Skip to content

Commit 9e534c5

Browse files
fanny-jiangfanny-jiang
authored
Add SSL config options to redis integration (DataDog#835)
* Add SSL config options to redis integration * fix trailing comma lint error * fix ssl_cert_reqs to use only int * fix ssl_cert_reqs template * revert fixtures change
1 parent 00b7b63 commit 9e534c5

3 files changed

Lines changed: 86 additions & 0 deletions

File tree

‎manifests/integrations/redis.pp‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,20 @@
1111
# The main redis port.
1212
# $ports
1313
# Array of redis ports: overrides port (optional)
14+
# $ssl
15+
# Enable SSL/TLS encryption for the check (optional)
16+
# $ssl_keyfile
17+
# The path to the client-side private keyfile (optional)
18+
# $ssl_certfile
19+
# The path to the client-side certificate file (optional)
20+
# $ssl_ca_certs
21+
# The path to the ca_certs file (optional)
22+
# $ssl_cert_reqs
23+
# Specifies whether a certificate is required from the
24+
# other side of the connection, and whether it's validated if provided (optional)
25+
# * 0 for ssl.CERT_NONE (certificates ignored)
26+
# * 1 for ssl.CERT_OPTIONAL (not required, but validated if provided)
27+
# * 2 for ssl.CERT_REQUIRED (required and validated)
1428
# $slowlog_max_len
1529
# The max length of the slow-query log (optional)
1630
# $tags
@@ -45,6 +59,11 @@
4559
String $password = '',
4660
Variant[String, Integer] $port = '6379',
4761
Optional[Array] $ports = undef,
62+
Boolean $ssl = false,
63+
String $ssl_keyfile = '',
64+
String $ssl_certfile = '',
65+
String $ssl_ca_certs = '',
66+
Optional[Integer] $ssl_cert_reqs = undef,
4867
Variant[String, Integer] $slowlog_max_len = '',
4968
Array $tags = [],
5069
Array $keys = [],
@@ -66,6 +85,11 @@
6685
'host' => $host,
6786
'password' => $password,
6887
'port' => $instance_port,
88+
'ssl' => $ssl,
89+
'ssl_keyfile' => $ssl_keyfile,
90+
'ssl_certfile' => $ssl_certfile,
91+
'ssl_ca_certs' => $ssl_ca_certs,
92+
'ssl_cert_reqs' => $ssl_cert_reqs,
6993
'slowlog_max_len' => $slowlog_max_len,
7094
'tags' => $tags,
7195
'keys' => $keys,

‎spec/classes/datadog_agent_integrations_redis_spec.rb‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,13 +117,23 @@
117117
'port' => 2379,
118118
'tags' => ['foo', 'bar'],
119119
'keys' => ['baz', 'bat'],
120+
'ssl' => true,
121+
'ssl_keyfile' => '/etc/pki/tls/certs/localhost.crt',
122+
'ssl_certfile' => '/path/to/cert.pem',
123+
'ssl_ca_certs' => '/path/to/ca_certs',
124+
'ssl_cert_reqs' => 0,
120125
},
121126
{
122127
'host' => 'redis1',
123128
'password' => 'hunter2',
124129
'port' => 2380,
125130
'tags' => ['foo', 'bar'],
126131
'keys' => ['baz', 'bat'],
132+
'ssl' => true,
133+
'ssl_keyfile' => '/etc/pki/tls/certs/localhost.crt',
134+
'ssl_certfile' => '/path/to/other/cert.pem',
135+
'ssl_ca_certs' => '/path/to/other/ca_certs',
136+
'ssl_cert_reqs' => 1,
127137
},
128138
],
129139
}
@@ -138,6 +148,14 @@
138148
it { is_expected.to contain_file(conf_file).without_content(%r{^[^#]*slowlog-max-len: 5309}) }
139149
it { is_expected.to contain_file(conf_file).without_content(%r{warn_on_missing_keys: false}) }
140150
it { is_expected.to contain_file(conf_file).without_content(%r{command_stats: true}) }
151+
it { is_expected.to contain_file(conf_file).with_content(%r{ssl: true}) }
152+
it { is_expected.to contain_file(conf_file).with_content(%r{ssl_keyfile: /etc/pki/tls/certs/localhost.crt}) }
153+
it { is_expected.to contain_file(conf_file).with_content(%r{ssl_certfile: /path/to/cert.pem}) }
154+
it { is_expected.to contain_file(conf_file).with_content(%r{ssl_certfile: /path/to/other/cert.pem}) }
155+
it { is_expected.to contain_file(conf_file).with_content(%r{ssl_ca_certs: /path/to/ca_certs}) }
156+
it { is_expected.to contain_file(conf_file).with_content(%r{ssl_ca_certs: /path/to/other/ca_certs}) }
157+
it { is_expected.to contain_file(conf_file).with_content(%r{ssl_cert_reqs: 0}) }
158+
it { is_expected.to contain_file(conf_file).with_content(%r{ssl_cert_reqs: 1}) }
141159
end
142160

143161
context 'with only keys' do
@@ -181,6 +199,35 @@
181199
it { is_expected.to contain_file(conf_file).with_content(%r{port: 2379}) }
182200
it { is_expected.to contain_file(conf_file).with_content(%r{tags:.*\s+- baz\s+- bat}) }
183201
end
202+
203+
context 'with ssl configs' do
204+
let(:params) do
205+
{
206+
instances: [
207+
{
208+
'host' => 'redis1',
209+
'password' => 'hunter2',
210+
'port' => 2379,
211+
'ssl' => true,
212+
'ssl_keyfile' => '/etc/pki/tls/certs/localhost.crt',
213+
'ssl_certfile' => '/path/to/cert.pem',
214+
'ssl_ca_certs' => '/path/to/ca_certs',
215+
'ssl_cert_reqs' => 0,
216+
},
217+
],
218+
}
219+
end
220+
221+
it { is_expected.to contain_file(conf_file).with_content(%r{host: redis1}) }
222+
it { is_expected.to contain_file(conf_file).with_content(%r{^[^#]*password: hunter2}) }
223+
it { is_expected.to contain_file(conf_file).with_content(%r{port: 2379}) }
224+
225+
it { is_expected.to contain_file(conf_file).with_content(%r{ssl: true}) }
226+
it { is_expected.to contain_file(conf_file).with_content(%r{ssl_keyfile: /etc/pki/tls/certs/localhost.crt}) }
227+
it { is_expected.to contain_file(conf_file).with_content(%r{ssl_certfile: /path/to/cert.pem}) }
228+
it { is_expected.to contain_file(conf_file).with_content(%r{ssl_ca_certs: /path/to/ca_certs}) }
229+
it { is_expected.to contain_file(conf_file).with_content(%r{ssl_cert_reqs: 0}) }
230+
end
184231
end
185232
end
186233
end

‎templates/agent-conf.d/redisdb.yaml.erb‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,21 @@ instances:
99
<% if instance['password'] and ! instance['password'].empty? -%>
1010
password: <%= instance['password'] %>
1111
<% end -%>
12+
<% if instance['ssl'] and ! instance['ssl'].nil? -%>
13+
ssl: <%= instance['ssl'] %>
14+
<% end -%>
15+
<% if instance['ssl_keyfile'] and ! instance['ssl_keyfile'].empty? -%>
16+
ssl_keyfile: <%= instance['ssl_keyfile'] %>
17+
<% end -%>
18+
<% if instance['ssl_certfile'] and ! instance['ssl_certfile'].empty? -%>
19+
ssl_certfile: <%= instance['ssl_certfile'] %>
20+
<% end -%>
21+
<% if instance['ssl_ca_certs'] and ! instance['ssl_ca_certs'].empty? -%>
22+
ssl_ca_certs: <%= instance['ssl_ca_certs'] %>
23+
<% end -%>
24+
<% if instance['ssl_cert_reqs'] and ! instance['ssl_cert_reqs'].nil? -%>
25+
ssl_cert_reqs: <%= instance['ssl_cert_reqs'] %>
26+
<% end -%>
1227
<% if instance['slowlog_max_len'] and ! instance['slowlog_max_len'].to_s.empty? -%>
1328
# unix_socket_path: /var/run/redis/redis.sock # optional, can be used in lieu of host/port
1429
slowlog-max-len: <%= instance['slowlog_max_len'] %>

0 commit comments

Comments
 (0)
⚡