Enable password-protected Redis

[samuelmak]

Summary

Enable password-protected Redis

Motivation

We would like to enable password auth of Redis so that the information is protected.

Proposal

Can we inject the password from kubernetes secret into Redis and Argo CD server so that they can communicate with a password protected channel?

[alexmt]

Hello @samuelmak ,

This is available but not documented. The password should be specified in REDIS_PASSWORD env variable in argocd-application-controller, argocd-server and argocd-repo-server deployments. Sending PR with the docs changes

[BenManifold]

Is there any way to set this password using a secret instead of an environment variable? Passwords as env-vars violates our infosec compliance guidelines.

[BenManifold]

Hello @samuelmak ,

This is available but not documented. The password should be specified in REDIS_PASSWORD env variable in argocd-application-controller, argocd-server and argocd-repo-server deployments. Sending PR with the docs changes

We really need a way to mount the password as a secrets file so we're not just skywriting in env vars all over the place

[LesleyDebes]

@alexmt Are there directions on how to pass the REDIS_PASSWORD environment correctly so that the Redis instance is password protected? Our team hasn't been able to get this working successfully but cannot find any info in the docs to see where we may be going wrong.

[nzin-appdirect]

Hi @LesleyDebes , I think it is because the haproxy is not setup to pass an AUTH token.
i.e.
in particular in

argo-cd/manifests/ha/base/redis-ha/chart/upstream.yaml

Line 343 in d511fb8

tcp-check send PING\r\n

we should have a

      tcp-check send AUTH <yourredispassword>\r\n
      tcp-check expect string +OK
      tcp-check send PING\r\n
      tcp-check expect string +PONG
      tcp-check send SENTINEL\ get-master-addr-by-name\ argocd\r\n
      tcp-check expect string REPLACE_ANNOUNCE0

[SnoozeFreddo]

Would also need some instructions for non HA version.

The docs just reference this issue but what's the solution to store it as a secret?

[todaywasawesome]

Closed by f1a449e