dandydeveloper-redis-ha

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

## Globally shared configuration

global:

# -- Default priority class for all components

priorityClassName: ""

# -- Openshift compatibility options

compatibility:

openshift:

adaptSecurityContext: auto

## -- Image information for Redis HA

## ref: http://kubernetes.io/docs/user-guide/compute-resources/

image:

# -- Redis image repository

repository: cgr.dev/chainguard-private/redis

# -- Redis image tag

tag: latest@sha256:918d7c855dd24cefdac9f7552b8855a7a33f269ab19143e81e6bd5948632cc96

# -- Redis image pull policy

pullPolicy: IfNotPresent

# -- Full name of the Redis HA Resources

fullnameOverride: ""

# -- Name override for Redis HA resources

nameOverride: ""

## Reference to one or more secrets to be used when pulling images

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

## This imagePullSecrets is only for redis images

# -- Reference to one or more secrets to be used when pulling redis images

imagePullSecrets: []

# - name: "image-pull-secret"

# -- Number of redis master/slave

replicas: 3

## Customize the statefulset pod management policy:

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies

# -- The statefulset pod management policy

podManagementPolicy: OrderedReady

## read-only replicas

## indexed slaves get never promoted to be master

## index starts with 0 - which is master on init

## i.e. "8,9" means 8th and 9th slave will be replica with replica-priority=0

## see also: https://redis.io/topics/sentinel

# -- Comma separated list of slaves which never get promoted to be master.

# Count starts with 0. Allowed values 1-9. i.e. 3,4 - 3th and 4th redis slave never make it to be master, where master is index 0.

ro_replicas: ""

# -- Kubernetes priorityClass name for the redis-ha-server pod

priorityClassName: ""

# -- Custom labels for the redis pod

labels: {}

# -- Custom labels for redis service

serviceLabels: {}

## Custom labels for the redis configmap

configmap:

# -- Custom labels for the redis configmap

labels: {}

## ConfigMap Test Parameters

configmapTest:

# -- Image for redis-ha-configmap-test hook

image:

# -- Repository of the configmap shellcheck test image.

repository: cgr.dev/chainguard-private/busybox

# -- Tag of the configmap shellcheck test image.

tag: latest@sha256:a4df82542624593a943071c90310653381295bb95494ff58a4650101aefeafaf

# -- Resources for the ConfigMap test pod

resources: {}

## Pods Service Account

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

serviceAccount:

# -- Specifies whether a ServiceAccount should be created

create: true

# -- The name of the ServiceAccount to use.

# If not set and create is true, a name is generated using the redis-ha.fullname template

name: ""

# -- opt in/out of automounting API credentials into container.

# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

automountToken: false

# -- Annotations to be added to the service account for the redis statefulset

annotations: {}

## Enables a HA Proxy for better LoadBalancing / Sentinel Master support. Automatically proxies to Redis master.

## Recommend for externally exposed Redis clusters.

## ref: https://cbonte.github.io/haproxy-dconv/1.9/intro.html

haproxy:

# -- Enabled HAProxy LoadBalancing/Proxy

enabled: false

# -- Modify HAProxy service port

servicePort: 6379

# -- Modify HAProxy deployment container port

containerPort: 6379

# -- Enable TLS termination on HAproxy, This will create a volume mount

tls:

# -- If "true" this will enable TLS termination on haproxy

enabled: false

# -- Secret containing the .pem file

# Supports templates like "{{ .Release.Name }}-haproxy-tls"

secretName: ""

# -- Key file name

keyName:

# -- Path to mount the secret that contains the certificates. haproxy

certMountPath: /tmp/

# -- Enable read-only redis-slaves

100

readOnly:

101

# -- Enable if you want a dedicated port in haproxy for redis-slaves

102

enabled: false

103

# -- Port for the read-only redis-slaves

104

port: 6380

105

# -- Additional ports to expose on HAProxy service and deployment

106

# Each port should have a name, containerPort, and optionally servicePort (defaults to containerPort)

107

additionalPorts: []

108

# Example:

109

# additionalPorts:

110

# - name: custom-port

111

# containerPort: 8080

112

# servicePort: 8080

113

# - name: another-port

114

# containerPort: 9090

115

# -- Number of HAProxy instances

116

replicas: 3

117

# -- Deployment strategy for the haproxy deployment

118

deploymentStrategy:

119

type: RollingUpdate

120

# rollingUpdate:

121

# maxSurge: 25%

122

# maxUnavailable: 25%

123

image:

124

# -- HAProxy Image Repository

125

repository: cgr.dev/chainguard-private/haproxy

126

# -- HAProxy Image Tag

127

tag: latest@sha256:10dbf137b6e6c493902dfaa60d873bd30342e1f4285c427aa7cf0933627d8426

128

# -- HAProxy Image PullPolicy

129

pullPolicy: IfNotPresent

130

# -- Custom labels for the haproxy pod

131

labels: {}

132

# -- Reference to one or more secrets to be used when pulling images

133

# ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

134

imagePullSecrets: []

135

# - name: "image-pull-secret"

136

137

# -- HAProxy template annotations

138

annotations: {}

139

# -- HAProxy deployment annotations

140

deploymentAnnotations: {}

141

# -- Annotations to be added to the HAProxy deployment pods

142

podAnnotations: {}

143

# -- HAProxy resources

144

resources: {}

145

# -- Configuration of `emptyDir`

146

emptyDir: {}

147

# -- Pod Disruption Budget

148

# ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

149

podDisruptionBudget: {}

150

# Use only one of the two

151

# maxUnavailable: 1

152

# minAvailable: 1

153

154

## Enable sticky sessions to Redis nodes via HAProxy

155

## Very useful for long-living connections as in case of Sentry for example

156

# -- HAProxy sticky load balancing to Redis nodes. Helps with connections shutdown.

157

stickyBalancing: false

158

# -- Kubernetes priorityClass name for the haproxy pod

159

priorityClassName: ""

160

## Service for HAProxy

161

service:

162

# -- HAProxy service type "ClusterIP", "LoadBalancer" or "NodePort"

163

type: ClusterIP

164

# -- (int) HAProxy service nodePort value (haproxy.service.type must be NodePort)

165

nodePort: ~

166

# -- HAProxy service loadbalancer IP

167

loadBalancerIP:

168

# -- (string) HAProxy service externalTrafficPolicy value (haproxy.service.type must be LoadBalancer)

169

externalTrafficPolicy: ~

170

# -- HAProxy external IPs

171

externalIPs: {}

172

# -- HAProxy service labels

173

labels: {}

174

# -- HAProxy service annotations

175

annotations: null

176

# -- List of CIDR's allowed to connect to LoadBalancer

177

loadBalancerSourceRanges: []

178

# -- HAProxy serviceAccountName

179

serviceAccountName: redis-sa

180

serviceAccount:

181

# -- Specifies whether a ServiceAccount should be created

182

create: true

183

automountToken: true

184

## Official HAProxy embedded prometheus metrics settings.

185

## Ref: https://github.com/haproxy/haproxy/tree/master/contrib/prometheus-exporter

186

187

metrics:

188

# -- HAProxy enable prometheus metric scraping

189

enabled: false

190

# -- HAProxy prometheus metrics scraping port

191

port: 9101

192

# -- HAProxy metrics scraping port name

193

portName: http-exporter-port

194

# -- HAProxy prometheus metrics scraping path

195

scrapePath: /metrics

196

serviceMonitor:

197

# -- When set true then use a ServiceMonitor to configure scraping

198

enabled: false

199

# -- Set the namespace the ServiceMonitor should be deployed

200

# @default -- `.Release.Namespace`

201

namespace: ""

202

# -- Set how frequently Prometheus should scrape (default is 30s)

203

interval: ""

204

# -- Set path to redis-exporter telemtery-path (default is /metrics)

205

telemetryPath: ""

206

# -- Set labels for the ServiceMonitor, use this to define your scrape label for Prometheus Operator

207

labels: {}

208

# -- Set timeout for scrape (default is 10s)

209

timeout: ""

210

# -- Set additional properties for the ServiceMonitor endpoints such as relabeling, scrapeTimeout, tlsConfig, and more.

211

endpointAdditionalProperties: {}

212

# -- Disable API Check on ServiceMonitor

213

disableAPICheck: false

214

init:

215

# -- Extra init resources

216

resources: {}

217

timeout:

218

# -- haproxy.cfg `timeout connect` setting

219

connect: 4s

220

# -- haproxy.cfg `timeout server` setting

221

server: 330s

222

# -- haproxy.cfg `timeout client` setting

223

client: 330s

224

# -- haproxy.cfg `timeout check` setting

225

check: 2s

226

# -- haproxy.cfg `timeout tunnel` setting

227

tunnel: 1h

228

# -- haproxy.cfg `check inter` setting

229

checkInterval: 1s

230

# -- haproxy.cfg `check fall` setting

231

checkFall: 1

232

# -- Security context to be added to the HAProxy deployment.

233

securityContext:

234

runAsUser: 99

235

fsGroup: 99

236

runAsNonRoot: true

237

# -- Security context to be added to the HAProxy containers.

238

containerSecurityContext:

239

runAsNonRoot: true

240

allowPrivilegeEscalation: false

241

seccompProfile:

242

type: RuntimeDefault

243

capabilities:

244

drop:

245

- ALL

246

# -- Whether the haproxy pods should be forced to run on separate nodes.

247

hardAntiAffinity: true

248

# -- Additional affinities to add to the haproxy pods.

249

additionalAffinities: {}

250

# -- Override all other affinity settings for the haproxy pods with a string.

251

affinity: ""

252

## Custom config-haproxy.cfg files used to override default settings. If this file is

253

## specified then the config-haproxy.cfg above will be ignored.

254

# -- (string) Allows for custom config-haproxy.cfg file to be applied. If this is used then default config will be overwriten

255

customConfig: ~

256

# customConfig: |-

257

# Define configuration here

258

259

## Place any additional configuration section to add to the default config-haproxy.cfg

260

# -- (string) Allows to place any additional configuration section to add to the default config-haproxy.cfg

261

extraConfig: ~

262

# extraConfig: |-

263

# Define configuration here

264

265

# -- Container lifecycle hooks.

266

# Ref: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/

267

lifecycle: {}

268

## HAProxy test related options

269

tests:

270

# -- Pod resources for the tests against HAProxy.

271

resources: {}

272

## Enable HAProxy parameters to bind and consume IPv6 addresses. Enabled by default.

273

IPv6:

274

# -- Enable HAProxy parameters to bind and consume IPv6 addresses. Enabled by default.

275

enabled: true

276

networkPolicy:

277

# -- whether NetworkPolicy for Haproxy should be created

278

enabled: false

279

# -- Annotations for Haproxy NetworkPolicy

280

annotations: {}

281

# -- Labels for Haproxy NetworkPolicy

282

labels: {}

283

# -- user defined ingress rules that Haproxy should permit into.

284

# uses the format defined in https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors

285

ingressRules: []

286

# - selectors:

287

# - namespaceSelector:

288

# matchLabels:

289

# name: my-redis-client-namespace

290

# podSelector:

291

# matchLabels:

292

# application: redis-client

293

## if ports is not defined then it defaults to the ports defined for enabled services (redis, sentinel)

294

# ports:

295

# - port: 6379

296

# protocol: TCP

297

# - port: 26379

298

# protocol: TCP

299

300

# -- user can define egress rules too, uses the same structure as ingressRules

301

egressRules: []

302

## Role Based Access

303

## Ref: https://kubernetes.io/docs/admin/authorization/rbac/

304

305

rbac:

306

# -- Create and use RBAC resources

307

create: true

308

# NOT RECOMMENDED: Additional container in which you can execute arbitrary commands to update sysctl parameters

309

# You can now use securityContext.sysctls to leverage this capability

310

# Ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/

311

312

sysctlImage:

313

# -- Enable an init container to modify Kernel settings

314

enabled: false

315

# -- sysctlImage command to execute

316

command: []

317

# -- sysctlImage Init container registry

318

registry: cgr.dev

319

# -- sysctlImage Init container name

320

repository: chainguard-private/busybox

321

# -- sysctlImage Init container tag

322

tag: latest@sha256:a4df82542624593a943071c90310653381295bb95494ff58a4650101aefeafaf

323

# -- sysctlImage Init container pull policy

324

pullPolicy: Always

325

# -- Mount the host `/sys` folder to `/host-sys`

326

mountHostSys: false

327

# -- sysctlImage resources

328

resources: {}

329

# -- Use an alternate scheduler, e.g. "stork".

330

# ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

331

schedulerName: ""

332

## Redis specific configuration options

333

redis:

334

# -- Port to access the redis service

335

port: 6379

336

# -- Redis convention for naming the cluster group: must match `^[\\w-\\.]+$` and can be templated

337

masterGroupName: "mymaster" # must match ^[\\w-\\.]+$) and can be templated

338

# -- Allows overriding the redis container command

339

customCommand: []

340

# - bash

341

342

# -- Allows overriding the redis container arguments

343

customArgs: []

344

# - "custom-startup.sh"

345

346

# -- Load environment variables from ConfigMap/Secret

347

envFrom: []

348

# - secretRef:

349

# name: add-env-secret

350

351

# -- Configure the 'minReadySeconds' parameter to StatefulSet

352

# ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#minreadyseconds

353

minReadySeconds: 0

354

## Configures redis with tls-port parameter

355

# -- (int) TLS Port to access the redis service

356

tlsPort: ~

357

# tlsPort: 6385

358

359

# -- (bool) Configures redis with tls-replication parameter, if true sets "tls-replication yes" in redis.conf

360

tlsReplication: ~

361

# -- It is possible to disable client side certificates authentication when "authClients" is set to "no"

362

authClients: ""

363

# authClients: "no"

364

365

# -- Increase terminationGracePeriodSeconds to allow writing large RDB snapshots. (k8s default is 30s)

366

# ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination-forced

367

terminationGracePeriodSeconds: 60

368

# -- Liveness probe parameters for redis container

369

livenessProbe:

370

# -- Enable the Liveness Probe

371

enabled: true

372

# -- Initial delay in seconds for liveness probe

373

initialDelaySeconds: 30

374

# -- Period in seconds after which liveness probe will be repeated

375

periodSeconds: 15

376

# -- Timeout seconds for liveness probe

377

timeoutSeconds: 15

378

# -- Success threshold for liveness probe

379

successThreshold: 1

380

# -- Failure threshold for liveness probe

381

failureThreshold: 5

382

# -- Readiness probe parameters for redis container

383

readinessProbe:

384

# -- Enable the Readiness Probe

385

enabled: true

386

# -- Initial delay in seconds for readiness probe

387

initialDelaySeconds: 30

388

# -- Period in seconds after which readiness probe will be repeated

389

periodSeconds: 15

390

# -- Timeout seconds for readiness probe

391

timeoutSeconds: 15

392

# -- Success threshold for readiness probe

393

successThreshold: 1

394

# -- Failure threshold for readiness probe

395

failureThreshold: 5

396

# -- Startup probe parameters for redis container

397

startupProbe:

398

# -- Enable Startup Probe

399

enabled: true

400

# -- Initial delay in seconds for startup probe

401

initialDelaySeconds: 30

402

# -- Period in seconds after which startup probe will be repeated

403

periodSeconds: 15

404

# -- Timeout seconds for startup probe

405

timeoutSeconds: 15

406

# -- Success threshold for startup probe

407

successThreshold: 1

408

# -- Failure threshold for startup probe

409

failureThreshold: 5

410

# -- Array with commands to disable

411

disableCommands:

412

- FLUSHDB

413

- FLUSHALL

414

# -- Any valid redis config options in this section will be applied to each server, For multi-value configs use list instead of string (for example loadmodule) (see below)

415

# @default -- see values.yaml

416

config:

417

## -- Additional redis conf options can be added below

418

## -- For all available options see http://download.redis.io/redis-stable/redis.conf

419

min-replicas-to-write: 1

420

# -- Value in seconds

421

min-replicas-max-lag: 5

422

# -- Max memory to use for each redis instance. Default is unlimited.

423

maxmemory: "0"

424

# -- Max memory policy to use for each redis instance. Default is volatile-lru.

425

maxmemory-policy: "volatile-lru"

426

# -- Determines if scheduled RDB backups are created. Default is false.

427

# -- Please note that local (on-disk) RDBs will still be created when re-syncing with a new slave. The only way to prevent this is to enable diskless replication.

428

save: "900 1"

429

# -- When enabled, directly sends the RDB over the wire to slaves, without using the disk as intermediate storage. Default is false.

430

repl-diskless-sync: "yes"

431

rdbcompression: "yes"

432

rdbchecksum: "yes"

433

# -- (string) Allows for custom redis.conf files to be applied. If this is used then `redis.config` is ignored

434

customConfig: ~

435

# customConfig: |-

436

# Define configuration here

437

438

# -- CPU/Memory for master/slave nodes resource requests/limits

439

resources: {}

440

# requests:

441

# memory: 200Mi

442

# cpu: 100m

443

# limits:

444

# memory: 700Mi

445

446

# -- Container Lifecycle Hooks for redis container

447

# Ref: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/

448

# @default -- see values.yaml

449

lifecycle:

450

preStop:

451

exec:

452

command: ["/bin/sh", "/readonly-config/trigger-failover-if-master.sh"]

453

# -- Annotations for the redis statefulset

454

annotations: {}

455

# -- Annotations to be added to the redis statefulset pods

456

podAnnotations: {}

457

# -- Update strategy for Redis StatefulSet

458

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

459

updateStrategy:

460

type: RollingUpdate

461

# -- additional volumeMounts for Redis container

462

extraVolumeMounts: []

463

# - name: empty

464

# mountPath: /empty

465

## Sentinel specific configuration options

466

sentinel:

467

# -- Port to access the sentinel service

468

port: 26379

469

## Configure the 'bind' directive to bind to a list of network interfaces

470

bind: ~

471

# bind: 0.0.0.0

472

473

## Configures sentinel with tls-port parameter

474

# -- (int) TLS Port to access the sentinel service

475

tlsPort: ~

476

# tlsPort: 26385

477

478

# -- (bool) Configures sentinel with tls-replication parameter, if true sets "tls-replication yes" in sentinel.conf

479

tlsReplication: ~

480

# tlsReplication: true

481

482

# -- It is possible to disable client side certificates authentication when "authClients" is set to "no"

483

authClients: ""

484

# authClients: "no"

485

486

## Configures sentinel with AUTH (requirepass params)

487

# -- Enables or disables sentinel AUTH (Requires `sentinel.password` to be set)

488

auth: false

489

# -- (string) A password that configures a `requirepass` in the conf parameters (Requires `sentinel.auth: enabled`)

490

password: ~

491

# password: password

492

493

# -- (bool) Configures sentinel with resolve-hostnames parameter, if true sets "resolve-hostnames yes" in sentinel.conf

494

resolveHostnames: ~

495

# resolveHostnames: true

496

497

# -- (bool) Configures sentinel with announce-hostnames parameter, if true sets "announce-hostnames yes" in sentinel.conf

498

announceHostnames: ~

499

# announceHostnames: true

500

501

# -- An existing secret containing a key defined by `sentinel.authKey` that configures `requirepass`

502

# in the conf parameters (Requires `sentinel.auth: enabled`, cannot be used in conjunction with `.Values.sentinel.password`)

503

# Supports templates like "{{ .Release.Name }}-sentinel-creds"

504

existingSecret: ""

505

## Defines the key holding the sentinel password in existing secret.

506

# -- The key holding the sentinel password in an existing secret.

507

authKey: sentinel-password

508

customCommand: []

509

customArgs: []

510

# liveness probe parameters for sentinel container

511

livenessProbe:

512

enabled: true

513

# -- Initial delay in seconds for liveness probe

514

initialDelaySeconds: 30

515

# -- Period in seconds after which liveness probe will be repeated

516

periodSeconds: 15

517

# -- Timeout seconds for liveness probe

518

timeoutSeconds: 15

519

# -- Success threshold for liveness probe

520

successThreshold: 1

521

# -- Failure threshold for liveness probe

522

failureThreshold: 5

523

# readiness probe parameters for sentinel container

524

readinessProbe:

525

enabled: true

526

# -- Initial delay in seconds for readiness probe

527

initialDelaySeconds: 30

528

# -- Period in seconds after which readiness probe will be repeated

529

periodSeconds: 15

530

# -- Timeout seconds for readiness probe

531

timeoutSeconds: 15

532

# -- Success threshold for readiness probe

533

successThreshold: 3

534

# -- Failure threshold for readiness probe

535

failureThreshold: 5

536

# -- Startup probe parameters for redis container

537

startupProbe:

538

# -- Enable Startup Probe

539

enabled: true

540

# -- Initial delay in seconds for startup probe

541

initialDelaySeconds: 5

542

# -- Period in seconds after which startup probe will be repeated

543

periodSeconds: 10

544

# -- Timeout seconds for startup probe

545

timeoutSeconds: 15

546

# -- Success threshold for startup probe

547

successThreshold: 1

548

# -- Failure threshold for startup probe

549

failureThreshold: 3

550

# -- Minimum number of nodes expected to be live.

551

quorum: 2

552

# -- Valid sentinel config options in this section will be applied as config options to each sentinel (see below)

553

# @default -- see values.yaml

554

config:

555

## Additional sentinel conf options can be added below. Only options that

556

## are expressed in the format simialar to 'sentinel xxx mymaster xxx' will

557

## be properly templated expect maxclients option.

558

## For available options see http://download.redis.io/redis-stable/sentinel.conf

559

down-after-milliseconds: 10000

560

## Failover timeout value in milliseconds

561

failover-timeout: 180000

562

parallel-syncs: 5

563

maxclients: 10000

564

## Custom sentinel.conf files used to override default settings. If this file is

565

## specified then the sentinel.config above will be ignored.

566

# -- Allows for custom sentinel.conf files to be applied. If this is used then `sentinel.config` is ignored

567

customConfig: ""

568

# customConfig: |-

569

# Define configuration here

570

571

# -- CPU/Memory for sentinel node resource requests/limits

572

resources: {}

573

# requests:

574

# memory: 200Mi

575

# cpu: 100m

576

# limits:

577

# memory: 200Mi

578

579

# -- Container Lifecycle Hooks for sentinel container.

580

# Ref: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/

581

lifecycle: {}

582

# -- additional volumeMounts for Sentinel container

583

extraVolumeMounts: []

584

# - name: empty

585

# mountPath: /empty

586

# -- Security context to be added to the Redis StatefulSet.

587

securityContext:

588

runAsUser: 1000

589

fsGroup: 1000

590

runAsNonRoot: true

591

## Assuming your kubelet allows it, you can the following instructions to configure

592

## specific sysctl parameters

593

594

# sysctls:

595

# - name: net.core.somaxconn

596

# value: '10000'

597

# -- Security context to be added to the Redis containers.

598

containerSecurityContext:

599

runAsUser: 1000

600

runAsNonRoot: true

601

allowPrivilegeEscalation: false

602

seccompProfile:

603

type: RuntimeDefault

604

capabilities:

605

drop:

606

- ALL

607

## Node labels, affinity, and tolerations for pod assignment

608

## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

609

## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature

610

## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

611

# -- Node labels for pod assignment

612

nodeSelector: {}

613

## -- Tolerations for pod assignment

614

## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

615

tolerations: []

616

# -- Whether the Redis server pods should be forced to run on separate nodes.

617

## This is accomplished by setting their AntiAffinity with requiredDuringSchedulingIgnoredDuringExecution as opposed to preferred.

618

## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#inter-pod-affinity-and-anti-affinity-beta-feature

619

hardAntiAffinity: true

620

# -- Additional affinities to add to the Redis server pods.

621

## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

622

additionalAffinities: {}

623

624

## Example:

625

## nodeAffinity:

626

## preferredDuringSchedulingIgnoredDuringExecution:

627

## - weight: 50

628

## preference:

629

## matchExpressions:

630

## - key: spot

631

## operator: NotIn

632

## values:

633

## - "true"

634

635

636

# -- Override all other affinity settings for the Redis server pods with a string.

637

affinity: ""

638

639

## Example:

640

## affinity: |

641

## podAntiAffinity:

642

## requiredDuringSchedulingIgnoredDuringExecution:

643

## - labelSelector:

644

## matchLabels:

645

## app: {{ template "redis-ha.name" . }}

646

## release: {{ .Release.Name }}

647

## topologyKey: kubernetes.io/hostname

648

## preferredDuringSchedulingIgnoredDuringExecution:

649

## - weight: 100

650

## podAffinityTerm:

651

## labelSelector:

652

## matchLabels:

653

## app: {{ template "redis-ha.name" . }}

654

## release: {{ .Release.Name }}

655

## topologyKey: failure-domain.beta.kubernetes.io/zone

656

657

658

## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

659

topologySpreadConstraints:

660

# -- Enable topology spread constraints

661

enabled: false

662

# -- Max skew of pods tolerated

663

maxSkew: ""

664

# -- Topology key for spread constraints

665

topologyKey: ""

666

# -- Enforcement policy, hard or soft

667

whenUnsatisfiable: ""

668

# Prometheus exporter specific configuration options

669

exporter:

670

# -- If `true`, the prometheus exporter sidecar is enabled

671

enabled: false

672

# -- Exporter image

673

image: cgr.dev/chainguard-private/prometheus-redis-exporter

674

# -- Exporter image tag

675

tag: latest@sha256:a728f1ed4fb5a901ea79dbc564f0e7e71c00bc80d9f3f5e0b170852b83ce49c0

676

# -- Exporter image pullPolicy

677

pullPolicy: IfNotPresent

678

# -- Exporter port

679

port: &exporter_port 9121

680

# -- Exporter port name

681

portName: exporter-port

682

# -- Exporter scrape path

683

scrapePath: &exporter_scrapePath /metrics

684

# -- Address/Host for Redis instance.

685

# Exists to circumvent issues with IPv6 dns resolution that occurs on certain environments

686

address: localhost

687

## Set this to true if you want to connect to redis tls port

688

# sslEnabled: true

689

690

# -- cpu/memory resource limits/requests

691

resources: {}

692

# -- Additional args for redis exporter

693

extraArgs: {}

694

# -- A custom custom Lua script that will be mounted to exporter for collection of custom metrics.

695

# Creates a ConfigMap and sets env var `REDIS_EXPORTER_SCRIPT`.

696

script: ""

697

# Used to mount a LUA-Script via config map and use it for metrics-collection

698

# script: |

699

# -- Example script copied from: https://github.com/oliver006/redis_exporter/blob/master/contrib/sample_collect_script.lua

700

# -- Example collect script for -script option

701

# -- This returns a Lua table with alternating keys and values.

702

# -- Both keys and values must be strings, similar to a HGETALL result.

703

# -- More info about Redis Lua scripting: https://redis.io/commands/eval

704

705

# local result = {}

706

707

# -- Add all keys and values from some hash in db 5

708

# redis.call("SELECT", 5)

709

# local r = redis.call("HGETALL", "some-hash-with-stats")

710

# if r ~= nil then

711

# for _,v in ipairs(r) do

712

# table.insert(result, v) -- alternating keys and values

713

# end

714

# end

715

716

# -- Set foo to 42

717

# table.insert(result, "foo")

718

# table.insert(result, "42") -- note the string, use tostring() if needed

719

720

# return result

721

722

serviceMonitor:

723

# -- When set true then use a ServiceMonitor to configure scraping

724

enabled: false

725

# -- Set the namespace the ServiceMonitor should be deployed

726

# @default -- `.Release.Namespace`

727

namespace: ""

728

# -- Set how frequently Prometheus should scrape (default is 30s)

729

interval: ""

730

# -- Set path to redis-exporter telemtery-path (default is /metrics)

731

telemetryPath: ""

732

# -- Set labels for the ServiceMonitor, use this to define your scrape label for Prometheus Operator

733

labels: {}

734

# -- Set timeout for scrape (default is 10s)

735

timeout: ""

736

# -- Set additional properties for the ServiceMonitor endpoints such as relabeling, scrapeTimeout, tlsConfig, and more.

737

endpointAdditionalProperties: {}

738

# -- Disable API Check on ServiceMonitor

739

disableAPICheck: false

740

# RelabelConfigs to apply to samples before scraping.

741

relabelings: []

742

# - sourceLabels: [__meta_kubernetes_pod_node_name]

743

# separator: ;

744

# regex: ^(.*)$

745

# targetLabel: nodename

746

# replacement: $1

747

# action: replace

748

749

# MetricRelabelConfigs to apply to samples after scraping, but before ingestion.

750

metricRelabelings: []

751

# - action: keep

752

753

# sourceLabels: [__name__]

754

# prometheus exporter SCANS redis db which can take some time

755

# allow different probe settings to not let container crashloop

756

livenessProbe:

757

httpGet:

758

# -- Exporter liveness probe httpGet path

759

path: *exporter_scrapePath

760

# -- Exporter liveness probe httpGet port

761

port: *exporter_port

762

# -- Initial delay in seconds for liveness probe of exporter

763

initialDelaySeconds: 15

764

# -- Timeout seconds for liveness probe of exporter

765

timeoutSeconds: 3

766

# -- Period in seconds after which liveness probe will be repeated

767

periodSeconds: 15

768

readinessProbe:

769

httpGet:

770

# -- Exporter readiness probe httpGet path

771

path: *exporter_scrapePath

772

# -- Exporter readiness probe httpGet port

773

port: *exporter_port

774

# -- Initial delay in seconds for readiness probe of exporter

775

initialDelaySeconds: 15

776

# -- Timeout seconds for readiness probe of exporter

777

timeoutSeconds: 3

778

# -- Period in seconds after which readiness probe will be repeated

779

periodSeconds: 15

780

# -- Success threshold for readiness probe of exporter

781

successThreshold: 2

782

# -- Pod Disruption Budget rules

783

podDisruptionBudget: {}

784

# Use only one of the two

785

# maxUnavailable: 1

786

# minAvailable: 1

787

788

# -- Configures redis with AUTH (requirepass & masterauth conf params)

789

auth: false

790

# -- (string) A password that configures a `requirepass` and `masterauth` in the conf parameters (Requires `auth: enabled`)

791

redisPassword: ~

792

# -- Annotations for auth secret

793

authSecretAnnotations: {}

794

## Use existing secret containing key `authKey` (ignores redisPassword)

795

## Can also store AWS S3 or SSH secrets in this secret

796

## Supports templates like "{{ .Release.Name }}-creds"

797

# -- An existing secret containing a key defined by `authKey` that configures `requirepass` and `masterauth` in the conf

798

# parameters (Requires `auth: enabled`, cannot be used in conjunction with `.Values.redisPassword`)

799

existingSecret: ~

800

# -- Defines the key holding the redis password in existing secret.

801

authKey: auth

802

persistentVolume:

803

# -- Enable persistent volume

804

enabled: true

805

## redis-ha data Persistent Volume Storage Class

806

## If defined, storageClassName: <storageClass>

807

## If set to "-", storageClassName: "", which disables dynamic provisioning

808

## If undefined (the default) or set to null, no storageClassName spec is

809

## set, choosing the default provisioner. (gp2 on AWS, standard on

810

## GKE, AWS & OpenStack)

811

812

# storageClass: "-"

813

# -- redis-ha data Persistent Volume Storage Class

814

storageClass: ~

815

# -- Persistent volume access modes

816

accessModes:

817

- ReadWriteOnce

818

# -- Persistent volume size

819

size: 10Gi

820

# -- Annotations for the volume

821

annotations: {}

822

# -- Labels for the volume

823

labels: {}

824

init:

825

# -- Extra init resources

826

resources: {}

827

# To use a hostPath for data, set persistentVolume.enabled to false

828

# and define hostPath.path.

829

# Warning: this might overwrite existing folders on the host system!

830

hostPath:

831

# -- Use this path on the host for data storage.

832

# path is evaluated as template so placeholders are replaced

833

path: ""

834

# path: "/data/{{ .Release.Name }}"

835

836

# -- if chown is true, an init-container with root permissions is launched to

837

# change the owner of the hostPath folder to the user defined in the

838

# security context

839

chown: true

840

# -- Configuration of `emptyDir`, used only if persistentVolume is disabled and no hostPath specified

841

emptyDir: {}

842

tls:

843

## Fill the name of secret if you want to use your own TLS certificates.

844

## The secret should contains keys named by "tls.certFile" - the certificate, "tls.keyFile" - the private key, "tls.caCertFile" - the certificate of CA and "tls.dhParamsFile" - the dh parameter file

845

## Supports templates like "{{ .Release.Name }}-tls"

846

## This secret will be generated using files from certs folder if the secretName is not set and redis.tlsPort is set

847

# secretName: tls-secret

848

849

# -- Name of certificate file

850

certFile: redis.crt

851

# -- Name of key file

852

keyFile: redis.key

853

# -- (string) Name of Diffie-Hellman (DH) key exchange parameters file (Example: redis.dh)

854

dhParamsFile: ~

855

# -- Name of CA certificate file

856

caCertFile: ca.crt

857

# restore init container is executed if restore.[s3|ssh].source is not false

858

# restore init container creates /data/dump.rdb_ from original if exists

859

# restore init container overrides /data/dump.rdb

860

# secrets are stored into environment of init container - stored encoded on k8s

861

# REQUIRED for s3 restore: AWS 'access_key' and 'secret_key' or stored in existingSecret

862

# EXAMPLE source for s3 restore: 's3://bucket/dump.rdb'

863

# REQUIRED for ssh restore: 'key' should be in one line including CR i.e. '-----BEGIN RSA PRIVATE KEY-----\n...\n...\n...\n-----END RSA PRIVATE KEY-----'

864

# EXAMPLE source for ssh restore: 'user@server:/path/dump.rdb'

865

# REQUIRED for redis restore: 'source' should be in form of redis connection uri: 'redis://[username:password@]host:port[/db]'

866

# EXAMPLE source for redis restore: 'redis://username:password@localhost:6379'

867

restore:

868

# -- Timeout for the restore

869

timeout: 600

870

# -- Set existingSecret to true to use secret specified in existingSecret above

871

existingSecret: false

872

s3:

873

# -- Restore init container - AWS S3 location of dump - i.e. s3://bucket/dump.rdb or false

874

source: ""

875

# If using existingSecret, that secret must contain:

876

# AWS_SECRET_ACCESS_KEY: <YOUR_ACCESS_KEY:>

877

# AWS_ACCESS_KEY_ID: <YOUR_KEY_ID>

878

# If not set the key and ID as strings below:

879

# -- Restore init container - AWS AWS_ACCESS_KEY_ID to access restore.s3.source

880

access_key: ""

881

# -- Restore init container - AWS AWS_SECRET_ACCESS_KEY to access restore.s3.source

882

secret_key: ""

883

# -- Restore init container - AWS AWS_REGION to access restore.s3.source

884

region: ""

885

ssh:

886

# -- Restore init container - SSH scp location of dump - i.e. user@server:/path/dump.rdb or false

887

source: ""

888

# -- Restore init container - SSH private key to scp restore.ssh.source to init container.

889

# Key should be in one line separated with \n.

890

# i.e. `-----BEGIN RSA PRIVATE KEY-----\n...\n...\n-----END RSA PRIVATE KEY-----`

891

key: ""

892

redis:

893

source: ""

894

## Custom PrometheusRule to be defined

895

## The value is evaluated as a template, so, for example, the value can depend on .Release or .Chart

896

## ref: https://github.com/coreos/prometheus-operator#customresourcedefinitions

897

prometheusRule:

898

# -- If true, creates a Prometheus Operator PrometheusRule.

899

enabled: false

900

# -- Additional labels to be set in metadata.

901

additionalLabels: {}

902

# -- Namespace which Prometheus is running in.

903

namespace:

904

# -- How often rules in the group are evaluated (falls back to `global.evaluation_interval` if not set).

905

interval: 10s

906

# -- Rules spec template (see https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#rule).

907

rules: []

908

# Example:

909

# - alert: RedisPodDown

910

# expr: |

911

# redis_up{job="{{ include "redis-ha.fullname" . }}"} == 0

912

# for: 5m

913

# labels:

914

# severity: critical

915

# annotations:

916

# description: Redis pod {{ "{{ $labels.pod }}" }} is down

917

# summary: Redis pod {{ "{{ $labels.pod }}" }} is down

918

# -- Extra init containers to include in StatefulSet

919

extraInitContainers: []

920

# - name: extraInit

921

# image: alpine

922

923

# -- Extra containers to include in StatefulSet

924

extraContainers: []

925

# - name: extra

926

# image: alpine

927

928

# -- Extra volumes to include in StatefulSet

929

extraVolumes: []

930

# - name: empty

931

# emptyDir: {}

932

933

# -- Labels added here are applied to all created resources

934

extraLabels: {}

935

networkPolicy:

936

# -- whether NetworkPolicy for Redis StatefulSets should be created.

937

# when enabled, inter-Redis connectivity is created

938

enabled: false

939

# -- Annotations for NetworkPolicy

940

annotations: {}

941

# -- Labels for NetworkPolicy

942

labels: {}

943

# -- User defined ingress rules that Redis should permit into.

944

# Uses the format defined in https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors

945

ingressRules: []

946

# - selectors:

947

# - namespaceSelector:

948

# matchLabels:

949

# name: my-redis-client-namespace

950

# podSelector:

951

# matchLabels:

952

# application: redis-client

953

## if ports is not defined then it defaults to the ports defined for enabled services (redis, sentinel)

954

# ports:

955

# - port: 6379

956

# protocol: TCP

957

# - port: 26379

958

# protocol: TCP

959

960

# -- user can define egress rules too, uses the same structure as ingressRules

961

egressRules:

962

- selectors:

963

# -- Allow all destinations for DNS traffic

964

- namespaceSelector: {}

965

- ipBlock:

966

# Cloud Provider often uses the local link local range to host managed DNS resolvers.

967

# We need to allow this range to ensure that the Redis pods can resolve DNS.

968

# Example architecture for GCP Cloud DNS: https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-dns#architecture

969

cidr: 169.254.0.0/16

970

ports:

971

- port: 53

972

protocol: UDP

973

- port: 53

974

protocol: TCP

975

splitBrainDetection:

976

# -- Interval between redis sentinel and server split brain checks (in seconds)

977

interval: 60

978

retryInterval: 10

979

# -- splitBrainDetection resources

980

resources: {}

981

# liveness probe parameters for split brain container

982

livenessProbe:

983

# -- Initial delay in seconds for liveness probe

984

initialDelaySeconds: 30

985

# -- Period in seconds after which liveness probe will be repeated

986

periodSeconds: 15

987

# -- Timeout seconds for liveness probe

988

timeoutSeconds: 15

989

# -- Success threshold for liveness probe

990

successThreshold: 1

991

# -- Failure threshold for liveness probe

992

failureThreshold: 5

993

exec:

994

command:

995

- cat

996

- /readonly-config/redis.conf

997

# readiness probe parameters for split brain container

998

readinessProbe:

999

# -- Initial delay in seconds for readiness probe

1000

initialDelaySeconds: 30

1001

# -- Period in seconds after which readiness probe will be repeated

1002

periodSeconds: 15

1003

# -- Timeout seconds for readiness probe

1004

timeoutSeconds: 15

1005

# -- Success threshold for readiness probe

1006

successThreshold: 1

1007

# -- Failure threshold for readiness probe

1008

failureThreshold: 5

1009

exec:

1010

command:

1011

- sh

1012

- -c

1013

- test -d /proc/1

1014

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

dandydeveloper-redis-ha

The trusted source for open source

Product

Solutions

Customers

Resources

Company