6 views
-/https://github.com/berriai/litellm/issues/28379
GitHub · issue

#28379 [Bug]: GCP IAM auth fails with Redis Cluster — sync path uses redis_connect_func which RedisCluster bootstrap ignores

  • State: open
  • Author: @alessio24dev
  • Labels: bug, SDK

### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

Configuring GCP IAM authentication (via `cache_params.gcp_service_account` or `REDIS_GCP_SERVICE_ACCOUNT` env) against a clustered Redis (e.g., Google Memorystore for Valkey, which is always cluster-mode) causes the proxy to crashloop at startup with:

``` redis.exceptions.RedisClusterException: Redis Cluster cannot be connected. Please provide at least one reachable node: Authentication required. ```

The same setup works correctly **without** GCP IAM when a static password is provided via `cache_params.password`.

### Root cause

In `litellm/_redis.py::_get_redis_client_logic`, the GCP IAM branch installs a custom connection callback via `redis_connect_func`:

```python if _gcp_service_account is not None: redis_kwargs["redis_connect_func"] = create_gcp_iam_redis_connect_func( service_account=_gcp_service_account, ssl_ca_certs=_gcp_ssl_ca_certs ) redis_kwargs["redis_connect_func"]._gcp_service_account = _gcp_service_account ```

`redis_connect_func` is honored by `redis.Redis` connections, but **`redis.RedisCluster`'s boo…

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (4 events)
#0 of 0 · 31d18h38m59s ago — entered · #import:https:::github.com:berriai:litellm post #2313
31609 is harder because it spans MCP request context, credential resolution, error handling, and compatibility across listing and invocation flows, requiring broader integration tests. 28379 is comparatively localized to Redis Cluster connection initialization and authentication wiring.
Redis cluster authentication involves client-library internals, connection bootstrapping, compatibility across deployment modes, and integration testing; the cast-settings defect is narrower configuration propagation and billing-state debugging.
The right-hand task is substantially harder because it requires changes to authentication and connection lifecycle behavior across clustered infrastructure, with compatibility, startup reliability, and regression-testing risks. The left-hand task is a narrowly scoped metadata update with limited implementation and validation effort.
#0 of 0 · 31d17h55m23s ago — current · #import:https:::github.com:berriai:litellm post #3039
34875 requires careful concurrency redesign across streaming completion paths, shared-state ownership, callback ordering, and regression coverage, making it riskier and broader than the targeted Redis client integration fix in 28379.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search