IBM Cloud Databases: Redis on IBM Cloud

Introduction

To deploy the GitGuardian app, a Redis instance is required. This page is dedicated to helping you set up Redis on IBM Cloud using IBM Cloud Databases for Redis.

IBM Cloud Databases for Redis is a standard Redis deployment, not Redis Cluster, and exposes the 16 logical databases GitGuardian relies on.

High-Availability

IBM Cloud Databases for Redis deploys a primary and a replica behind a single endpoint, with failover coordinated by Redis Sentinel on IBM's side. Failover generally takes less than 30 seconds, during which the GitGuardian application may see read-only errors.

Installation

From the IBM Cloud console

To create a Redis instance from the IBM Cloud console, we recommend following the official documentation.

You need to set the following fields:

• Keep the proposed Version. IBM Cloud provisions Redis 8.2, which GitGuardian supports.
• Set the Service endpoints to Private.
• Allocate at least 8 GB of RAM in total (4 GB per member). This is the smallest allocation IBM Cloud accepts.
• Keep the default maxmemory-policy (noeviction), which GitGuardian requires for its task queue.
• Set the admin password after provisioning. You must save this value as it is required to configure the GitGuardian application.

Using the CLI

ibmcloud resource service-instance-create <instance-name> databases-for-redis standard <region> \
  --service-endpoints private \
  -p '{"members_host_flavor":"multitenant","members_memory_allocation_mb":"8192","members_disk_allocation_mb":"8192"}'

Using Terraform

To create a Redis instance using Terraform, you need the following resource:

• ibm_database

In addition to the fields required by Terraform, we require the following fields to be set:

• service = "databases-for-redis"
• service_endpoints = "private": keep the instance off the public internet.
• Keep the default maxmemory-policy of noeviction.

Authentication and TLS

IBM Cloud Databases for Redis requires the admin username together with its password; the Redis default user is not available. Set the username in the Redis configuration, or use a URL of the form rediss://admin:<password>@<host>:<port>.

TLS is mandatory. Enable it in the GitGuardian configuration and keep the server certificate check disabled, which is the default:

redis:
  main:
    user: 'admin'
    host: '<instance-id>.<deployment-id>.private.databases.appdomain.cloud'
    port: <port>
    existingSecret: 'gitguardian-redis-secret'
    existingSecretKeys:
      password: 'REDIS_PASSWORD'
    tls:
      enabled: true
      requireServerCert: false

Server certificate check

The IBM Cloud Databases CA certificate carries no Key Usage extension. Enabling redis.main.tls.requireServerCert makes the GitGuardian application reject it during the installation. Keep the default value: the connection stays encrypted.

info

Our Helm installation supports Redis authentication from IBM Cloud Databases as long as it is managed through a password mechanism and not via IBM Cloud IAM.