fix(helm): bundle Redis in secret-manager modes unless the URL is supplied

Suppressing Redis whenever a secret mode was active left those deployments
with no Redis at all — REDIS_URL is optional there and both shipped examples
omit it. The chart now steps aside only on a detectable signal: an explicit
app.env.REDIS_URL, an ESO remoteRefs.app.REDIS_URL mapping, or the new
redis.provideUrl=false opt-out for a pre-created Secret it cannot read.

Author: waleedlatif1

apps/docs/content/docs/en/platform/self-hosting/redis.mdx

@@ -58,7 +58,12 @@ app:
     REDIS_URL: "rediss://:<password>@my-cache.internal:6380"
 ```
 
-`app.env.REDIS_URL` takes over whenever `redis.enabled` is false. Setting it there is enough — the chart writes every `app.env` key into one Secret that **both** the app and realtime Deployments consume via `envFrom`. Supply it through your secret store rather than plain values; it contains a password, and `externalSecrets.remoteRefs.app.REDIS_URL` is supported.
+`app.env.REDIS_URL` takes over whenever it is set, and the chart skips the bundled instance so you do not get a stray pod.
+
+If the URL lives in a secret store rather than in values:
+
+- **External Secrets** — map `externalSecrets.remoteRefs.app.REDIS_URL`. The chart detects the mapping and steps aside automatically.
+- **Pre-created Secret** (`app.secrets.existingSecret`) — set `redis.provideUrl: false`. The chart cannot read your Secret, so without this it would inject a computed `REDIS_URL` that takes precedence over `envFrom` and shadows your value.
 
 The bundled Redis is deliberately non-persistent (`--save ""`, `--appendonly no`) with a 512 MB cap: Sim stores coordination state and short-lived keys in it, so a restart costs in-flight live updates rather than committed data.
 

helm/sim/README.md

@@ -473,17 +473,17 @@ Two changes alter behavior on an existing release. Neither requires action, but
 
 * **Free-tier plan limits are no longer preset.** `app.envDefaults` previously shipped `RATE_LIMIT_FREE_SYNC`, `RATE_LIMIT_FREE_ASYNC`, `EXECUTION_TIMEOUT_FREE`, `EXECUTION_TIMEOUT_ASYNC_FREE`, `FREE_TABLES_LIMIT: 3`, and `FREE_TABLE_ROWS_LIMIT: 1000`. With billing disabled the application treats these as **opt-in** — unset means unlimited — so presetting them imposed hosted-plan caps on self-hosted deployments and diverged from Docker Compose, which presets nothing. They are now commented out. **On upgrade, these limits stop being enforced.** To keep them, set the keys explicitly under `app.env`. An explicitly set value has always taken precedence and is unaffected.
 
-* **Redis is now bundled** (`redis.enabled: true`), matching the Docker Compose stack. Redis backs pub/sub and the Socket.IO adapter, and multi-replica deployments silently drop cross-pod events without it. The chart only manages Redis when it can be sure you are not supplying it yourself, so no upgrade reroutes an existing instance:
+* **Redis is now bundled** (`redis.enabled: true`), matching the Docker Compose stack. Redis backs pub/sub and the Socket.IO adapter, and multi-replica deployments silently drop cross-pod events without it. The chart steps aside whenever it can tell you are supplying `REDIS_URL` yourself, so no upgrade reroutes an existing instance:
 
   | Your configuration | Bundled Redis | `REDIS_URL` |
   |---|---|---|
   | Default install | Deployed | Points at the bundled instance |
   | `app.env.REDIS_URL` set | Not deployed | Your value |
-  | `app.secrets.existingSecret.enabled` | Not deployed | Whatever your Secret contains — the chart injects nothing |
-  | `externalSecrets.enabled` | Not deployed | Whatever ESO syncs — the chart injects nothing |
+  | `externalSecrets.remoteRefs.app.REDIS_URL` mapped | Not deployed | Synced by ESO — detected automatically |
+  | `redis.provideUrl: false` | Not deployed | Whatever your pre-created Secret contains |
   | `redis.enabled: false` | Not deployed | Unset unless you provide it |
 
-  The two secret-manager rows matter: those modes carry `REDIS_URL` out-of-band where the chart cannot read it, and a chart-computed `env` entry would take precedence over `envFrom` and silently shadow it. Rendering is therefore byte-identical to 1.4.0 in both modes. To use the bundled Redis while running a secret manager, set `app.env.REDIS_URL` to the in-cluster address (`redis://<release>-redis:6379`) explicitly — it is not a secret.
+  **If you use `app.secrets.existingSecret` and that Secret already contains `REDIS_URL`, set `redis.provideUrl: false`.** The chart cannot read a pre-created Secret, so it would otherwise inject a computed `REDIS_URL` as a container `env` entry, which takes precedence over `envFrom` and would shadow your value. External Secrets needs no such flag — mapping `remoteRefs.app.REDIS_URL` is detected on its own.
 
 ## Upgrading to 1.2.0
 

helm/sim/examples/values-existing-secret.yaml

@@ -69,3 +69,7 @@ postgresql:
 # kubectl create secret generic sim-postgresql-secret \
 #   --namespace sim \
 #   --from-literal=POSTGRES_PASSWORD="$(openssl rand -base64 16 | tr -d '/+=')"
+
+# Redis: the chart bundles one by default and wires REDIS_URL to it. If the
+# Secret referenced above already contains REDIS_URL, set redis.provideUrl=false
+# so the chart does not shadow it.

helm/sim/examples/values-external-secrets.yaml

@@ -124,3 +124,7 @@ postgresql:
 #         kubernetes:
 #           mountPath: "kubernetes"
 #           role: "external-secrets"
+
+# Redis: the chart bundles one by default and wires REDIS_URL to it. To use a
+# managed Redis instead, map externalSecrets.remoteRefs.app.REDIS_URL — the
+# chart detects that and steps aside.

helm/sim/templates/_helpers.tpl

@@ -465,33 +465,44 @@ PII (Presidio) service URL
 {{- end }}
 
 {{/*
-Whether the chart owns Redis for this release.
-
-False when the operator is supplying REDIS_URL out-of-band — either explicitly in
-app.env, or through a pre-created Secret / External Secrets, where the chart
-cannot see the value. In those modes emitting a computed REDIS_URL as a container
-`env` would shadow the operator's value (env beats envFrom), silently rerouting a
-managed Redis to an empty in-cluster one on upgrade. Deploying an unused Redis pod
-alongside it would be wrong too, so both are skipped.
+Whether the operator is supplying REDIS_URL themselves.
+
+Three detectable signals:
+  - app.env.REDIS_URL set explicitly
+  - externalSecrets.remoteRefs.app.REDIS_URL mapped (ESO syncs it into the Secret)
+  - redis.provideUrl=false, the opt-out for a pre-created Secret that already
+    contains REDIS_URL, which the chart cannot read at render time
+
+When any holds, the chart neither deploys Redis nor emits a computed REDIS_URL —
+a container `env` entry beats `envFrom`, so emitting one would silently shadow
+the operator's value and reroute a managed Redis to an empty in-cluster instance.
+*/}}
+{{- define "sim.redisUrlSuppliedByOperator" -}}
+{{- $esoRef := "" -}}
+{{- if .Values.externalSecrets.enabled -}}
+{{- $esoRef = dig "remoteRefs" "app" "REDIS_URL" "" .Values.externalSecrets -}}
+{{- end -}}
+{{- if or (.Values.app.env.REDIS_URL | default "") $esoRef (not .Values.redis.provideUrl) -}}
+true
+{{- end -}}
+{{- end }}
 
-To use the bundled Redis while running a secret manager, set
-app.env.REDIS_URL to the in-cluster address explicitly — it is not a secret.
+{{/*
+Whether the chart owns Redis for this release: enabled, and the operator is not
+supplying a URL themselves. Secret-manager modes alone do NOT suppress it —
+doing so left those deployments with no Redis at all, since REDIS_URL is optional
+and the shipped examples omit it.
 */}}
 {{- define "sim.chartManagesRedis" -}}
-{{- $externalUrl := .Values.app.env.REDIS_URL | default "" -}}
-{{- $secretMode := or
-      (and .Values.app.secrets .Values.app.secrets.existingSecret .Values.app.secrets.existingSecret.enabled)
-      .Values.externalSecrets.enabled -}}
-{{- if and .Values.redis.enabled (not $externalUrl) (not $secretMode) -}}
+{{- if and .Values.redis.enabled (not (include "sim.redisUrlSuppliedByOperator" .)) -}}
 true
 {{- end -}}
 {{- end }}
 
 {{/*
-Redis URL used as a chart-computed container env. Only emitted when the chart
-owns Redis (see sim.chartManagesRedis) or when app.env.REDIS_URL is set
-explicitly. Empty otherwise, so a Secret-supplied value flows through envFrom
-untouched.
+Redis URL emitted as a chart-computed container env. Only set when the chart owns
+Redis, or when app.env.REDIS_URL is given explicitly. Empty otherwise, so a
+Secret- or ESO-supplied value flows through envFrom untouched.
 */}}
 {{- define "sim.redisUrl" -}}
 {{- $external := .Values.app.env.REDIS_URL | default "" -}}

helm/sim/tests/redis_test.yaml

@@ -114,35 +114,49 @@ tests:
             name: FREE_TABLES_LIMIT
             value: "3"
 
-  # Secret-manager modes carry REDIS_URL out-of-band, where the chart cannot see
-  # it. Emitting a computed REDIS_URL as inline `env` would beat `envFrom` and
-  # silently reroute a managed Redis to an empty in-cluster one on upgrade.
-  - it: does not inject REDIS_URL in existingSecret mode
+  # A secret mode alone must NOT suppress Redis — REDIS_URL is optional there and
+  # the shipped examples omit it, so suppressing would leave no Redis at all.
+  - it: still bundles Redis in existingSecret mode when no URL is supplied
+    template: deployment-redis.yaml
+    set:
+      app.secrets.existingSecret.enabled: true
+      app.secrets.existingSecret.name: my-app-secrets
+    asserts:
+      - hasDocuments:
+          count: 2
+
+  # ...but the operator can opt out when their pre-created Secret already has it,
+  # which the chart cannot read at render time.
+  - it: honours redis.provideUrl=false for a Secret that already carries REDIS_URL
     template: deployment-app.yaml
     set:
       app.secrets.existingSecret.enabled: true
       app.secrets.existingSecret.name: my-app-secrets
+      redis.provideUrl: false
     asserts:
       - notContains:
           path: spec.template.spec.containers[0].env
           content:
             name: REDIS_URL
             value: "redis://t-sim-redis:6379"
 
-  - it: does not bundle Redis in existingSecret mode
+  - it: deploys no Redis when provideUrl is false
     template: deployment-redis.yaml
     set:
       app.secrets.existingSecret.enabled: true
       app.secrets.existingSecret.name: my-app-secrets
+      redis.provideUrl: false
     asserts:
       - hasDocuments:
           count: 0
 
-  - it: does not inject REDIS_URL in External Secrets mode
+  # ESO exposes a detectable signal, so no manual opt-out is needed there.
+  - it: detects an ESO-mapped REDIS_URL and steps aside
     template: deployment-app.yaml
     set:
       externalSecrets.enabled: true
       externalSecrets.secretStoreRef.name: my-store
+      externalSecrets.remoteRefs.app.REDIS_URL: sim/app/redis-url
       externalSecrets.remoteRefs.app.BETTER_AUTH_SECRET: sim/app/better-auth-secret
       externalSecrets.remoteRefs.app.ENCRYPTION_KEY: sim/app/encryption-key
       externalSecrets.remoteRefs.app.INTERNAL_API_SECRET: sim/app/internal-api-secret
@@ -155,7 +169,7 @@ tests:
             name: REDIS_URL
             value: "redis://t-sim-redis:6379"
 
-  - it: does not bundle Redis in External Secrets mode
+  - it: still bundles Redis under ESO when REDIS_URL is not mapped
     template: deployment-redis.yaml
     set:
       externalSecrets.enabled: true
@@ -167,16 +181,4 @@ tests:
       externalSecrets.remoteRefs.postgresql.password: sim/postgresql/password
     asserts:
       - hasDocuments:
-          count: 0
-
-  - it: realtime also gets no computed REDIS_URL in existingSecret mode
-    template: deployment-realtime.yaml
-    set:
-      app.secrets.existingSecret.enabled: true
-      app.secrets.existingSecret.name: my-app-secrets
-    asserts:
-      - notContains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: REDIS_URL
-            value: "redis://t-sim-redis:6379"
+          count: 2

helm/sim/values.yaml

@@ -106,7 +106,7 @@ app:
     # Optional: API Key Encryption (RECOMMENDED for production)
     # Generate with: openssl rand -hex 32 (produces the required 64-hex-char / 32-byte value).
     API_ENCRYPTION_KEY: ""  # OPTIONAL - encrypts API keys at rest; if unset, keys are stored in plain text
-    REDIS_URL: ""           # OPTIONAL - external Redis connection string. Takes precedence over the bundled Redis (see the `redis:` section) and suppresses it. May also come from a pre-created Secret or External Secrets; in those modes the chart injects no REDIS_URL and deploys no bundled Redis, so your value is used as-is.
+    REDIS_URL: ""           # OPTIONAL - external Redis connection string. Takes precedence over the bundled Redis (see the `redis:` section) and suppresses it. If it instead comes from a pre-created Secret, set redis.provideUrl=false; if from External Secrets, map externalSecrets.remoteRefs.app.REDIS_URL and the chart detects it.
 
     # Email & Communication
     # Configure one provider — the mailer auto-detects in priority order:
@@ -564,6 +564,13 @@ realtime:
 redis:
   enabled: true
 
+  # Inject REDIS_URL pointing at the bundled instance. Set false when you run
+  # `app.secrets.existingSecret` and that Secret already contains REDIS_URL —
+  # the chart cannot read a pre-created Secret, and a computed env entry would
+  # take precedence over it. Not needed for External Secrets: mapping
+  # externalSecrets.remoteRefs.app.REDIS_URL is detected automatically.
+  provideUrl: true
+
   image:
     repository: redis
     tag: "7-alpine"