Merge pull request #113 from triggermesh/task/add-redis-tls-auth-support

Redis: Add Redis tls auth support

Author: Pablo Mercado

config/300-redisbroker.yaml

@@ -87,8 +87,8 @@ spec:
                                 type: string
                               key:
                                 type: string
-                      caCertificate:
-                        description: Contains a CA Certificate used to connect to Redis.
+                      tlsCACertificate:
+                        description: Contains a CA certificate used to connect to Redis.
                         type: object
                         properties:
                           secretKeyRef:
@@ -99,6 +99,31 @@ spec:
                                 type: string
                               key:
                                 type: string
+                      tlsCertificate:
+                        description: Contains a certificate used to connect to authenticate to Redis.
+                        type: object
+                        properties:
+                          secretKeyRef:
+                            description: A reference to a Kubernetes Secret object.
+                            type: object
+                            properties:
+                              name:
+                                type: string
+                              key:
+                                type: string
+                      tlsKey:
+                        description: Contains a key certificate used to connect to authenticate to Redis.
+                        type: object
+                        properties:
+                          secretKeyRef:
+                            description: A reference to a Kubernetes Secret object.
+                            type: object
+                            properties:
+                              name:
+                                type: string
+                              key:
+                                type: string
+
                       tlsEnabled:
                         description: Use TLS enctrypted Redis connection.
                         type: boolean

docs/redis-broker.md

@@ -25,7 +25,15 @@ spec:
           secretKeyRef:
             name: <Kubernetes secret name>
             key: <Kubernetes secret key>
-        caCertificate: <CA certificate used to connect to redis. Optional>
+        tlsCACertificate: <CA certificate used to connect to redis. Optional>
+          secretKeyRef:
+            name: <Kubernetes secret name>
+            key: <Kubernetes secret key>
+        tlsCertificate: <Certificate used to authenticate to redis. Optional>
+          secretKeyRef:
+            name: <Kubernetes secret name>
+            key: <Kubernetes secret key>
+        tlsKey: <Certificate key used to authenticate to redis. Optional>
           secretKeyRef:
             name: <Kubernetes secret name>
             key: <Kubernetes secret key>

pkg/apis/eventing/v1alpha1/deepcopy_generated.go

@@ -56,7 +56,13 @@ type RedisConnection struct {
 	Password *SecretValueFromSource `json:"password,omitempty"`
 
 	// CA Certificate used to connect to Redis.
-	CACertificate *SecretValueFromSource `json:"caCertificate,omitempty"`
+	TLSCACertificate *SecretValueFromSource `json:"tlsCACertificate,omitempty"`
+
+	// Certificate used to connect to authenticate to Redis.
+	TLSCertificate *SecretValueFromSource `json:"tlsCertificate,omitempty"`
+
+	// Certificate Key used to connect to authenticate to Redis.
+	TLSKey *SecretValueFromSource `json:"tlsKey,omitempty"`
 
 	// Use TLS enctrypted connection.
 	TLSEnabled *bool `json:"tlsEnabled,omitempty"`

pkg/apis/eventing/v1alpha1/redisbroker_types.go

@@ -84,10 +84,22 @@ func redisDeploymentOption(rb *eventingv1alpha1.RedisBroker, redisSvc *corev1.Se
 					rb.Spec.Redis.Connection.Password.SecretKeyRef.Key)(c)
 			}
 
-			if rb.Spec.Redis.Connection.CACertificate != nil {
+			if rb.Spec.Redis.Connection.TLSCACertificate != nil {
 				resources.ContainerAddEnvVarFromSecret("REDIS_TLS_CA_CERTIFICATE",
-					rb.Spec.Redis.Connection.CACertificate.SecretKeyRef.Name,
-					rb.Spec.Redis.Connection.CACertificate.SecretKeyRef.Key)(c)
+					rb.Spec.Redis.Connection.TLSCACertificate.SecretKeyRef.Name,
+					rb.Spec.Redis.Connection.TLSCACertificate.SecretKeyRef.Key)(c)
+			}
+
+			if rb.Spec.Redis.Connection.TLSCertificate != nil {
+				resources.ContainerAddEnvVarFromSecret("REDIS_TLS_CERTIFICATE",
+					rb.Spec.Redis.Connection.TLSCertificate.SecretKeyRef.Name,
+					rb.Spec.Redis.Connection.TLSCertificate.SecretKeyRef.Key)(c)
+			}
+
+			if rb.Spec.Redis.Connection.TLSKey != nil {
+				resources.ContainerAddEnvVarFromSecret("REDIS_TLS_KEY",
+					rb.Spec.Redis.Connection.TLSKey.SecretKeyRef.Name,
+					rb.Spec.Redis.Connection.TLSKey.SecretKeyRef.Key)(c)
 			}
 
 			if rb.Spec.Redis.Connection.TLSEnabled != nil && *rb.Spec.Redis.Connection.TLSEnabled {
@@ -96,7 +108,8 @@ func redisDeploymentOption(rb *eventingv1alpha1.RedisBroker, redisSvc *corev1.Se
 
 			if rb.Spec.Redis.Connection.TLSSkipVerify != nil && *rb.Spec.Redis.Connection.TLSSkipVerify {
 				tlsSkipVerifyDefault := "true"
-				if rb.Spec.Redis.Connection.CACertificate != nil {
+				// TODO this should be moved to webhook
+				if rb.Spec.Redis.Connection.TLSCACertificate != nil {
 					tlsSkipVerifyDefault = "false"
 				}
 				resources.ContainerAddEnvFromValue("REDIS_TLS_SKIP_VERIFY", tlsSkipVerifyDefault)(c)