First Commit

argocd/README.md

@@ -0,0 +1,84 @@
+# Argo CD examples
+
+This directory is excluded from the packaged Helm chart. Its files are examples
+for managing the chart from Argo CD.
+
+## Application
+
+[`application.yaml`](application.yaml) deploys:
+
+- three Redis shards;
+- one replica per shard;
+- authenticated Redis with a chart-generated initial password;
+- persistent volumes using the cluster's default StorageClass;
+- internal-only Redis Services;
+- RedisInsight connected automatically to the balanced bootstrap endpoint.
+
+Apply it once:
+
+```sh
+kubectl apply -f argocd/application.yaml
+```
+
+Edit the destination namespace, target revision, and inline `valuesObject` as
+needed. Because this file is not a Helm template, changing it in the Redis
+Application's own repository does not change the live Application spec during a
+normal sync. Reapply it, or manage it from an app-of-apps/ApplicationSet.
+
+## Password Secret
+
+For production GitOps, use an externally managed Secret and set:
+
+```yaml
+auth:
+  enabled: true
+  existingSecret: redis-auth
+  existingSecretKey: redis-password
+```
+
+[`redis-auth-secret.example.yaml`](redis-auth-secret.example.yaml) documents the
+required Secret shape. Do not commit an actual cleartext password.
+
+If the chart generates the password, retain
+`RespectIgnoreDifferences=true` and the Secret ignore rule from
+`application.yaml`; Argo's Helm renderer cannot use `lookup` to read the live
+Secret while comparing desired state.
+
+## Enabling external access
+
+Add this to `valuesObject`:
+
+```yaml
+externalAccess:
+  enabled: true
+  loadBalancerClass: ""
+  loadBalancerSourceRanges:
+    - 203.0.113.0/24
+```
+
+This creates one balanced bootstrap LoadBalancer and one LoadBalancer per Redis
+member. Every advertised member address must be routable from external clients.
+
+## Exposing RedisInsight with Istio
+
+Add:
+
+```yaml
+redisInsight:
+  enabled: true
+  ingress:
+    enabled: true
+    host: redisinsight.example.com
+    tls:
+      enabled: true
+      credentialName: redisinsight-tls
+      certificate:
+        create: true
+        issuerName: letsencrypt-production
+        issuerKind: ClusterIssuer
+        secretNamespace: istio-system
+```
+
+Replace the hostname, issuer, gateway selector, and Secret namespace with values
+from your environment. RedisInsight has no built-in ingress authentication; add
+an identity-aware proxy or Istio authorization policy before exposing it.

argocd/application.yaml

@@ -0,0 +1,77 @@
+# Public Argo CD example. Adjust the destination namespace, revision and values
+# for your environment, then apply this file once (or manage it from an
+# app-of-apps). Files under argocd/ are examples and are not rendered by Helm.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: redis-cluster
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://git.mulas.me/corrado/redis-cluster.git
+    targetRevision: master
+    path: .
+    helm:
+      releaseName: redis
+      valuesObject:
+        cluster:
+          shards: 3
+          replicasPerShard: 1
+
+        # Production deployments should authenticate even when Redis is only
+        # reachable inside the cluster. This example lets the chart create the
+        # initial password Secret; see the ignore rule below.
+        auth:
+          enabled: true
+
+        persistence:
+          # Empty selects the cluster's default StorageClass.
+          storageClass: ""
+          # This is per Redis member. The chart imposes no maximum.
+          size: 10Gi
+
+        # Disabled by default because this creates one LoadBalancer per member
+        # plus one balanced bootstrap LoadBalancer.
+        externalAccess:
+          enabled: false
+
+        metrics:
+          serviceMonitor:
+            enabled: false
+
+        # RedisInsight automatically discovers the release's balanced
+        # bootstrap endpoint. No IP address is required.
+        redisInsight:
+          enabled: true
+          persistence:
+            storageClass: ""
+            size: 2Gi
+          ingress:
+            enabled: false
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: redis
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - RespectIgnoreDifferences=true
+
+  # Argo CD renders Helm without API access, so Helm's lookup cannot recover a
+  # previously generated password during comparison. Ignore the generated
+  # Secret data to keep the first password stable. Prefer an existing Secret
+  # managed by SOPS, Sealed Secrets or External Secrets for serious GitOps use.
+  ignoreDifferences:
+    - group: ""
+      kind: Secret
+      name: redis-redis-cluster
+      namespace: redis
+      jsonPointers:
+        - /data/redis-password

argocd/redis-auth-secret.example.yaml

@@ -0,0 +1,19 @@
+# OPTIONAL — the clean GitOps way to handle the password: create the secret
+# out-of-band (or via SealedSecrets/SOPS/ExternalSecrets), then set
+# auth.existingSecret: redis-auth in the Application's valuesObject.
+#
+# Do NOT commit a real password to git. Either apply this once by hand with a
+# real value:
+#
+#   kubectl create secret generic redis-auth -n redis \
+#     --from-literal=redis-password="$(openssl rand -base64 24)"
+#
+# ...or encrypt this file with your secret-management tool of choice.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: redis-auth
+  namespace: redis
+type: Opaque
+stringData:
+  redis-password: CHANGE-ME