cloud-host/backend/helm/cloudhost-app/templates/redis-deployment.yaml

{{- if .Values.redis.enabled }}
{{- $name    := include "cloudhost-app.name" . -}}
{{- $ns      := include "cloudhost-app.namespace" . -}}
{{- $redisName := printf "%s-redis" $name -}}
{{- /* Preserve the existing password across upgrades — regenerating it every
       upgrade would break app↔Redis auth against the persisted volume. */ -}}
{{- $redisSecretName := printf "%s-secret" $redisName -}}
{{- $existingRedis := lookup "v1" "Secret" $ns $redisSecretName -}}
{{- $redisPass := "" -}}
{{- if and $existingRedis $existingRedis.data (index $existingRedis.data "password") -}}
{{- $redisPass = index $existingRedis.data "password" | b64dec -}}
{{- else -}}
{{- $redisPass = randAlphaNum 16 -}}
{{- end -}}
---
apiVersion: v1
kind: Secret
metadata:
  name: {{ $redisSecretName }}
  namespace: {{ $ns }}
  labels:
    app: {{ $redisName }}
    {{- include "cloudhost-app.labels" . | nindent 4 }}
  annotations:
    "helm.sh/resource-policy": keep
type: Opaque
data:
  password: {{ $redisPass | b64enc | quote }}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: {{ $redisName }}-data
  namespace: {{ $ns }}
  labels:
    app: {{ $redisName }}
    {{- include "cloudhost-app.labels" . | nindent 4 }}
  annotations:
    "helm.sh/resource-policy": keep
spec:
  accessModes:
    - ReadWriteOnce
  {{- if .Values.global.storageClass }}
  storageClassName: {{ .Values.global.storageClass | quote }}
  {{- end }}
  resources:
    requests:
      storage: {{ .Values.redis.storageSize | default "1Gi" | quote }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ $redisName }}
  namespace: {{ $ns }}
  labels:
    app: {{ $redisName }}
    {{- include "cloudhost-app.labels" . | nindent 4 }}
spec:
  replicas: 1
  # RWO volume + single replica: recreate the old pod before starting the new
  # one, otherwise a rolling update deadlocks on the attached PVC.
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: {{ $redisName }}
  template:
    metadata:
      labels:
        app: {{ $redisName }}
    spec:
      containers:
        - name: redis
          image: {{ include "cloudhost-app.baseImage" (dict "root" $ "image" (printf "redis:%s-alpine" (.Values.redis.version | default "7.2"))) }}
          args: ["--requirepass", "$(REDIS_PASSWORD)"]
          ports:
            - containerPort: 6379
          env:
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ $redisSecretName }}
                  key: password
            # redis-cli in the probes auto-authenticates from REDISCLI_AUTH,
            # so `redis-cli ping` works even with --requirepass set.
            - name: REDISCLI_AUTH
              valueFrom:
                secretKeyRef:
                  name: {{ $redisSecretName }}
                  key: password
          volumeMounts:
            - name: redis-data
              mountPath: /data
          resources:
            requests:
              cpu: {{ .Values.redis.resources.cpuRequest | default "50m" | quote }}
              memory: {{ .Values.redis.resources.memoryRequest | default "64Mi" | quote }}
            limits:
              cpu: {{ .Values.redis.resources.cpuLimit | default "200m" | quote }}
              memory: {{ .Values.redis.resources.memoryLimit | default "256Mi" | quote }}
          readinessProbe:
            exec:
              command: ["redis-cli", "ping"]
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            exec:
              command: ["redis-cli", "ping"]
            initialDelaySeconds: 15
            periodSeconds: 20
        {{- include "cloudhost-app.logShipperContainers" (dict "root" . "workloadName" $redisName "workloadType" "redis") | nindent 8 }}
      volumes:
        - name: redis-data
          persistentVolumeClaim:
            claimName: {{ $redisName }}-data
        {{- include "cloudhost-app.logShipperVolumes" (dict "root" . "workloadName" $redisName) | nindent 8 }}
---
apiVersion: v1
kind: Service
metadata:
  name: {{ $redisName }}
  namespace: {{ $ns }}
  labels:
    app: {{ $redisName }}
    {{- include "cloudhost-app.labels" . | nindent 4 }}
spec:
  type: ClusterIP
  selector:
    app: {{ $redisName }}
  ports:
    - port: 6379
      targetPort: 6379
      protocol: TCP
{{- end }}