vrr/cozystack
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(redis): add TLS values and schema

Browse source 
Add tls section to values.yaml and values.schema.json so users can enable
TLS termination on the client-facing port. Defaults preserve current behavior
(disabled), and the schema documents the relationship with cert-manager.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
This commit is contained in:
Arsolitt 2026-04-29 19:35:14 +03:00
parent d482d1e56a
commit 857ebd0420
No known key found for this signature in database
GPG key ID: 4D8302CE6A9247C4
2 changed files with 49 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

36
packages/apps/redis/values.schema.json
View file

@ -91,6 +91,42 @@
"description": "Enable password generation.",
"type": "boolean",
"default": true
},
"tls": {
"description": "TLS configuration for client-facing connections. When enabled, an nginx stream sidecar terminates TLS on port 6380. Intra-cluster traffic on 6379 (operator probes, sentinel, replication) remains plaintext.",
"type": "object",
"properties": {
"enabled": {
"description": "Enable TLS termination via nginx stream sidecar.",
"type": "boolean",
"default": false
},
"secretName": {
"description": "Name of an existing kubernetes.io/tls secret. When non-empty, cert-manager Certificate is NOT rendered and the user manages the secret.",
"type": "string",
"default": ""
},
"issuerRef": {
"description": "cert-manager Issuer reference. Used only when secretName is empty.",
"type": "object",
"properties": {
"name": {
"description": "Issuer/ClusterIssuer resource name.",
"type": "string",
"default": "selfsigned-cluster-issuer"
},
"kind": {
"description": "Either \"Issuer\" or \"ClusterIssuer\".",
"type": "string",
"default": "ClusterIssuer",
"enum": [
"Issuer",
"ClusterIssuer"
]
}
}
}
}
}
}
}

13
packages/apps/redis/values.yaml
View file

@ -46,3 +46,16 @@ version: v8
## @param {bool} authEnabled - Enable password generation.
authEnabled: true
## @param {struct} tls - TLS configuration for client-facing connections. When enabled, an nginx stream sidecar terminates TLS on port 6380. Intra-cluster traffic on 6379 (operator probes, sentinel, replication) remains plaintext.
## @field {bool} enabled - Enable TLS termination via nginx stream sidecar.
## @field {string} secretName - Name of an existing kubernetes.io/tls secret. When non-empty, cert-manager Certificate is NOT rendered and the user manages the secret.
## @field {struct} issuerRef - cert-manager Issuer reference. Used only when secretName is empty.
## @field {string} issuerRef.name - Issuer/ClusterIssuer resource name.
## @field {string} issuerRef.kind - Either "Issuer" or "ClusterIssuer".
tls:
enabled: false
secretName: ""
issuerRef:
name: "selfsigned-cluster-issuer"
kind: "ClusterIssuer"