deployment/production/redis-production.yml

Rama main · réplica de lectura del repositorio original.

# Production Redis Deployment with Persistence
# Phase 3: Production Caching Infrastructure

apiVersion: v1
kind: ConfigMap
metadata:
  name: redis-config
  namespace: janua-production
data:
  redis.conf: |
    # Network Configuration
    bind 0.0.0.0
    port 6379
    timeout 300
    tcp-keepalive 300
    
    # Memory Management
    maxmemory 1gb
    maxmemory-policy allkeys-lru
    
    # Persistence Configuration
    save 900 1
    save 300 10
    save 60 10000
    stop-writes-on-bgsave-error yes
    rdbcompression yes
    rdbchecksum yes
    dbfilename dump.rdb
    
    # Append Only File (AOF)
    appendonly yes
    appendfilename "appendonly.aof"
    appendfsync everysec
    no-appendfsync-on-rewrite no
    auto-aof-rewrite-percentage 100
    auto-aof-rewrite-min-size 64mb
    
    # Security
    # requirepass will be set via environment variable
    
    # Performance Optimizations
    tcp-backlog 511
    databases 16
    
    # Logging
    loglevel notice
    syslog-enabled yes
    syslog-ident redis
    
    # Slow Log
    slowlog-log-slower-than 10000
    slowlog-max-len 128

---
apiVersion: v1
kind: Secret
metadata:
  name: redis-secret
  namespace: janua-production
type: Opaque
stringData:
  REDIS_PASSWORD: "REPLACE_WITH_SECURE_REDIS_PASSWORD"
  # Redis URL for applications
  REDIS_URL: "redis://:REPLACE_WITH_SECURE_REDIS_PASSWORD@redis-service:6379/0"

---
# Redis StatefulSet for Production
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: redis
  namespace: janua-production
  labels:
    app: redis
    component: cache
spec:
  serviceName: redis-service
  replicas: 1  # Single instance, can be upgraded to cluster mode later
  selector:
    matchLabels:
      app: redis
  template:
    metadata:
      labels:
        app: redis
        component: cache
      annotations:
        prometheus.io/scrape: "false"  # Redis exporter will handle metrics
    spec:
      securityContext:
        fsGroup: 999
        runAsUser: 999
        runAsGroup: 999
      
      containers:
      - name: redis
        image: redis:7-alpine
        ports:
        - containerPort: 6379
          name: redis
        
        command:
        - redis-server
        - /etc/redis/redis.conf
        - --requirepass
        - $(REDIS_PASSWORD)
        
        env:
        - name: REDIS_PASSWORD
          valueFrom:
            secretKeyRef:
              name: redis-secret
              key: REDIS_PASSWORD
        
        resources:
          requests:
            cpu: 250m
            memory: 512Mi
          limits:
            cpu: 1000m
            memory: 1.5Gi
        
        # Health Checks
        livenessProbe:
          exec:
            command:
            - redis-cli
            - --raw
            - incr
            - ping
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
        
        readinessProbe:
          exec:
            command:
            - redis-cli
            - --raw
            - incr
            - ping
          initialDelaySeconds: 5
          periodSeconds: 5
          timeoutSeconds: 3
          successThreshold: 1
          failureThreshold: 3
        
        # Volume Mounts
        volumeMounts:
        - name: redis-data
          mountPath: /data
        - name: redis-config
          mountPath: /etc/redis/redis.conf
          subPath: redis.conf
        
        # Security Context
        securityContext:
          runAsNonRoot: true
          runAsUser: 999
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
      
      volumes:
      - name: redis-config
        configMap:
          name: redis-config
  
  volumeClaimTemplates:
  - metadata:
      name: redis-data
    spec:
      accessModes: ["ReadWriteOnce"]
      storageClassName: "fast-ssd"
      resources:
        requests:
          storage: 20Gi

---
# Redis Service
apiVersion: v1
kind: Service
metadata:
  name: redis-service
  namespace: janua-production
  labels:
    app: redis
    component: cache
spec:
  type: ClusterIP
  ports:
  - port: 6379
    targetPort: 6379
    protocol: TCP
    name: redis
  selector:
    app: redis

---
# Redis Exporter for Monitoring
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis-exporter
  namespace: janua-production
  labels:
    app: redis-exporter
    component: monitoring
spec:
  replicas: 1
  selector:
    matchLabels:
      app: redis-exporter
  template:
    metadata:
      labels:
        app: redis-exporter
        component: monitoring
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "9121"
    spec:
      containers:
      - name: redis-exporter
        image: oliver006/redis_exporter:latest
        ports:
        - containerPort: 9121
          name: metrics
        env:
        - name: REDIS_ADDR
          value: "redis://redis-service:6379"
        - name: REDIS_PASSWORD
          valueFrom:
            secretKeyRef:
              name: redis-secret
              key: REDIS_PASSWORD
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 200m
            memory: 256Mi
        securityContext:
          runAsNonRoot: true
          runAsUser: 65534
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop:
            - ALL

---
# Redis Exporter Service
apiVersion: v1
kind: Service
metadata:
  name: redis-exporter-service
  namespace: janua-production
  labels:
    app: redis-exporter
    component: monitoring
spec:
  type: ClusterIP
  ports:
  - port: 9121
    targetPort: 9121
    protocol: TCP
    name: metrics
  selector:
    app: redis-exporter