Skip to content

Conversation

@danegsta
Copy link
Member

@danegsta danegsta commented Jan 6, 2026

Description

Introduce a new Tls EndpointProperty to enable resolving whether an endpoint is TLS enabled via ReferenceExpression (resolves to true or false depending on whether an endpoint is TLS enabled). HTTPS endpoints are automatically considered TLS enabled, while non-HTTP TCP endpoints require TLS to be explicitly enabled on the endpoint.

This is a bit of a brute force approach, but several different connection strings need a boolean value to indicate whether a connection uses TLS or not, but there's currently timing issues where we may not know if an endpoint is actually TLS terminated when a connection string is requested. We need some kind of value provider to correctly populate connection strings in these cases.

I also took the opportunity to update the redis connection string to use redis and rediss schemes instead of tcp to make generating URI style connection strings more straightforward.

Fixes #13645

Copilot AI review requested due to automatic review settings January 6, 2026 22:19
@github-actions
Copy link
Contributor

github-actions bot commented Jan 6, 2026

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 13778

Or

  • Run remotely in PowerShell:
iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 13778"

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR introduces a new Tls property to the EndpointProperty enum, enabling resolution of TLS status via ReferenceExpression. The implementation automatically defaults to true for HTTPS endpoints while allowing explicit TLS configuration for non-HTTP TCP endpoints (like Redis with TLS).

Key changes:

  • Added Tls property to EndpointAnnotation that defaults to true for HTTPS scheme
  • Added Tls enum value to EndpointProperty for reference resolution
  • Refactored Redis connection string and URI building to use the new EndpointProperty.Tls

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File Description
src/Aspire.Hosting/ApplicationModel/EndpointAnnotation.cs Adds new Tls property with smart defaulting based on URI scheme (HTTPS = true)
src/Aspire.Hosting/ApplicationModel/EndpointReference.cs Adds Tls property to EndpointReference, adds Tls enum value to EndpointProperty, implements expression resolution for TLS status returning "true"/"false" strings
src/Aspire.Hosting.Redis/RedisResource.cs Refactors connection string building to use EndpointProperty.Tls instead of TlsEnabled flag, simplifies URI expression using PrimaryEndpoint.Scheme
src/Aspire.Hosting.Redis/RedisBuilderExtensions.cs Adds explicit scheme configuration for Redis endpoints and sets Tls = true on primary endpoint when TLS certificate is configured

@danegsta danegsta requested a review from mitchdenny as a code owner January 6, 2026 23:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Need to use a value provider to delay evaluating Redis connection string TLS configuration

2 participants