[stable/redis] Fail health probes when authentication fails (#7622)

* Add secret checksum to metrics deployment Signed-off-by: Jacob LeGrone <git@jacob.work> * Fail health probes if auth is invalid Signed-off-by: Jacob LeGrone <git@jacob.work> * Configure master service port number Signed-off-by: Jacob LeGrone <git@jacob.work> * Increment chart version Signed-off-by: Jacob LeGrone <git@jacob.work>
2026-08-23 22:37:45 +00:00 · 2018-09-10 02:34:52 -07:00
parent 84fd9e8d40
commit 342d894906
9 changed files with 81 additions and 14 deletions
@@ -1,5 +1,5 @@
 name: redis
-version: 3.9.0
+version: 3.10.0
 appVersion: 4.0.11
 description: Open source, advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.
 keywords:
@@ -101,6 +101,7 @@ The following table lists the configurable parameters of the Redis chart and the
 | `master.affinity   `                       | Affinity settings for Redis master pod assignment                                                              | []                                                   |
 | `master.schedulerName`                     | Name of an alternate scheduler                                                                                 | `nil`                                                |
 | `master.service.type`                      | Kubernetes Service type (redis master)                                                                         | `ClusterIP`                                          |
+| `master.service.port`                      | Kubernetes Service port (redis master)                                                                         | `6379`                                               |
 | `master.service.nodePort`                  | Kubernetes Service nodePort (redis master)                                                                     | `nil`                                                |
 | `master.service.annotations`               | annotations for redis master service                                                                           | {}                                                   |
 | `master.service.loadBalancerIP`            | loadBalancerIP if redis master service type is `LoadBalancer`                                                  | `nil`                                                |
@@ -77,8 +77,9 @@ readinessProbe:
  failureThreshold: {{ $readinessProbe.failureThreshold | default .Values.master.readinessProbe.failureThreshold }}
  exec:
    command:
-    - redis-cli
-    - ping
+    - sh
+    - -c
+    - /health/ping_local_and_master.sh
 {{- end }}
 {{- end -}}
 {{- end -}}
@@ -98,8 +99,9 @@ livenessProbe:
  failureThreshold: {{ $livenessProbe.failureThreshold | default .Values.master.livenessProbe.failureThreshold}}
  exec:
    command:
-    - redis-cli
-    - ping
+    - sh
+    - -c
+    - /health/ping_local_and_master.sh
 {{- end }}
 {{- end -}}
 {{- end -}}
@@ -0,0 +1,44 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app: {{ template "redis.name" . }}
+    chart: {{ template "redis.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "redis.fullname" . }}-health
+data:
+  ping_local.sh: |-
+    response=$(
+      redis-cli \
+{{- if .Values.usePassword }}
+        -a $REDIS_PASSWORD \
+{{- end }}
+        -h localhost \
+        -p $REDIS_PORT \
+        ping
+    )
+    if [ "$response" != "PONG" ]; then
+      echo "$response"
+      exit 1
+    fi
+  ping_master.sh: |-
+    response=$(
+      redis-cli \
+{{- if .Values.usePassword }}
+        -a $REDIS_MASTER_PASSWORD \
+{{- end }}
+        -h $REDIS_MASTER_HOST \
+        -p $REDIS_MASTER_PORT_NUMBER \
+        ping
+    )
+    if [ "$response" != "PONG" ]; then
+      echo "$response"
+      exit 1
+    fi
+  ping_local_and_master.sh: |-
+    script_dir="$(dirname "$0")"
+    exit_status=0
+    "$script_dir/ping_local.sh" || exit_status=$?
+    "$script_dir/ping_master.sh" || exit_status=$?
+    exit $exit_status
@@ -19,8 +19,9 @@ spec:
      {{- if .Values.metrics.podLabels }}
 {{ toYaml .Values.metrics.podLabels | indent 8 }}
      {{- end }}
-      {{- if .Values.metrics.podAnnotations }}
      annotations:
+        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+      {{- if .Values.metrics.podAnnotations }}
 {{ toYaml .Values.metrics.podAnnotations | indent 8 }}
      {{- end }}
    spec:
@@ -26,6 +26,7 @@ spec:
 {{ toYaml .Values.master.podLabels | indent 8 }}
 {{- end }}
      annotations:
+        checksum/health: {{ include (print $.Template.BasePath "/health-configmap.yaml") . | sha256sum }}
        checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
      {{- if .Values.master.podAnnotations }}
@@ -83,9 +84,9 @@ spec:
        {{- else }}
        - name: ALLOW_EMPTY_PASSWORD
          value: "yes"
+        {{- end }}
        - name: REDIS_PORT
          value: {{ .Values.master.port | quote }}
-        {{- end }}
        - name: REDIS_DISABLE_COMMANDS
          value: {{ .Values.master.disableCommands }}
        {{- if .Values.master.extraFlags }}
@@ -104,8 +105,9 @@ spec:
          failureThreshold: {{ .Values.master.livenessProbe.failureThreshold }}
          exec:
            command:
-            - redis-cli
-            - ping
+            - sh
+            - -c
+            - /health/ping_local.sh
        {{- end }}
        {{- if .Values.master.readinessProbe.enabled}}
        readinessProbe:
@@ -116,12 +118,15 @@ spec:
          failureThreshold: {{ .Values.master.readinessProbe.failureThreshold }}
          exec:
            command:
-            - redis-cli
-            - ping
+            - sh
+            - -c
+            - /health/ping_local.sh
        {{- end }}
        resources:
 {{ toYaml .Values.master.resources | indent 10 }}
        volumeMounts:
+        - name: health
+          mountPath: /health
        - name: redis-data
          mountPath: {{ .Values.master.persistence.path }}
          subPath: {{ .Values.master.persistence.subPath }}
@@ -131,6 +136,10 @@ spec:
          subPath: redis.conf
        {{- end }}
      volumes:
+      - name: health
+        configMap:
+          name: {{ template "redis.fullname" . }}-health
+          defaultMode: 0755
      {{- if .Values.configmap }}
      - name: config
        configMap:
@@ -19,7 +19,7 @@ spec:
  {{- end -}}
  ports:
  - name: redis
-    port: 6379
+    port: {{ .Values.master.service.port }}
    targetPort: redis
    {{- if .Values.master.service.nodePort }}
    nodePort: {{ .Values.master.service.nodePort }}
@@ -23,6 +23,7 @@ spec:
 {{ toYaml (.Values.slave.podLabels | default .Values.master.podLabels) | indent 8 }}
      {{- end }}
      annotations:
+        checksum/health: {{ include (print $.Template.BasePath "/health-configmap.yaml") . | sha256sum }}
        checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
      {{- if (.Values.slave.podAnnotations | default .Values.master.podAnnotations) }}
@@ -69,7 +70,7 @@ spec:
        - name: REDIS_PORT
          value: {{ .Values.slave.port | default .Values.master.port | quote }}
        - name: REDIS_MASTER_PORT_NUMBER
-          value: {{ .Values.master.port | quote }}
+          value: {{ .Values.master.service.port | quote }}
        {{- if .Values.usePassword }}
        - name: REDIS_PASSWORD
          valueFrom:
@@ -108,12 +109,20 @@ spec:
        {{ include "redis.slave.readinessProbe" . | indent 8 }}
        resources:
 {{ toYaml (.Values.slave.resources | default .Values.master.resources) | indent 10 }}
-      {{- if .Values.configmap }}
        volumeMounts:
+        - name: health
+          mountPath: /health
+        {{- if .Values.configmap }}
        - name: config
          mountPath: /opt/bitnami/redis/etc/redis.conf
          subPath: redis.conf
+        {{- end }}
      volumes:
+      - name: health
+        configMap:
+          name: {{ template "redis.fullname" . }}-health
+          defaultMode: 0755
+      {{- if .Values.configmap }}
      - name: config
        configMap:
          name: {{ template "redis.fullname" . }}
@@ -157,6 +157,7 @@ master:
  service:
    ##  Redis Master Service type
    type: ClusterIP
+    port: 6379

    ## Specify the nodePort value for the LoadBalancer and NodePort service types.
    ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport