Redis Agent Pre-Configuration (4369536)

This article outlines the pre-configuration requirements for deploying the Redis cartridge in Foglight. It includes user permissions and certificate setup for secure communication with the Redis Enterprise REST API. 
 

To enable secure monitoring, the Redis Agent requires a user with appropriate REST API access and a trusted certificate for encrypted communication. Without these, the agent cannot authenticate or connect securely to Redis Enterprise.

1. Configure Redis Agent User Permissions

Foglight requires a user with one of the following Cluster Management Access roles:

• DB Member
• Cluster Viewer
• Cluster Member
• Admin

It is recommended to use DB Member or Cluster Viewer for minimal access.

Refer to the Redis Enterprise documentation for full role descriptions.

Note: Redis ACLs (data access controls) are not required.

2. Create a User with REST API Permissions

• Open the Redis Management UI in a browser.
• Navigate to the Access Control section.
• On the Users tab, click the + icon.
• Enter a username, email, and password.
• Select one of the supported roles.
• Save the user.

3. Enable Certificate Authentication

To securely communicate with the Redis REST API, Foglight requires the root certificate in its truststore.

• Locate the certificate on any Redis node:

/etc/opt/redislabs/api_cert.pem

• Copy the default or production certificate.
• Import it into a JKS truststore using keytool:
  
  

keytool -importcert \\
  -keystore truststore.jks \\
  -alias redis_api_cert \\
  -file api_cert.pem \\
  -keypass changeit \\
  -storepass changeit \\
  -storetype JKS \\
  -noprompt

4. Configure JVM Parameters

Edit baseline.jvmargs.config in [FGLAM_HOME]/state/default/config:

vmparameter.0 = "-Djavax.net.ssl.trustStore="C:/path/to/truststore.jks"";
vmparameter.1 = "-Djavax.net.ssl.trustStorePassword=changeit";
vmparameter.2 = "-Djavax.net.ssl.trustStoreType=JKS";
    

Use forward slashes for Windows paths and escape quotes with a backslash (").

5. Restart FglAM

Restart the Foglight Agent Manager to apply the updated JVM parameters.

6. Configure Agent Properties

Ensure the Disable certificate authentication? checkbox is unchecked in the Agent Status Properties.

• The default truststore (cacerts) includes many well-known CA certificates.
• Using -Djavax.net.ssl.trustStore overrides the default JRE truststore.
• To retain existing CA certificates, import the Redis certificate into cacerts and copy it to a custom location.