Redis always started in insecure mode

[tonyespy]

The Redis startup sequence has been updated for Hanoi to be compliant with our Secret Creation and Distribution ADR. Instead of the Redis credentials being read from Vault via security-secretstore-read and written to disk, a new service security-bootstrap-redis has been introduced which reads the newly generated credentials and calls into Redis (running in insecure mode) to set the credentials. The credentials are not persisted however which means the next time the EdgeX system is started, the same sequence happens all over again, so basically every time EdgeX starts, there's a small window where Redis is running in insecure mode.

Version: v1.2.2-dev.104

[jim-wang-intel]

Hi Tony @tonyespy : when running in security enable mode, the redis db password has been stored into vault (See: https://github.com/edgexfoundry/edgex-go/blob/master/internal/security/secretstore/init.go#L335) as part of secretstore-setup process. Inside the secretstore-setup, in that addDBCredential function, it has that checking logic whether redis db password is already in vault or not (see https://github.com/edgexfoundry/edgex-go/blob/master/internal/security/secretstore/init.go#L411-L429). So it will re-use the stored db password from vault when EdgeX restart next time. Could you please elaborate what this issue more on what you were trying to resolve for?