# Redis Distributed Lock

Type: `lock.redis`

Status: alpha

Reference: https://docs.dapr.io/reference/components-reference/supported-locks/redis-lock/

## Example

```
apiVersion: cra.diagrid.io/v1beta1
kind: Component
metadata:
  name: <name>
spec:
  type: lock.redis
  version: v1
  metadata:
    # The Redis password (Optional)
    #- name: redisPassword
    #  value: "redis-password"
    # The Redis username (Optional)
    #- name: redisUsername
    #  value: "redis-user"
    # Connection-string for the redis host. If "redisType" is "cluster" it can be multiple hosts separated by commas or just a single host. The port can be included in the host string (e.g. "host:6379") or provided separately via "redisPort".
    - name: redisHost
      value: "mycompany.com:6379"
    # Dial timeout duration (Optional)
    #- name: dialTimeout
    #  value: "5s"
    # Whether to enable TLS encryption (Optional)
    #- name: enableTLS
    #  value: "false"
    # Whether to enable failover mode (for Sentinel) (Optional)
    #- name: failover
    #  value: "false"
    # Idle check frequency (Optional)
    #- name: idleCheckFrequency
    #  value: "1m"
    # Idle timeout duration (Optional)
    #- name: idleTimeout
    #  value: "5m"
    # Skip TLS certificate verification (insecure). Only use for testing. (Optional)
    #- name: insecureSkipTLSVerify
    #  value: "false"
    # Prefix added to keys in the state store. (Optional)
    #- name: keyPrefix
    #  value: "appid"
    # Maximum connection age (Optional)
    #- name: maxConnAge
    #  value: "30m"
    # Maximum number of retries when attempting to acquire a lock (Optional)
    #- name: maxRetries
    #  value: "3"
    # Maximum backoff duration between retries (Optional)
    #- name: maxRetryBackoff
    #  value: "2s"
    # Minimum idle connections (Optional)
    #- name: minIdleConns
    #  value: "0"
    # Connection pool size (Optional)
    #- name: poolSize
    #  value: "10"
    # Connection pool timeout (Optional)
    #- name: poolTimeout
    #  value: "4s"
    # Processing timeout for lock ownership (Optional)
    #- name: processingTimeout
    #  value: "60s"
    # Read timeout duration (Optional)
    #- name: readTimeout
    #  value: "3s"
    # Redeliver interval for re-attempting lock acquisition (Optional)
    #- name: redeliverInterval
    #  value: "15s"
    # The Redis database number (Optional)
    #- name: redisDB
    #  value: "0"
    # Maximum Redis retries (Optional)
    #- name: redisMaxRetries
    #  value: "3"
    # Maximum Redis retry interval (Optional)
    #- name: redisMaxRetryInterval
    #  value: "512ms"
    # Minimum Redis retry interval (Optional)
    #- name: redisMinRetryInterval
    #  value: "8ms"
    # The Redis port. Optional: if "redisHost" already contains a port, this field must either match or be omitted. When "redisHost" does not include a port and this field is not set, the default Redis port 6379 is used. (Optional)
    #- name: redisPort
    #  value: "6379"
    # The Redis type (Optional)
    #- name: redisType
    #  value: "node"
    # The Sentinel master name (used if redisType is 'sentinel') (Optional)
    #- name: sentinelMasterName
    #  value: "mymaster"
    # Whether to use Entra ID for authentication (Optional)
    #- name: useEntraID
    #  value: "false"
    # Write timeout duration (Optional)
    #- name: writeTimeout
    #  value: "3s"

```

## Authentication profiles

Available authentication profiles:

- Password Authentication

- Sentinel Authentication

- TLS Authentication

- OIDC private_key_jwt

### Password Authentication

Authenticate using Redis password.

#### `redisPassword`

The Redis password

Example value: `redis-password`

#### `redisUsername`

The Redis username

Example value: `redis-user`

### Sentinel Authentication

Authenticate using Redis Sentinel password.

#### `sentinelPassword`

The Redis Sentinel password

Example value: `sentinel-password`

#### `sentinelUsername`

The Redis Sentinel username

Example value: `sentinel-user`

### TLS Authentication

Authenticate using Redis TLS certificate.

#### `clientCert`

The Redis client certificate

Example value:

```
-----BEGIN CERTIFICATE-----\nXXX...
```

#### `clientKey`

The Redis client key

Example value:

```
-----BEGIN PRIVATE KEY-----\nXXX...
```

### OIDC private_key_jwt

Authenticate using OpenID Connect with the private_key_jwt client authentication
method (RFC 7523). An OAuth2 access token is obtained from the identity provider
using a signed JWT client assertion and used as the password for the Redis AUTH
command. The token is refreshed in the background before it expires.

#### `oidcClientAssertionCert` (string)

**Required** - PEM-encoded X.509 certificate paired with the client assertion signing key. Use secretKeyRef for secret reference.

Example value: `-----BEGIN CERTIFICATE-----\n...`

#### `oidcClientAssertionKey` (string)

**Required** - PEM-encoded RSA private key used to sign the client assertion. Use secretKeyRef for secret reference.

Example value: `-----BEGIN PRIVATE KEY-----\n...`

#### `oidcClientID` (string)

**Required** - The OAuth2 client ID that has been provisioned in the identity provider.

Example value: `my-client-id`

#### `oidcTokenEndpoint` (string)

**Required** - URL of the OAuth2 identity provider access token endpoint.

Example value: `https://identity.example.com/v1/token`

#### `oidcAudience` (string)

Overrides the JWT client assertion audience (aud). Defaults to the token endpoint URL.

Example value: `https://identity.example.com/realms/local`

#### `oidcCACert` (string)

PEM-encoded CA certificate used to verify the TLS connection to the token endpoint. This is distinct from the TLS configuration of the Redis connection itself.

Example value: `-----BEGIN CERTIFICATE-----\n...`

#### `oidcKid` (string)

The JWT key ID (kid) header to use for the client assertion, when required by the identity provider (for example, the thumbprint of the client certificate).

Example value: `1234567890`

#### `oidcResource` (string)

Optional OAuth2 resource parameter to include in the token request when required by the identity provider.

Example value: `URI:RS-12345-API`

#### `oidcScopes` (string)

Comma-delimited list of OAuth2/OIDC scopes to request with the access token. Although not required, this field is recommended.

Default value: `openid`

Example value: `openid,redis-prod`

#### `redisUsername` (string)

Username to pass to the Redis AUTH command together with the access token. When omitted, the token is sent using the 1-argument AUTH \<token> form (authenticating as the default user), accepted by the widest range of RESP-compatible auth layers. Set a username to use the 2-argument AUTH \<username> \<token> (ACL) form.

Example value: `my-user`

#### `useOIDC` (bool)

If set to true, enables OIDC private_key_jwt authentication. Must not be combined with "redisPassword" or "useEntraID".

Default value: `false`

Example value: `true`

## Metadata

### `redisHost` (string)

**Required** - Connection-string for the redis host. If "redisType" is "cluster" it can be multiple hosts separated by commas or just a single host. The port can be included in the host string (e.g. "host:6379") or provided separately via "redisPort".

Example value: `mycompany.com:6379`

### `dialTimeout`

Dial timeout duration

Default value: `5s`

Example value: `5s`

### `enableTLS` (bool)

Whether to enable TLS encryption

Default value: `false`

Example value: `false`

### `failover` (bool)

Whether to enable failover mode (for Sentinel)

Default value: `false`

Example value: `false`

### `idleCheckFrequency`

Idle check frequency

Default value: `1m`

Example value: `1m`

### `idleTimeout`

Idle timeout duration

Default value: `5m`

Example value: `5m`

### `insecureSkipTLSVerify` (bool)

Skip TLS certificate verification (insecure). Only use for testing.

Default value: `false`

Example value: `false`

### `keyPrefix` (string)

Prefix added to keys in the state store.

Default value: `appid`

Example value: `appid`

Allowed values:

- appid

- name

- none

### `maxConnAge`

Maximum connection age

Default value: `30m`

Example value: `30m`

### `maxRetries`

Maximum number of retries when attempting to acquire a lock

Default value: `3`

Example value: `3`

### `maxRetryBackoff`

Maximum backoff duration between retries

Default value: `2s`

Example value: `2s`

### `minIdleConns`

Minimum idle connections

Default value: `0`

Example value: `0`

### `poolSize`

Connection pool size

Default value: `10`

Example value: `10`

### `poolTimeout`

Connection pool timeout

Default value: `4s`

Example value: `4s`

### `processingTimeout`

Processing timeout for lock ownership

Default value: `60s`

Example value: `60s`

### `readTimeout`

Read timeout duration

Default value: `3s`

Example value: `3s`

### `redeliverInterval`

Redeliver interval for re-attempting lock acquisition

Default value: `15s`

Example value: `15s`

### `redisDB`

The Redis database number

Default value: `0`

Example value: `0`

### `redisMaxRetries`

Maximum Redis retries

Default value: `3`

Example value: `3`

### `redisMaxRetryInterval`

Maximum Redis retry interval

Default value: `512ms`

Example value: `512ms`

### `redisMinRetryInterval`

Minimum Redis retry interval

Default value: `8ms`

Example value: `8ms`

### `redisPort` (string)

The Redis port. Optional: if "redisHost" already contains a port, this field must either match or be omitted. When "redisHost" does not include a port and this field is not set, the default Redis port 6379 is used.

Example value: `6379`

### `redisType`

The Redis type

Default value: `node`

Example value: `node`

Allowed values:

- node

- cluster

- sentinel

### `sentinelMasterName`

The Sentinel master name (used if redisType is 'sentinel')

Example value: `mymaster`

### `useEntraID` (bool)

Whether to use Entra ID for authentication

Default value: `false`

Example value: `false`

### `writeTimeout`

Write timeout duration

Default value: `3s`

Example value: `3s`