Flagsmith / Flagsmith/flagsmith
feat: Add configurable Redis cache KEY_PREFIX for shared Redis deployments
- Dominant language
- Python
- Stars
- 6.6k
- Forks
- 567
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 124
Description
## Summary
When self-hosting Flagsmith with a shared Redis instance that uses ACL-based multi-tenancy, all cache keys are written with an empty `KEY_PREFIX` (Django default), producing keys like `:1:environment_document_xxx`. This makes it impossible to restrict Flagsmith's Redis user to a namespace prefix (e.g., `~flagsmith:*`) via Redis ACL rules.
## Current behavior
Flagsmith's `CACHES` configuration in `api/app/settings/common.py` does not include a `KEY_PREFIX` for any of the Redis-backed cache entries (`environment_cache`, `environment_document_cache`, etc.). Django's `BaseCache.make_key` produces keys in the format `{KEY_PREFIX}:{VERSION}:{key}` — with an empty prefix, all keys start with `:1:`.
## Desired behavior
A new environment variable (e.g., `CACHE_KEY_PREFIX`) that sets `KEY_PREFIX` on all Redis-backed cache entries in the `CACHES` dict. Example:
```python
CACHE_KEY_PREFIX = env.str("CACHE_KEY_PREFIX", default="")
for cache_name, cache_config in CACHES.items():
if "redis" in cache_config.get("BACKEND", "").lower():
cache_config["KEY_PREFIX"] = CACHE_KEY_PREFIX
```
With `CACHE_KEY_PREFIX=flagsmith`, keys become `flagsmith:1:environment_document_xxx`, which can be matched by Redis ACL `~flagsmith:*`.
## Use case
Our infrastructure runs a single Redis instance with per-service ACL users. Each service gets a dedicated user restricted to its own key namespace (`~:*`). This is a common pattern for shared Redis deployments where full isolation (separate Redis instances) is impractical.
Without a configurable prefix, the Flagsmith Redis user must be granted `~*` (all keys), breaking the isolation model.
## Additional context
- This becomes more important as #6815 migrates more in-process caches to Redis
- Django's `CACHES` framework natively supports `KEY_PREFIX` — this is just about exposing it via env var
- Flagsmith's task processor already uses Postgres (not Redis), so this only affects cache keys
Contributor guide
Research direction
Start in api/app/settings/common.py and inspect how CACHES defines environment_cache and environment_document_cache. Trace Django’s cache key generation with a configured CACHE_KEY_PREFIX, then verify Redis-backed entries use the prefix and produce keys that match the documented ACL namespace.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- django, python, redis
- Domain
- backend, databases
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100