mirror of https://github.com/grafana/grafana
Alerting: Add options to configure TLS for HA using Redis (#87567)
* Add Alerting HA Redis Client TLS configs * Add test to ping miniredis with mTLS * Update .ini files and docs * Add tests for unified alerting ha redis TLS settings * Fix malformed go.sum * Add modowner * Fix lint error * Update docs and use dstls configpull/83024/head^2
Fayzal Ghantiwala
1 year ago
committed by
GitHub
parent
e39658097f
commit
7a2fbad0c8
@ -0,0 +1,89 @@ |
|||||||
|
package notifier |
||||||
|
|
||||||
|
import ( |
||||||
|
"context" |
||||||
|
"crypto/tls" |
||||||
|
"crypto/x509" |
||||||
|
"os" |
||||||
|
"testing" |
||||||
|
"time" |
||||||
|
|
||||||
|
"github.com/alicebob/miniredis/v2" |
||||||
|
dstls "github.com/grafana/dskit/crypto/tls" |
||||||
|
"github.com/grafana/grafana/pkg/infra/log" |
||||||
|
"github.com/madflojo/testcerts" |
||||||
|
"github.com/prometheus/client_golang/prometheus" |
||||||
|
"github.com/stretchr/testify/require" |
||||||
|
) |
||||||
|
|
||||||
|
func TestNewRedisPeerWithTLS(t *testing.T) { |
||||||
|
// Write client and server certificates/keys to tempDir, both issues by the same CA
|
||||||
|
certPaths := createX509TestDir(t) |
||||||
|
|
||||||
|
// Set up tls.Config and start miniredis with server-side TLS
|
||||||
|
x509Cert, err := tls.LoadX509KeyPair(certPaths.serverCert, certPaths.serverKey) |
||||||
|
require.NoError(t, err) |
||||||
|
clientCAPool := x509.NewCertPool() |
||||||
|
clientCAFile, err := os.ReadFile(certPaths.ca) |
||||||
|
require.NoError(t, err) |
||||||
|
clientCAPool.AppendCertsFromPEM(clientCAFile) |
||||||
|
|
||||||
|
mr, err := miniredis.RunTLS(&tls.Config{ |
||||||
|
Certificates: []tls.Certificate{x509Cert}, |
||||||
|
ClientCAs: clientCAPool, |
||||||
|
}) |
||||||
|
require.NoError(t, err) |
||||||
|
defer mr.Close() |
||||||
|
|
||||||
|
// Create redis peer with client-side TLS
|
||||||
|
redisPeer, err := newRedisPeer(redisConfig{ |
||||||
|
addr: mr.Addr(), |
||||||
|
tlsEnabled: true, |
||||||
|
tls: dstls.ClientConfig{ |
||||||
|
CertPath: certPaths.clientCert, |
||||||
|
KeyPath: certPaths.clientKey, |
||||||
|
CAPath: certPaths.ca, |
||||||
|
ServerName: "localhost", |
||||||
|
}}, log.NewNopLogger(), prometheus.DefaultRegisterer, time.Second*60) |
||||||
|
require.NoError(t, err) |
||||||
|
|
||||||
|
ping := redisPeer.redis.Ping(context.Background()) |
||||||
|
require.NoError(t, ping.Err()) |
||||||
|
} |
||||||
|
|
||||||
|
type certPaths struct { |
||||||
|
clientCert string |
||||||
|
clientKey string |
||||||
|
serverCert string |
||||||
|
serverKey string |
||||||
|
ca string |
||||||
|
} |
||||||
|
|
||||||
|
func createX509TestDir(t *testing.T) certPaths { |
||||||
|
t.Helper() |
||||||
|
|
||||||
|
tmpDir := t.TempDir() |
||||||
|
|
||||||
|
ca := testcerts.NewCA() |
||||||
|
caCertFile, _, err := ca.ToTempFile(tmpDir) |
||||||
|
require.NoError(t, err) |
||||||
|
|
||||||
|
serverKp, err := ca.NewKeyPair("localhost") |
||||||
|
require.NoError(t, err) |
||||||
|
|
||||||
|
serverCertFile, serverKeyFile, err := serverKp.ToTempFile(tmpDir) |
||||||
|
require.NoError(t, err) |
||||||
|
|
||||||
|
clientKp, err := ca.NewKeyPair() |
||||||
|
require.NoError(t, err) |
||||||
|
clientCertFile, clientKeyFile, err := clientKp.ToTempFile(tmpDir) |
||||||
|
require.NoError(t, err) |
||||||
|
|
||||||
|
return certPaths{ |
||||||
|
clientCert: clientCertFile.Name(), |
||||||
|
clientKey: clientKeyFile.Name(), |
||||||
|
serverCert: serverCertFile.Name(), |
||||||
|
serverKey: serverKeyFile.Name(), |
||||||
|
ca: caCertFile.Name(), |
||||||
|
} |
||||||
|
} |
||||||
Loading…
Reference in new issue