Redis

Single-instance Redis per environment, deployed from the Bitnami Helm chart through Argo CD's multi-source pattern. Used by the Tomoda backend for sessions, rate limits, and short-lived caches — not as a persistence-of-record store.

Argo CD Application

k8s/envs/<env>/redis/application.yaml declares two sources:

• Chart — registry-1.docker.io/bitnamicharts/redis at chart version 24.1.2.
• Values — the same devops Git repo, referenced as $values, pointing at k8s/envs/<env>/redis/values.yaml.

The split lets the chart upgrade independently of the values file. Both envs sync into the data namespace.

Values (both envs)

image:
  registry: docker.io
  repository: bitnami/redis
  tag: latest
  digest: "sha256:a7eb13…"   # redis 8.10.0

architecture: standalone
replicaCount: 1
auth:
  enabled: true
  sentinel: false
  existingSecret: redis-<env>-password-secret
  existingSecretPasswordKey: redis-password

The image tracks the maintained bitnami/redis (not the frozen bitnamilegacy/* namespace, which stopped receiving CVE patches in Aug 2025) and pins the digest for reproducibility. Re-pin the digest from bitnami/redis:latest when refreshing to pick up newer CVE fixes. standalone is a single Redis pod, no failover (lean): the data is recoverable (no source-of-truth state) and the restart blast radius is small.

Node placement

Both envs pin to the on-demand pool=data: nodeSelector: {pool: data} plus a toleration for the workload=stateful:NoSchedule taint (k8s/envs/{dev,prod}/redis/values.yaml). Sharing the tainted data pool with CNPG keeps Redis off spot and off burst nodes. See GKE node pools.

HA switch (resilient flavour)

Lean is architecture: standalone, one pod. The resilient upgrade switches to Sentinel: architecture: replication + sentinel.enabled: true, giving 1 master + 2 replicas + 3 sentinels for automatic failover. Applications keep connecting through the Sentinel-aware Service; the DSN changes but the REDIS_* env contract does not. Turn this on together with the Postgres HA switch when the data pool is scaled up.

Auth

auth.enabled: true in both envs; Redis requires a password on every connection. The chart reads it from an existing Secret: auth.existingSecret: redis-<env>-password-secret, auth.existingSecretPasswordKey: redis-password (k8s/envs/{dev,prod}/redis/values.yaml).

That Secret is projected by an ExternalSecret (k8s/envs/{dev,prod}/redis/external-secret.yaml) from the per-env GCP Secret Manager key tomoda-redis-password-<env> into redis-password. The backend reads the same value as REDIS_PASSWORD, so pod and clients stay in sync.

Network reach is constrained independently: the Redis Service is reachable only inside the data namespace, gated by consumer-side NetworkPolicies and the absence of any Ingress or LoadBalancer.

Persistence

Env	PVC size	Notes
dev	5Gi	RDB/AOF snapshots survive pod restart
prod	10Gi	Larger room for prod working set

Both use the cluster default StorageClass.

Resources

Env	Requests	Limits
dev	50m CPU, 64Mi memory	100m CPU, 128Mi memory
prod	10m CPU, 128Mi memory	1 CPU, 1024Mi memory

Metrics

Dev's values.yaml sets metrics.enabled: true, running the Bitnami Redis exporter sidecar and registering a ServiceMonitor in monitoring under release: monitoring — kube-prometheus-stack picks it up automatically.

Prod's values.yaml does not set the metrics block, so prod Redis has no Prometheus scrape. Deliberate gap: if Redis becomes an alert source or SLO target, mirror the dev metrics block into prod.

DSNs (application-facing)

The Bitnami chart names its Service <release>-master. Applications connect to:

Env	Hostname	Port
dev	redis-dev-master.data.svc.cluster.local	6379
prod	redis-prod-master.data.svc.cluster.local	6379

These hostnames are written into the Tomoda backend-config-<env> ConfigMap. The prod release is redis-prod (application.yaml metadata), so redis-prod-master is the rendered Service name.

Operations

• Bounce — kubectl -n data rollout restart statefulset/<release>-master. With architecture: standalone there is no quorum to worry about; persistence survives the restart.
• Console — use Redis Insight for a GUI, or kubectl -n data exec -it <release>-master-0 -- redis-cli for ad-hoc commands.
• Storage expansion — bump master.persistence.size in values.yaml; commit and let Argo CD apply. PVC expansion on standard-rwo is online.
• Chart upgrade — change targetRevision on the chart source. Review the Bitnami release notes — values keys do drift between major chart versions.