Mukul SharmaandClaude Opus 5
fb7db5aee6
References to helm-overrides/k8s-admin-prd-ase1 now either name the homelab repo that still has that folder, or point at the GKE equivalent under gke-toolshed-prd-usc1. Comments only; no rendered values change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fn2kUxyYNY4ApytbLiGWeY
85 lines
3.6 KiB
YAML
85 lines
3.6 KiB
YAML
# Chart defaults. Real configuration lives in
|
|
# helm-overrides/gke-toolshed-prd-usc1/redis/custom-values.yaml.
|
|
|
|
fullnameOverride: redis
|
|
|
|
image:
|
|
# Pulled from Docker Hub, like every other infra component here (gitea,
|
|
# vault, harbor, postgresql). The base-images mirror in Harbor exists to
|
|
# remove Docker Hub from the *application build* path — it is not in play
|
|
# for platform components.
|
|
repository: redis
|
|
tag: "7-alpine"
|
|
pullPolicy: IfNotPresent
|
|
|
|
# Name of the Secret holding the admin password. Created by External
|
|
# Secrets from Vault, not by this chart — a chart that generates its own
|
|
# password regenerates it on every render, which would rewrite the ACL file
|
|
# and lock every already-provisioned app out of its own data.
|
|
existingSecret: redis-credentials
|
|
secretKeys:
|
|
password: password
|
|
|
|
service:
|
|
port: 6379
|
|
|
|
persistence:
|
|
enabled: true
|
|
# local-path-provisioner, this cluster's default StorageClass. Small: this
|
|
# holds the ACL file and (if enabled) an RDB snapshot, not a dataset of
|
|
# any size — maxmemory below is the real ceiling on what Redis will hold.
|
|
# The volume is not resizable in place with this provisioner, so it is
|
|
# sized up front.
|
|
storageClass: local-path
|
|
size: 1Gi
|
|
|
|
config:
|
|
# ACL FILE, NOT requirepass. This distinction is load-bearing and easy to
|
|
# "simplify" into a security hole, so it is written down here rather than
|
|
# left to be rediscovered:
|
|
#
|
|
# toolshed provisions per-app users with ACL SETUSER, and persists them
|
|
# with ACL SAVE (internal/dbprovision.EnsureRedisUser) — without that
|
|
# save, every provisioned user is lost on the next restart and every app
|
|
# using Redis fails to authenticate with credentials that still look
|
|
# valid. ACL SAVE requires an aclfile; that is why one is configured.
|
|
#
|
|
# But ACL SAVE also writes the *default* user's state to that file. With
|
|
# `requirepass` set and the default user defined only by it, the saved
|
|
# entry comes back as `user default on nopass ~* &* +@all` — and after
|
|
# the next restart the ACL file wins, leaving Redis accepting
|
|
# UNAUTHENTICATED connections with full access. Verified directly, not
|
|
# inferred: with requirepass the restarted server answered an
|
|
# unauthenticated PING with PONG and served a key.
|
|
#
|
|
# Defining the default user in the ACL file instead (seeded by the init
|
|
# container, see the StatefulSet) keeps its password across every
|
|
# subsequent ACL SAVE — the same restart then correctly answers
|
|
# `NOAUTH Authentication required.`
|
|
#
|
|
# If you ever add `requirepass` here, you reintroduce that hole.
|
|
maxmemory: 48mb
|
|
# allkeys-lru, because this backs a connection kind literally called
|
|
# "cache" and eviction under pressure is that contract. An app using
|
|
# Redis as its only copy of something wants noeviction instead — at
|
|
# which case writes start failing when full rather than data silently
|
|
# disappearing. Neither is safe for every use; this one matches the name.
|
|
maxmemoryPolicy: allkeys-lru
|
|
# Snapshotting off. What must survive a restart is the ACL file, which is
|
|
# written by ACL SAVE independently of RDB/AOF. Cached values are by
|
|
# definition reconstructible, and on a node at its memory ceiling a
|
|
# background save's copy-on-write spike is a real risk for no benefit.
|
|
save: ""
|
|
|
|
# Tuned for a node with 8GB total that is already near its ceiling. The
|
|
# request is what the scheduler reserves; the limit is sized above
|
|
# maxmemory so Redis hits its own eviction policy rather than being
|
|
# OOM-killed by the kernel, which loses the whole instance instead of the
|
|
# coldest keys.
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 32Mi
|
|
limits:
|
|
memory: 96Mi
|