How to connect Stackstorm to Redis with TLS?

[jpvis]

Hi,
I'm trying to connect Stackstrom to Redis cluster using TLS.
Configuration is used :

[coordination]
url = redis://ctrl-node1:26379?sentinel=mymaster&
  sentinel_fallback=ctrl-node2:26379&
  sentinel_fallback=ctrl-node3:2637&
  ssl=true&
  ssl_certfile=%2Fetc%2Fpki%2Fst2-ha%2Fst2-node1.crt&
  ssl_keyfile=%2Fetc%2Fpki%2Fst2-ha%2Fst2-node1.key

From Redis side I'm getting logs:

752211:X 25 Oct 2021 02:16:59.130 # Error accepting a client connection: error:1408F10B:SSL routines:ssl3_get_record:wrong version number
752211:X 25 Oct 2021 02:16:59.130 # Error accepting a client connection: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (conn: fd=16)

Same error in redis.log and sentinel.logs

I successfully connected to Redis using redis-cli.

redis-cli --tls     --cert /etc/pki/st2-ha/ctrl-node1.crt     --key /etc/pki/st2-ha/ctrl-node1.key     --cacert /etc/pki/ca-trust/source/anchors/st2_ha_ca.crt -h ctrl-node1  -p 26379
ctrl-node1:26379> info
# Server
redis_version:6.0.16

So certificates are fine. There only difference that in redis-cli I can provice CA certificate, but in Stackstorm there is no such option

Stackstorm version:

st2 3.5.0, on Python 3.6.8

[vikasorchestral]

R u solve this one we have same problem

[bertyah]

same problem here. trying to connect to redis in AWS.

[amanda11]

There was a problem connecting to Redis via SSL in versions 3.7.0 and below. This will be fixed in 3.8.0. The fix is in the unstable release of StackStorm, the PR with the fix is #5660.

This allows you to connect to a redis sentinel that has both a SSL and non-SSL port. Whereby the sentinels use TLS to connect to master. It will then allow StackStorm to inquire on the sentinel over the non-SSL port to find the master, and then use TLS to connect to the redis master.

To connect to redis sentinel over SSL will require changes to tooz library which StackStorm uses to access redis, as I believe its driver when connecting to the redis sentinel doesn't pass the SSL credentials.

[SuganJoe]

While connecting to an external Redis cluster, does it require to connect via sentinel ?
From the url posted in the discussion, it looks like a sentinel.

We are trying to connect to an external Redis cluster (TLS enabled)using its host name like below

st2:
  config: |
  [coordination]
  url = redis://<password>@master.server:6379
  

and get error below
tooz.coordination.ToozConnectionError: Timeout reading from socket

[amanda11]

You don't have to use sentinel, it was just being used in this setup. However when trying to use the sentinel to a SSL redis I found the problem mentioned above.

Looking at the two fixes that were needed for: #5660, then I think you might need the monkey-patch part of the fix to get to a redis cluster using SSL, as that isn't specific for sentinel. That code fix is only available in the unstable 3.8 yet, we've not released 3.8.

The other change to update the redis library, I think was specific to sentinel.