helm: add Redis TLS to the fleet chart, mirroring database.tls

[yaroslavmokflmg]

Why

A managed Redis (Memorystore, ElastiCache) accepts only TLS connections and signs its certificate
with a private CA. The chart had no way to turn TLS on, and no way to hand the client a CA, so the
only Redis it could reach was a plaintext in-cluster one.

What

cache.tls mirrors database.tls one for one — same shape, same whole-Secret mount, same
fallback rules.

values key	env var	notes
cache.tls.enabled	FLEET_REDIS_USE_TLS	off by default
cache.tls.caCertKey	FLEET_REDIS_TLS_CA	key inside the Secret, becomes /secrets/redis/<key>
cache.tls.serverName	FLEET_REDIS_TLS_SERVER_NAME	only when the certificate names a host the address does not
cache.tls.existingSecret	—	Secret mounted at /secrets/redis; falls back to cache.secretName

Both workloads that open a Redis connection are covered: the Fleet server and the vuln-processing
cron. Nothing else is needed for a clustered managed Redis —
redis_cluster_follow_redirections defaults to true, so MOVED replies from a discovery endpoint
are followed.

Files

file	change
charts/fleet/values.yaml	cache.tls block
charts/fleet/templates/deployment.yaml	env, volume mount, volume
charts/fleet/templates/vulnprocessing/cronjob.yaml	the same three, for the cron
openframe/docs/helm-chart.md	"Redis TLS" section, table row, Files-changed row

Compatibility

Default is enabled: false, so an in-cluster Redis renders byte for byte as before.

[github-actions]

🦩 Flamingo Code Review

No findings on the current head.

Mode: advisory

---

Need another pass? Commits pushed after this review are not reviewed automatically.

• Review the new commits — the commits added since this review
• Review the whole diff again — ignoring what was already reviewed

Prefer typing? Comment @flamingo-review, or @flamingo-review full. To review every push on this pull request, add the flamingo-review-always label.

React 👍/👎 on inline comments to teach the reviewer.

Started 2026-09-15 20:43 UTC · updated 2026-09-15 20:43 UTC · workflow run