Upgrade redis client version by adam-cattermole · Pull Request #543 · Kuadrant/limitador

adam-cattermole · 2026-11-02T11:34:13Z

Upgrades the redis client version to v1.7
Migrate from the native-tls to rustls, leveraging hosts OpenSSL provider

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

Summary by CodeRabbit

Improvements
- Redis TLS connections now verify the server certificate and hostname. Applications using Redis TLS must configure a rustls cryptographic provider before creating storage.
- Redis connections are more resilient to slow responses and recover when Redis scripts have been cleared.
Documentation
- Updated sandbox instructions explain how to generate and use the Redis TLS certificates, including regenerating existing certificates.

coderabbitai · 2026-11-02T11:34:31Z

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Files ignored due to path filters: 1

Cargo.lock is excluded by !**/*.lock

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: c9a97e92-349d-4f64-8435-1b209e32203d

Commits

Reviewing files that changed from the base of the PR and between 16252be and 3f4d9fc.

Files ignored due to path filters: 1

Cargo.lock is excluded by !**/*.lock

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 7b37e888-45cc-4f64-80b5-75c43c494ed4

Commits

Reviewing files that changed from the base of the PR and between 679ee7f and 16252be.

Files ignored due to path filters: 1

Cargo.lock is excluded by !**/*.lock

Files selected for processing: 15

Dockerfile
Dockerfile.aarch64
Dockerfile.ppc64le
Dockerfile.s390x
limitador-server/Cargo.toml
limitador-server/sandbox/Makefile
limitador-server/sandbox/docker-compose-limitador-redis-tls.yaml
limitador-server/sandbox/redis-tls/README.md
limitador-server/sandbox/redis-tls/redis-cert.ext
limitador-server/src/main.rs
limitador/Cargo.toml
limitador/src/lib.rs
limitador/src/storage/redis/redis_async.rs
limitador/src/storage/redis/redis_cached.rs
limitador/src/storage/redis/redis_sync.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The changes update Rust TLS dependencies and Redis storage behaviour, configure rustls provider installation at server startup, and revise Redis TLS sandbox certificates and configuration.

Changes: Redis TLS and client updates

Layer / File(s)	Summary
Rustls dependencies and startup `limitador/Cargo.toml`, `limitador-server/Cargo.toml`, `limitador-server/src/main.rs`, `Dockerfile*`, `limitador/src/lib.rs`	Redis dependencies use rustls features. The server replaces its OpenSSL dependency and installs a default rustls crypto provider at startup. Docker build environments set `OPENSSL_NO_VENDOR=1`. Crate documentation describes the provider configuration requirement.
Redis storage connection and recovery `limitador/src/storage/redis/redis_async.rs`, `limitador/src/storage/redis/redis_cached.rs`, `limitador/src/storage/redis/redis_sync.rs`	Async Redis storage disables connection and response timeouts and matches missing scripts using `ServerErrorKind::NoScript`. Tests cover slow responses, script reload, and updated Redis error kinds. Cached storage retains its configured timeout values and now passes them as `Some(Duration)`.
Redis TLS sandbox certificates and configuration `limitador-server/sandbox/Makefile`, `limitador-server/sandbox/redis-tls/*`, `limitador-server/sandbox/docker-compose-limitador-redis-tls.yaml`	The sandbox generates CA and Redis server certificates with specified extensions. Limitador loads the CA certificate, and the Redis URL no longer includes `#insecure`. The TLS instructions describe CA trust and hostname verification.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Other

Possibly related PRs

Kuadrant/limitador#537: Changes Docker build stages and OpenSSL paths, which are also affected by this PR’s build environment updates.

Suggested reviewers: eguzki

Merge Risk: Minimal · previous review 16252

No actionable merge-blocking risk was identified.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "Upgrade redis client version" matches the main change. The PR upgrades the Redis client from 0.27 to 1.7 in limitador/Cargo.toml and updates the storage code for the new client's API, inclu…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "Upgrade redis client version" matches the main change. The PR upgrades the Redis client from 0.27 to 1.7 in limitador/Cargo.toml and updates the storage code for the new client's API, including timeouts, error kinds, and script reloading. The title does not mention the TLS migration from native-tls to rustls, which the PR objectives also describe as a key part of the work. That omission makes the title partially complete, but it does not make it inaccurate.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 4 functions across 5 files. (10 skipped: 10 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

Generate docstrings

Commit to this branch
Create a new PR

Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

_{A rabbit checks the Redis stream,
While rustls guards the TLS dream.
A CA rests in its mount,
And scripts reload when counts must count.
The rabbit hops through builds anew,
With certificates in view.}

adam-cattermole · 2026-11-02T11:37:04Z

+rustls-openssl = { version = "0.4.1", package = "quixotic-plecostomus-rustls-openssl", default-features = false, features = [
+    "tls12",
+] }


This dep enables using OpenSSL provider from the host, see here https://github.com/praxis-proxy/praxis/blob/main/docs/operating/fips.md#scope-and-exemptions

adam-cattermole · 2026-11-02T11:40:56Z

+    rustls_openssl::default_provider()
+        .install_default()
+        .map_err(|_| "a rustls crypto provider was already installed before server startup")?;


So this is new; the lib no longer configures a crypto provider, and expects the user of the crate to provide one

Signed-off-by: Adam Cattermole <a.d.cattermole@gmail.com>

eguzki

LGTM

FIPS compliance ✅
Version incompatibility checks ✅
Manual verification: Ran the redis-tls sandbox manually and checked counters ✅

Worth a tracking issue to switch back to the canonical rustls-openssl name once patches land upstream.

Left one nit, but feel free to ignore it

eguzki · 2026-11-03T15:55:39Z


 #[actix_rt::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    rustls_openssl::default_provider()


woudl it make sense to gate install of the tls provider? Seems to me that Redis is the only consumer of rustls in limitador-server today.

eguzki · 2026-11-03T16:01:21Z

 ENV GITHUB_SHA=${GITHUB_SHA:-unknown}
-ENV RUSTFLAGS="-C target-feature=-crt-static"
+ENV RUSTFLAGS="-C target-feature=-crt-static" \
+    OPENSSL_NO_VENDOR=1


nice build time safety rail.

adam-cattermole added this pull request to stack #539 November 2, 2026 11:34

kuadrant-dev added this to Kuadrant Nov 2, 2026

adam-cattermole commented Nov 2, 2026

View reviewed changes

adam-cattermole force-pushed the upgrade-redis-client branch from 3787967 to 16252be Compare November 2, 2026 11:39

adam-cattermole commented Nov 2, 2026

View reviewed changes

adam-cattermole force-pushed the upgrade-redis-client branch from 16252be to f15770f Compare November 2, 2026 12:56

Base automatically changed from decouple-redis-feature to main November 2, 2026 15:10

adam-cattermole added 3 commits November 2, 2026 15:10

Update redis-client version to 1.7

f6b6ff9

Signed-off-by: Adam Cattermole <a.d.cattermole@gmail.com>

Migrate Redis client from native TLS to rustls

ee755b0

Signed-off-by: Adam Cattermole <a.d.cattermole@gmail.com>

Use host OpenSSL provider for Redis TLS

3f4d9fc

Signed-off-by: Adam Cattermole <a.d.cattermole@gmail.com>

adam-cattermole force-pushed the upgrade-redis-client branch from f15770f to 3f4d9fc Compare November 2, 2026 15:10

adam-cattermole enabled stacked auto-merge November 2, 2026 15:43

adam-cattermole added the dependencies Pull requests that update a dependency file label Nov 2, 2026

adam-cattermole mentioned this pull request Nov 3, 2026

Align Limitador's Redis client version with PPE praxis-proxy/policy#203

Open

eguzki approved these changes Nov 3, 2026

View reviewed changes

adam-cattermole added this pull request to the merge queue Nov 3, 2026

Merged via the queue into main with commit ff80a94 Nov 3, 2026
20 checks passed

adam-cattermole deleted the upgrade-redis-client branch November 3, 2026 17:35

github-project-automation Bot moved this to Done in Kuadrant Nov 3, 2026

Navigation Menu

Repository navigation

Upgrade redis client version - #543

Upgrade redis client version#543
adam-cattermole merged 3 commits into
mainfrom
upgrade-redis-client

adam-cattermole commented Nov 2, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Nov 2, 2026 •

edited

Loading

Review skipped

Uh oh!

adam-cattermole Nov 2, 2026

Uh oh!

adam-cattermole Nov 2, 2026

Uh oh!

eguzki left a comment

Uh oh!

eguzki Nov 3, 2026

Uh oh!

eguzki Nov 3, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

adam-cattermole commented Nov 2, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

adam-cattermole Nov 2, 2026

Choose a reason for hiding this comment

Uh oh!

adam-cattermole Nov 2, 2026

Choose a reason for hiding this comment

Uh oh!

eguzki left a comment

Choose a reason for hiding this comment

Uh oh!

eguzki Nov 3, 2026

Choose a reason for hiding this comment

Uh oh!

eguzki Nov 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

adam-cattermole commented Nov 2, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Nov 2, 2026 •

edited

Loading