feat(manager+scheduler): add ExternalRedis TLS support (related to issue dragonflyoss/dragonly #4734)

charts/dragonfly/Chart.yaml

@@ -3,8 +3,8 @@ name: dragonfly
 description: Dragonfly is an intelligent P2P based image and file distribution system
 icon: https://raw.githubusercontent.com/dragonflyoss/dragonfly/main/docs/images/logo/dragonfly.svg
 type: application
-version: 1.6.27
-appVersion: 2.4.4-rc.1
+version: 1.6.28
+appVersion: 2.4.4-rc.2
 keywords:
   - dragonfly
   - d7y
@@ -27,7 +27,8 @@ sources:
 
 annotations:
   artifacthub.io/changes: |
-    - Centralize health probe configuration into global readinessProbe and livenessProbe settings, and fix GRPC health probe timeout parameter format.
+    - Bump dragonfly version to v2.4.4-rc.2.
+    - Add externalRedis TLS client configuration support.
 
   artifacthub.io/links: |
     - name: Chart Source

charts/dragonfly/README.md

@@ -259,6 +259,11 @@ helm delete dragonfly --namespace dragonfly-system
 | externalRedis.password | string | `""` | External redis password. |
 | externalRedis.sentinelPassword | string | `""` | External redis sentinel password. |
 | externalRedis.sentinelUsername | string | `""` | External redis sentinel addresses. |
+| externalRedis.tls | object | `{"caCert":"","cert":"","insecureSkipVerify":false,"key":""}` | TLS client configuration for external redis connection. |
+| externalRedis.tls.caCert | string | `""` | caCert is the CA certificate file path for redis TLS handshake. |
+| externalRedis.tls.cert | string | `""` | cert is the client certificate file path for redis TLS handshake. |
+| externalRedis.tls.insecureSkipVerify | bool | `false` | insecureSkipVerify controls whether the client verifies the server's certificate chain and hostname. |
+| externalRedis.tls.key | string | `""` | key is the client key file path for redis TLS handshake. |
 | externalRedis.username | string | `""` | External redis username. |
 | fullnameOverride | string | `""` | Override dragonfly fullname. |
 | global.imagePullSecrets | list | `[]` | Global Docker registry secret names as an array. |

charts/dragonfly/templates/manager/manager-configmap.yaml

@@ -73,6 +73,19 @@ data:
         db: {{ .Values.externalRedis.db }}
         brokerDB: {{ .Values.externalRedis.brokerDB }}
         backendDB: {{ .Values.externalRedis.backendDB }}
+        {{- with .Values.externalRedis.tls }}
+        {{- if or .insecureSkipVerify .caCert }}
+        tls:
+          {{- if .caCert }}
+          caCert: {{ .caCert | quote }}
+          {{- end }}
+          {{- if and .cert .key }}
+          cert: {{ .cert | quote }}
+          key: {{ .key | quote }}
+          {{- end }}
+          insecureSkipVerify: {{ .insecureSkipVerify }}
+        {{- end }}
+        {{- end }}
         {{- end }}
     cache:
 {{ toYaml .Values.manager.config.cache | indent 6 }}

charts/dragonfly/templates/scheduler/scheduler-configmap.yaml

@@ -31,6 +31,19 @@ data:
         sentinelPassword: {{ .Values.externalRedis.sentinelPassword }}
         brokerDB: {{ .Values.externalRedis.brokerDB }}
         backendDB: {{ .Values.externalRedis.backendDB }}
+        {{- with .Values.externalRedis.tls }}
+        {{- if or .insecureSkipVerify .caCert }}
+        tls:
+          {{- if .caCert }}
+          caCert: {{ .caCert | quote }}
+          {{- end }}
+          {{- if and .cert .key }}
+          cert: {{ .cert | quote }}
+          key: {{ .key | quote }}
+          {{- end }}
+          insecureSkipVerify: {{ .insecureSkipVerify }}
+        {{- end }}
+        {{- end }}
         {{- end }}
     dynconfig:
 {{ toYaml .Values.scheduler.config.dynconfig | indent 6 }}
@@ -63,6 +76,19 @@ data:
         sentinelPassword: {{ .Values.externalRedis.sentinelPassword }}
         brokerDB: {{ .Values.externalRedis.brokerDB }}
         backendDB: {{ .Values.externalRedis.backendDB }}
+        {{- with .Values.externalRedis.tls }}
+        {{- if or .insecureSkipVerify .caCert }}
+        tls:
+          {{- if .caCert }}
+          caCert: {{ .caCert | quote }}
+          {{- end }}
+          {{- if and .cert .key }}
+          cert: {{ .cert | quote }}
+          key: {{ .key | quote }}
+          {{- end }}
+          insecureSkipVerify: {{ .insecureSkipVerify }}
+        {{- end }}
+        {{- end }}
         {{- end }}
     storage:
 {{ toYaml .Values.scheduler.config.storage | indent 6 }}

charts/dragonfly/values.yaml

@@ -1938,6 +1938,17 @@ externalRedis:
   brokerDB: 1
   # -- External redis backend db.
   backendDB: 2
+  # -- TLS client configuration for external redis connection.
+  tls:
+    # -- caCert is the CA certificate file path for redis TLS handshake.
+    caCert: ''
+    # -- cert is the client certificate file path for redis TLS handshake.
+    cert: ''
+    # -- key is the client key file path for redis TLS handshake.
+    key: ''
+    # -- insecureSkipVerify controls whether the client verifies the
+    # server's certificate chain and hostname.
+    insecureSkipVerify: false
 
 injector:
   # -- Enable injector.