Skip to content

[DPE-10892] Add scripting and caching permissions - #101

Open
reneradoi wants to merge 3 commits into
9/edgefrom
sripting-and-caching-permissions
Open

[DPE-10892] Add scripting and caching permissions#101
reneradoi wants to merge 3 commits into
9/edgefrom
sripting-and-caching-permissions

Conversation

@reneradoi

Copy link
Copy Markdown
Contributor

This PR addresses:

The permissions for external client users are adjusted to allow client-side caching and LUA scripting. To safeguard memory consumption for client-side caching, the configuration tracking-table-max-keys is explicitly set to 1M (same as default).

Regarding scripting: The scripting permissions do not impact the keyspace permissions, or in other words: Scripts can only be executed on a key if the user has permissions for it. This was confirmed by testing:

$ juju deploy data-integrator
$ juju deploy ./valkey_ubuntu@24.04-amd64.charm --trust --resource valkey-image=ghcr.io/canonical/charmed-valkey:9.0.1-26.04_edge
$ juju config data-integrator prefix-name="test:*"
$ juju integrate data-integrator valkey                                                                             
$ valkey-cli -h 10.1.0.12 -p 6379
10.1.0.12:6379> auth relation-5-ee6157ff1cd25188 <password>
OK                                                                
10.1.0.12:6379> set mykey 42
(error) NOPERM No permissions to access a key
10.1.0.12:6379> set test:mykey 42
OK
10.1.0.12:6379> get mykey
(error) NOPERM No permissions to access a key
10.1.0.12:6379> get test:mykey
"42"
10.1.0.12:6379> EVAL "return server.call('SET', KEYS[1], ARGV[1])" 1 foo bar
(error) NOPERM No permissions to access a key
10.1.0.12:6379> EVAL "return server.call('SET', KEYS[1], ARGV[1])" 1 test:foo bar
OK
10.1.0.12:6379> EVAL "return server.call('GET', KEYS[1])" 1 foo
(error) NOPERM No permissions to access a key
10.1.0.12:6379> EVAL "return server.call('GET', KEYS[1])" 1 test:foo
"bar"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant