1# Redis Recipe — Python — REFERENCE ONLY
2 
3## Redis Client with Token Refresh
4 
5### Requirements
6 
7Add to `requirements.txt`:
8 
9```
10redis>=5.0
11azure-identity
12```
13 
14### Cache Module
15 
16Create `cache.py`:
17 
18```python
19import os
20import time
21import threading
22import redis
23from azure.identity import DefaultAzureCredential
24 
25# Redis ACL auth requires both username and token as password
26_REDIS_USERNAME = "default"
27_TOKEN_SCOPE = "https://redis.azure.com/.default"
28_TOKEN_REFRESH_MARGIN = 300  # Refresh 5 minutes before expiry
29 
30_credential = DefaultAzureCredential()
31_lock = threading.RLock()  # reentrant — get_cache() calls _get_token() while holding the lock
32_token_cache: dict = {}
33 
34 
35def _get_token():
36    """Return a valid Entra ID token, refreshing if within expiry margin."""
37    with _lock:
38        now = time.time()
39        if not _token_cache or now >= _token_cache["expires_on"] - _TOKEN_REFRESH_MARGIN:
40            tok = _credential.get_token(_TOKEN_SCOPE)
41            _token_cache["token"] = tok.token
42            _token_cache["expires_on"] = tok.expires_on
43        return _token_cache["token"]
44 
45 
46def create_redis_client() -> redis.Redis:
47    """Create a Redis client. Token is refreshed on each call via _get_token()."""
48    return redis.Redis(
49        host=os.environ["REDIS_HOST"],
50        port=int(os.environ.get("REDIS_PORT", 6380)),
51        ssl=True,
52        username=_REDIS_USERNAME,
53        password=_get_token(),
54        decode_responses=True,
55    )
56 
57 
58def get_cache() -> redis.Redis:
59    """Lazy/refreshing accessor — call this from request handlers instead of holding a module-level client.
60    Recreates the client when the cached token is within the refresh margin and closes the prior one."""
61    global _client
62    with _lock:
63        now = time.time()
64        if _client is None or now >= _token_cache.get("expires_on", 0) - _TOKEN_REFRESH_MARGIN:
65            old = _client
66            _client = create_redis_client()
67            if old is not None:
68                try:
69                    old.close()
70                except Exception:
71                    pass
72        return _client
73 
74 
75_client: redis.Redis | None = None
76```
77 
78> ⚠️ Entra ID tokens expire in ~1 hour. The `_get_token()` helper refreshes proactively 5 minutes before expiry, and `get_cache()` recreates the underlying client so in-flight pool connections pick up the new token. Always call `get_cache()` from request handlers — never cache the client at module scope across the token lifetime.
79 
80### Usage
81 
82```python
83from cache import get_cache
84 
85def get_cached(key: str):
86    cache = get_cache()
87    value = cache.get(key)
88    if value is None:
89        value = "computed-value"
90        cache.setex(key, 300, value)  # TTL 5 minutes
91    return value
92```
93 
94## Files to Modify
95 
96| File | Action |
97|------|--------|
98| `cache.py` | Create — Redis client with token refresh |
99| `main.py` | Modify — use cache client |
100| `requirements.txt` | Modify — add redis, azure-identity |
101