truebyteinnovationllp/redis-chart repository overview

⁠Redis Helm Chart

Enterprise-grade, highly-available Redis for Kubernetes. One chart, three topologies, production-hardened defaults.

⁠TL;DR

# From the repo root
helm install my-redis ./helm/redis \
  --namespace redis --create-namespace \
  --set architecture=sentinel

Retrieve the auto-generated password:

kubectl get secret -n redis my-redis -o jsonpath='{.data.redis-password}' | base64 -d

Smoke-test the release:

helm test my-redis -n redis

⁠Architectures

⁠standalone

Single Redis node, optionally persistent. For dev/test or non-HA caches.

⁠sentinel (recommended for HA)

sentinel.replicaCount nodes (1 master + replicas). Each pod runs a Redis and a Sentinel container. Sentinels monitor the master and perform automatic failover. On (re)start every node asks the existing Sentinels who the master is and configures itself accordingly, so failover survives pod restarts.

Use a Sentinel-aware client pointed at the Sentinel port:

host: my-redis.redis.svc.cluster.local
sentinel port: 26379
master group: mymaster

⁠cluster (sharding)

A Redis Cluster of cluster.masters shards, each with cluster.replicasPerMaster replicas. A post-install Job (*-cluster-init) forms the cluster and is idempotent on upgrades. Nodes advertise via stable pod hostnames (cluster-preferred-endpoint-type hostname), so the cluster survives pod IP changes. Use a cluster-aware client (-c).

⁠Configuration

Key values (see values.yaml⁠ for the full, documented list):

⁠Examples

Standalone, no persistence, custom memory policy:

helm install cache ./helm/redis \
  --set architecture=standalone \
  --set persistence.enabled=false \
  --set redis.maxmemory=512mb \
  --set redis.maxmemoryPolicy=allkeys-lru

Sentinel HA, 5 nodes, with Prometheus monitoring:

helm install ha ./helm/redis \
  --set architecture=sentinel \
  --set sentinel.replicaCount=5 \
  --set sentinel.quorum=3 \
  --set metrics.serviceMonitor.enabled=true \
  --set metrics.prometheusRule.enabled=true

Cluster with 6 shards and TLS:

kubectl create secret generic redis-tls \
  --from-file=tls.crt --from-file=tls.key --from-file=ca.crt -n redis

helm install shard ./helm/redis -n redis \
  --set architecture=cluster \
  --set cluster.masters=6 \
  --set tls.enabled=true \
  --set tls.existingSecret=redis-tls

⁠Security

• Runs as non-root (uid 100 / gid 101), read-only root filesystem, all Linux capabilities dropped, RuntimeDefault seccomp.
• Authentication on by default; password stored in a Kubernetes Secret and, when auth.usePasswordFiles=true, mounted as a file (never placed on the CLI).
• The generated password is preserved across helm upgrade (looked up from the existing Secret) so upgrades never rotate it unexpectedly.
• Optional TLS for client and replication traffic.
• Optional NetworkPolicy to restrict who may connect.

⁠Observability

The redis_exporter sidecar exposes Prometheus metrics on port 9121 via the *-metrics Service. Enable metrics.serviceMonitor.enabled to register with the Prometheus Operator and metrics.prometheusRule.enabled for the bundled alerts (instance down, OOM, too many connections, replication broken, rejected connections, cluster unhealthy).

⁠Validating changes

This chart is CI-validated with:

helm lint helm/redis
helm template r helm/redis --set architecture=standalone   # + sentinel, cluster
# rendered manifests checked with kubeconform against the target k8s version

⁠Supply-chain security

The chart and images are signed with Cosign⁠ and ship SBOM + provenance attestations. Verify before deploying:

KEY=https://raw.githubusercontent.com/truebyteinnovation/docker-images/main/assets/cosign.pub
cosign verify --key $KEY oci://registry-1.docker.io/truebyteinnovation/redis-chart:0.1.3
cosign verify --key $KEY docker.io/truebyteinnovation/redis:7.4.2-alpine3.21
cosign verify --key $KEY docker.io/truebyteinnovation/redis-exporter:1.86.0

⁠Roadmap

• OpenTelemetry Collector sidecar option
• Backup/restore (RDB snapshots to object storage) as a CronJob
• values.schema.json for richer input validation

⁠License

BSD-3-Clause (matching upstream Redis).