Connecting to a sharded Valkey™ cluster

# Build the redis-tools utility with TLS support manually.
RUN apt-get update && \
    apt-get install wget make gcc libssl-dev --yes && \
    wget https://download.redis.io/redis-stable.tar.gz && \
    tar -xzvf redis-stable.tar.gz && \
    cd redis-stable && \
    make BUILD_TLS=yes MALLOC=libc && \
    make install && \
    cp ./src/redis-cli /usr/bin/ && \
    # Get an SSL certificate.
    mkdir --parents ~/.redis && \
    wget "https://storage.yandexcloud.net/cloud-certs/CA.pem" \
         --output-document ~/.redis/YandexInternalRootCA.crt && \
    chmod 0655 ~/.redis/YandexInternalRootCA.crt

redis-cli \
    -c \
    -h <FQDN_of_master_host_in_required_shard> \
    -a <password> \
    -p 6380 \
    --tls \
    --cacert ~/.redis/YandexInternalRootCA.crt \

using System;
using System.Threading.Tasks;
using System.Net.Security;
using System.Security.Authentication;
using System.Security.Cryptography.X509Certificates;
using StackExchange.Redis;

namespace RedisClient
{
    class Program
    {
        // Configuration constants
        private const string TEST_KEY = "test-key";
        private const string TEST_VALUE = "test-value";
        private const string USERNAME = "default";
        private const string PASSWORD = "<password>";
        private const string CERT = "/home/<home_directory>/.redis/YandexInternalRootCA.crt"            

        static async Task<int> Main(string[] args)
        {
            try
            {
                var masterOptions = new ConfigurationOptions
                {
                    EndPoints = {
                        "<FQDN_of_master_host_in_shard_1>:6380",
                        ...
                        "<FQDN_of_master_host_in_shard_N>:6380"
                    },
                    User = USERNAME,
                    Password = PASSWORD,
                    Ssl = true
                };
                masterOptions.CertificateValidation += (
                    object sender,
                    X509Certificate? certificate,
                    X509Chain? chain,
                    SslPolicyErrors sslPolicyErrors) =>
                {
                    if (certificate == null) {
                        return false;       
                    }
                    var ca = new X509Certificate2(CERT);
                    bool verdict = (certificate.Issuer == ca.Subject);
                    if (verdict) {
                        return true;
                    }
                    Console.WriteLine("Certificate error: {0}", sslPolicyErrors);
                    return false;
                }

                var connection = await ConnectionMultiplexer.ConnectAsync(masterOptions);

                var db = connection.GetDatabase();

                // Send SET command
                bool setResult = await db.StringSetAsync(TEST_KEY, TEST_VALUE);
                if (!setResult)
                {
                    Console.WriteLine($"SET failed for key {TEST_KEY}");
                    return 1;
                }
                Console.WriteLine($"Successfully set {TEST_KEY} = {TEST_VALUE}");

                // Send GET command
                var getResult = await db.StringGetAsync(TEST_KEY);
                if (!getResult.HasValue)
                {
                    Console.WriteLine($"GET failed: Key {TEST_KEY} not found");
                    return 1;
                }

                string retrievedValue = getResult.ToString();
                if (retrievedValue != TEST_VALUE)
                {
                    Console.WriteLine($"GET failed. Expected: '{TEST_VALUE}', Actual: '{retrievedValue}'");
                    return 1;
                }
                Console.WriteLine($"Successfully retrieved {TEST_KEY} = {retrievedValue}");

            return 0;
        }
        catch (Exception ex)
        {
            Console.WriteLine($"Operation failed: {ex.Message}");
            return 1;
        }
        }
    }    
}

package main

import (
    "context"
    "crypto/tls"
    "crypto/x509"
    "fmt"
    "net"
    "os"
    "strings"
    "time"

    "github.com/redis/go-redis/v9"
)

func main() {
    caCert, err := os.ReadFile("/home/<home_directory>/.redis/YandexInternalRootCA.crt")
    if err != nil {
        panic(err)
    }
    caCertPool := x509.NewCertPool()
    caCertPool.AppendCertsFromPEM(caCert)

    hostports := []string{
        "<FQDN_of_master_host_in_shard_1>:6380",
        ...
        "<FQDN_of_master_host_in_shard_N>:6380",
    }
    options := redis.UniversalOptions{
        Addrs:        hostports,
        MaxRedirects: 1,
        Password:     "password",
        DB:           0,
        ReadOnly:     false,
        DialTimeout:  5 * time.Second,
        TLSConfig: &tls.Config{
            RootCAs:            caCertPool,
            ServerName: "c-<cluster_ID>.rw.mdb.yandexcloud.net",
            VerifyPeerCertificate: func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
                certs := make([]*x509.Certificate, len(rawCerts))
                for i := 0; i < len(rawCerts); i++ {
                    cert, err := x509.ParseCertificate(rawCerts[i])
                    if err != nil {
                        return fmt.Errorf("error parsing certificate: %+v", err)
                    }
                    certs[i] = cert
                }

                opts := x509.VerifyOptions{
                    Roots:         caCertPool,
                    CurrentTime:   time.Now(),
                    DNSName:       "",
                    Intermediates: x509.NewCertPool(),
                }

                for i := range certs {
                    if i == 0 {
                        continue
                    }
                    opts.Intermediates.AddCert(certs[i])
                }
                _, err := certs[0].Verify(opts)
                return err
            },
        },
    }
    options.Dialer = func(ctx context.Context, network, addr string) (net.Conn, error) {
        parts := strings.Split(addr, ":")
        newAddr := addr
        if len(parts) > 1 && !strings.HasPrefix(parts[0], "[") {
            newAddr = "[" + strings.Join(parts[:len(parts)-1], ":") + "]:" + parts[len(parts)-1]
        }

        netDialer := &net.Dialer{
            Timeout:   options.DialTimeout,
            KeepAlive: 5 * time.Minute,
        }
        return tls.DialWithDialer(netDialer, network, newAddr, options.TLSConfig)
    }

    ctx := context.Background()

    client := redis.NewUniversalClient(&options)
    err = client.Set(ctx, "foo", "bar", 0).Err()
    if err != nil {
        panic(err)
    }

    get := client.Get(ctx, "foo")
    err = get.Err()
    if err != nil {
        panic(err)
    }
    fmt.Println(get.String())
}

package com.example;

import redis.clients.jedis.DefaultJedisClientConfig;
import redis.clients.jedis.HostAndPort;
import redis.clients.jedis.JedisCluster;
import redis.clients.jedis.JedisPoolConfig;

import javax.net.ssl.SSLParameters;
import java.util.HashSet;
import java.util.Set;

public class App {
  public static void main(String[] args) {
    System.setProperty("javax.net.ssl.trustStore", "/home/<home_directory>/.redis/YATrustStore");
    System.setProperty("javax.net.ssl.trustStorePassword", "<secure_certificate_storage_password>");

    JedisPoolConfig jedisPoolConfig = new JedisPoolConfig();
    Set<HostAndPort> jedisClusterNodes = new HashSet<HostAndPort>();
    SSLParameters sslParameters = new SSLParameters();
    jedisClusterNodes.add(new HostAndPort("<FQDN_of_master_host_in_shard_1>", 6380));
    ...
    jedisClusterNodes.add(new HostAndPort("<FQDN_of_master_host_in_shard_N>", 6380));

    DefaultJedisClientConfig jedisClientConfig = DefaultJedisClientConfig.builder().
            password("<cluster_password>").
            ssl(true).
            sslParameters(sslParameters).
            build();

    try {
      JedisCluster jc = new JedisCluster(jedisClusterNodes, jedisClientConfig, 5, jedisPoolConfig);

      jc.set("foo", "bar");
      System.out.println(jc.get("foo"));
      jc.close();
    } catch (Exception ex) {
      ex.printStackTrace();
    }
  }
}

"use strict";

const Redis = require("ioredis");
const fs = require("fs");

const cluster = new Redis.Cluster(
    [
        {
            host: "<FQDN_of_master_host_in_shard_1>",
            port: 6380
        },
        ...
        {
            host: "<FQDN_of_master_host_in_shard_N>",
            port: 6380
        },
    ],
    {
        redisOptions: {
            password: "<password>",
            tls: {
                ca: [fs.readFileSync("/home/<home_directory>/.redis/YandexInternalRootCA.crt")],
                checkServerIdentity: () => {
                    return null;
                }
            }
        }
    }
);

cluster.on("ready", () => {
    Promise.all([
        cluster.set("foo", "bar"),
        cluster.get("foo")
    ]).then(
        (result) => {
            console.log(result[1]); // result == [ "OK", "bar"]
            cluster.disconnect();
        },
        (reject) => {
             console.log(reject);
             cluster.disconnect();
        }
    );
});

<?php

require "Predis/Autoloader.php";
Predis\Autoloader::register();

$hosts = [
    'tls://<FQDN_of_master_host_in_shard_1>:6380?ssl[cafile]=/home/<home_directory>/.redis/YandexInternalRootCA.crt',
    ...
    'tls://<FQDN_of_master_host_in_shard_N>:6380?ssl[cafile]=/home/<home_directory>/.redis/YandexInternalRootCA.crt',
];

$options = [
    'cluster' => 'predis',
    'parameters' => [
        'password' => '<password>',
    ],
];

$conn = new Predis\Client($hosts, $options);
$conn->set('foo', 'bar');

var_dump($conn->get("foo"));

$conn->disconnect();
?>

import OpenSSL
from rediscluster import RedisCluster

startup_nodes = [
    {"host": "<FQDN_of_master_host_in_shard_1>", "port": 6380},
    ...
    {"host": "<FQDN_of_master_host_in_shard_N>", "port": 6380},
]

rc = RedisCluster(
    startup_nodes=startup_nodes,
    decode_responses=True,
    skip_full_coverage_check=True,
    password="<password>",
    ssl=True,
    ssl_ca_certs="/home/<home_directory>/.redis/YandexInternalRootCA.crt",
)

rc.set("foo", "bar")

print(rc.get("foo"))

# coding: utf-8

require 'redis'

nodes = [
  { host: '<FQDN_of_master_host_in_shard_1>', port: 6380 },
  ...
  { host: '<FQDN_of_master_host_in_shard_N>', port: 6380 }
]

conn = Redis.new(
  cluster: nodes,
  password: '<password>',
  ssl: true,
  ssl_params: {
    ca_file: '/home/<home_directory>/.redis/YandexInternalRootCA.crt',
    verify_hostname: false
  }
)

conn.set('foo', 'bar')
puts conn.get('foo')

conn.close