dragonflydb / dragonflydb/dragonfly-operator
Setting admin_nopass to false prevents operator from configuring instances
- Dominant language
- Go
- Stars
- 357
- Forks
- 111
- PR merge metrics
- No merged PRs in 30d
Description
Configuring authentication on the non-admin port works perfectly with:
```yaml
authentication:
passwordFromSecret:
name: foo
key: password
```
However, on inspection of `kubectl describe statefulset dragonfly`, containers are configured with the following arguments:
```text
Args:
--alsologtostderr
--primary_port_http_enabled=false
--admin_port=9999
--admin_nopass
```
I confirmed that when authentication is configured, connecting to the non-admin port requires a password, and connecting to the admin port does not. I assumed that overriding `admin_nopass` would cause the operator to authenticate with the secret above, but it still attempts an unauthenticated connection to the admin port.
```text
2023-11-17T02:39:39Z ERROR Failed to mark pod as master {"controller": "pod", "controllerGroup": "", "controllerKind": "Pod", "Pod": {"name":"dragonfly-0","namespace":"default"}, "namespace": "default", "name": "dragonfly-0", "reconcileID": "", "podName": "dragonfly-0", "error": "error running SLAVE OF NO ONE command: NOAUTH Authentication required."}
github.com/dragonflydb/dragonfly-operator/internal/controller.(*DragonflyInstance).configureReplication
/workspace/internal/controller/dragonfly_instance.go:108
github.com/dragonflydb/dragonfly-operator/internal/controller.(*DfPodLifeCycleReconciler).Reconcile
/workspace/internal/controller/dragonfly_pod_lifecycle_controller.go:92
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:122
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:323
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:274
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:235
2023-11-17T02:39:39Z INFO could not initialize replication. will retry {"controller": "pod", "controllerGroup": "", "controllerKind": "Pod", "Pod": {"name":"dragonfly-0","namespace":"default"}, "namespace": "default", "name": "dragonfly-0", "reconcileID": "ac977a2c-ea01-49f8-8812-574a2d9acc31", "error": "error running SLAVE OF NO ONE command: NOAUTH Authentication required."}
```
I assume this is just because the username/password pair is not passed on construction of the redis client at `internal/controller/dragonfly_instance.go:369`. Are there plans to support this/would a pull request supporting this be welcome?
Contributor guide
Research direction
Start with internal/controller/dragonfly_instance.go:369, where the Redis client is constructed, and trace its use from configureReplication at line 108. Check how the configured authentication secret reaches the operator and verify that replication initialization succeeds when the admin port requires authentication.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes, redis
- Domain
- databases, devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100