Redis

This is most about AWS ElastiCache service, Redis cache that is fast key/value store.

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache and message broker. It supports data structures such as strings, hashes, lists, sets, sorted sets with range queries, bitmaps, hyperloglogs, geospatial indexes with radius queries and streams. Read more...

Install

Install the cli client only

# Local laptop
## Version distributed with Ubuntu 20.04
apt install redis-tools # redis-cli 5.0.7, does not support redis-over-TLS --tls flag

## Latest release, eg. redis-cli 6.2.3. supports redis-over-TLS --tls flag
add-apt-repository ppa:redislabs/redis
apt-get install redis


# A pod
kubectl -n default run --image=ubuntu:20.04 ubuntu-1 --rm -it -- bash
export DEBIAN_FRONTEND=noninteractive
apt update; apt install -yqq dnsutils netcat stunnel vim net-tools # select 8, 27, these are optional packages
apt install -yqq redis-tools # redis-cli 5.0.7

## Latest release, eg. redis-cli 6.2.3
apt-get install software-properties-common # installs 'add-apt-repository'
add-apt-repository ppa:redislabs/redis
apt-get install redis

Test connectivity

REDIS_PRIMARY=master.re111111111111.aaaaaa.ng.0001.aaa.cache.amazonaws.com
REDIS_REPLICA=replica.re111111111111.aaaaaa.ng.0001.aaa.cache.amazonaws.com
REDIS_AUTH_TOKEN='p#ssw0rd1'

redis-cli -h $REDIS_PRIMARY -p 6379 ping # no-encription-in-transit
PONG

Connect to the server and run commands from cli

Note: All below examples are based on connecting to AWS Redis ElasticCache

No-auth, no-encryption-in-transit

# connect to the server cli
$ redis-cli -h redis.acme.com -p 6379

# Using docker
$ docker run -it redis redis-cli -h redis.acme.com -p 6379

# Using telnet `apt install telnet`
telnet redis.acme.com 6379
Trying 10.10.10.111... # <-- server IP
Connected to redis.acme.com.
Escape character is '^]'.
monitor                     # command 1, streams back every command processed by Redis
+OK                         # stop monitoring by Ctl^C or issue command `QUIT` if using Telnet session
QUIT
+OK
Connection closed by foreign host.

telnet redis.acme.com 6379
Trying 10.10.10.111... # <-- server IP
KEYS AuthenticationService  # command 2, show keys
+1600340814.733253 [0 10.10.10.222:59730] "keys" "AuthenticationService" # <-- .222 client IP
*0
^]
telnet> Connection closed.

Auth and encryption-in-transit

Stunnel proxy

Note: If your redis-cli <6.x use this method

Authenticating Users with the Redis AUTH Command, with encryption in transport and at rest. This requires to use some sort of proxy that will enable SSL transport in beetween the redis-client and the AWS hosted redis-cache.

apt update; apt install -yqq dnsutils netcat redis-tools stunnel vim net-tools procps iproute2
# | iproute2(ss), procps(ps), dnsutils(dig)

# Config vars
 STUNNEL_UID=root
STUNNEL_GUID=root
PORT_PRIMARY=6379
PORT_REPLICA=6380
REDIS_PRIMARY=master.re111111111111.aaaaaa.ng.0001.aaa.cache.amazonaws.com
REDIS_REPLICA=replica.re111111111111.aaaaaa.ng.0001.aaa.cache.amazonaws.com

# Config 'stunnel' - local laptop
sudo bash -c "cat > /etc/stunnel/redis-cli.conf << EOF
fips = no
setuid = $STUNNEL_UID
setgid = $STUNNEL_GUID
pid = /var/run/stunnel.pid
debug = 7
delay = yes
#options = NO_SSLv2 # these options might be not valid anymore
#options = NO_SSLv3
[redis-cli]
   client = yes
   accept = 127.0.0.1:${PORT_PRIMARY}
   connect = $REDIS_PRIMARY:6379
[redis-cli-replica]
   client = yes
   accept = 127.0.0.1:${PORT_REPLICA}
   connect = $REDIS_REPLICA:6379
EOF"
cat /etc/stunnel/redis-cli.conf

# Config 'stunnel' - container (works with Istio sidecar, no-privilege mode needed)
cat > /etc/stunnel/redis-cli.conf << EOF
fips = no
setuid = $STUNNEL_UID
setgid = $STUNNEL_GUID
pid = /var/run/stunnel.pid
debug = 7
delay = yes
#options = NO_SSLv2 # Illegal TLS option
options = NO_SSLv3
[redis-cli]
   client = yes
   accept = 127.0.0.1:${PORT_PRIMARY}
   connect = $REDIS_PRIMARY:6379
[redis-cli-replica]
   client = yes
   accept = 127.0.0.1:${PORT_REPLICA}
   connect = $REDIS_REPLICA:6379
EOF
cat /etc/stunnel/redis-cli.conf

Create proxy-tunnel

stunnel /etc/stunnel/redis-cli.conf
netstat -tulnp | grep -i stunnel
root@ubuntu-1-57789d9bf7-pmg2j:/# netstat -tulnp | grep -i stunnel
tcp        0      0 127.0.0.1:6379          0.0.0.0:*               LISTEN      1049/stunnel
tcp        0      0 127.0.0.1:6380          0.0.0.0:*               LISTEN      1049/stunnel

pkill stunnel # kill stunnel

# Connect
redis-cli -h localhost      -p $PORT_PRIMARY
redis-cli -h localhost      -p $PORT_PRIMARY -a "$REDIS_AUTH_TOKEN"
redis-cli -h localhost      -p $PORT_PRIMARY -a "$REDIS_AUTH_TOKEN" ping
redis-cli -h localhost      -p $PORT_PRIMARY -a "$REDIS_AUTH_TOKEN" info server
redis-cli -h $REDIS_PRIMARY -p $PORT_PRIMARY -a "$REDIS_AUTH_TOKEN" --stat
redis-cli -u redis://"${REDIS_AUTH_TOKEN}"@${REDIS_PRIMARY}:${PORT_PRIMARY}/0 ping # never worked, could password contain unallowed chars

Note: Auth redis-cli -h localhost -p 8000 -a password, alternatively, you can authenticate by running the auth command followed by your password after establishing the connection: auth password1

Note: Continuous stats mode redis-cli --stat -i 5, in this mode a new line is printed every second with useful information and the difference between the old data point, -i 5 emits lines every 5 seconds, default is 1s

redis-cli --tls (6.x)

REDIS_PRIMARY=master.re111111111111.aaaaaa.ng.0001.aaa.cache.amazonaws.com
REDIS_REPLICA=replica.re111111111111.aaaaaa.ng.0001.aaa.cache.amazonaws.com
REDIS_AUTH_TOKEN='passwprd1' # default env var is: REDISCLI_AUTH

# connects to a cluster with [x]encryption enabled
redis-cli -h $REDIS_PRIMARY -p 6379 --no-auth-warning --tls
# connects to a cluster with [x]encryption and [x]authentication enabled
redis-cli -h $REDIS_PRIMARY -p 6379 --no-auth-warning --tls -a $REDIS_AUTH_TOKEN --verbose

# if using cname eg. REDIS_PRIMARY=redis then --sni is required
redis-cli -h $REDIS_PRIMARY -p 6379 --no-auth-warning --tls -a $REDIS_AUTH_TOKEN --sni $REDIS_PRIMARY --verbose 

# verify RedisCache SSL
openssl s_client -connect $REDIS_PRIMARY:6379 -servername $REDIS_PRIMARY

Commands

# auth
redis.acme.com:6379> AUTH p!ssw0rd1

# list who is connected
localhost:6379> CLIENT LIST
id=136260 addr=10.0.0.5:42257 fd=9 name=backendservice-11111f57fc-h7l9b age=96965 idle=49 flags=P db=0 sub=1 psub=0 multi=-1 qbuf=0 qbuf-free=0 obl=0 oll=0 omem=0 events=r cmd=ping
id=136261 addr=10.0.0.5:46525 fd=10 name=backendservice-11111f57fc-h7l9b age=96965 idle=6 flags=N db=0 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=0 obl=0 oll=0 omem=0 events=r cmd=evalsha
id=138125 addr=10.0.0.5:56729 fd=20 name=authservice-2222265797-zkcnw age=42695 idle=22 flags=N db=0 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=0 obl=0 oll=0 omem=0 events=r cmd=info
id=138126 addr=10.0.0.5:48548 fd=26 name=authservice-2222265797-zkcnw age=42694 idle=22 flags=P db=0 sub=1 psub=0 multi=-1 qbuf=0 qbuf-free=0 obl=0 oll=0 omem=0 events=r cmd=ping

# list keys 'KEYS pattern'
redis.acme.com:6379> KEYS *Auth*

# set value
redis.acme.com:6379>  SET mykey 10
"OK"

# read value
redis.acme.com:6379>  DUMP mykey
"\u0000\xC0\n\t\u0000\xBEm\u0006\x89Z(\u0000\n"

# monitor activity
redis.acme.com:6379>  MONITOR