diff --git a/.changeset/five-hounds-know.md b/.changeset/five-hounds-know.md deleted file mode 100644 index 4a9c5777095..00000000000 --- a/.changeset/five-hounds-know.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -'hive': minor ---- - -Added opt-in AWS IAM authentication for ElastiCache Redis connections and Redis Cluster mode -support. When IAM is enabled, services authenticate to Redis using short-lived SigV4 pre-signed -tokens instead of static passwords, with automatic token refresh before expiry. - -### New environment variables - -| Variable | Service | Description | -| ---------------------------- | ---------------------------------------- | ----------------------------------------------------------------------------- | -| `AWS_REGION` | schema, server, tokens, usage, workflows | Default AWS region for all AWS connections. | -| `REDIS_AWS_IAM_AUTH_ENABLED` | schema, server, tokens, usage, workflows | Set to `1` to enable IAM authentication for Redis. | -| `REDIS_AWS_IAM_CACHE_NAME` | schema, server, tokens, usage, workflows | The ElastiCache Redis cache instance name. Used as the host for the signer. | -| `REDIS_AWS_REGION` | schema, server, tokens, usage, workflows | Optional override for the Redis region (defaults to `AWS_REGION`). | -| `REDIS_CLUSTER_MODE_ENABLED` | schema, server, tokens, usage, workflows | Set to `1` to connect using Redis Cluster mode. | -| `REDIS_USERNAME` | schema, server, tokens, usage, workflows | Optional Redis username for ACL-based authentication (defaults to `default`). | - -### To enable - -- `REDIS_AWS_IAM_AUTH_ENABLED=1` -- `REDIS_TLS_ENABLED=1` must be set (IAM authentication requires TLS). -- `REDIS_AWS_REGION` or `AWS_REGION` must be set. -- `REDIS_AWS_IAM_CACHE_NAME` set to the name of the cache instance in AWS. This will be used as the hostname for the signer. -- The pod/instance must have AWS credentials available (e.g. IRSA, EKS Pod Identity, instance - profile) with the appropriate ElastiCache IAM permissions. - -### Other changes -- Bumping ioredis to `5.10.1`. diff --git a/deployment/CHANGELOG.md b/deployment/CHANGELOG.md index 2e04c5df6c5..0e5265f0ba1 100644 --- a/deployment/CHANGELOG.md +++ b/deployment/CHANGELOG.md @@ -1,5 +1,41 @@ # hive +## 11.4.0 + +### Minor Changes + +- [#8078](https://github.com/graphql-hive/console/pull/8078) + [`bd6cce7`](https://github.com/graphql-hive/console/commit/bd6cce70b253deb676300e5e4ba063a6307e37cb) + Thanks [@mish-elle](https://github.com/mish-elle)! - Added opt-in AWS IAM authentication for + ElastiCache Redis connections and Redis Cluster mode support. When IAM is enabled, services + authenticate to Redis using short-lived SigV4 pre-signed tokens instead of static passwords, with + automatic token refresh before expiry. + + ### New environment variables + + | Variable | Service | Description | + | ---------------------------- | ---------------------------------------- | ----------------------------------------------------------------------------- | + | `AWS_REGION` | schema, server, tokens, usage, workflows | Default AWS region for all AWS connections. | + | `REDIS_AWS_IAM_AUTH_ENABLED` | schema, server, tokens, usage, workflows | Set to `1` to enable IAM authentication for Redis. | + | `REDIS_AWS_IAM_CACHE_NAME` | schema, server, tokens, usage, workflows | The ElastiCache Redis cache instance name. Used as the host for the signer. | + | `REDIS_AWS_REGION` | schema, server, tokens, usage, workflows | Optional override for the Redis region (defaults to `AWS_REGION`). | + | `REDIS_CLUSTER_MODE_ENABLED` | schema, server, tokens, usage, workflows | Set to `1` to connect using Redis Cluster mode. | + | `REDIS_USERNAME` | schema, server, tokens, usage, workflows | Optional Redis username for ACL-based authentication (defaults to `default`). | + + ### To enable + + - `REDIS_AWS_IAM_AUTH_ENABLED=1` + - `REDIS_TLS_ENABLED=1` must be set (IAM authentication requires TLS). + - `REDIS_AWS_REGION` or `AWS_REGION` must be set. + - `REDIS_AWS_IAM_CACHE_NAME` set to the name of the cache instance in AWS. This will be used as + the hostname for the signer. + - The pod/instance must have AWS credentials available (e.g. IRSA, EKS Pod Identity, instance + profile) with the appropriate ElastiCache IAM permissions. + + ### Other changes + + - Bumping ioredis to `5.10.1`. + ## 11.3.0 ### Minor Changes diff --git a/deployment/package.json b/deployment/package.json index 82a945fcab3..d76ed6e52d6 100644 --- a/deployment/package.json +++ b/deployment/package.json @@ -1,6 +1,6 @@ { "name": "hive", - "version": "11.3.0", + "version": "11.4.0", "private": true, "scripts": { "generate": "tsx generate.ts",