redis.md

description
This article explains how to configure a Redis repository

Redis

Overview

The Redis repository plugin enables you to connect to Redis databases to use the Rate Limit feature. The Redis plugin is part of the default distribution of APIM.

Supported databases

Database	Version tested
Redis	6.2.x / 7.0.x

Configure the Rate Limit repository plugin

The following tables show the configuration options for different Redis implementations. All specific configurations are located under the ratelimit.redis attribute.

{% tabs %} {% tab title="Standalone" %} Redis Standalone options:

Parameter	Default	Description
host	localhost
port	6379
password

{% endtab %}

{% tab title="Sentinel" %} Redis Sentinel options:

Parameter	Default	Description
sentinel.nodes		List of sentinels with host and port
sentinel.master		Mandatory when using Sentinel
password

{% endtab %}

{% tab title="SSL" %} Redis SSL options:

Parameter	Default	Description
ssl	false
trustAll	true	Default value is true for backward compatibility but keep in mind that this is not a good practice and you should set to false and configure a truststore
tlsProtocols	See Vert.x doc	List of TLS protocols to allow comma separated
tlsCiphers	See Vert.x doc	List of TLS ciphers to allow comma separated
alpn	false
openssl	false	Used to rely on OpenSSL Engine instead of default JDK SSL Engine
keystore		Configuration for Mutual TLS. The keystore is used to select the client certificate to send to the backend server when connecting. See Redis SSL keystore options (client certificate, Mutual TLS)
truststore		Configuration for the truststore. The truststore is used to validate the server’s certificate. See Redis SSL truststore options

{% endtab %}

{% tab title="SSL keystore" %} Redis SSL keystore options (client certificate, Mutual TLS):

Parameter	Default	Description
type		Supports jks, pem, pkcs12
path		A path is required if certificate’s type is jks or pkcs12
password
alias
certificates		List of certificates with cert and key. Certificates are required if keystore’s type is pem

{% endtab %}

{% tab title="SSL trustore" %} Redis SSL truststore options:

Parameter	Default	Description
type		Supports jks, pem, pkcs12
path
password
alias

{% endtab %} {% endtabs %}

Below is the minimum configuration needed to get started with a Redis database.

# ===================================================================
# MINIMUM REDIS REPOSITORY PROPERTIES
#
# This is a minimal sample file declared connection to Redis
# ===================================================================
ratelimit:
  type: redis               # repository type
  redis:                    # redis repository
    host:                   # redis host (default localhost)
    port:                   # redis port (default 6379)
    password:               # redis password (default null)
    timeout:                # redis timeout (default -1)

    # Following properties are REQUIRED ONLY when running Redis in sentinel mode
    sentinel:
      master:               # redis sentinel master host
      password:             # redis sentinel master password
      nodes: [              # redis sentinel node(s) list
        {
          host : localhost, # redis sentinel node host
          port : 26379      # redis sentinel node port
        },
        {
          host : localhost,
          port : 26380
        },
        {
          host : localhost,
          port : 26381
        }
      ]

    # Following SSL settings are REQUIRED ONLY for Redis client SSL
    ssl: true                # redis ssl mode (default false)
    trustAll: false
    tlsProtocols: TLSv1.2, TLSv1.3
    tlsCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
    alpn: false
    openssl: false
    # Keystore for redis mTLS (client certificate)
    keystore:
      type: jks
      path: ${gravitee.home}/security/redis-keystore.jks
      password: secret
    keyPassword:
    alias:
    certificates: # Certificates are required if keystore's type is pem
    #      - cert: ${gravitee.home}/security/redis-mycompany.org.pem
    #        key: ${gravitee.home}/security/redis-mycompany.org.key
    #      - cert: ${gravitee.home}/security/redis-myothercompany.com.pem
    #        key: ${gravitee.home}/security/redis-myothercompany.com.key
    truststore:
      type: pem
      path: ${gravitee.home}/security/redis-truststore.jks
      password: secret
      alias:

{% hint style="info" %} If Redis Rate Limit repository is not accessible, the API call will fail. Do not forget to monitor your probe health-check to verify that Redis repository is healthy. See the Internal API documentation for health endpoints. {% endhint %}