Skip to content

Support getting configuration from both stdin and file at the same time#7893

Merged
yossigo merged 1 commit intoredis:unstablefrom
ushachar:handle_stdin_config
Oct 11, 2020
Merged

Support getting configuration from both stdin and file at the same time#7893
yossigo merged 1 commit intoredis:unstablefrom
ushachar:handle_stdin_config

Conversation

@ushachar
Copy link
Contributor

@ushachar ushachar commented Oct 7, 2020

This allows supplying secret configuration (for example - masterauth) via a secure channel
instead of having it in a plaintext file / command line param, while still allowing for most
of the configuration to reside there.

Also, remove 'special' case handling for --check-rdb which hasn't been relevant
since 4.0.0.

src/server.c Outdated
Comment on lines -5355 to -5357
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i suppose there's a reason for that.
probably that sentinel must be able to rewrite it's config and restart.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, It still won't start without a configfile -- I just simplified the check a bit since I now have an explicit flag for stdin and don't have to use the hack of saving '-' as the config file name.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i think it's not just that it shouldn't start without a config file.
i think the intention was that it should explicitly fail when config_from_stdin is true.
if the main reason for providing config via stdin is that we don't store passwords on disk, sentinel isn't designed to do that.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't think so -- It's perfectly fine to have the config come from stdin initially AS LONG as you also have a file to write to later on.
(it's less useful obviously, but not something that will fail later on).

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok. sounds reasonable to me, but i'd like @yossigo to confirm that.

@ushachar ushachar force-pushed the handle_stdin_config branch from 7c97805 to 16fcf5f Compare October 7, 2020 21:50
This allows supplying secret configuration (for example - masterauth) via a secure channel
instead of having it in a plaintext file / command line param, while still allowing for most
of the configuration to reside there.

Also, remove 'special' case handling for --check-rdb which hasn't been relevant
since 4.0.0.
@ushachar ushachar force-pushed the handle_stdin_config branch from 16fcf5f to 1892c7e Compare October 7, 2020 21:53
}
/* Append content from stdin */
if (config_from_stdin) {
serverLog(LL_WARNING,"Reading config from stdin");
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
serverLog(LL_WARNING,"Reading config from stdin");
serverLog(LL_VERBOSE,"Reading config from stdin");

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've intentionally made this a warning -- if someone uses this flag but doesn't provide any content via stdin the server will hang waiting for it (this is the behavior without this change as well). Emitting the warning might help avoid the follow-up SO question / GitHub issue.


void usage(void) {
fprintf(stderr,"Usage: ./redis-server [/path/to/redis.conf] [options]\n");
fprintf(stderr,"Usage: ./redis-server [/path/to/redis.conf] [options] [-]\n");
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have some concerns about the user experience here. If only the filename is specified, it is used for input+rewrite. If stdin+filename are specified, the filename is used for output only which can be a bit confusing.

Maybe we should consider being more explicit about it, i.e. add a 'config-file-name' configuration directive which is used for rewriting and is by default the name of the input file (and none if we read stdin / command line args only). That directive could be used on the command line or inside the stdin stream of course.

@ushachar Does that make sense?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The config file is always used for input+rewrite --- if stdin is provided as well then the content of stdin is appended to the string handed off to the parsing function.

@yossigo yossigo merged commit dab5ec9 into redis:unstable Oct 11, 2020
JackieXie168 pushed a commit to JackieXie168/redis that referenced this pull request Nov 4, 2020
…me (redis#7893)

This allows supplying secret configuration (for example - masterauth) via a secure channel
instead of having it in a plaintext file / command line param, while still allowing for most
of the configuration to reside there.

Also, remove 'special' case handling for --check-rdb which hasn't been relevant
since 4.0.0.
@oranagra oranagra mentioned this pull request Jan 13, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants