14:21:42 +01:00
parent e39658097f
commit 7a2fbad0c8
11 changed files with 242 additions and 12 deletions
@@ -1190,6 +1190,32 @@ ha_redis_peer_name =
 # The maximum number of simultaneous redis connections.
 ha_redis_max_conns = 5

+# Enable TLS on the client used to communicate with the redis server. This should be set to true
+# if using any of the other ha_redis_tls_* fields.
+ha_redis_tls_enabled = false
+
+# Path to the PEM-encoded TLS client certificate file used to authenticate with the redis server.
+ha_redis_tls_cert_path =
+
+# Path to the PEM-encoded TLS private key file. Also requires the client certificate to be configured.
+ha_redis_tls_key_path =
+
+# Path to the PEM-encoded CA certificates file.
+ha_redis_tls_ca_path =
+
+# Overrides the expected name of the redis server certificate.
+ha_redis_tls_server_name =
+
+# Skips validating the redis server certificate.
+ha_redis_tls_insecure_skip_verify =
+
+# Overrides the default TLS cipher suite list.
+ha_redis_tls_cipher_suites =
+
+# Overrides the default minimum TLS version.
+# Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
+ha_redis_tls_min_version =
+
 # Listen address/hostname and port to receive unified alerting messages for other Grafana instances. The port is used for both TCP and UDP. It is assumed other Grafana instances are also running on the same port.
 ha_listen_address = "0.0.0.0:9094"

@@ -1101,6 +1101,35 @@
 # provided, a random one will be generated.
 ;ha_redis_peer_name =

+# The maximum number of simultaneous redis connections.
+# ha_redis_max_conns = 5
+
+# Enable TLS on the client used to communicate with the redis server. This should be set to true
+# if using any of the other ha_redis_tls_* fields.
+# ha_redis_tls_enabled = false
+
+# Path to the PEM-encoded TLS client certificate file used to authenticate with the redis server.
+# ha_redis_tls_cert_path =
+
+# Path to the PEM-encoded TLS private key file. Also requires the client certificate to be configured.
+# ha_redis_tls_key_path =
+
+# Path to the PEM-encoded CA certificates file.
+# ha_redis_tls_ca_path =
+
+# Overrides the expected name of the redis server certificate.
+# ha_redis_tls_server_name =
+
+# Skips validating the redis server certificate.
+# ha_redis_tls_insecure_skip_verify =
+
+# Overrides the default TLS cipher suite list.
+# ha_redis_tls_cipher_suites =
+
+# Overrides the default minimum TLS version.
+# Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
+# ha_redis_tls_min_version =
+
 # Listen address/hostname and port to receive unified alerting messages for other Grafana instances. The port is used for both TCP and UDP. It is assumed other Grafana instances are also running on the same port. The default value is `0.0.0.0:9094`.
 ;ha_listen_address = "0.0.0.0:9094"