fix(redis): async TLS/IAM passed an unsupported ssl_context — use native ssl_* kwargs

Merged
JU
4mo ago
+57-35

Description

Fixes two async Redis bugs with the same root cause: redis-py's async client (5.0.8) has no ssl_context parameter (only the sync SSLConnection does), so passing one is either silently dropped or raises a TypeError. Both surfaced via live end-to-end TLS testing.

1. REDIS_SSL path (mTLS / CA silently dropped). _build_async_redis_connection set connection_kwargs["ssl"] = <prebuilt ssl_context>. The context — including the CA bundle and the mTLS client cert (load_cert_chain) — was ignored: TLS negotiated but unverified and with no client cert. Masked because REDIS_SSL_CERT_REQS defaults to none. (Follow-up to #12321, which merged before this fix.)

2. USE_REDIS_IAM_AUTH path (hard crash). configure_redis_iam_auth set connection_kwargs["ssl_context"], which the async client rejects with TypeError: Redis.__init__() got an unexpected keyword argument 'ssl_context' — every async Redis connection under ElastiCache IAM auth crashed at construction.

Fix (both): pass redis-py's native async ssl_* kwargs (ssl, ssl_cert_reqs, ssl_ca_certs, ssl_certfile, ssl_keyfile, ssl_check_hostname) — the same mechanism the sync pool already uses. The sync paths are unchanged (sync SSLConnection does support ssl_context).

How Has This Been Tested?

  • Live e2e against a TLS + mTLS Redis (tls-auth-clients yes): async client PINGs with CA + client cert; rejected on wrong CA / missing client cert.
  • Direct repro confirming the IAM path no longer raises the ssl_context TypeError and now sets verifying native kwargs.
  • Unit tests assert native kwargs reach the async client for both the REDIS_SSL and IAM paths; backend/tests/unit/onyx/redis green; ty + ruff + pre-commit clean.

Additional Options

  • [Optional] Please cherry-pick this PR to the latest release version.
  • [Optional] Override Linear Check