Skip to content

Commit cc5a37f

Browse files
renovate[bot]kiblik
renovate[bot]
authored and
kiblik
committed
feat(helm): Use Valkey
Signed-off-by: kiblik <5609770+kiblik@users.noreply.github.com>
1 parent 22afcfc commit cc5a37f

File tree

14 files changed

+142
-142
lines changed

14 files changed

+142
-142
lines changed

‎.github/workflows/k8s-tests.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,8 +73,8 @@ jobs:
7373
--set images.nginx.image.tag=latest \
7474
--set imagePullPolicy=Never \
7575
--set initializer.keepSeconds="-1" \
76-
--set redis.enabled=true \
77-
--set createRedisSecret=true \
76+
--set valkey.enabled=true \
77+
--set createValkeySecret=true \
7878
--set postgresql.enabled=true \
7979
--set createPostgresqlSecret=true \
8080
--set createSecret=true

‎helm/defectdojo/Chart.lock‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@ dependencies:
22
- name: postgresql
33
repository: oci://us-docker.pkg.dev/os-public-container-registry/defectdojo
44
version: 16.7.27
5-
- name: redis
6-
repository: oci://us-docker.pkg.dev/os-public-container-registry/defectdojo
7-
version: 19.6.4
8-
digest: sha256:b22ad615baaa104a188c735f74ddddaec83b698315bb82f722679f762be64b50
9-
generated: "2025-08-27T11:22:22.13669-05:00"
5+
- name: valkey
6+
repository: oci://registry-1.docker.io/cloudpirates
7+
version: 0.9.2
8+
digest: sha256:9e9234390f5cb295e3bbf0dbe2a0a6475a13ce8cf4b5c5458bc733205afefe95
9+
generated: "2025-11-04T19:07:03.952089+01:00"

‎helm/defectdojo/Chart.yaml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@ dependencies:
1313
version: ~16.7.0
1414
repository: "oci://us-docker.pkg.dev/os-public-container-registry/defectdojo"
1515
condition: postgresql.enabled
16-
- name: redis
17-
version: ~19.6.4
18-
repository: "oci://us-docker.pkg.dev/os-public-container-registry/defectdojo"
19-
condition: redis.enabled
16+
- name: valkey
17+
version: ~0.9.2
18+
repository: "oci://registry-1.docker.io/cloudpirates"
19+
condition: valkey.enabled
2020
# For correct syntax, check https://artifacthub.io/docs/topics/annotations/helm/
2121
# This is example for "artifacthub.io/changes"
2222
# artifacthub.io/changes: |
@@ -34,4 +34,6 @@ dependencies:
3434
# description: Critical bug
3535
annotations:
3636
artifacthub.io/prerelease: "true"
37-
artifacthub.io/changes: ""
37+
artifacthub.io/changes: |
38+
- kind: changed
39+
description: Replace Redis with Valkey

‎helm/defectdojo/README.md‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ helm install \
9494
--set django.ingress.enabled=${DJANGO_INGRESS_ENABLED} \
9595
--set django.ingress.activateTLS=${DJANGO_INGRESS_ACTIVATE_TLS} \
9696
--set createSecret=true \
97-
--set createRedisSecret=true \
97+
--set createValkeySecret=true \
9898
--set createPostgresqlSecret=true
9999
```
100100

@@ -280,10 +280,10 @@ helm install \
280280
--set host="defectdojo.${TLS_CERT_DOMAIN}" \
281281
--set django.ingress.secretName="minikube-tls" \
282282
--set createSecret=true \
283-
--set createRedisSecret=true \
283+
--set createValkeySecret=true \
284284
--set createPostgresqlSecret=true
285285

286-
# For high availability deploy multiple instances of Django, Celery and Redis
286+
# For high availability deploy multiple instances of Django, Celery and Valkey
287287
helm install \
288288
defectdojo \
289289
./helm/defectdojo \
@@ -292,9 +292,10 @@ helm install \
292292
--set django.ingress.secretName="minikube-tls" \
293293
--set django.replicas=3 \
294294
--set celery.worker.replicas=3 \
295-
--set redis.replicas=3 \
295+
--set valkey.architecture=replication \
296+
--set valkey.replicaCount=3 \
296297
--set createSecret=true \
297-
--set createRedisSecret=true \
298+
--set createValkeySecret=true \
298299
--set createPostgresqlSecret=true
299300

300301
# Run highly available PostgreSQL cluster
@@ -306,13 +307,14 @@ helm install \
306307
--set host="defectdojo.${TLS_CERT_DOMAIN}" \
307308
--set django.replicas=3 \
308309
--set celery.worker.replicas=3 \
309-
--set redis.replicas=3 \
310+
--set valkey.architecture=replication \
311+
--set valkey.replicaCount=3 \
310312
--set django.ingress.secretName="minikube-tls" \
311313
--set postgresql.enabled=true \
312314
--set postgresql.replication.enabled=true \
313315
--set postgresql.replication.slaveReplicas=3 \
314316
--set createSecret=true \
315-
--set createRedisSecret=true \
317+
--set createValkeySecret=true \
316318
--set createPostgresqlSecret=true
317319

318320
# Note: If you run `helm install defectdojo before, you will get an error
@@ -359,16 +361,13 @@ You will still need to set a host value as well.
359361

360362
If you want to use a redis-sentinel setup as the Celery broker, you will need to set the following.
361363

362-
1. Set redis.scheme to "sentinel" in values.yaml
364+
1. Set valkey.scheme to "sentinel" in values.yaml
363365
2. Set two additional extraEnv vars specifying the sentinel master name and port in values.yaml
364366

365367
```yaml
366-
celery:
367-
broker: 'redis'
368-
369-
redis:
370-
redisServer: 'PutYourRedisSentinelAddress'
368+
valkey:
371369
scheme: 'sentinel'
370+
redisServer: 'PutYourRedisSentinelAddress'
372371

373372
extraEnv:
374373
- name: DD_CELERY_BROKER_TRANSPORT_OPTIONS
@@ -451,10 +450,10 @@ extraEnv:
451450

452451
#### Step 4: Deploy DefectDojo
453452

454-
After modifying the `values.yaml` file as needed, deploy DefectDojo using Helm. This command also generates the required secrets for the DefectDojo admin UI and Redis:
453+
After modifying the `values.yaml` file as needed, deploy DefectDojo using Helm. This command also generates the required secrets for the DefectDojo admin UI and Valkey:
455454

456455
```bash
457-
helm install defectdojo defectdojo -f values.yaml -n defectdojo --set createSecret=true --set createRedisSecret=true
456+
helm install defectdojo defectdojo -f values.yaml -n defectdojo --set createSecret=true --set createValkeySecret=true
458457
```
459458

460459
**NOTE**: It is important to highlight that this setup can also be utilized for achieving high availability (HA) in PostgreSQL. By placing a load balancer in front of the PostgreSQL cluster, read and write requests can be efficiently routed to the appropriate primary or standby servers as needed.
@@ -509,8 +508,8 @@ A Helm chart for Kubernetes to install DefectDojo
509508
510509
| Repository | Name | Version |
511510
|------------|------|---------|
511+
| oci://registry-1.docker.io/cloudpirates | valkey | ~0.9.2 |
512512
| oci://us-docker.pkg.dev/os-public-container-registry/defectdojo | postgresql | ~16.7.0 |
513-
| oci://us-docker.pkg.dev/os-public-container-registry/defectdojo | redis | ~19.6.4 |
514513
515514
## Values
516515
@@ -547,7 +546,6 @@ A Helm chart for Kubernetes to install DefectDojo
547546
| celery.beat.resources.requests.memory | string | `"128Mi"` | |
548547
| celery.beat.startupProbe | object | `{}` | Enable startup probe for Celery beat container. |
549548
| celery.beat.tolerations | list | `[]` | |
550-
| celery.broker | string | `"redis"` | |
551549
| celery.logLevel | string | `"INFO"` | |
552550
| celery.worker.affinity | object | `{}` | |
553551
| celery.worker.annotations | object | `{}` | Annotations for the Celery worker deployment. |
@@ -583,8 +581,9 @@ A Helm chart for Kubernetes to install DefectDojo
583581
| cloudsql.use_private_ip | bool | `false` | whether to use a private IP to connect to the database |
584582
| cloudsql.verbose | bool | `true` | By default, the proxy has verbose logging. Set this to false to make it less verbose |
585583
| createPostgresqlSecret | bool | `false` | create postgresql secret in defectdojo chart, outside of postgresql chart |
586-
| createRedisSecret | bool | `false` | create redis secret in defectdojo chart, outside of redis chart |
584+
| createRedisSecret | bool | `false` | this value is deprecated and will be removed in the future |
587585
| createSecret | bool | `false` | create defectdojo specific secret |
586+
| createValkeySecret | bool | `false` | create valkey secret in defectdojo chart, outside of valkey chart |
588587
| dbMigrationChecker.containerSecurityContext | object | `{}` | Container security context for the DB migration checker. |
589588
| dbMigrationChecker.enabled | bool | `true` | Enable/disable the DB migration checker. |
590589
| dbMigrationChecker.extraEnv | list | `[]` | Additional environment variables for DB migration checker. |
@@ -727,9 +726,6 @@ A Helm chart for Kubernetes to install DefectDojo
727726
| postgresql.primary.podSecurityContext.enabled | bool | `true` | Default is true for K8s. Enabled needs to false for OpenShift restricted SCC and true for anyuid SCC |
728727
| postgresql.primary.podSecurityContext.fsGroup | int | `1001` | fsGroup specification below is not applied if enabled=false. enabled=false is the required setting for OpenShift "restricted SCC" to work successfully. |
729728
| postgresql.volumePermissions.containerSecurityContext | object | `{"runAsUser":1001}` | if using restricted SCC set runAsUser: "auto" and if running under anyuid SCC - runAsUser needs to match the line above |
730-
| redis | object | `{"architecture":"standalone","auth":{"existingSecret":"defectdojo-redis-specific","existingSecretPasswordKey":"redis-password","password":""},"enabled":true,"sentinel":{"enabled":false},"tls":{"enabled":false}}` | For more advance options check the bitnami chart documentation: https://github.com/bitnami/charts/tree/main/bitnami/redis |
731-
| redis.enabled | bool | `true` | To use an external instance, switch enabled to `false`` and set the address in `redisServer` below |
732-
| redis.tls.enabled | bool | `false` | If TLS is enabled, the Redis broker will use the redis:// and optionally mount the certificates from an existing secret. |
733729
| redisParams | string | `""` | Parameters attached to the redis connection string, defaults to "ssl_cert_reqs=optional" if `redis.tls.enabled` |
734730
| redisServer | string | `nil` | To use an external Redis instance, set `redis.enabled` to false and set the address here: |
735731
| revisionHistoryLimit | int | `10` | Allow overriding of revisionHistoryLimit across all deployments. |
@@ -747,6 +743,10 @@ A Helm chart for Kubernetes to install DefectDojo
747743
| tests.unitTests.resources.requests.cpu | string | `"100m"` | |
748744
| tests.unitTests.resources.requests.memory | string | `"128Mi"` | |
749745
| trackConfig | string | `"disabled"` | Track configuration (trackConfig): will automatically respin application pods in case of config changes detection can be: 1. disabled (default) 2. enabled, enables tracking configuration changes based on SHA256 |
746+
| valkey | object | `{"auth":{"existingSecret":"defectdojo-valkey-specific","existingSecretPasswordKey":"valkey-password","password":""},"enabled":true,"sentinel":{"enabled":false},"service":{"port":6379},"tls":{"enabled":false}}` | For more advance options check the bitnami chart documentation: https://artifacthub.io/packages/helm/cloudpirates-valkey/valkey |
747+
| valkey.enabled | bool | `true` | To use an external instance, switch enabled to `false` and set the address in `redisServer` below |
748+
| valkey.service | object | `{"port":6379}` | To use a different port for Redis (default: 6379) |
749+
| valkey.tls.enabled | bool | `false` | If TLS is enabled, the Redis broker will use the redis:// and optionally mount the certificates from an existing secret. |
750750
751751
----------------------------------------------
752752
Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)

‎helm/defectdojo/README.md.gotmpl‎

Lines changed: 14 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ helm install \
9494
--set django.ingress.enabled=${DJANGO_INGRESS_ENABLED} \
9595
--set django.ingress.activateTLS=${DJANGO_INGRESS_ACTIVATE_TLS} \
9696
--set createSecret=true \
97-
--set createRedisSecret=true \
97+
--set createValkeySecret=true \
9898
--set createPostgresqlSecret=true
9999
```
100100

@@ -280,10 +280,10 @@ helm install \
280280
--set host="defectdojo.${TLS_CERT_DOMAIN}" \
281281
--set django.ingress.secretName="minikube-tls" \
282282
--set createSecret=true \
283-
--set createRedisSecret=true \
283+
--set createValkeySecret=true \
284284
--set createPostgresqlSecret=true
285285

286-
# For high availability deploy multiple instances of Django, Celery and Redis
286+
# For high availability deploy multiple instances of Django, Celery and Valkey
287287
helm install \
288288
defectdojo \
289289
./helm/defectdojo \
@@ -292,9 +292,10 @@ helm install \
292292
--set django.ingress.secretName="minikube-tls" \
293293
--set django.replicas=3 \
294294
--set celery.worker.replicas=3 \
295-
--set redis.replicas=3 \
295+
--set valkey.architecture=replication \
296+
--set valkey.replicaCount=3 \
296297
--set createSecret=true \
297-
--set createRedisSecret=true \
298+
--set createValkeySecret=true \
298299
--set createPostgresqlSecret=true
299300

300301
# Run highly available PostgreSQL cluster
@@ -306,13 +307,14 @@ helm install \
306307
--set host="defectdojo.${TLS_CERT_DOMAIN}" \
307308
--set django.replicas=3 \
308309
--set celery.worker.replicas=3 \
309-
--set redis.replicas=3 \
310+
--set valkey.architecture=replication \
311+
--set valkey.replicaCount=3 \
310312
--set django.ingress.secretName="minikube-tls" \
311313
--set postgresql.enabled=true \
312314
--set postgresql.replication.enabled=true \
313315
--set postgresql.replication.slaveReplicas=3 \
314316
--set createSecret=true \
315-
--set createRedisSecret=true \
317+
--set createValkeySecret=true \
316318
--set createPostgresqlSecret=true
317319

318320
# Note: If you run `helm install defectdojo before, you will get an error
@@ -359,16 +361,13 @@ You will still need to set a host value as well.
359361

360362
If you want to use a redis-sentinel setup as the Celery broker, you will need to set the following.
361363

362-
1. Set redis.scheme to "sentinel" in values.yaml
364+
1. Set valkey.scheme to "sentinel" in values.yaml
363365
2. Set two additional extraEnv vars specifying the sentinel master name and port in values.yaml
364366

365367
```yaml
366-
celery:
367-
broker: 'redis'
368-
369-
redis:
370-
redisServer: 'PutYourRedisSentinelAddress'
368+
valkey:
371369
scheme: 'sentinel'
370+
redisServer: 'PutYourRedisSentinelAddress'
372371

373372
extraEnv:
374373
- name: DD_CELERY_BROKER_TRANSPORT_OPTIONS
@@ -451,10 +450,10 @@ extraEnv:
451450

452451
#### Step 4: Deploy DefectDojo
453452

454-
After modifying the `values.yaml` file as needed, deploy DefectDojo using Helm. This command also generates the required secrets for the DefectDojo admin UI and Redis:
453+
After modifying the `values.yaml` file as needed, deploy DefectDojo using Helm. This command also generates the required secrets for the DefectDojo admin UI and Valkey:
455454

456455
```bash
457-
helm install defectdojo defectdojo -f values.yaml -n defectdojo --set createSecret=true --set createRedisSecret=true
456+
helm install defectdojo defectdojo -f values.yaml -n defectdojo --set createSecret=true --set createValkeySecret=true
458457
```
459458

460459

‎helm/defectdojo/templates/_helpers.tpl‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -58,29 +58,25 @@
5858
{{- end -}}
5959

6060
{{- define "redis.hostname" -}}
61-
{{- if eq .Values.celery.broker "redis" -}}
62-
{{- if .Values.redis.enabled -}}
63-
{{- printf "%s-%s" .Release.Name "redis-master" | trunc 63 | trimSuffix "-" -}}
61+
{{- if .Values.valkey.enabled -}}
62+
{{- printf "%s-%s" .Release.Name "valkey" | trunc 63 | trimSuffix "-" -}}
6463
{{- else -}}
6564
{{- .Values.redisServer | default "127.0.0.1" | quote -}}
6665
{{- end -}}
6766
{{- end -}}
68-
{{- end -}}
6967

7068
{{- /*
7169
Determine the protocol to use for Redis.
7270
*/}}
7371
{{- define "redis.scheme" -}}
74-
{{- if eq .Values.celery.broker "redis" -}}
75-
{{- if .Values.redis.tls.enabled -}}
72+
{{- if .Values.valkey.tls.enabled -}}
7673
{{- printf "rediss" -}}
77-
{{- else if .Values.redis.sentinel.enabled -}}
74+
{{- else if .Values.valkey.sentinel.enabled -}}
7875
{{- printf "sentinel" -}}
7976
{{- else -}}
8077
{{- printf "redis" -}}
8178
{{- end -}}
8279
{{- end -}}
83-
{{- end -}}
8480

8581
{{- /*
8682
Builds the repository names for use with local or private registries

‎helm/defectdojo/templates/celery-beat-deployment.yaml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -144,10 +144,8 @@ spec:
144144
- name: DD_CELERY_BROKER_PASSWORD
145145
valueFrom:
146146
secretKeyRef:
147-
{{- if eq .Values.celery.broker "redis" }}
148-
name: {{ .Values.redis.auth.existingSecret | default "defectdojo-redis-specific" }}
149-
key: {{ .Values.redis.auth.existingSecretPasswordKey | default "redis-password" }}
150-
{{- end }}
147+
name: {{ .Values.valkey.auth.existingSecret | default "defectdojo-valkey-specific" }}
148+
key: {{ .Values.valkey.auth.existingSecretPasswordKey | default "valkey-password" }}
151149
- name: DD_DATABASE_PASSWORD
152150
valueFrom:
153151
secretKeyRef:

‎helm/defectdojo/templates/celery-worker-deployment.yaml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -139,10 +139,8 @@ spec:
139139
- name: DD_CELERY_BROKER_PASSWORD
140140
valueFrom:
141141
secretKeyRef:
142-
{{- if eq .Values.celery.broker "redis" }}
143-
name: {{ .Values.redis.auth.existingSecret| default "defectdojo-redis-specific" }}
144-
key: {{ .Values.redis.auth.existingSecretPasswordKey | default "redis-password" }}
145-
{{- end }}
142+
name: {{ .Values.valkey.auth.existingSecret| default "defectdojo-valkey-specific" }}
143+
key: {{ .Values.valkey.auth.existingSecretPasswordKey | default "valkey-password" }}
146144
- name: DD_DATABASE_PASSWORD
147145
valueFrom:
148146
secretKeyRef:

‎helm/defectdojo/templates/configmap.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{{- $fullName := include "defectdojo.fullname" . -}}
2-
{{- $defaultBrokerParams := ternary "ssl_cert_reqs=optional" "" .Values.redis.tls.enabled -}}
2+
{{- $defaultBrokerParams := ternary "ssl_cert_reqs=optional" "" .Values.valkey.tls.enabled -}}
33
apiVersion: v1
44
kind: ConfigMap
55
metadata:
@@ -26,10 +26,10 @@ data:
2626
DD_ADMIN_LAST_NAME: {{ .Values.admin.LastName | default "User" }}
2727
DD_ALLOWED_HOSTS: {{ include "django.allowed_hosts" . }}
2828
DD_SITE_URL: {{ .Values.siteUrl | default "http://localhost:8080" }}
29-
DD_CELERY_BROKER_SCHEME: {{ if eq .Values.celery.broker "redis" }}{{ template "redis.scheme" . }}{{ end }}
29+
DD_CELERY_BROKER_SCHEME: {{ template "redis.scheme" . }}
3030
DD_CELERY_BROKER_USER: ''
31-
DD_CELERY_BROKER_HOST: {{ if eq .Values.celery.broker "redis" }}{{ template "redis.hostname" . }}{{ end }}
32-
DD_CELERY_BROKER_PORT: '{{ if eq .Values.celery.broker "redis" }}{{- if ( hasKey .Values.redis "master" ) -}}{{ .Values.redis.master.service.ports.redis }}{{ else }}6379{{ end }}{{- end -}}'
31+
DD_CELERY_BROKER_HOST: {{ template "redis.hostname" . }}
32+
DD_CELERY_BROKER_PORT: '{{ .Values.valkey.service.port }}'
3333
DD_CELERY_BROKER_PARAMS: '{{ .Values.redisParams | default $defaultBrokerParams }}'
3434
DD_CELERY_BROKER_PATH: '{{ .Values.celery.path | default "//" }}'
3535
DD_CELERY_LOG_LEVEL: {{ .Values.celery.logLevel }}

‎helm/defectdojo/templates/django-deployment.yaml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -199,10 +199,8 @@ spec:
199199
- name: DD_CELERY_BROKER_PASSWORD
200200
valueFrom:
201201
secretKeyRef:
202-
{{- if eq .Values.celery.broker "redis" }}
203-
name: {{ .Values.redis.auth.existingSecret | default "defectdojo-redis-specific" }}
204-
key: {{ .Values.redis.auth.existingSecretPasswordKey | default "redis-password" }}
205-
{{- end }}
202+
name: {{ .Values.valkey.auth.existingSecret | default "defectdojo-valkey-specific" }}
203+
key: {{ .Values.valkey.auth.existingSecretPasswordKey | default "valkey-password" }}
206204
{{- if .Values.django.uwsgi.enableDebug }}
207205
- name: DD_DEBUG
208206
value: 'True'

0 commit comments

Comments
 (0)