Flagsmith / Flagsmith/flagsmith

feat: Add configurable Redis cache KEY_PREFIX for shared Redis deployments

Open Beginner friendly
#7,297 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
6.6k
Forks
567
Avg merge
1d 14h
Merged PRs (30d)
124

Description

## Summary

When self-hosting Flagsmith with a shared Redis instance that uses ACL-based multi-tenancy, all cache keys are written with an empty `KEY_PREFIX` (Django default), producing keys like `:1:environment_document_xxx`. This makes it impossible to restrict Flagsmith's Redis user to a namespace prefix (e.g., `~flagsmith:*`) via Redis ACL rules.

## Current behavior

Flagsmith's `CACHES` configuration in `api/app/settings/common.py` does not include a `KEY_PREFIX` for any of the Redis-backed cache entries (`environment_cache`, `environment_document_cache`, etc.). Django's `BaseCache.make_key` produces keys in the format `{KEY_PREFIX}:{VERSION}:{key}` — with an empty prefix, all keys start with `:1:`.

## Desired behavior

A new environment variable (e.g., `CACHE_KEY_PREFIX`) that sets `KEY_PREFIX` on all Redis-backed cache entries in the `CACHES` dict. Example:

```python
CACHE_KEY_PREFIX = env.str("CACHE_KEY_PREFIX", default="")

for cache_name, cache_config in CACHES.items():
if "redis" in cache_config.get("BACKEND", "").lower():
cache_config["KEY_PREFIX"] = CACHE_KEY_PREFIX
```

With `CACHE_KEY_PREFIX=flagsmith`, keys become `flagsmith:1:environment_document_xxx`, which can be matched by Redis ACL `~flagsmith:*`.

## Use case

Our infrastructure runs a single Redis instance with per-service ACL users. Each service gets a dedicated user restricted to its own key namespace (`~:*`). This is a common pattern for shared Redis deployments where full isolation (separate Redis instances) is impractical.

Without a configurable prefix, the Flagsmith Redis user must be granted `~*` (all keys), breaking the isolation model.

## Additional context

- This becomes more important as #6815 migrates more in-process caches to Redis
- Django's `CACHES` framework natively supports `KEY_PREFIX` — this is just about exposing it via env var
- Flagsmith's task processor already uses Postgres (not Redis), so this only affects cache keys

Contributor guide

Open the contributing guide

Research direction

Start in api/app/settings/common.py and inspect how CACHES defines environment_cache and environment_document_cache. Trace Django’s cache key generation with a configured CACHE_KEY_PREFIX, then verify Redis-backed entries use the prefix and produce keys that match the documented ACL namespace.

Written by the indexing model from the issue text.

Assessment

Tech stack
django, python, redis
Domain
backend, databases
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.