apache / apache/apisix

feat: support 'redis_username' variable for Redis Cluster authentication

Open
#13,463 3 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Lua
Stars
17.1k
Forks
2.9k
Avg merge
3d 16h
Merged PRs (30d)
63

Description

### Description

When using the redis-cluster policy in limit-count or equivalent plugins, APISIX can only authenticate against Redis using the default user and there is no way to configure a named ACL user to limit its privileges. This is a security gap in environments that follow the principle of least privilege.

What makes this more visible is the existing inconsistency in APISIX itself since the standalone redis policy already supports redis_username . The redis-cluster policy has no equivalent field, leaving cluster users with a weaker security posture than standalone users with no documented reason for the difference.

### Proposal

- Add a new optional variable 'redis_username' for redis cluster (on apisix/utils/redis-schema.lua and apisix/utils/rediscluster.lua)
- Implement the possibility to use a username in resty.rediscluster library (dependency) so another MR on https://github.com/steve0511/resty-redis-cluster will be necessary to complete this issue

Contributor guide

Open the contributing guide

Research direction

Start with apisix/utils/redis-schema.lua and apisix/utils/rediscluster.lua, comparing the cluster path with the standalone redis_username support. Then inspect the resty-redis-cluster dependency and its related MR requirements. Done means an optional redis_username can authenticate Redis Cluster users with the dependency support in place.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua, redis
Domain
authentication, databases
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.