diff --git a/bitnami/redis/7.2/debian-11/Dockerfile b/bitnami/redis/7.2/debian-11/Dockerfile index cf2de5ae11b7..f43de178d69f 100644 --- a/bitnami/redis/7.2/debian-11/Dockerfile +++ b/bitnami/redis/7.2/debian-11/Dockerfile @@ -7,10 +7,10 @@ ARG TARGETARCH LABEL com.vmware.cp.artifact.flavor="sha256:1e1b4657a77f0d47e9220f0c37b9bf7802581b93214fff7d1bd2364c8bf22e8e" \ org.opencontainers.image.base.name="docker.io/bitnami/minideb:bullseye" \ - org.opencontainers.image.created="2024-02-14T23:59:08Z" \ + org.opencontainers.image.created="2024-02-15T10:21:24Z" \ org.opencontainers.image.description="Application packaged by VMware, Inc" \ org.opencontainers.image.licenses="Apache-2.0" \ - org.opencontainers.image.ref.name="7.2.4-debian-11-r16" \ + org.opencontainers.image.ref.name="7.2.4-debian-11-r17" \ org.opencontainers.image.title="redis" \ org.opencontainers.image.vendor="VMware, Inc." \ org.opencontainers.image.version="7.2.4" diff --git a/bitnami/redis/7.2/debian-11/rootfs/opt/bitnami/scripts/libredis.sh b/bitnami/redis/7.2/debian-11/rootfs/opt/bitnami/scripts/libredis.sh index 34329c95fa66..09ad07460a17 100644 --- a/bitnami/redis/7.2/debian-11/rootfs/opt/bitnami/scripts/libredis.sh +++ b/bitnami/redis/7.2/debian-11/rootfs/opt/bitnami/scripts/libredis.sh @@ -228,11 +228,7 @@ redis_validate() { print_validation_error "The private key file in the specified path ${REDIS_TLS_KEY_FILE} does not exist" fi if [[ -z "$REDIS_TLS_CA_FILE" ]]; then - if [[ -z "$REDIS_TLS_CA_DIR" ]]; then - print_validation_error "You must provide either a CA X.509 certificate or a CA certificates directory in order to use TLS" - elif [[ ! -d "$REDIS_TLS_CA_DIR" ]]; then - print_validation_error "The CA certificates directory specified by path ${REDIS_TLS_CA_DIR} does not exist" - fi + print_validation_error "You must provide a CA X.509 certificate in order to use TLS" elif [[ ! -f "$REDIS_TLS_CA_FILE" ]]; then print_validation_error "The CA X.509 certificate file in the specified path ${REDIS_TLS_CA_FILE} does not exist" fi @@ -269,8 +265,7 @@ redis_configure_replication() { elif [[ "$REDIS_REPLICATION_MODE" =~ ^(slave|replica)$ ]]; then if [[ -n "$REDIS_SENTINEL_HOST" ]]; then local -a sentinel_info_command=("redis-cli" "-h" "${REDIS_SENTINEL_HOST}" "-p" "${REDIS_SENTINEL_PORT_NUMBER}") - is_boolean_yes "$REDIS_TLS_ENABLED" && sentinel_info_command+=("--tls" "--cert" "${REDIS_TLS_CERT_FILE}" "--key" "${REDIS_TLS_KEY_FILE}") - is_empty_value "$REDIS_TLS_CA_FILE" && sentinel_info_command+=("--cacertdir" "${REDIS_TLS_CA_DIR}") || sentinel_info_command+=("--cacert" "${REDIS_TLS_CA_FILE}") + is_boolean_yes "$REDIS_TLS_ENABLED" && sentinel_info_command+=("--tls" "--cert" "${REDIS_TLS_CERT_FILE}" "--key" "${REDIS_TLS_KEY_FILE}" "--cacert" "${REDIS_TLS_CA_FILE}") sentinel_info_command+=("sentinel" "get-master-addr-by-name" "${REDIS_SENTINEL_MASTER_NAME}") read -r -a REDIS_SENTINEL_INFO <<< "$("${sentinel_info_command[@]}" | tr '\n' ' ')" REDIS_MASTER_HOST=${REDIS_SENTINEL_INFO[0]} @@ -436,7 +431,7 @@ redis_configure_default() { fi redis_conf_set tls-cert-file "$REDIS_TLS_CERT_FILE" redis_conf_set tls-key-file "$REDIS_TLS_KEY_FILE" - is_empty_value "$REDIS_TLS_CA_FILE" && redis_conf_set tls-ca-cert-dir "$REDIS_TLS_CA_DIR" || redis_conf_set tls-ca-cert-file "$REDIS_TLS_CA_FILE" + redis_conf_set tls-ca-cert-file "$REDIS_TLS_CA_FILE" ! is_empty_value "$REDIS_TLS_KEY_FILE_PASS" && redis_conf_set tls-key-file-pass "$REDIS_TLS_KEY_FILE_PASS" [[ -n "$REDIS_TLS_DH_PARAMS_FILE" ]] && redis_conf_set tls-dh-params-file "$REDIS_TLS_DH_PARAMS_FILE" redis_conf_set tls-auth-clients "$REDIS_TLS_AUTH_CLIENTS" diff --git a/bitnami/redis/7.2/debian-11/rootfs/opt/bitnami/scripts/redis-env.sh b/bitnami/redis/7.2/debian-11/rootfs/opt/bitnami/scripts/redis-env.sh index 5d3bb6b61705..ed9a7f67a4f5 100644 --- a/bitnami/redis/7.2/debian-11/rootfs/opt/bitnami/scripts/redis-env.sh +++ b/bitnami/redis/7.2/debian-11/rootfs/opt/bitnami/scripts/redis-env.sh @@ -51,7 +51,6 @@ redis_env_vars=( REDIS_TLS_KEY_FILE REDIS_TLS_KEY_FILE_PASS REDIS_TLS_CA_FILE - REDIS_TLS_CA_DIR REDIS_TLS_DH_PARAMS_FILE REDIS_TLS_AUTH_CLIENTS REDIS_SENTINEL_MASTER_NAME @@ -121,7 +120,6 @@ export REDIS_TLS_CERT_FILE="${REDIS_TLS_CERT_FILE:-}" export REDIS_TLS_KEY_FILE="${REDIS_TLS_KEY_FILE:-}" export REDIS_TLS_KEY_FILE_PASS="${REDIS_TLS_KEY_FILE_PASS:-}" export REDIS_TLS_CA_FILE="${REDIS_TLS_CA_FILE:-}" -export REDIS_TLS_CA_DIR="${REDIS_TLS_CA_DIR:-}" export REDIS_TLS_DH_PARAMS_FILE="${REDIS_TLS_DH_PARAMS_FILE:-}" export REDIS_TLS_AUTH_CLIENTS="${REDIS_TLS_AUTH_CLIENTS:-yes}" diff --git a/bitnami/redis/README.md b/bitnami/redis/README.md index 1eda5902c771..340f586684bc 100644 --- a/bitnami/redis/README.md +++ b/bitnami/redis/README.md @@ -479,6 +479,7 @@ Starting with version 6, Redis(R) adds the support for SSL/TLS connections. Shou * `REDIS_TLS_CA_DIR`: Directory containing the CA certificates. No defaults. * `REDIS_TLS_DH_PARAMS_FILE`: File containing DH params (in order to support DH based ciphers). No defaults. * `REDIS_TLS_AUTH_CLIENTS`: Whether to require clients to authenticate or not. Defaults to `yes`. + When enabling TLS, conventional standard traffic is disabled by default. However this new feature is not mutually exclusive, which means it is possible to listen to both TLS and non-TLS connection simultaneously. To enable non-TLS traffic, set `REDIS_TLS_PORT_NUMBER` to another port different than `0`. 1. Using `docker run`