configure turtle to use the redis ca certificate

.gitignore

@@ -6,6 +6,7 @@ google-cloud-credentials.json
 /workingdir/*
 /artifacts/*
 .history
+.vscode/
 
 shell.apk
 .secrets*

Dockerfile

@@ -8,20 +8,21 @@ WORKDIR /app/turtle
 RUN ./scripts/fetchRemoteTarballs.sh android
 
 RUN ln -s /app/turtle/workingdir /app/workingdir && \
-    for SDK_VERSION in `ls /app/workingdir/android/`; do \
-      echo "preparing $SDK_VERSION shell app" && \
-      cd /app/workingdir/android/$SDK_VERSION && \
-      mv packages non-workspace-packages && \
-      # Keep in sync with src/bin/setup/android/index.ts#_installNodeModules
-      # --prod requires --ignore-scripts (otherwise
-      # expo-yarn-workspaces errors as missing)
-      yarn install --ignore-scripts --prod && \
-      mv non-workspace-packages packages ; \
-    done
+  for SDK_VERSION in `ls /app/workingdir/android/`; do \
+  echo "preparing $SDK_VERSION shell app" && \
+  cd /app/workingdir/android/$SDK_VERSION && \
+  mv packages non-workspace-packages && \
+  # Keep in sync with src/bin/setup/android/index.ts#_installNodeModules
+  # --prod requires --ignore-scripts (otherwise
+  # expo-yarn-workspaces errors as missing)
+  yarn install --ignore-scripts --prod && \
+  mv non-workspace-packages packages ; \
+  done
 
 ENV NODE_ENV "production"
 ENV TURTLE_WORKING_DIR_PATH /app/turtle/workingdir/
 
 ADD supervisord.conf /etc/supervisor/conf.d/supervisord.conf
+ADD redislabs_ca.pem /var/run/config/redislabs-tls/redislabs_ca.pem
 
 CMD ["/usr/bin/supervisord"]

k8s/android/turtle-deployment.template.yml

@@ -152,6 +152,8 @@ spec:
             value: '-Xms2048m -XX:+HeapDumpOnOutOfMemoryError -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap -XX:+UseG1GC'
           - name: GRADLE_OPTS
             value: '-Dorg.gradle.parallel=true -Dorg.gradle.configureondemand=true -Dorg.gradle.daemon=false -Dorg.gradle.jvmargs="-Xms2048m -XX:+HeapDumpOnOutOfMemoryError -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap -XX:+UseG1GC"'
+          - name: REDIS_CA_CERTIFICATE
+            value: '/var/run/config/redislabs-tls/redislabs_ca.pem'
         resources:
           requests:
             memory: "8192Mi"

redislabs_ca.pem

@@ -0,0 +1 @@
+this is just a placeholder to simplify deployments

src/config.ts

@@ -1,3 +1,4 @@
+import fs from 'fs';
 import os from 'os';
 import path from 'path';
 
@@ -44,8 +45,17 @@ export default {
     intervalMs: env('DATADOG_INTERVAL_MS', 5 * 60 * 1000),
   },
   redis: {
-    url: env('REDIS_URL'),
-    configUrl: env('REDIS_CONFIG_URL'),
+    main: {
+      url: env('REDIS_URL'),
+      caCertificate: envTransform(
+        'REDIS_CA_CERTIFICATE',
+        null,
+        (caCertificate: string) => caCertificate && fs.readFileSync(caCertificate),
+      ),
+    },
+    turtle: {
+      url: env('REDIS_CONFIG_URL'),
+    },
   },
   logger: {
     level: env('LOGGER_LEVEL', 'info'),
@@ -81,7 +91,7 @@ export default {
     androidDependenciesDir: env(
       'TURTLE_ANDROID_DEPENDENCIES_DIR',
       path.join(os.homedir(), '.turtle/androidDependencies'),
-      ),
+    ),
     tempS3LogsDir: env('TURTLE_TEMP_S3_LOGS_DIR', '/tmp/logs'),
     fakeUploadDir: envOptional('TURTLE_FAKE_UPLOAD_DIR'),
     temporaryFilesRoot: env(

src/utils/redis.ts

@@ -12,18 +12,27 @@ export enum RedisClient {
   Configuration = 'REDIS_CLIENT_CONFIGURATION',
 }
 
-interface IClientConfig { [key: string]: string; }
+interface IClientConfig {
+  [key: string]: {
+    url: string;
+    caCertificate?: string;
+  };
+}
 
-const clientToUrl: IClientConfig = {
-  [RedisClient.Subscriber]: config.redis.url,
-  [RedisClient.Default]: config.redis.url,
-  [RedisClient.Configuration]: config.redis.configUrl,
+const clientConfigs: IClientConfig = {
+  [RedisClient.Subscriber]: config.redis.main,
+  [RedisClient.Default]: config.redis.main,
+  [RedisClient.Configuration]: config.redis.turtle,
 };
 
 export function connect(timeoutMs: number, type: string): Promise<any> {
   return new Promise((resolve, reject) => {
-    const redisClient = new Redis(clientToUrl[type], {
+    const { url, caCertificate } = clientConfigs[type];
+    const redisClient = new Redis(url, {
       maxRetriesPerRequest: 2,
+      ...caCertificate && {
+        tls: { ca: caCertificate },
+      },
     });
     const timer = setTimeout(() => reject(new Error('Timeout at connecting to Redis')), timeoutMs);
     redisClient.on('ready', () => {