Repository navigation
Conversation
…posture A FIPS install needs an https Identity Service introspection URL and an https memory product validator URL; the chart refuses the in-cluster http defaults for both. Show both in the enablement steps, note that the hosting environment provides TLS, list allow_insecure_transport among the rejected settings, and add the matching troubleshooting rows.
Contributor
🧠 Redis MemoryFound 5 related items from repository history (5 new this commit):
Memory updated at 1ca6728 |
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hold until the Agent Memory chart release that includes redislabsdev/iris#1606 is published. The new troubleshooting row for the product validator URL describes a chart check that chart 0.7.0 doesn't have yet. The rest is already true for 0.7.0.
Ticket: MOD-19267
What
A FIPS-oriented Redis Agent Memory install needs two
https://endpoints. The chart refuses its in-clusterhttp://defaults for both:memory.auth.agent_keys.introspection.base_url: Data Plane to Identity Service agent-key introspection.identityService.productValidation.products.memory.baseURL: Identity Service to Control Plane grant validation. This call carries the Control Plane internal token.Before this PR, the FIPS section only showed
security.profile: fips, so following it failed athelm template.Changes
operations.md(FIPS-oriented posture):helm upgradeexamples set both endpoints.allow_insecure_transportamong the rejected settings.https://product validator URL.reference.md: the "Pod fails to start in FIPS posture" row names the Identity Service error. Two new rows cover the twohelm templateerrors, quoted from the chart.prerequisites.md: one sentence and a link to the FIPS section.Source
memory/helm/templates/_helpers.tplinredislabsdev/iris.identity-service/internal/infrastructure/fips_posture.go.