Connect to an encrypted Redis cluster from spring template

Question

I am trying to connect to an encrypted in transit ElastiCache cluster from spring boot to use for a session repository. I have code that works for an unencrypted cluster, but I cannot get it to work when I turn on ssl. Here is my code

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.session.ExpiringSession;
import org.springframework.session.SessionRepository;
import org.springframework.session.data.redis.config.ConfigureRedisAction;
import org.springframework.session.data.redis.config.annotation.web.http.EnableRedisHttpSession;
import org.springframework.session.data.redis.config.annotation.web.http.RedisHttpSessionConfiguration;
import org.springframework.session.web.http.SessionRepositoryFilter;

   @Configuration
   @EnableRedisHttpSession
   @ConditionalOnProperty(value = "spring.session.enabled", havingValue = "true")
   public class RedisSessionConfig extends RedisHttpSessionConfiguration {

    private final String NAMESPACE = "myname";

    public RedisSessionConfig() {

        // when extending RedisHttpSessionConfiguration to override the repository filter
        // we need to manually set the namespace
        this.setRedisNamespace(NAMESPACE);

    }

   @Autowired
   private RedisTemplate<Object, Object> redisTemplate;

   @Bean
    public static ConfigureRedisAction configureRedisAction() {
        return ConfigureRedisAction.NO_OP;
    }

   @Bean
   @Override
   public <S extends ExpiringSession> SessionRepositoryFilter<? extends ExpiringSession> springSessionRepositoryFilter(SessionRepository<S> sessionRepository) {
        return super.springSessionRepositoryFilter(new SafeDeserializationRepository<>(sessionRepository, redisTemplate, NAMESPACE));
    }

}

and the configuration

spring:
   redis:
        url: mycluster.id.region.cache.amazonaws.com:port

Does anyone know how to do this?

Answer 1

So I had to add my own LettuceConnectionFactory implementation, and then because the connections were going particularly slow I also needed to implement my own connection pool.

Here is the code:

@Configuration
class MyLettuceConnectionFactory extends LettuceConnectionFactory {

    @Autowired
    public MyLettuceConnectionFactory(
            @Value("${redis-configuration.clusterEndpoint}") String clusterNodes,
            @Value("${redis-configuration.port}") int port,
            @Value("${redis-configuration.ssl}") boolean ssl,
            @Value("${redis-configuration.pool.minimumIdle}") int minIdle,
            @Value("${redis-configuration.pool.maximumIdle}") int maxIdle
            ) {
        super(new MyLettucePool(clusterNodes, port, ssl, minIdle, maxIdle));
        this.setUseSsl(ssl);
    }

    @Override
    public void afterPropertiesSet() {
        super.afterPropertiesSet();
        DirectFieldAccessor accessor = new DirectFieldAccessor(this);
        AbstractRedisClient client = (AbstractRedisClient) accessor.getPropertyValue("client");
        if(client instanceof RedisClusterClient){
            RedisClusterClient clusterClient = (RedisClusterClient) client;
            clusterClient.setOptions(ClusterClientOptions.builder().validateClusterNodeMembership(false).build());
        }
    }
}

And for my custom connection pool:

public class MyLettucePool implements LettucePool {

    private RedisClusterClient client;
    private int dbIndex=0;
    private GenericObjectPool<StatefulConnection<byte[], byte[]>> internalPool;


    public MyLettucePool(String clusterEndpoint, int port, boolean useSsl, int minIdle, int maxIdle) {
        RedisURI uri = new RedisURI();
        uri.setSsl(useSsl);
        uri.setPort(port);
        uri.setHost(clusterEndpoint);


        GenericObjectPoolConfig<StatefulConnection<byte[], byte[]>> config = new GenericObjectPoolConfig<>();
        config.setMinIdle(minIdle);
        config.setMaxIdle(maxIdle);

        this.client = RedisClusterClient.create(uri);
        this.client.setOptions(ClusterClientOptions.builder().autoReconnect(true).validateClusterNodeMembership(false).build());
        this.internalPool = ConnectionPoolSupport.createGenericObjectPool(() -> this.client.connect(new ByteArrayCodec()), new GenericObjectPoolConfig());
}


    @Override
    public AbstractRedisClient getClient() {
        return this.client;
    }

    @Override
    @SuppressWarnings("unchecked")
    public StatefulConnection<byte[], byte[]> getResource() {
       try {
            return internalPool.borrowObject();
        } catch (Exception e) {
            throw new PoolException("Could not get a resource from the pool", e);
        }
    }

    @Override
    public void returnBrokenResource(final StatefulConnection<byte[], byte[]> resource) {

        try {
            internalPool.invalidateObject(resource);
        } catch (Exception e) {
            throw new PoolException("Could not invalidate the broken resource", e);
        }
    }


    @Override
    public void returnResource(final StatefulConnection<byte[], byte[]> resource) {
        try {
            internalPool.returnObject(resource);
        } catch (Exception e) {
            throw new PoolException("Could not return the resource to the pool", e);
        }
    }

    @Override
    public void destroy() {
        try {
            client.shutdown();
            internalPool.close();
        } catch (Exception e) {
            throw new PoolException("Could not destroy the pool", e);
        }
    }