From 1d3149ca0da7ba6504c7b8d369fee0cab8a12279 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Wed, 15 Jul 2026 10:04:32 +0530 Subject: [PATCH 1/2] feat(redis-ha-proxy): Configure Redis Ha Proxy TLS settings Signed-off-by: akhil nittala --- build/redis/haproxy.cfg.tpl | 45 +++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 12 deletions(-) diff --git a/build/redis/haproxy.cfg.tpl b/build/redis/haproxy.cfg.tpl index 0952c8c7659..dfc08f7b5c9 100644 --- a/build/redis/haproxy.cfg.tpl +++ b/build/redis/haproxy.cfg.tpl @@ -1,6 +1,27 @@ {{- if eq .UseTLS "true"}} global ca-base /app/config/redis/tls + +{{- if .tlsMinVersion}} + ssl-default-bind-options ssl-min-ver TLSv{{.tlsMinVersion}} + ssl-default-server-options ssl-min-ver TLSv{{.tlsMinVersion}} +{{- end}} + +{{- if .tlsCiphers}} +{{- if eq .tlsMinVersion "1.3"}} + # TLS 1.3 cipher suites + ssl-default-bind-ciphersuites {{.tlsCiphers}} + ssl-default-server-ciphersuites {{.tlsCiphers}} +{{- else}} + # TLS 1.2 and below cipher lists + ssl-default-bind-ciphers {{.tlsCiphers}} + ssl-default-server-ciphers {{.tlsCiphers}} + + # Also configure TLS 1.3 cipher suites when TLS 1.3 is negotiated + ssl-default-bind-ciphersuites {{.tlsCiphers}} + ssl-default-server-ciphersuites {{.tlsCiphers}} +{{- end}} +{{- end}} {{- end}} defaults REDIS @@ -37,9 +58,9 @@ backend check_if_redis_is_master_0 server R1 {{.ServiceName}}-announce-1:26379 check inter 3s server R2 {{.ServiceName}}-announce-2:26379 check inter 3s {{- else}} - server R0 {{.ServiceName}}-announce-0:26379 verify required ca-file tls.crt check inter 3s - server R1 {{.ServiceName}}-announce-1:26379 verify required ca-file tls.crt check inter 3s - server R2 {{.ServiceName}}-announce-2:26379 verify required ca-file tls.crt check inter 3s + server R0 {{.ServiceName}}-announce-0:26379 ssl verify required ca-file tls.crt check inter 3s + server R1 {{.ServiceName}}-announce-1:26379 ssl verify required ca-file tls.crt check inter 3s + server R2 {{.ServiceName}}-announce-2:26379 ssl verify required ca-file tls.crt check inter 3s {{- end}} # Check Sentinel and whether they are nominated master backend check_if_redis_is_master_1 @@ -63,9 +84,9 @@ backend check_if_redis_is_master_1 server R1 {{.ServiceName}}-announce-1:26379 check inter 3s server R2 {{.ServiceName}}-announce-2:26379 check inter 3s {{- else}} - server R0 {{.ServiceName}}-announce-0:26379 verify required ca-file tls.crt check inter 3s - server R1 {{.ServiceName}}-announce-1:26379 verify required ca-file tls.crt check inter 3s - server R2 {{.ServiceName}}-announce-2:26379 verify required ca-file tls.crt check inter 3s + server R0 {{.ServiceName}}-announce-0:26379 ssl verify required ca-file tls.crt check inter 3s + server R1 {{.ServiceName}}-announce-1:26379 ssl verify required ca-file tls.crt check inter 3s + server R2 {{.ServiceName}}-announce-2:26379 ssl verify required ca-file tls.crt check inter 3s {{- end}} # Check Sentinel and whether they are nominated master backend check_if_redis_is_master_2 @@ -89,9 +110,9 @@ backend check_if_redis_is_master_2 server R1 {{.ServiceName}}-announce-1:26379 check inter 3s server R2 {{.ServiceName}}-announce-2:26379 check inter 3s {{- else}} - server R0 {{.ServiceName}}-announce-0:26379 verify required ca-file tls.crt check inter 3s - server R1 {{.ServiceName}}-announce-1:26379 verify required ca-file tls.crt check inter 3s - server R2 {{.ServiceName}}-announce-2:26379 verify required ca-file tls.crt check inter 3s + server R0 {{.ServiceName}}-announce-0:26379 ssl verify required ca-file tls.crt check inter 3s + server R1 {{.ServiceName}}-announce-1:26379 ssl verify required ca-file tls.crt check inter 3s + server R2 {{.ServiceName}}-announce-2:26379 ssl verify required ca-file tls.crt check inter 3s {{- end}} # decide redis backend to use @@ -125,9 +146,9 @@ backend bk_redis_master server R2 {{.ServiceName}}-announce-2:6379 check inter 3s fall 1 rise 1 {{- else}} use-server R0 if { srv_is_up(R0) } { nbsrv(check_if_redis_is_master_0) ge 2 } - server R0 {{.ServiceName}}-announce-0:6379 verify required ca-file tls.crt check inter 3s fall 1 rise 1 + server R0 {{.ServiceName}}-announce-0:6379 ssl verify required ca-file tls.crt check inter 3s fall 1 rise 1 use-server R1 if { srv_is_up(R1) } { nbsrv(check_if_redis_is_master_1) ge 2 } - server R1 {{.ServiceName}}-announce-1:6379 verify required ca-file tls.crt check inter 3s fall 1 rise 1 + server R1 {{.ServiceName}}-announce-1:6379 ssl verify required ca-file tls.crt check inter 3s fall 1 rise 1 use-server R2 if { srv_is_up(R2) } { nbsrv(check_if_redis_is_master_2) ge 2 } - server R2 {{.ServiceName}}-announce-2:6379 verify required ca-file tls.crt check inter 3s fall 1 rise 1 + server R2 {{.ServiceName}}-announce-2:6379 ssl verify required ca-file tls.crt check inter 3s fall 1 rise 1 {{- end}} From fb202c54a76a7d35644a805b5bf656f66a1afa86 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Wed, 22 Jul 2026 10:12:00 +0530 Subject: [PATCH 2/2] feat(redis-ha-proxy): Configure Redis Ha Proxy TLS settings Signed-off-by: akhil nittala --- build/redis/haproxy.cfg.tpl | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/build/redis/haproxy.cfg.tpl b/build/redis/haproxy.cfg.tpl index dfc08f7b5c9..0c4e975c71b 100644 --- a/build/redis/haproxy.cfg.tpl +++ b/build/redis/haproxy.cfg.tpl @@ -2,24 +2,24 @@ global ca-base /app/config/redis/tls -{{- if .tlsMinVersion}} - ssl-default-bind-options ssl-min-ver TLSv{{.tlsMinVersion}} - ssl-default-server-options ssl-min-ver TLSv{{.tlsMinVersion}} +{{- if .TLSMinVersion}} + ssl-default-bind-options ssl-min-ver TLSv{{.TLSMinVersion}} + ssl-default-server-options ssl-min-ver TLSv{{.TLSMinVersion}} {{- end}} -{{- if .tlsCiphers}} -{{- if eq .tlsMinVersion "1.3"}} +{{- if .TLSCiphers}} +{{- if eq .TLSMinVersion "1.3"}} # TLS 1.3 cipher suites - ssl-default-bind-ciphersuites {{.tlsCiphers}} - ssl-default-server-ciphersuites {{.tlsCiphers}} + ssl-default-bind-ciphersuites {{.TLSCiphers}} + ssl-default-server-ciphersuites {{.TLSCiphers}} {{- else}} # TLS 1.2 and below cipher lists - ssl-default-bind-ciphers {{.tlsCiphers}} - ssl-default-server-ciphers {{.tlsCiphers}} + ssl-default-bind-ciphers {{.TLSCiphers}} + ssl-default-server-ciphers {{.TLSCiphers}} # Also configure TLS 1.3 cipher suites when TLS 1.3 is negotiated - ssl-default-bind-ciphersuites {{.tlsCiphers}} - ssl-default-server-ciphersuites {{.tlsCiphers}} + ssl-default-bind-ciphersuites {{.TLSCiphers}} + ssl-default-server-ciphersuites {{.TLSCiphers}} {{- end}} {{- end}} {{- end}}