[bitnami/redis] Add TLS support (#2753)

* [bitnami/redis] Add TLS support Signed-off-by: joancafom <jcarmona@bitnami.com> * Update values.yaml * Fix linter in values.yaml * Apply same changes to the production one Fix linter * Impove release NOTES * [bitnami/redis] Update components versions Signed-off-by: Bitnami Containers <containers@bitnami.com> Co-authored-by: Carlos Rodríguez Hernández <carlosrh@vmware.com> Co-authored-by: Bitnami Containers <containers@bitnami.com>
2026-08-10 14:15:55 +08:00 · 2020-06-10 13:17:14 +02:00
parent 628ffb6194
commit bc8581861f
9 changed files with 368 additions and 21 deletions
@@ -1,6 +1,6 @@
 apiVersion: v1
 name: redis
-version: 10.6.19
+version: 10.7.0
 appVersion: 6.0.5
 description: Open source, advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.
 keywords:
@@ -137,6 +137,13 @@ The following table lists the configurable parameters of the Redis chart and the
 | `master.podLabels`                            | Additional labels for Redis master pod                                                                                                              | {}                                                      |
 | `master.podAnnotations`                       | Additional annotations for Redis master pod                                                                                                         | {}                                                      |
 | `redisPort`                                   | Redis port (in both master and slaves)                                                                                                              | `6379`                                                  |
+| `tls.enabled`                                 | Enable TLS support for replication traffic                                                                                                                                                                                               | `false`                                                 |
+| `tls.authClients`                             | Require clients to authenticate or not                                                                                                                                                                                                   | `true`                                                 |
+| `tls.certificatesSecret`                      | Name of the secret that contains the certificates                                                                                                                                                                                          | `nil`                                                   |
+| `tls.certFilename`                            | Certificate filename                                                                                                                                                                                              | `nil`                                                   |
+| `tls.certKeyFilename`                         | Certificate key filename                                                                                                                                                                                              | `nil`                                                   |
+| `tls.certCAFilename`                          | CA Certificate filename                                                                                                                                                                                              |`nil`                                                   |
+| `tls.dhParamsFilename`                        | DH params (in order to support DH based ciphers)                                                                                                                                                                                              |`nil`                                                   |
 | `master.command`                              | Redis master entrypoint string. The command `redis-server` is executed if this is not provided.                                                     | `/run.sh`                                               |
 | `master.configmap`                            | Additional Redis configuration for the master nodes (this value is evaluated as a template)                                                         | `nil`                                                   |
 | `master.disableCommands`                      | Array of Redis commands to disable (master)                                                                                                         | `["FLUSHDB", "FLUSHALL"]`                               |
@@ -355,6 +362,36 @@ sentinels.enabled=true
 metrics.enabled=true
 ```

+### Securing traffic using TLS
+
+TLS support can be enabled in the chart by specifying the `tls.` parameters while creating a release. The following parameters should be configured to properly enable the TLS support in the chart:
+
+- `tls.enabled`: Enable TLS support. Defaults to `false`
+- `tls.certificatesSecret`: Name of the secret that contains the certificates. No defaults.
+- `tls.certFilename`: Certificate filename. No defaults.
+- `tls.certKeyFilename`: Certificate key filename. No defaults.
+- `tls.certCAFilename`: CA Certificate filename. No defaults.
+
+For example:
+
+First, create the secret with the cetificates files:
+
+```console
+kubectl create secret generic certificates-tls-secret --from-file=./cert.pem --from-file=./cert.key --from-file=./ca.pem
+```
+
+Then, use the following parameters:
+
+```console
+tls.enabled="true"
+tls.certificatesSecret="certificates-tls-secret"
+tls.certFilename="cert.pem"
+tls.certKeyFilename="cert.key"
+tls.certCAFilename="ca.pem"
+```
+
+> **Note TLS and Prometheus Metrics**: Current version of Redis Metrics Exporter (v1.6.1 at the time of writing) does not fully support the use of TLS. By enabling both features, the metric reporting pod is likely to not work as expected. See Redis Metrics Exporter issue [387](https://github.com/oliver006/redis_exporter/issues/387) for more information.
+
 ### Metrics

 The chart optionally can start a metrics exporter for [prometheus](https://prometheus.io). The metrics endpoint (port 9121) is exposed in the service. Metrics can be scraped from within the cluster using something similar as the described in the [example Prometheus scrape configuration](https://github.com/prometheus/prometheus/blob/master/documentation/examples/prometheus-kubernetes.yml). If metrics are to be scraped from outside the cluster, the Kubernetes API proxy can be utilized to access the endpoint.
@@ -52,23 +52,39 @@ To connect to your Redis server:

 1. Run a Redis pod that you can use as a client:

+{{- if .Values.tls.enabled }}
+   kubectl run --namespace {{ .Release.Namespace }} {{ template "redis.fullname" . }}-client --restart='Never' --env REDIS_PASSWORD=$REDIS_PASSWORD --image {{ template "redis.image" . }} --command -- sleep infinity
+
+   Copy your TLS certificates to the pod:
+
+   kubectl cp --namespace {{ .Release.Namespace }} /path/to/client.cert {{ template "redis.fullname" . }}-client:/tmp/client.cert
+   kubectl cp --namespace {{ .Release.Namespace }} /path/to/client.key {{ template "redis.fullname" . }}-client:/tmp/client.key
+   kubectl cp --namespace {{ .Release.Namespace }} /path/to/CA.cert {{ template "redis.fullname" . }}-client:/tmp/CA.cert
+
+   Use the following command to attach to the pod:
+
+   kubectl exec --tty -i {{ template "redis.fullname" . }}-client \
+   {{- if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}--labels="{{ template "redis.fullname" . }}-client=true" \{{- end }}
+   --namespace {{ .Release.Namespace }} -- bash
+{{- else }}
   kubectl run --namespace {{ .Release.Namespace }} {{ template "redis.fullname" . }}-client --rm --tty -i --restart='Never' \
   {{ if .Values.usePassword }} --env REDIS_PASSWORD=$REDIS_PASSWORD \{{ end }}
   {{- if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}--labels="{{ template "redis.fullname" . }}-client=true" \{{- end }}
   --image {{ template "redis.image" . }} -- bash
+{{- end }}

 2. Connect using the Redis CLI:

 {{- if .Values.cluster.enabled }}
   {{- if .Values.sentinel.enabled }}
-   redis-cli -h {{ template "redis.fullname" . }} -p {{ .Values.sentinel.service.redisPort }}{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }} # Read only operations
-   redis-cli -h {{ template "redis.fullname" . }} -p {{ .Values.sentinel.service.sentinelPort }}{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }} # Sentinel access
+   redis-cli -h {{ template "redis.fullname" . }} -p {{ .Values.sentinel.service.redisPort }}{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} # Read only operations
+   redis-cli -h {{ template "redis.fullname" . }} -p {{ .Values.sentinel.service.sentinelPort }}{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} # Sentinel access
   {{- else }}
-   redis-cli -h {{ template "redis.fullname" . }}-master{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}
-   redis-cli -h {{ template "redis.fullname" . }}-slave{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}
+   redis-cli -h {{ template "redis.fullname" . }}-master{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }}
+   redis-cli -h {{ template "redis.fullname" . }}-slave{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }}
   {{- end }}
 {{- else }}
-   redis-cli -h {{ template "redis.fullname" . }}-master{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}
+   redis-cli -h {{ template "redis.fullname" . }}-master{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }}
 {{- end }}

 {{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}
@@ -83,7 +99,7 @@ To connect to your database from outside the cluster execute the following comma

    export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
    export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "redis.fullname" . }}-master)
-    redis-cli -h $NODE_IP -p $NODE_PORT {{- if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}
+    redis-cli -h $NODE_IP -p $NODE_PORT {{- if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }}

 {{- else if contains "LoadBalancer" .Values.master.service.type }}

@@ -91,16 +107,16 @@ To connect to your database from outside the cluster execute the following comma
        Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "redis.fullname" . }}'

    export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "redis.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
-    redis-cli -h $SERVICE_IP -p {{ .Values.master.service.port }} {{- if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}
+    redis-cli -h $SERVICE_IP -p {{ .Values.master.service.port }} {{- if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }}

 {{- else if contains "ClusterIP" .Values.master.service.type }}

    kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ template "redis.fullname" . }}-master {{ .Values.redisPort }}:{{ .Values.redisPort }} &
-    redis-cli -h 127.0.0.1 -p {{ .Values.redisPort }} {{- if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}
+    redis-cli -h 127.0.0.1 -p {{ .Values.redisPort }} {{- if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }}

 {{- end }}
 {{- end }}

 {{ include "redis.checkRollingTags" . }}

-{{- include "redis.validateValues" . }}
+{{- include "redis.validateValues" . }}
@@ -156,6 +156,36 @@ Also, we can't use a single if because lazy evaluation is not an option
 {{- end -}}
 {{- end -}}

+{{/*
+Return the path to the cert file.
+*/}}
+{{- define "redis.tlsCert" -}}
+{{- required "Certificate filename is required when TLS in enabled" .Values.tls.certFilename | printf "/opt/bitnami/redis/certs/%s" -}}
+{{- end -}}
+
+{{/*
+Return the path to the cert key file.
+*/}}
+{{- define "redis.tlsCertKey" -}}
+{{- required "Certificate Key filename is required when TLS in enabled" .Values.tls.certKeyFilename | printf "/opt/bitnami/redis/certs/%s" -}}
+{{- end -}}
+
+{{/*
+Return the path to the CA cert file.
+*/}}
+{{- define "redis.tlsCACert" -}}
+{{- required "Certificate CA filename is required when TLS in enabled" .Values.tls.certCAFilename | printf "/opt/bitnami/redis/certs/%s" -}}
+{{- end -}}
+
+{{/*
+Return the path to the DH params file.
+*/}}
+{{- define "redis.tlsDHParams" -}}
+{{- if .Values.tls.dhParamsFilename -}}
+{{- printf "/opt/bitnami/redis/certs/%s" .Values.tls.dhParamsFilename -}}
+{{- end -}}
+{{- end -}}
+
 {{/*
 Create the name of the service account to use
 */}}
@@ -375,4 +405,4 @@ redis: spreadConstraints
    Pod Topology Spread Constraints are only available on K8s  >= 1.16
    Find more information at https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
 {{- end -}}
-{{- end -}}
+{{- end -}}
@@ -25,7 +25,15 @@ data:
        -a $REDIS_PASSWORD $no_auth_warning \
 {{- end }}
        -h localhost \
+{{- if .Values.tls.enabled }}
+        -p $REDIS_TLS_PORT \
+        --tls \
+        --cert {{ template "redis.tlsCert" . }} \
+        --key {{ template "redis.tlsCertKey" . }} \
+        --cacert {{ template "redis.tlsCACert" . }} \
+{{- else }}
        -p $REDIS_PORT \
+{{- end }}
        ping
    )
    if [ "$response" != "PONG" ]; then
@@ -48,7 +56,15 @@ data:
        -a $REDIS_PASSWORD $no_auth_warning \
 {{- end }}
        -h localhost \
+{{- if .Values.tls.enabled }}
+        -p $REDIS_TLS_PORT \
+        --tls \
+        --cert {{ template "redis.tlsCert" . }} \
+        --key {{ template "redis.tlsCertKey" . }} \
+        --cacert {{ template "redis.tlsCACert" . }} \
+{{- else }}
        -p $REDIS_PORT \
+{{- end }}
        ping
    )
    if [ "$response" != "PONG" ] && [ "$response" != "LOADING Redis is loading the dataset in memory" ]; then
@@ -72,7 +88,15 @@ data:
        -a $REDIS_PASSWORD $no_auth_warning \
 {{- end }}
        -h localhost \
+{{- if .Values.tls.enabled }}
+        -p $REDIS_SENTINEL_TLS_PORT_NUMBER \
+        --tls \
+        --cert {{ template "redis.tlsCert" . }} \
+        --key {{ template "redis.tlsCertKey" . }} \
+        --cacert {{ template "redis.tlsCACert" . }} \
+{{- else }}
        -p $REDIS_SENTINEL_PORT \
+{{- end }}
        ping
    )
    if [ "$response" != "PONG" ]; then
@@ -112,6 +136,12 @@ data:
 {{- end }}
        -h $REDIS_MASTER_HOST \
        -p $REDIS_MASTER_PORT_NUMBER \
+{{- if .Values.tls.enabled }}
+        --tls \
+        --cert {{ template "redis.tlsCert" . }} \
+        --key {{ template "redis.tlsCertKey" . }} \
+        --cacert {{ template "redis.tlsCACert" . }} \
+{{- end }}
        ping
    )
    if [ "$response" != "PONG" ]; then
@@ -135,6 +165,12 @@ data:
 {{- end }}
        -h $REDIS_MASTER_HOST \
        -p $REDIS_MASTER_PORT_NUMBER \
+{{- if .Values.tls.enabled }}
+        --tls \
+        --cert {{ template "redis.tlsCert" . }} \
+        --key {{ template "redis.tlsCertKey" . }} \
+        --cacert {{ template "redis.tlsCACert" . }} \
+{{- end }}
        ping
    )
    if [ "$response" != "PONG" ] && [ "$response" != "LOADING Redis is loading the dataset in memory" ]; then
@@ -89,7 +89,19 @@ spec:
              if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then
                cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf
              fi
+              {{- if .Values.tls.enabled }}
+              ARGS=("--port" "0")
+              ARGS+=("--tls-port" "${REDIS_TLS_PORT}")
+              ARGS+=("--tls-cert-file" "${REDIS_TLS_CERT_FILE}")
+              ARGS+=("--tls-key-file" "${REDIS_TLS_KEY_FILE}")
+              ARGS+=("--tls-ca-cert-file" "${REDIS_TLS_CA_FILE}")
+              ARGS+=("--tls-auth-clients" "${REDIS_TLS_AUTH_CLIENTS}")
+              {{- if .Values.tls.dhParamsFilename }}
+              ARGS+=("--tls-dh-params-file" "${REDIS_TLS_DH_PARAMS_FILE}")
+              {{- end }}
+              {{- else }}
              ARGS=("--port" "${REDIS_PORT}")
+              {{- end }}
              {{- if .Values.usePassword }}
              ARGS+=("--requirepass" "${REDIS_PASSWORD}")
              ARGS+=("--masterauth" "${REDIS_PASSWORD}")
@@ -126,8 +138,27 @@ spec:
            - name: ALLOW_EMPTY_PASSWORD
              value: "yes"
            {{- end }}
+            - name: REDIS_TLS_ENABLED
+              value: {{ ternary "yes" "no" .Values.tls.enabled | quote }}
+            {{- if .Values.tls.enabled }}
+            - name: REDIS_TLS_PORT
+              value: {{ .Values.redisPort | quote }}
+            - name:  REDIS_TLS_AUTH_CLIENTS
+              value: {{ ternary "yes" "no" .Values.tls.authClients | quote }}
+            - name:  REDIS_TLS_CERT_FILE
+              value: {{ template "redis.tlsCert" . }}
+            - name:  REDIS_TLS_KEY_FILE
+              value: {{ template "redis.tlsCertKey" . }}
+            - name:  REDIS_TLS_CA_FILE
+              value: {{ template "redis.tlsCACert" . }}
+            {{- if .Values.tls.dhParamsFilename }}
+            - name:  REDIS_TLS_DH_PARAMS_FILE
+              value: {{ template "redis.tlsDHParams" . }}
+            {{- end }}
+            {{- else }}
            - name: REDIS_PORT
              value: {{ .Values.redisPort | quote }}
+            {{- end }}
          ports:
            - name: redis
              containerPort: {{ .Values.redisPort }}
@@ -176,6 +207,11 @@ spec:
              mountPath: /opt/bitnami/redis/mounted-etc
            - name: redis-tmp-conf
              mountPath: /opt/bitnami/redis/etc/
+            {{- if .Values.tls.enabled }}
+            - name: redis-certificates
+              mountPath: /opt/bitnami/redis/certs
+              readOnly: true
+            {{- end }}
        {{- if and .Values.cluster.enabled .Values.sentinel.enabled }}
        - name: sentinel
          image: "{{ template "sentinel.image" . }}"
@@ -209,7 +245,19 @@ spec:
              existing_sentinels=$(timeout -s 3 {{ .Values.sentinel.initialCheckTimeout }} redis-cli --raw -h {{ template "redis.fullname" . }} -a "$REDIS_PASSWORD" -p {{ .Values.sentinel.service.sentinelPort }} SENTINEL sentinels {{ .Values.sentinel.masterSet }})
              echo "$existing_sentinels" | awk -f /health/parse_sentinels.awk | tee -a  /opt/bitnami/redis-sentinel/etc/sentinel.conf

-              redis-server /opt/bitnami/redis-sentinel/etc/sentinel.conf --sentinel
+              {{- if .Values.tls.enabled }}
+              ARGS=("--port" "0")
+              ARGS+=("--tls-port" "${REDIS_SENTINEL_TLS_PORT_NUMBER}")
+              ARGS+=("--tls-cert-file" "${REDIS_SENTINEL_TLS_CERT_FILE}")
+              ARGS+=("--tls-key-file" "${REDIS_SENTINEL_TLS_KEY_FILE}")
+              ARGS+=("--tls-ca-cert-file" "${REDIS_SENTINEL_TLS_CA_FILE}")
+              ARGS+=("--tls-auth-clients" "${REDIS_SENTINEL_TLS_AUTH_CLIENTS}")
+              {{- if .Values.tls.dhParamsFilename }}
+              ARGS+=("--tls-dh-params-file" "${REDIS_SENTINEL_TLS_DH_PARAMS_FILE}")
+              {{- end }}
+              {{- end }}
+
+              redis-server /opt/bitnami/redis-sentinel/etc/sentinel.conf --sentinel {{- if .Values.tls.enabled }} "${ARGS[@]}" {{- end }}
          env:
            {{- if .Values.usePassword }}
            {{- if .Values.usePasswordFile }}
@@ -226,8 +274,27 @@ spec:
            - name: ALLOW_EMPTY_PASSWORD
              value: "yes"
            {{- end }}
+            - name: REDIS_SENTINEL_TLS_ENABLED
+              value: {{ ternary "yes" "no" .Values.tls.enabled | quote }}
+            {{- if .Values.tls.enabled }}
+            - name: REDIS_SENTINEL_TLS_PORT_NUMBER
+              value: {{ .Values.sentinel.port | quote }}
+            - name:  REDIS_SENTINEL_TLS_AUTH_CLIENTS
+              value: {{ ternary "yes" "no" .Values.tls.authClients | quote }}
+            - name:  REDIS_SENTINEL_TLS_CERT_FILE
+              value: {{ template "redis.tlsCert" . }}
+            - name:  REDIS_SENTINEL_TLS_KEY_FILE
+              value: {{ template "redis.tlsCertKey" . }}
+            - name:  REDIS_SENTINEL_TLS_CA_FILE
+              value: {{ template "redis.tlsCACert" . }}
+            {{- if .Values.tls.dhParamsFilename }}
+            - name:  REDIS_SENTINEL_TLS_DH_PARAMS_FILE
+              value: {{ template "redis.dhParams" . }}
+            {{- end }}
+            {{- else }}
            - name: REDIS_SENTINEL_PORT
              value: {{ .Values.sentinel.port | quote }}
+            {{- end }}
          ports:
            - name: redis-sentinel
              containerPort: {{ .Values.sentinel.port }}
@@ -276,6 +343,11 @@ spec:
              mountPath: /opt/bitnami/redis-sentinel/mounted-etc
            - name: sentinel-tmp-conf
              mountPath: /opt/bitnami/redis-sentinel/etc/
+            {{- if .Values.tls.enabled }}
+            - name: redis-certificates
+              mountPath: /opt/bitnami/redis/certs
+              readOnly: true
+            {{- end }}
        {{- end }}
  {{- if .Values.metrics.enabled }}
        - name: metrics
@@ -299,11 +371,22 @@ spec:
                  name: {{ template "redis.secretName" . }}
                  key: {{ template "redis.secretPasswordKey" . }}
            {{- end }}
+            {{- if .Values.tls.enabled }}
+            - name: REDIS_EXPORTER_TLS_CLIENT_KEY_FILE
+              value: {{ template "redis.tlsCertKey" . }}
+            - name: REDIS_EXPORTER_TLS_CLIENT_CERT_FILE
+              value: {{ template "redis.tlsCert" . }}
+            {{- end }}
          volumeMounts:
            {{- if .Values.usePasswordFile }}
            - name: redis-password
              mountPath: /secrets/
            {{- end }}
+            {{- if .Values.tls.enabled }}
+            - name: redis-certificates
+              mountPath: /opt/bitnami/redis/certs
+              readOnly: true
+            {{- end }}
          ports:
            - name: metrics
              containerPort: 9121
@@ -378,6 +461,12 @@ spec:
        - name: sentinel-tmp-conf
          emptyDir: {}
        {{- end }}
+        {{- if .Values.tls.enabled }}
+        - name: redis-certificates
+          secret:
+            secretName: {{ required "A secret containing the certificates for the TLS traffic is required when TLS in enabled" .Values.tls.certificatesSecret }}
+            defaultMode: 256
+        {{- end }}
  {{- if and .Values.master.persistence.enabled (not .Values.persistence.existingClaim) }}
  volumeClaimTemplates:
    - metadata:
@@ -101,7 +101,20 @@ spec:
              if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then
                cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf
              fi
+              {{- if .Values.tls.enabled }}
+              ARGS=("--port" "0")
+              ARGS+=("--tls-port" "${REDIS_TLS_PORT}")
+              ARGS+=("--tls-cert-file" "${REDIS_TLS_CERT_FILE}")
+              ARGS+=("--tls-key-file" "${REDIS_TLS_KEY_FILE}")
+              ARGS+=("--tls-ca-cert-file" "${REDIS_TLS_CA_FILE}")
+              ARGS+=("--tls-auth-clients" "${REDIS_TLS_AUTH_CLIENTS}")
+              ARGS+=("--tls-replication" "yes")
+              {{- if .Values.tls.dhParamsFilename }}
+              ARGS+=("--tls-dh-params-file" "${REDIS_TLS_DH_PARAMS_FILE}")
+              {{- end }}
+              {{- else }}
              ARGS=("--port" "${REDIS_PORT}")
+              {{- end }}
              ARGS+=("--slaveof" "${REDIS_MASTER_HOST}" "${REDIS_MASTER_PORT_NUMBER}")
              {{- if .Values.usePassword }}
              ARGS+=("--requirepass" "${REDIS_PASSWORD}")
@@ -126,8 +139,6 @@ spec:
              value: slave
            - name: REDIS_MASTER_HOST
              value: {{ template "redis.fullname" . }}-master-0.{{ template "redis.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
-            - name: REDIS_PORT
-              value: {{ .Values.redisPort | quote }}
            - name: REDIS_MASTER_PORT_NUMBER
              value: {{ .Values.redisPort | quote }}
            {{- if .Values.usePassword }}
@@ -152,6 +163,27 @@ spec:
            - name: ALLOW_EMPTY_PASSWORD
              value: "yes"
            {{- end }}
+            - name: REDIS_TLS_ENABLED
+              value: {{ ternary "yes" "no" .Values.tls.enabled | quote }}
+            {{- if .Values.tls.enabled }}
+            - name: REDIS_TLS_PORT
+              value: {{ .Values.redisPort | quote }}
+            - name:  REDIS_TLS_AUTH_CLIENTS
+              value: {{ ternary "yes" "no" .Values.tls.authClients | quote }}
+            - name:  REDIS_TLS_CERT_FILE
+              value: {{ template "redis.tlsCert" . }}
+            - name:  REDIS_TLS_KEY_FILE
+              value: {{ template "redis.tlsCertKey" . }}
+            - name:  REDIS_TLS_CA_FILE
+              value: {{ template "redis.tlsCACert" . }}
+            {{- if .Values.tls.dhParamsFilename }}
+            - name:  REDIS_TLS_DH_PARAMS_FILE
+              value: {{ template "redis.tlsDHParams" . }}
+            {{- end }}
+            {{- else }}
+            - name: REDIS_PORT
+              value: {{ .Values.redisPort | quote }}
+            {{- end }}
          ports:
            - name: redis
              containerPort: {{ .Values.redisPort }}
@@ -207,6 +239,11 @@ spec:
              mountPath: /opt/bitnami/redis/mounted-etc
            - name: redis-tmp-conf
              mountPath: /opt/bitnami/redis/etc
+            {{- if .Values.tls.enabled }}
+            - name: redis-certificates
+              mountPath: /opt/bitnami/redis/certs
+              readOnly: true
+            {{- end }}
        {{- if and .Values.cluster.enabled .Values.sentinel.enabled }}
        - name: sentinel
          image: {{ template "sentinel.image" . }}
@@ -236,7 +273,20 @@ spec:
                {{- end }}
              fi

-              redis-server /opt/bitnami/redis-sentinel/etc/sentinel.conf --sentinel
+              {{- if .Values.tls.enabled }}
+              ARGS=("--port" "0")
+              ARGS+=("--tls-port" "${REDIS_SENTINEL_TLS_PORT_NUMBER}")
+              ARGS+=("--tls-cert-file" "${REDIS_SENTINEL_TLS_CERT_FILE}")
+              ARGS+=("--tls-key-file" "${REDIS_SENTINEL_TLS_KEY_FILE}")
+              ARGS+=("--tls-ca-cert-file" "${REDIS_SENTINEL_TLS_CA_FILE}")
+              ARGS+=("--tls-replication" "yes")
+              ARGS+=("--tls-auth-clients" "${REDIS_SENTINEL_TLS_AUTH_CLIENTS}")
+              {{- if .Values.tls.dhParamsFilename }}
+              ARGS+=("--tls-dh-params-file" "${REDIS_SENTINEL_TLS_DH_PARAMS_FILE}")
+              {{- end }}
+              {{- end }}
+
+              redis-server /opt/bitnami/redis-sentinel/etc/sentinel.conf --sentinel {{- if .Values.tls.enabled }} "${ARGS[@]}" {{- end }}
          env:
            {{- if .Values.usePassword }}
            {{- if .Values.usePasswordFile }}
@@ -253,8 +303,27 @@ spec:
            - name: ALLOW_EMPTY_PASSWORD
              value: "yes"
            {{- end }}
+            - name: REDIS_SENTINEL_TLS_ENABLED
+              value: {{ ternary "yes" "no" .Values.tls.enabled | quote }}
+            {{- if .Values.tls.enabled }}
+            - name: REDIS_SENTINEL_TLS_PORT_NUMBER
+              value: {{ .Values.sentinel.port | quote }}
+            - name:  REDIS_SENTINEL_TLS_AUTH_CLIENTS
+              value: {{ ternary "yes" "no" .Values.tls.authClients | quote }}
+            - name:  REDIS_SENTINEL_TLS_CERT_FILE
+              value: {{ template "redis.tlsCert" . }}
+            - name:  REDIS_SENTINEL_TLS_KEY_FILE
+              value: {{ template "redis.tlsCertKey" . }}
+            - name:  REDIS_SENTINEL_TLS_CA_FILE
+              value: {{ template "redis.tlsCACert" . }}
+            {{- if .Values.tls.dhParamsFilename }}
+            - name:  REDIS_SENTINEL_TLS_DH_PARAMS_FILE
+              value: {{ template "redis.dhParams" . }}
+            {{- end }}
+            {{- else }}
            - name: REDIS_SENTINEL_PORT
              value: {{ .Values.sentinel.port | quote }}
+            {{- end }}
          ports:
            - name: redis-sentinel
              containerPort: {{ .Values.sentinel.port }}
@@ -303,6 +372,11 @@ spec:
              mountPath: /opt/bitnami/redis-sentinel/mounted-etc
            - name: sentinel-tmp-conf
              mountPath: /opt/bitnami/redis-sentinel/etc
+            {{- if .Values.tls.enabled }}
+            - name: redis-certificates
+              mountPath: /opt/bitnami/redis/certs
+              readOnly: true
+            {{- end }}
          {{- end }}
        {{- if .Values.metrics.enabled }}
        - name: metrics
@@ -326,11 +400,22 @@ spec:
                  name: {{ template "redis.secretName" . }}
                  key: {{ template "redis.secretPasswordKey" . }}
            {{- end }}
+            {{- if .Values.tls.enabled }}
+            - name: REDIS_EXPORTER_TLS_CLIENT_KEY_FILE
+              value: {{ template "redis.tlsCertKey" . }}
+            - name: REDIS_EXPORTER_TLS_CLIENT_CERT_FILE
+              value: {{ template "redis.tlsCert" . }}
+            {{- end }}
          volumeMounts:
            {{- if .Values.usePasswordFile }}
            - name: redis-password
              mountPath: /secrets/
            {{- end }}
+            {{- if .Values.tls.enabled }}
+            - name: redis-certificates
+              mountPath: /opt/bitnami/redis/certs
+              readOnly: true
+            {{- end }}
          ports:
            - name: metrics
              containerPort: 9121
@@ -397,6 +482,12 @@ spec:
        - name: redis-data
          emptyDir: {}
    {{- else }}
+    {{- if .Values.tls.enabled }}
+        - name: redis-certificates
+          secret:
+            secretName: {{ required "A secret containing the certificates for the TLS traffic is required when TLS in enabled" .Values.tls.certificatesSecret }}
+            defaultMode: 256
+    {{- end }}
  volumeClaimTemplates:
    - metadata:
        name: redis-data
@@ -18,7 +18,7 @@ image:
  ## Bitnami Redis image tag
  ## ref: https://github.com/bitnami/bitnami-docker-redis#supported-tags-and-respective-dockerfile-links
  ##
-  tag: 6.0.5-debian-10-r0
+  tag: 6.0.5-debian-10-r1
  ## Specify a imagePullPolicy
  ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
  ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
@@ -60,7 +60,7 @@ sentinel:
    ## Bitnami Redis image tag
    ## ref: https://github.com/bitnami/bitnami-docker-redis-sentinel#supported-tags-and-respective-dockerfile-links
    ##
-    tag: 6.0.4-debian-10-r11
+    tag: 6.0.5-debian-10-r0
    ## Specify a imagePullPolicy
    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
    ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
@@ -220,6 +220,31 @@ persistence:
 # Redis port
 redisPort: 6379

+##
+## TLS configuration
+##
+tls:
+  # Enable TLS traffic
+  enabled: false
+  #
+  # Whether to require clients to authenticate or not.
+  authClients: true
+  #
+  # Name of the Secret that contains the certificates
+  certificatesSecret:
+  #
+  # Certificate filename
+  certFilename:
+  #
+  # Certificate Key filename
+  certKeyFilename:
+  #
+  # CA Certificate filename
+  certCAFilename:
+  #
+  # File containing DH params (in order to support DH based ciphers)
+  # dhParamsFilename:
+
 ##
 ## Redis Master parameters
 ##
@@ -236,7 +261,6 @@ master:
  ## Redis additional command line flags
  ##
  ## Can be used to specify command line flags, for example:
-  ##
  ## extraFlags:
  ##  - "--maxmemory-policy volatile-ttl"
  ##  - "--repl-backlog-size 1024mb"
@@ -18,7 +18,7 @@ image:
  ## Bitnami Redis image tag
  ## ref: https://github.com/bitnami/bitnami-docker-redis#supported-tags-and-respective-dockerfile-links
  ##
-  tag: 6.0.5-debian-10-r0
+  tag: 6.0.5-debian-10-r1
  ## Specify a imagePullPolicy
  ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
  ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
@@ -60,7 +60,7 @@ sentinel:
    ## Bitnami Redis image tag
    ## ref: https://github.com/bitnami/bitnami-docker-redis-sentinel#supported-tags-and-respective-dockerfile-links
    ##
-    tag: 6.0.4-debian-10-r11
+    tag: 6.0.5-debian-10-r0
    ## Specify a imagePullPolicy
    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
    ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
@@ -220,6 +220,31 @@ persistence:
 # Redis port
 redisPort: 6379

+##
+## TLS configuration
+##
+tls:
+  # Enable TLS traffic
+  enabled: false
+  #
+  # Whether to require clients to authenticate or not.
+  authClients: true
+  #
+  # Name of the Secret that contains the certificates
+  certificatesSecret:
+  #
+  # Certificate filename
+  certFilename:
+  #
+  # Certificate Key filename
+  certKeyFilename:
+  #
+  # CA Certificate filename
+  certCAFilename:
+  #
+  # File containing DH params (in order to support DH based ciphers)
+  # dhParamsFilename:
+
 ##
 ## Redis Master parameters
 ##
@@ -236,7 +261,6 @@ master:
  ## Redis additional command line flags
  ##
  ## Can be used to specify command line flags, for example:
-  ##
  ## extraFlags:
  ##  - "--maxmemory-policy volatile-ttl"
  ##  - "--repl-backlog-size 1024mb"