Scripting permissions

[hk21702]

Please grant scripting permissions for users or allow the configuration of permissions.

valkey-operator/src/managers/config.py

Line 243 in 95c61c4

permissions = f"-@all +@read +@write +@keyspace +@pubsub +@transaction +info ~{values['resource']} &{values['resource']}"

We have a use case that requires the use of operations such as script load, eval, and evalsha.

https://github.com/wikimedia/mediawiki-services-jobrunner/blob/fe525ace2c9924d71a02a548a5a542ea9ff3e4fd/src/RedisJobChronService.php#L217
https://doc.wikimedia.org/mediawiki-core/REL1_46/php/RedisConnRef_8php_source.html

[reneradoi]

Thank you again for reporting! As discussed, we will think about how to safely enable scripting permissions and allocate time for the implementation. I will update you when there is news.

[alexdlukens-canonical]

Hello, @reneradoi was wondering if there is any update regarding this issue?

If we manually update the permissions of users using valkey-cli, they are reverted whenever valkey is restarted + reloads from the users.acl file.

Could a charm configuration be added to add specified permissions to all relation users? e.g. juju config valkey extra-relation-user-permissions="+eval +evalsha +@scripting"? Or alternatively, support for specifying permissions on the valkey-client relation somehow

[reneradoi]

Hey @alexdlukens-canonical, we plan to allow scripting permissions by default to client relation users. This will be added soon, I will reply here once merged.