Skip to content

PMM-15322 Pass TLS flags to valkey_exporter - #5854

Open
marcuscruz-percona wants to merge 6 commits into
mainfrom
PMM-15322-valkey-exporter-tls-flags
Open

PMM-15322 Pass TLS flags to valkey_exporter#5854
marcuscruz-percona wants to merge 6 commits into
mainfrom
PMM-15322-valkey-exporter-tls-flags

Conversation

@marcuscruz-percona

@marcuscruz-percona marcuscruz-percona commented Aug 28, 2026

Copy link
Copy Markdown

Ticket number: PMM-15322

Feature build: SUBMODULES-0

Problem

pmm-admin add valkey accepts --tls, --tls-skip-verify, --tls-ca, --tls-cert and --tls-key, and the command succeeds, but none of them reached valkey_exporter. Only the rediss:// scheme was encoded into --redis.addr. The certificates were shipped to the agent host as text files and then never referenced by any argument.

Monitoring a Valkey/Redis instance behind a private CA, with a certificate whose SAN does not match, or requiring client certificates therefore left redis_up at 0 while the CLI reported the service was added successfully.

Fix

valkeyExporterConfig now emits --tls-ca-cert-file, --tls-client-cert-file and --tls-client-key-file for whichever certificates are present, plus --skip-tls-verification when skip-verify is set. Everything is gated on TLS being enabled, matching the rediss:// decision in DSN(), so nothing points the exporter at certificates over a plaintext link.

No pmmAgentVersion gate is needed: all four flags exist in oliver006/redis_exporter v1.72.1 — the build shipped with PMM 3.5.0, the first release with Valkey support — through the currently pinned v1.89.0.

Two adjacent defects found while investigating, both fixed here:

  • redactWords() covered the MySQL and PostgreSQL private keys but not ValkeyOptions.SSLKey, so the Valkey private key could appear verbatim in exporter logs and API output.
  • TemplateDelimiters() had no Valkey case. pmm-agent renders each text file's content as a Go template with missingkey=error, so a PEM containing the active delimiter broke exporter startup. All three certificates feed delimiter selection, not only the private key, because all three are rendered.

The text file names (tlsCa, tlsCert, tlsKey) are now shared constants in models rather than string literals duplicated between Agent.Files() and the argument builder — renaming one used to silently stop the flags from resolving.

Docs: the Valkey/Redis connect page gained a mutual-TLS example, now that --tls-cert and --tls-key take effect.

Testing

  • go test ./managed/services/agents/... ./managed/models/... -run TestValkey, also under -race -count=5.
  • Coverage added for mutual TLS, CA-only, client certificate without CA, an incomplete key pair in both directions, certificates supplied with TLS disabled, skip-verify with TLS disabled, unix socket connections, an unknown pmm-agent version, redaction of the private key (and not the CA or certificate), material surviving an exposeSecrets request, PEM content containing the active delimiter, and argument determinism.
  • Full-package failures unchanged against the base commit; golangci-lint clean on every changed file, and one pre-existing exhaustive error is resolved by the new TemplateDelimiters case.

Not verified by me: the live end-to-end run against a real TLS/mTLS Valkey instance. Worth confirming on the feature build that ps aux | grep valkey_exporter shows the four flags pointing at real files and that redis_up reports 1.

Related work

  • Supersedes PMM-15322: Pass TLS certificate and skip-verify flags to valkey_exporter #5763, which reported and first fixed the same root cause. This version follows the mysqld_exporter pattern in managed/services/agents/mysql.go, avoids calling Files() twice, and adds the redaction and delimiter fixes.
  • PMM-15278 overlaps but is not addressed here: connection_checker.go and service_info_broker.go never set TlsSkipVerify on the Valkey requests, so "Check connection" and version detection still fail with skip-verify. That is the exporter-adjacent half of the problem and stays on its own ticket.

Follow-up suggestions (deliberately not addressed)

  1. The inventory API (AddValkeyExporter / ChangeValkeyExporter) accepts tls_ca / tls_cert / tls_key with tls=false. The material is stored and shipped, then silently ignored — the same failure mode as this ticket, through a path the CLI cannot produce (add_valkey.go only reads the PEM files when --tls is set). Rejecting it with InvalidArgument would make later, unrelated Change calls fail on any row already stored in that shape, so it is left alone; CertificatesIgnoredWhenTLSDisabled documents the current contract.
  2. Nothing in this repository verifies an exporter's flag spellings against the shipped binary — not for valkey_exporter, not for mysqld_exporter. A typo in any of these four strings passes every unit test and reproduces redis_up 0. Real coverage needs an e2e test against a live TLS Valkey, which belongs in pmm-qa.
  3. Agent.Files() and mysql.go still match the MySQL text file names by string literal. The new models.TLSCaFileName constants are used on the Valkey path only; converting the MySQL path is a separate cleanup.
  4. The Valkey/Redis connect page has pre-existing broken examples outside this diff. pmm-admin add valkey takes the service name and address as positional arguments — there is no --address flag — yet the "With remote monitoring" and "With TLS connection" examples pass --address=, and the basic example passes three positionals where the command accepts two. The inventory add service valkey examples have the same --address problem (Address is arg:"" there too). Every one of these fails at flag parsing. Left out to keep this PR to the ticket.
  • API Docs updated

No API endpoints were added, removed or altered.

pmm-admin add valkey accepts --tls-ca, --tls-cert, --tls-key and
--tls-skip-verify, and the certificates already reach the agent host as
text files, but valkeyExporterConfig never pointed the exporter at them.
TLS reached valkey_exporter only through the rediss:// scheme, so any
instance behind a private CA or requiring mutual TLS reported redis_up 0
while the CLI reported success.

Emit --tls-ca-cert-file, --tls-client-cert-file, --tls-client-key-file
and --skip-tls-verification when TLS is enabled, following the pattern
already used for mysqld_exporter.

Also fix two adjacent defects on the same path:

  - redactWords omitted ValkeyOptions.SSLKey, so the private key could
    appear verbatim in exporter logs and API output.
  - TemplateDelimiters had no Valkey case, so a certificate containing
    the active delimiter broke exporter startup. pmm-agent renders text
    file contents as templates, so all three certificates are checked.

Signed-off-by: Marcus Cruz <marcus.cruz@percona.com>
The valkey_exporter arguments matched the text file keys by string
literal, duplicating the names produced by Agent.Files(). Renaming a key
in one place would have silently stopped the flags from resolving.

Export TLSCaFileName, TLSCertFileName and TLSKeyFileName from models and
use them on both sides, and build the flags from a fixed table instead of
ranging over the map, so emission no longer depends on iteration order.

Signed-off-by: Marcus Cruz <marcus.cruz@percona.com>
Fold the TLS cases into TestValkeyExporterConfig, which covers the same
unit, and drop the duplicated fixtures and the inlined helper copy.

Add the scenarios the first round missed: unix socket connections, a
private key without a certificate, an unknown pmm-agent version, and
material surviving an exposeSecrets request. The delimiter cases now
assert the rewritten flag rather than only the absence of the default
delimiter.

Signed-off-by: Marcus Cruz <marcus.cruz@percona.com>
@coderabbitai

coderabbitai Bot commented Aug 28, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f7fda91b-f014-4dd8-a7c1-6cfa32f1a320

📥 Commits

Reviewing files that changed from the base of the PR and between 328fdd9 and e855081.

📒 Files selected for processing (2)
  • documentation/docs/install-pmm/install-pmm-client/connect-database/valkey-redis.md
  • managed/services/agents/valkey_test.go
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • percona/pmm-qa (manual)
  • percona/pmm (manual)
🚧 Files skipped from review as they are similar to previous changes (1)
  • documentation/docs/install-pmm/install-pmm-client/connect-database/valkey-redis.md

Included review availability: Your plan provides up to 4 included reviews per hour; 2 remain after this review.


Walkthrough

Valkey TLS support now uses shared names for CA, client certificate, and client key files. Exporter configuration adds TLS file and skip-verification arguments, passes the same files to the agent process, and uses safe template delimiters. Valkey private keys are redacted from output. Tests cover TLS combinations, delimiter escaping, socket connections, unknown versions, and deterministic arguments. Documentation adds a mutual TLS connection example.

Sequence Diagram(s)

sequenceDiagram
  participant ValkeyOptions
  participant valkeyExporterConfig
  participant AgentProcess
  ValkeyOptions->>valkeyExporterConfig: TLS options and certificate contents
  valkeyExporterConfig->>AgentProcess: TLS flags and TextFiles
  AgentProcess->>AgentProcess: Redact SSLKey
Loading

Merge Risk: ⚪ Minimal · up to e8550

The PR now passes configured Valkey TLS certificates and verification settings to the exporter while protecting certificate rendering and private-key output. No actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 4
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title clearly and concisely identifies the main change: passing TLS flags to valkey_exporter.
Description check ✅ Passed The description is complete and relevant. It includes the ticket number, feature build, problem, fix, testing details, related work, follow-up items, and the API documentation checklist.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@marcuscruz-percona
marcuscruz-percona requested a balanced review from Copilot August 28, 2026 20:20
@marcuscruz-percona marcuscruz-percona self-assigned this Aug 28, 2026
@marcuscruz-percona marcuscruz-percona added bug Bug report go Pull requests that update Go code labels Aug 28, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds Valkey exporter TLS/mTLS argument propagation and improves certificate handling.

Changes:

  • Passes TLS certificate and verification flags to valkey_exporter.
  • Adds private-key redaction, safe template delimiters, shared file constants, and tests.
  • Documents mutual TLS setup.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
managed/services/agents/valkey.go Builds exporter TLS arguments.
managed/services/agents/valkey_test.go Covers TLS configurations and redaction.
managed/services/agents/agents.go Redacts Valkey private keys.
managed/models/agent_model.go Shares TLS filenames and selects safe delimiters.
managed/models/agent_model_test.go Tests files and delimiters.
documentation/docs/install-pmm/install-pmm-client/connect-database/valkey-redis.md Adds an mTLS example.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@codecov

codecov Bot commented Aug 28, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 45.60%. Comparing base (31318c7) to head (5d5270d).
⚠️ Report is 160 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #5854      +/-   ##
==========================================
+ Coverage   43.59%   45.60%   +2.00%     
==========================================
  Files         415      217     -198     
  Lines       43134    28127   -15007     
==========================================
- Hits        18804    12827    -5977     
+ Misses      22454    13915    -8539     
+ Partials     1876     1385     -491     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

The mutual TLS example passed the address via --address, which pmm-admin
add valkey does not accept: name and address are positional. The command
failed at flag parsing before reaching TLS.

Reword the skip-verify note. Supplying --tls-ca already anchors trust, so
a self-signed certificate does not need verification disabled.

Replace the paired positional booleans in the test exporter helper with a
named-field fixture struct.

Signed-off-by: Marcus Cruz <marcus.cruz@percona.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Bug report documentation Documentation changes go Pull requests that update Go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants