Without TLS
The password crosses the network in the clear, because AUTH is an ordinary command
- library
- redis-py
- tls
- no
Generate connection settings for one of four client libraries. They disagree on option names and on defaults, and the defaults that differ most are the ones that matter during a network partition.
Worked setups you can load into the form above. Each one is a decision the generator makes differently, and the reason it makes it.
The password crosses the network in the clear, because AUTH is an ordinary command
More connections share the same single-threaded executor
These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.
A dropped connection blocks the calling thread until the kernel's TCP timeout, which can be minutes. In a thread pool that takes the whole service down.
Instead:Set both a connect and a command timeout.
Redis runs commands on one thread, so extra connections add contention rather than capacity.
Instead:Use pipelining, and size the pool for concurrency.
It ends up in version control history, and deleting the line later does not remove it from history.
Instead:Read it from the environment or a secret store.
go-redis defaults to ten connections per CPU and ioredis retries twenty times per request. Neither is what most people expect.
Instead:Set the values explicitly.
A Redis client works identically in every library while the network is healthy. What separates them is the behaviour during a partition, and that is set by options most people never touch.
Most clients default to no socket timeout. A dropped connection then blocks the calling thread until the kernel's TCP timeout expires, which can be minutes. In a request-handling thread pool that is an outage of the whole service, not of one request.
Every one of these libraries has two, and setting only one leaves the other unbounded. A connect timeout does nothing for a command that was accepted and never answered.
Redis executes commands on a single thread, so every connection in the pool shares one executor. Extra connections add memory and contention rather than capacity. Pipelining is what raises throughput; more connections is not.
go-redis sizes its pool at ten per CPU, which on a large machine is far more connections than intended. ioredis retries each request twenty times by default, so a partition can keep a request alive for a long time before it fails. Lettuce shares one thread-safe connection and needs a pool only for blocking commands.
Every snippet here reads it from the environment. A literal in source ends up in version control history, where removing the line later does not remove it.