feat(charts): replace in-cluster valkey with aiven valkey

charts/wonderwall-forward-auth/Chart.lock

@@ -1,6 +0,0 @@
-dependencies:
-- name: valkey
-  repository: https://charts.bitnami.com/bitnami
-  version: 3.0.7
-digest: sha256:d6621585cb66ddc9802c7a6303b20a33a5970aeaaaf57ee9b45d1cbd9f7a7b27
-generated: "2025-05-20T14:28:10.651543+02:00"

charts/wonderwall-forward-auth/Chart.yaml

@@ -5,7 +5,3 @@ type: application
 version: 1.0.0
 sources:
   - https://github.com/nais/wonderwall/tree/master/charts/wonderwall-forward-auth
-dependencies:
-  - name: valkey
-    version: 3.0.7
-    repository: https://charts.bitnami.com/bitnami

charts/wonderwall-forward-auth/Feature.yaml

@@ -1,6 +1,8 @@
 environmentKinds:
   - management
-timeout: "1800s"
+dependencies:
+  - allOf:
+      - nais-netpols-management
 values:
   openid.clientID:
     computed:
@@ -41,3 +43,19 @@ values:
     computed:
       template: |
         {{ printf "https://%s" (subdomain . "console") | quote }}
+  valkey.host:
+    computed:
+      template: |
+        {{ .Env.wonderwall_forward_auth_valkey_host | quote }}
+  valkey.port:
+    computed:
+      template: |
+        {{ .Env.wonderwall_forward_auth_valkey_port | quote }}
+  valkey.username:
+    computed:
+      template: |
+        {{ .Env.wonderwall_forward_auth_valkey_username | quote }}
+  valkey.password:
+    computed:
+      template: |
+        {{ .Env.wonderwall_forward_auth_valkey_password | quote }}

charts/wonderwall-forward-auth/templates/deployment.yaml

@@ -2,8 +2,6 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/search: "true"
   labels:
     {{- include "wonderwall-forward-auth.labels" . | nindent 4 }}
   name: {{ include "wonderwall-forward-auth.fullname" . }}
@@ -18,8 +16,8 @@ spec:
         kubectl.kubernetes.io/default-container: {{ include "wonderwall-forward-auth.fullname" . }}
         checksum/secret: {{ pick ( include (print $.Template.BasePath "/secret.yaml") . | fromYaml ) "data" | toYaml | sha256sum }}
       labels:
+        aiven: enabled
         {{- include "wonderwall-forward-auth.labels" . | nindent 8 }}
-        {{ printf "%s-client" .Values.valkey.fullnameOverride }}: "true"
       name: {{ include "wonderwall-forward-auth.fullname" . }}
     spec:
       affinity:
@@ -40,11 +38,6 @@ spec:
             value: {{ include "wonderwall-forward-auth.fullname" . }}
           - name: OTEL_EXPORTER_OTLP_ENDPOINT
             value: {{ .Values.otel.endpoint }}
-          - name: WONDERWALL_REDIS_PASSWORD
-            valueFrom:
-              secretKeyRef:
-                name: {{ .Values.valkey.fullnameOverride }}
-                key: "valkey-password"
           envFrom:
             - secretRef:
                 name: {{ include "wonderwall-forward-auth.fullname" . }}

charts/wonderwall-forward-auth/templates/networkpolicy.yaml

@@ -21,21 +21,11 @@ spec:
           podSelector:
             matchLabels:
               nais.io/ingressClass: {{ .Values.ingressClassName }}
-  egress:
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: nais-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/instance: {{ .Release.Name }}
-              app.kubernetes.io/name: valkey
   podSelector:
     matchLabels:
       {{- include "wonderwall-forward-auth.selectorLabels" . | nindent 6 }}
   policyTypes:
     - Ingress
-    - Egress
 {{- if .Capabilities.APIVersions.Has "networking.gke.io/v1alpha3" }}
 ---
 apiVersion: networking.gke.io/v1alpha3

charts/wonderwall-forward-auth/templates/prometheusrule.yaml

@@ -18,7 +18,7 @@ spec:
             consequence: This probably means that end-users are having trouble with authentication.
             action: |
               * Check the logs and metrics in the dashboard
-              * Check the Valkey instance in the cluster
+              * Check Aiven Valkey (session store) and verify Aiven network connectivity
               * Check the Zitadel dashboard: <https://monitoring.nais.io/d/bel6280x2srggc/>
             dashboard_url: "https://monitoring.nais.io/d/ben86a369fj7kd?var-tenant={{ .Values.fasit.tenant.name }}"
           labels:

charts/wonderwall-forward-auth/templates/secret.yaml

@@ -4,8 +4,6 @@ kind: Secret
 type: kubernetes.io/Opaque
 metadata:
   name: {{ include "wonderwall-forward-auth.fullname" . }}
-  annotations:
-    reloader.stakater.com/match: "true"
   labels:
     {{- include "wonderwall-forward-auth.labels" . | nindent 4 }}
 stringData:
@@ -25,9 +23,10 @@ stringData:
   {{ end }}
   WONDERWALL_OPENID_WELL_KNOWN_URL: "{{ .Values.openid.wellKnownURL | required ".Values.openid.wellKnownURL is required." }}"
   WONDERWALL_ENCRYPTION_KEY: "{{ .Values.session.cookieEncryptionKey | required ".Values.session.cookieEncryptionKey is required." }}"
-  WONDERWALL_REDIS_URI: "redis://{{ .Values.valkey.fullnameOverride }}-primary:6379"
-  WONDERWALL_REDIS_USERNAME: "default"
-  WONDERWALL_REDIS_TLS: "false"
+  WONDERWALL_REDIS_URI: "rediss://{{ .Values.valkey.host | required ".Values.valkey.host is required." }}:{{ .Values.valkey.port | required ".Values.valkey.port is required." }}"
+  WONDERWALL_REDIS_USERNAME: "{{ .Values.valkey.username | required ".Values.valkey.username is required." }}"
+  WONDERWALL_REDIS_PASSWORD: "{{ .Values.valkey.password | required ".Values.valkey.password is required." }}"
+  WONDERWALL_REDIS_TLS: "true"
   WONDERWALL_SESSION_MAX_LIFETIME: "{{ .Values.session.maxLifetime | required ".Values.session.maxLifetime is required." }}"
   WONDERWALL_SESSION_FORWARD_AUTH: "true"
   WONDERWALL_SESSION_FORWARD_AUTH_SET_HEADERS: "true"

charts/wonderwall-forward-auth/values.yaml

@@ -42,13 +42,7 @@ sso:
   domain:
 
 valkey:
-  fullnameOverride: "wonderwall-forward-auth-valkey"
-  architecture: "standalone"
-  primary:
-    resourcesPreset: "medium"
-    persistence:
-      enabled: false
-  networkPolicy:
-    enabled: true
-    allowExternal: false
-    allowExternalEgress: false
+  host:
+  port:
+  username:
+  password: