Allow using hosted Redis instances by default

ruby/lib/ci/queue/configuration.rb

@@ -3,7 +3,7 @@ module CI
   module Queue
     class Configuration
       attr_accessor :timeout, :worker_id, :max_requeues, :grind_count, :failure_file, :export_flaky_tests_file
-      attr_accessor :requeue_tolerance, :namespace, :failing_test, :statsd_endpoint
+      attr_accessor :requeue_tolerance, :namespace, :failing_test, :statsd_endpoint, :strict_ssl
       attr_accessor :max_test_duration, :max_test_duration_percentile, :track_test_duration
       attr_accessor :max_test_failed, :redis_ttl, :warnings_file, :debug_log, :max_missed_heartbeat_seconds
       attr_reader :circuit_breakers
@@ -37,7 +37,8 @@ def initialize(
         grind_count: nil, max_duration: nil, failure_file: nil, max_test_duration: nil,
         max_test_duration_percentile: 0.5, track_test_duration: false, max_test_failed: nil,
         queue_init_timeout: nil, redis_ttl: 8 * 60 * 60, report_timeout: nil, inactive_workers_timeout: nil,
-        export_flaky_tests_file: nil, warnings_file: nil, debug_log: nil, max_missed_heartbeat_seconds: nil)
+        export_flaky_tests_file: nil, warnings_file: nil, debug_log: nil, max_missed_heartbeat_seconds: nil,
+        strict_ssl: false)
         @build_id = build_id
         @circuit_breakers = [CircuitBreaker::Disabled]
         @failure_file = failure_file
@@ -51,6 +52,7 @@ def initialize(
         @requeue_tolerance = requeue_tolerance
         @seed = seed
         @statsd_endpoint = statsd_endpoint
+        @strict_ssl = strict_ssl
         @timeout = timeout
         @queue_init_timeout = queue_init_timeout
         @track_test_duration = track_test_duration

ruby/lib/ci/queue/redis/base.rb

@@ -33,14 +33,20 @@ def initialize(redis_url, config)
           @redis_url = redis_url
           @config = config
           if ::Redis::VERSION > "5.0.0"
-            @redis = ::Redis.new(
+            connection_options = {
               url: redis_url,
               # Booting a CI worker is costly, so in case of a Redis blip,
               # it makes sense to retry for a while before giving up.
               reconnect_attempts: reconnect_attempts,
               middlewares: custom_middlewares,
               custom: custom_config,
-            )
+            }
+
+            if !config.strict_ssl
+              connection_options[:ssl_params] = { verify_mode: OpenSSL::SSL::VERIFY_NONE }
+            end
+
+            @redis = ::Redis.new(**connection_options)
           else
             @redis = ::Redis.new(url: redis_url)
           end

ruby/lib/minitest/queue/runner.rb

@@ -443,6 +443,15 @@ def parser
             queue_config.timeout = timeout
           end
 
+          help = <<~EOS
+            Force strict SSL checks on the Redis connection.
+            The default connection behavior is to set SSL verification to `OpenSSL::SSL::VERIFY_NONE` because hosted Redis services may use self-signed certificates.
+            When this flag is activated, the full TLS check will be performed.
+          EOS
+          parser.on('--strict-ssl', *help) do
+            queue_config.strict_ssl = true
+          end
+
           help = <<~EOS
             Specify a timeout after which the report command will fail if not all tests have been processed.
             Defaults to the value set for --timeout.

ruby/lib/rspec/queue.rb

@@ -76,6 +76,15 @@ def parser(options)
           options[:queue_url] = url
         end
 
+        help = <<~EOS
+          Force strict SSL checks on the Redis connection.
+          The default connection behavior is to set SSL verification to `OpenSSL::SSL::VERIFY_NONE` because hosted Redis services may use self-signed certificates.
+          When this flag is activated, the full TLS check will be performed.
+        EOS
+        parser.on('--strict-ssl', *help) do
+          queue_config.strict_ssl = true
+        end
+
         help = <<~EOS
           Wait for all workers to complete and summarize the test failures.
         EOS