0cfb9c6 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

adding IdleTimeout with the redis-connection-idle-timeout flag, to ke… (#1691)

* adding IdleTimeout with the redis-connection-idle-timeout flag, to keep redis connections in valid state, when Redis option is set * docs update - add redis idle timeout configurations * changelog update for #1691 fix

commit0cfb9c6da0c30feb3aceefd0e8537ad4a9927b0f authorDmitry Kartsev <dmitry.kartsev@cnvrg.io> dateTue 9 Aug 2022, 23:57 (4 years ago) parent6e02bb4

6 files changed+17−5

compare with master

unifiedsplit

CHANGELOG.md+2 docs/docs/configuration/overview.md+2−1 docs/docs/configuration/sessions.md+4 pkg/apis/options/options.go+1−1 pkg/apis/options/sessions.go+1 pkg/sessions/redis/redis_store.go+7−3

CHANGELOG.md+2

@@ -7,6 +7,8 @@

77## Breaking Changes

99## Changes since v7.3.0

10+- [#1691](https://github.com/oauth2-proxy/oauth2-proxy/pull/1691) Fix Redis IdleTimeout when Redis timeout option is set to non-zero (@dimss)

11+

1012- [#1669](https://github.com/oauth2-proxy/oauth2-proxy/pull/1699) Fix method deprecated error in lint (@t-katsumura)

1113

1214- [#1709](https://github.com/oauth2-proxy/oauth2-proxy/pull/1709) Show an alert message when basic auth credentials are invalid (@aiciobanu)

docs/docs/configuration/overview.md+2−1

@@ -167,6 +167,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/

170+| `--redis-connection-idle-timeout` | int | Redis connection idle timeout seconds. If Redis [timeout](https://redis.io/docs/reference/clients/#client-timeouts) option is set to non-zero, the `--redis-connection-idle-timeout` must be less than Redis timeout option. Exmpale: if either redis.conf includes `timeout 15` or using `CONFIG SET timeout 15` the `--redis-connection-idle-timeout` must be at least `--redis-connection-idle-timeout=14` | 0 |

@@ -594,4 +595,4 @@ http:

594595

595596:::note

596597If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.

597−:::

598+:::

docs/docs/configuration/sessions.md+4

@@ -65,3 +65,7 @@ Redis Cluster is available to be the backend store as well. To leverage it, you

6565`--redis-use-cluster=true` flag, and configure the flags `--redis-cluster-connection-urls` appropriately.

6666

6767Note that flags `--redis-use-sentinel=true` and `--redis-use-cluster=true` are mutually exclusive.

68+

69+Note, if Redis timeout option is set to non-zero, the `--redis-connection-idle-timeout`

70+must be less than [Redis timeout option](https://redis.io/docs/reference/clients/#client-timeouts). For example: if either redis.conf includes

71+`timeout 15` or using `CONFIG SET timeout 15` the `--redis-connection-idle-timeout` must be at least `--redis-connection-idle-timeout=14`

pkg/apis/options/options.go+1−1

@@ -143,7 +143,7 @@ func NewFlagSet() *pflag.FlagSet {

143143 flagSet.StringSlice("redis-sentinel-connection-urls", []string{}, "List of Redis sentinel connection URLs (eg redis://HOST[:PORT]). Used in conjunction with --redis-use-sentinel")

144144 flagSet.Bool("redis-use-cluster", false, "Connect to redis cluster. Must set --redis-cluster-connection-urls to use this feature")

145145 flagSet.StringSlice("redis-cluster-connection-urls", []string{}, "List of Redis cluster connection URLs (eg redis://HOST[:PORT]). Used in conjunction with --redis-use-cluster")

146−

146+ flagSet.Int("redis-connection-idle-timeout", 0, "Redis connection idle timeout seconds, if Redis timeout option is non-zero, the --redis-connection-idle-timeout must be less then Redis timeout option")

147147 flagSet.String("signature-key", "", "GAP-Signature request signature key (algorithm:secretkey)")

148148 flagSet.Bool("gcp-healthchecks", false, "Enable GCP/GKE healthcheck endpoints")

149149

pkg/apis/options/sessions.go+1

@@ -32,6 +32,7 @@ type RedisStoreOptions struct {

3232 ClusterConnectionURLs []string `flag:"redis-cluster-connection-urls" cfg:"redis_cluster_connection_urls"`

3333 CAPath string `flag:"redis-ca-path" cfg:"redis_ca_path"`

3434 InsecureSkipTLSVerify bool `flag:"redis-insecure-skip-tls-verify" cfg:"redis_insecure_skip_tls_verify"`

35+ IdleTimeout int `flag:"redis-connection-idle-timeout" cfg:"redis_connection_idle_timeout"`

3536}

3637

3738func sessionOptionsDefaults() SessionOptions {

pkg/sessions/redis/redis_store.go+7−3

@@ -104,6 +104,7 @@ func buildSentinelClient(opts options.RedisStoreOptions) (Client, error) {

104104 SentinelPassword: opts.SentinelPassword,

105105 Password: opts.Password,

106106 TLSConfig: opt.TLSConfig,

107+ IdleTimeout: time.Duration(opts.IdleTimeout) * time.Second,

107108 })

108109 return newClient(client), nil

109110}

@@ -120,9 +121,10 @@ func buildClusterClient(opts options.RedisStoreOptions) (Client, error) {

120121 }

121122

122123 client := redis.NewClusterClient(&redis.ClusterOptions{

123− Addrs: addrs,

124− Password: opts.Password,

125− TLSConfig: opt.TLSConfig,

124+ Addrs: addrs,

125+ Password: opts.Password,

126+ TLSConfig: opt.TLSConfig,

127+ IdleTimeout: time.Duration(opts.IdleTimeout) * time.Second,

126128 })

127129 return newClusterClient(client), nil

128130}

@@ -143,6 +145,8 @@ func buildStandaloneClient(opts options.RedisStoreOptions) (Client, error) {

143145 return nil, err

144146 }

145147

148+ opt.IdleTimeout = time.Duration(opts.IdleTimeout) * time.Second

149+

146150 client := redis.NewClient(opt)

147151 return newClient(client), nil

148152}