Add support for Redis TLS

kpn · Aug 26, 2024 · 77de6b9 · 77de6b9
1 parent b9773cc
commit 77de6b9
Show file tree

Hide file tree

Showing 5 changed files with 22 additions and 7 deletions.
diff --git a/LICENCE b/LICENCE
@@ -18,4 +18,4 @@ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+SOFTWARE.
diff --git a/charts/sentry/templates/_helper-sentry-relay.tpl b/charts/sentry/templates/_helper-sentry-relay.tpl
@@ -2,6 +2,7 @@
 {{- $redisHost := include "sentry.redis.host" . -}}
 {{- $redisPort := include "sentry.redis.port" . -}}
 {{- $redisPass := include "sentry.redis.password" . -}}
+{{- $redisScheme := include "sentry.redis.scheme" . -}}
 config.yml: |-
   relay:
     {{- if .Values.relay.mode }}
@@ -28,9 +29,9 @@ config.yml: |-
         value: 50000000  # 50MB or bust
 
     {{- if $redisPass }}
-    redis: "redis://:{{ $redisPass }}@{{ $redisHost }}:{{ $redisPort }}"
+    redis: "{{ $redisScheme }}://:{{ $redisPass }}@{{ $redisHost }}:{{ $redisPort }}"
     {{- else }}
-    redis: "redis://{{ $redisHost }}:{{ $redisPort }}"
+    redis: "{{ $redisScheme }}://{{ $redisHost }}:{{ $redisPort }}"
     {{- end }}
     topics:
       metrics_sessions: ingest-metrics

diff --git a/charts/sentry/templates/_helper-sentry.tpl b/charts/sentry/templates/_helper-sentry.tpl
@@ -2,6 +2,7 @@
 {{- $redisHost := include "sentry.redis.host" . -}}
 {{- $redisPort := include "sentry.redis.port" . -}}
 {{- $redisPass := include "sentry.redis.password" . -}}
+{{- $redisScheme := include "sentry.redis.scheme" . -}}
 config.yml: |-
   {{- if .Values.system.adminEmail }}
   system.admin-email: {{ .Values.system.adminEmail | quote }}
@@ -182,9 +183,9 @@ sentry.conf.py: |-
   {{- if or (.Values.rabbitmq.enabled) (.Values.rabbitmq.host) }}
   BROKER_URL = os.environ.get("BROKER_URL", "amqp://{{ .Values.rabbitmq.auth.username }}:{{ .Values.rabbitmq.auth.password }}@{{ template "sentry.rabbitmq.host" . }}:5672/{{ .Values.rabbitmq.vhost }}")
   {{- else if $redisPass }}
-  BROKER_URL = os.environ.get("BROKER_URL", "redis://:{{ $redisPass }}@{{ $redisHost }}:{{ $redisPort }}/0")
+  BROKER_URL = os.environ.get("BROKER_URL", "{{ $redisScheme }}://:{{ $redisPass }}@{{ $redisHost }}:{{ $redisPort }}/0")
   {{- else }}
-  BROKER_URL = os.environ.get("BROKER_URL", "redis://{{ $redisHost }}:{{ $redisPort }}/0")
+  BROKER_URL = os.environ.get("BROKER_URL", "{{ $redisScheme }}://{{ $redisHost }}:{{ $redisPort }}/0")
   {{- end }}
 
   #########

diff --git a/charts/sentry/templates/_helper.tpl b/charts/sentry/templates/_helper.tpl
@@ -260,6 +260,17 @@ Set redis host
 {{- end -}}
 {{- end -}}
 
+{{/*
+Set redis host
+*/}}
+{{- define "sentry.redis.scheme" -}}
+{{- if .Values.redis.enabled -}}
+{{- default "redis" .Values.redis.scheme }}
+{{- else -}}
+{{ required "A valid .Values.externalRedis.scheme is required" .Values.externalRedis.scheme }}
+{{- end -}}
+{{- end -}}
+
 {{/*
 Set redis secret
 */}}
@@ -454,6 +465,8 @@ Common Snuba environment variables
   value: /etc/snuba/settings.py
 - name: DEFAULT_BROKERS
   value: {{ include "sentry.kafka.bootstrap_servers_string" . | quote }}
+- name: REDIS_SSL
+  value: "True"
 {{- if .Values.externalClickhouse.existingSecret }}
 - name: CLICKHOUSE_PASSWORD
   valueFrom:
@@ -620,7 +633,7 @@ Common Sentry environment variables
   valueFrom:
     secretKeyRef:
       name: {{ .Values.discord.existingSecret }}
-      key: {{ default "bot-token" .Values.slack.existingSecretBotToken }}      
+      key: {{ default "bot-token" .Values.slack.existingSecretBotToken }}
 {{- end }}
 {{- if and .Values.github.existingSecret }}
 - name: GITHUB_APP_PRIVATE_KEY

diff --git a/charts/sentry/templates/deployment-sentry-web.yaml b/charts/sentry/templates/deployment-sentry-web.yaml
@@ -11,7 +11,7 @@ metadata:
 spec:
   revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
   strategy:
-    type: {{ .Values.sentry.web.strategyType }}
+    type: Recreate
   selector:
     matchLabels:
         app: {{ template "sentry.fullname" . }}