You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "gdelvaldi (via GitHub)" <gi...@apache.org> on 2026/06/02 05:01:52 UTC

[I] feat: support 'redis_username' variable for Redis Cluster authentication [apisix]

gdelvaldi opened a new issue, #13463:
URL: https://github.com/apache/apisix/issues/13463

   ### Description
   
   ### Description
   When using the redis-cluster policy in limit-count or equivalent plugins, APISIX can only authenticate against Redis using the default user and there is no way to configure a named ACL user to limit its privileges. This is a security gap in environments that follow the principle of least privilege. 
   
   What makes this more visible is the existing inconsistency in APISIX itself since the standalone redis policy already supports redis_username . The redis-cluster policy has no equivalent field, leaving cluster users with a weaker security posture than standalone users with no documented reason for the difference.
   
   ### Proposal
   
   - Add a new optional variable 'redis_username'  for redis cluster (on apisix/utils/redis-schema.lua and apisix/utils/rediscluster.lua)
   - Implement the possibility to use a username in resty.rediscluster library (dependency) so another MR on https://github.com/steve0511/resty-redis-cluster will be necessary to complete this issue
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] feat: support 'redis_username' variable for Redis Cluster authentication [apisix]

Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #13463:
URL: https://github.com/apache/apisix/issues/13463#issuecomment-4623090113

   Hi @gdelvaldi, I agree with your point of view, and welcome detailed technical proposals.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] feat: support 'redis_username' variable for Redis Cluster authentication [apisix]

Posted by "sandeepkunusoth (via GitHub)" <gi...@apache.org>.
sandeepkunusoth commented on issue #13463:
URL: https://github.com/apache/apisix/issues/13463#issuecomment-5588306483

   anyone working on this? if not i can pick up


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] feat: support 'redis_username' variable for Redis Cluster authentication [apisix]

Posted by "gdelvaldi (via GitHub)" <gi...@apache.org>.
gdelvaldi commented on issue #13463:
URL: https://github.com/apache/apisix/issues/13463#issuecomment-4651909835

   Hi @Baoyuantop thanks for the quick response! About the change it is minimal and fully backwards compatible, it's a single optional username config field that would allow to call `redis_client:auth(self.config.username, self.config.auth)` instead of the current one: `redis_client:auth(self.config.auth)`, but for this last part there is a linked PR on the concerned project.
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org