dragonflydb / dragonflydb/dragonfly-operator

Setting admin_nopass to false prevents operator from configuring instances

Open
#133 8 comments 2 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
357
Forks
111
PR merge metrics
No merged PRs in 30d

Description

Configuring authentication on the non-admin port works perfectly with:
```yaml
authentication:
passwordFromSecret:
name: foo
key: password
```

However, on inspection of `kubectl describe statefulset dragonfly`, containers are configured with the following arguments:
```text
Args:
--alsologtostderr
--primary_port_http_enabled=false
--admin_port=9999
--admin_nopass
```

I confirmed that when authentication is configured, connecting to the non-admin port requires a password, and connecting to the admin port does not. I assumed that overriding `admin_nopass` would cause the operator to authenticate with the secret above, but it still attempts an unauthenticated connection to the admin port.

```text
2023-11-17T02:39:39Z ERROR Failed to mark pod as master {"controller": "pod", "controllerGroup": "", "controllerKind": "Pod", "Pod": {"name":"dragonfly-0","namespace":"default"}, "namespace": "default", "name": "dragonfly-0", "reconcileID": "", "podName": "dragonfly-0", "error": "error running SLAVE OF NO ONE command: NOAUTH Authentication required."}
github.com/dragonflydb/dragonfly-operator/internal/controller.(*DragonflyInstance).configureReplication
/workspace/internal/controller/dragonfly_instance.go:108
github.com/dragonflydb/dragonfly-operator/internal/controller.(*DfPodLifeCycleReconciler).Reconcile
/workspace/internal/controller/dragonfly_pod_lifecycle_controller.go:92
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:122
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:323
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:274
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.4/pkg/internal/controller/controller.go:235
2023-11-17T02:39:39Z INFO could not initialize replication. will retry {"controller": "pod", "controllerGroup": "", "controllerKind": "Pod", "Pod": {"name":"dragonfly-0","namespace":"default"}, "namespace": "default", "name": "dragonfly-0", "reconcileID": "ac977a2c-ea01-49f8-8812-574a2d9acc31", "error": "error running SLAVE OF NO ONE command: NOAUTH Authentication required."}
```

I assume this is just because the username/password pair is not passed on construction of the redis client at `internal/controller/dragonfly_instance.go:369`. Are there plans to support this/would a pull request supporting this be welcome?

Contributor guide

Open the contributing guide

Research direction

Start with internal/controller/dragonfly_instance.go:369, where the Redis client is constructed, and trace its use from configureReplication at line 108. Check how the configured authentication secret reaches the operator and verify that replication initialization succeeds when the admin port requires authentication.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes, redis
Domain
databases, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.