First Commit

values.yaml

@@ -0,0 +1,247 @@
+# Native Redis Cluster topology. The member StatefulSets contain
+# shards * (replicasPerShard + 1) pods. Changing either value after the cluster
+# contains data requires an explicit Redis reshard/add-node operation; a Helm
+# upgrade alone intentionally does not mutate the slot map.
+cluster:
+  # -- Independently writable hash-slot primaries. Redis requires at least 3
+  # for automatic failover elections.
+  shards: 3
+  # -- Readable, failover-capable replicas attached to every shard primary.
+  replicasPerShard: 1
+  # -- Dedicated node-to-node cluster bus port.
+  busPort: 16379
+  nodeTimeoutMilliseconds: 10000
+  requireFullCoverage: true
+  allowReadsWhenDown: false
+  migrationBarrier: 1
+
+image:
+  repository: redis
+  tag: 7.4-alpine
+  pullPolicy: IfNotPresent
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+auth:
+  enabled: false
+  # -- Password. Leave empty to auto-generate one (persisted across upgrades
+  # via helm lookup).
+  password: ""
+  # -- Use an existing secret instead of creating one.
+  existingSecret: ""
+  existingSecretKey: redis-password
+
+redis:
+  port: 6379
+  # -- Cap Redis memory usage; keep it below the container memory limit.
+  maxmemory: 384mb
+  maxmemoryPolicy: noeviction
+  # -- Extra lines appended verbatim to redis.conf.
+  extraConfig: ""
+  resources:
+    requests:
+      cpu: 70m
+      memory: 256Mi
+    limits:
+      memory: 512Mi
+
+probes:
+  redis:
+    # -- Redis may need to recover AOF and rejoin the cluster after a worker or
+    # storage outage. Startup failures are tolerated for 15 minutes.
+    startup:
+      initialDelaySeconds: 10
+      periodSeconds: 5
+      timeoutSeconds: 4
+      failureThreshold: 180
+    # -- Ten consecutive failed checks over 150 seconds are required before
+    # Kubernetes restarts Redis. LOADING and CLUSTERDOWN remain live states.
+    liveness:
+      periodSeconds: 15
+      timeoutSeconds: 8
+      failureThreshold: 10
+    # -- Readiness only controls traffic; it never restarts the container.
+    readiness:
+      periodSeconds: 5
+      timeoutSeconds: 4
+      failureThreshold: 3
+
+# Redis Cluster clients must reach the exact member named by MOVED/ASK replies.
+# When enabled, the Kubernetes LoadBalancer implementation allocates one
+# endpoint per member plus a balanced bootstrap endpoint. Pods discover their
+# assigned endpoint from the Kubernetes API before Redis starts.
+externalAccess:
+  # -- Disabled by default because this creates one LoadBalancer per Redis
+  # member plus one bootstrap LoadBalancer and can incur provider charges.
+  enabled: false
+  port: 6379
+  bootstrap:
+    annotations: {}
+  memberServices:
+    annotations: {}
+  loadBalancerClass: ""
+  externalTrafficPolicy: Cluster
+  # -- Strongly recommended: restrict this to the client networks. An empty
+  # list leaves reachability to the LoadBalancer/firewall implementation.
+  loadBalancerSourceRanges: []
+  allocateLoadBalancerNodePorts: true
+  endpointDiscovery:
+    image:
+      repository: curlimages/curl
+      tag: 8.21.0
+      pullPolicy: IfNotPresent
+    resources:
+      requests:
+        cpu: 5m
+        memory: 8Mi
+      limits:
+        memory: 32Mi
+
+metrics:
+  enabled: true
+  image:
+    # -- redis_exporter's own release registry (upstream project; also mirrored
+    # at quay.io/oliver006/redis_exporter and docker.io/oliver006/redis_exporter).
+    # GHCR avoids Docker Hub pull rate limits.
+    repository: ghcr.io/oliver006/redis_exporter
+    tag: v1.87.0-alpine
+    pullPolicy: IfNotPresent
+  port: 9121
+  resources:
+    requests:
+      cpu: 25m
+      memory: 32Mi
+    limits:
+      memory: 64Mi
+  serviceMonitor:
+    # -- Requires the Prometheus Operator CRDs (kube-prometheus-stack).
+    enabled: false
+    interval: 30s
+    scrapeTimeout: 10s
+    # -- Extra labels so your Prometheus instance selects this ServiceMonitor,
+    # e.g. release: kube-prometheus-stack
+    labels: {}
+
+# Optional browser UI for inspecting and operating this Redis Cluster. The
+# component is disabled by default; enabling it creates one RedisInsight pod,
+# its Service and storage, and (when requested) an Istio HTTP route.
+redisInsight:
+  enabled: false
+  image:
+    repository: redis/redisinsight
+    tag: 3.8.0
+    pullPolicy: IfNotPresent
+  port: 5540
+  connection:
+    # -- Empty automatically uses this release's balanced bootstrap endpoint:
+    # internal Service DNS normally, or the discovered LoadBalancer ingress
+    # address when external access is enabled. Set a hostname/IP to override.
+    host: ""
+    # -- Zero automatically follows externalAccess.port or redis.port.
+    port: 0
+    alias: redis-cluster
+    tls: false
+  persistence:
+    enabled: true
+    # -- Empty uses the cluster's default StorageClass.
+    storageClass: ""
+    accessModes:
+      - ReadWriteOnce
+    size: 1Gi
+    annotations: {}
+  resources:
+    requests:
+      cpu: 50m
+      memory: 128Mi
+    limits:
+      memory: 512Mi
+  podAnnotations: {}
+  nodeSelector: {}
+  tolerations: []
+  ingress:
+    enabled: false
+    host: ""
+    gatewaySelector:
+      istio: ingressgateway
+    requestTimeout: 60s
+    tls:
+      enabled: false
+      # -- Name of an existing TLS Secret available to the Istio ingress
+      # gateway. Required when TLS is enabled.
+      credentialName: ""
+      certificate:
+        # -- Ask cert-manager to create credentialName. Leave false when the
+        # Secret is managed outside this chart.
+        create: false
+        issuerName: ""
+        issuerKind: ClusterIssuer
+        # -- Empty creates the Certificate in the release namespace. Some
+        # Istio installations require gateway credentials in istio-system;
+        # set that namespace explicitly when needed.
+        secretNamespace: ""
+
+persistence:
+  enabled: true
+  # -- Empty uses the cluster's default StorageClass.
+  storageClass: ""
+  accessModes:
+    - ReadWriteOnce
+  # -- Requested capacity for every Redis member PVC. The chart imposes no
+  # upper bound; the StorageClass and cluster quota decide what is available.
+  size: 3Gi
+  annotations: {}
+
+istio:
+  # -- Keep the Envoy sidecar OFF the Redis pods (recommended). Redis Cluster
+  # uses direct pod-to-pod client and cluster-bus connections. Client pods can reach
+  # Redis from inside the mesh (mTLS in PERMISSIVE mode, or add a
+  # PeerAuthentication exception for this workload if you run STRICT).
+  injectSidecar: false
+
+networkPolicy:
+  # -- Standard Kubernetes NetworkPolicy. Enforcement depends on the installed
+  # CNI. Pod-to-pod client, replication, key-migration, and cluster-bus traffic
+  # is always allowed.
+  enabled: false
+  # -- Allow any pod in the cluster to reach the Redis client port.
+  # Set to false and fill extraIngress to lock down clients.
+  allowExternal: true
+  # -- Extra "from" peers allowed on the client ports when allowExternal=false,
+  # e.g. [{namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: myapp}}}]
+  extraIngress: []
+  # -- Namespaces allowed to scrape metrics (empty = any).
+  metricsFromNamespaces: []
+
+podDisruptionBudget:
+  enabled: true
+  maxUnavailable: 1
+
+serviceAccount:
+  create: true
+  name: ""
+  annotations: {}
+
+nodeSelector: {}
+tolerations: []
+topologySpreadConstraints: []
+priorityClassName: ""
+
+podAnnotations: {}
+podLabels: {}
+
+podSecurityContext:
+  fsGroup: 999
+  runAsNonRoot: true
+
+containerSecurityContext:
+  runAsUser: 999
+  runAsGroup: 999
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: true
+  capabilities:
+    drop:
+      - ALL
+
+terminationGracePeriodSeconds: 30