chore(infra): wire redis password parameter and secret-based overlays

Author: Mateus Medeiros

.github/workflows/deploy-infra.yml

@@ -26,6 +26,7 @@ env:
   GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
   POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
   MINIO_ROOT_PASSWORD: ${{ secrets.MINIO_ROOT_PASSWORD }}
+  REDIS_PASSWORD: ${{ secrets.REDIS_PASSWORD }}
 
 jobs:
   deploy:
@@ -49,6 +50,7 @@ jobs:
           GHCR_TOKEN \
           POSTGRES_PASSWORD \
           MINIO_ROOT_PASSWORD \
+          REDIS_PASSWORD \
           CLOUDFLARE_API_TOKEN
 
     - name: Install .NET

.github/workflows/deploy-users.yml

@@ -20,6 +20,7 @@ env:
   GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
   GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
   POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
+  REDIS_PASSWORD: ${{ secrets.REDIS_PASSWORD }}
   APPLICATIONINSIGHTS_CONNECTION_STRING: ${{ secrets.APPLICATIONINSIGHTS_CONNECTION_STRING }}
 
 jobs:
@@ -56,6 +57,7 @@ jobs:
           GHCR_USERNAME \
           GHCR_TOKEN \
           POSTGRES_PASSWORD \
+          REDIS_PASSWORD \
           APPLICATIONINSIGHTS_CONNECTION_STRING \
           Authentication__ExternalRedirect__AllowedReturnUrls__0
 

README.md

@@ -222,13 +222,15 @@ cd src/host/WriteFluency.AppHost
 aspirate generate --skip-build --non-interactive \
   -pa wf-infra-minio-user=minioadmin \
   -pa wf-infra-minio-password=admin123 \
-  -pa wf-infra-postgres-password=postgres
+  -pa wf-infra-postgres-password=postgres \
+  -pa wf-infra-redis-password=admin123
 ```
 
 Parameters passed with `-pa`:
 - `wf-infra-minio-user`: MinIO root user.
 - `wf-infra-minio-password`: MinIO root password.
 - `wf-infra-postgres-password`: Postgres password.
+- `wf-infra-redis-password`: Redis password.
 
 ### Deploy to Kubernetes
 ```bash

src/host/WriteFluency.AppHost/AppHost.cs

@@ -23,7 +23,9 @@
 var postgresdb = postgres.AddDatabase("wf-propositions-postgresdb");
 var usersdb = postgres.AddDatabase("wf-users-postgresdb");
 
+var redisPassword = builder.AddParameter("wf-infra-redis-password", "admin123", secret: true);
 var redis = builder.AddRedis("wf-infra-redis", port: 6379)
+    .WithPassword(redisPassword)
     .WithArgs("--maxmemory", "500mb", "--maxmemory-policy", "allkeys-lru")
     .WithDataVolume("writefluency-redis-data");
 

src/host/WriteFluency.AppHost/aspirate-output/wf-infra-redis/deployment.yaml

@@ -1,8 +1,12 @@
 resources:
-- deployment.yaml
+- statefulset.yaml
 - service.yaml
 
 generatorOptions:
   disableNameSuffixHash: true
 
+configMapGenerator:
+- name: wf-infra-redis-env
+  literals:
+    - REDIS_PASSWORD=admin123
 

src/host/WriteFluency.AppHost/aspirate-output/wf-infra-redis/kustomization.yaml

@@ -8,6 +8,6 @@ spec:
   selector:
     app: wf-infra-redis
   ports:
-  - name: redis
+  - name: tcp
     port: 6379
     targetPort: 6379

src/host/WriteFluency.AppHost/aspirate-output/wf-infra-redis/service.yaml

@@ -0,0 +1,47 @@
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: wf-infra-redis
+  labels:
+    app: wf-infra-redis
+spec:
+  serviceName: "wf-infra-redis"
+  replicas: 1
+  selector:
+    matchLabels:
+      app: wf-infra-redis
+  template:
+    metadata:
+      labels:
+        app: wf-infra-redis
+    spec:
+      containers:
+        - name: wf-infra-redis
+          image: docker.io/library/redis:8.2
+          imagePullPolicy: Always
+          command:
+            - /bin/sh
+          args:
+            - '-c'
+            - 'redis-server --requirepass $REDIS_PASSWORD --save 60 1'
+            - '--maxmemory'
+            - '500mb'
+            - '--maxmemory-policy'
+            - 'allkeys-lru'
+          ports:
+            - containerPort: 6379
+          envFrom:
+            - configMapRef:
+                name: wf-infra-redis-env
+          volumeMounts:
+            - name: writefluency-redis-data
+              mountPath: /data
+  volumeClaimTemplates:
+    - metadata:
+        name: writefluency-redis-data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi

src/host/WriteFluency.AppHost/aspirate-output/wf-infra-redis/statefulset.yaml

@@ -22,9 +22,13 @@ configMapGenerator:
     - WF_USERS_POSTGRESDB_URI=postgresql://postgres:{wf-infra-postgres-password-uri-encoded.value}@wf-infra-postgres:5432/wf-users-postgresdb
     - WF_USERS_POSTGRESDB_JDBCCONNECTIONSTRING=jdbc:postgresql://wf-infra-postgres:5432/wf-users-postgresdb
     - WF_USERS_POSTGRESDB_DATABASENAME=wf-users-postgresdb
+    - ConnectionStrings__wf-infra-redis=wf-infra-redis:6379,password=admin123
+    - WF_INFRA_REDIS_HOST=wf-infra-redis
+    - WF_INFRA_REDIS_PORT=6379
+    - WF_INFRA_REDIS_PASSWORD=admin123
+    - WF_INFRA_REDIS_URI=redis://:{wf-infra-redis-password-uri-encoded.value}@wf-infra-redis:6379
     - Smtp__FromEmail=noreply@writefluency.com
     - Smtp__FromName=WriteFluency
-    - ConnectionStrings__wf-infra-redis=wf-infra-redis:6379
     - Smtp__Host=wf-infra-smtp
     - Smtp__Port=2525
     - RESOURCE_NAME=wf-users-api

src/host/WriteFluency.AppHost/aspirate-output/wf-users-api/kustomization.yaml

@@ -12,3 +12,7 @@ patches:
     target:
       kind: StatefulSet
       name: wf-infra-postgres
+  - path: wf-infra-redis/statefulset-patch.yaml
+    target:
+      kind: StatefulSet
+      name: wf-infra-redis