redis: add credentials provider option and built-in Entra ID auth - #1626
Open
cosmin-staicu wants to merge 1 commit into
Open
redis: add credentials provider option and built-in Entra ID auth#1626cosmin-staicu wants to merge 1 commit into
cosmin-staicu wants to merge 1 commit into
Conversation
🦋 Changeset detectedLatest commit: a0a06fb The changes in this PR will be included in the next version bump. This PR includes changesets to release 2 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
|
cosmin-staicu
force-pushed
the
feat/redis-entra-credentials-provider
branch
from
August 4, 2026 14:27
63e17d0 to
3135f36
Compare
cosmin-staicu
force-pushed
the
feat/redis-entra-credentials-provider
branch
from
August 19, 2026 13:19
3135f36 to
e227b1a
Compare
GetRedisClient only accepted a static Username/Password, which does not work with managed Redis offerings that authenticate with short-lived identity tokens. Azure Managed Redis and Redis Enterprise Cloud issue Microsoft Entra ID tokens that expire after roughly an hour and have to be refreshed and re-AUTH'd on the live connection before they lapse. Managed Redis evicts a pub/sub connection when its token expires and, under RESP2, a pub/sub socket cannot process an out-of-band AUTH, so it has to reconnect with a fresh token — which hits the coordination bus every component built on this module relies on. go-redis has supported this since v9.6 through StreamingCredentialsProvider. Expose it two ways: - WithStreamingCredentialsProvider, a vendor-neutral option for callers that bring their own provider. - RedisConfig.azure_entra, a config-driven flag that builds a provider from github.com/redis/go-redis-entraid off the ambient Azure identity, so a deployment turns this on in YAML without its own call site. Both are additive: GetRedisClient keeps its existing signature for callers that pass no options, and existing YAML is unaffected. Signed-off-by: Cosmin Staicu <cosmin.staicu@uipath.com>
cosmin-staicu
force-pushed
the
feat/redis-entra-credentials-provider
branch
from
September 10, 2026 08:11
9867e3b to
a0a06fb
Compare
Author
|
Rebased onto current The log-config-watch work that had crept onto this branch has moved to #1791, which is stacked on this one. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds support for runtime-rotated Redis credentials to
GetRedisClient, with two entry points: a vendor-neutralWithStreamingCredentialsProvideroption and a config-drivenazure_entraflag for Microsoft Entra ID. Backwards compatible — existing callers and YAML are unaffected.GetRedisClientcurrently only accepts a staticUsername/Password. That doesn't work with managed Redis offerings that authenticate via short-lived identity tokens — Azure Managed Redis and Redis Enterprise Cloud issue Microsoft Entra ID tokens that expire (~1h) and must be refreshed and re-AUTH'd on the live connection before they lapse.With only static credentials, a long-running deployment gets disconnected when the token expires. It's worst for the coordination bus that LiveKit relies on: managed Redis evicts pub/sub connections when their token expires, and under RESP2 a pub/sub socket can't process an out-of-band
AUTH, so it must reconnect with a fresh token. Every component that builds its client throughprotocol— server, sip, egress, ingress — is affected.go-redis already supports this through
StreamingCredentialsProvider(≥ v9.6; this module is on v9.20.0), and Redis publishes an official extension,go-redis-entraid, that implements