feat(redis): Allow loading credentials from a mounted file path

docs/faq.md

@@ -316,6 +316,34 @@ If for some reason authenticated Redis does not work for you and you want to use
 The Redis password is stored in Kubernetes secret `argocd-redis` with key `auth` in the namespace where Argo CD is installed.
 You can config your secret provider to generate Kubernetes secret accordingly.
 
+## How do I provide Redis credentials using a file mount?
+
+Redis credentials can be mounted as files in a specified directory, rather than being set directly as environment variables from a secret.
+
+**Set the Environment Variable**
+
+Set the `REDIS_CREDS_FILE_PATH` environment variable to the directory where your credential files are mounted.
+
+| Variable Name           | Description                                   |
+|-------------------------|-----------------------------------------------|
+| `REDIS_CREDS_FILE_PATH` | Path to the directory containing credential files |
+
+**Provide Credential Files**
+
+Place the following files in the specified directory:
+
+| Credential Type      | File Name           |
+|----------------------|---------------------|
+| Redis password       | `auth`              |
+| Redis username       | `auth_username`     |
+| Sentinel username    | `sentinel_username` |
+| Sentinel password    | `sentinel_auth`     |
+
+**Fallback Behavior:**  
+If a credential file is missing or cannot be read, Argo CD will automatically fall back to the corresponding environment variable (such as `REDIS_PASSWORD`, `REDIS_USERNAME`, etc.).
+
+This approach allows for more secure and flexible management of Redis credentials, especially when integrating with external secret management solutions.
+
 ## How do I fix `Manifest generation error (cached)`?
 
 `Manifest generation error (cached)` means that there was an error when generating manifests and that the error message has been cached to avoid runaway retries.

hack/start-redis-with-password.sh

@@ -2,7 +2,7 @@
 
 # Default values for environment variables
 REDIS_PORT="${ARGOCD_E2E_REDIS_PORT:-6379}"
-REDIS_IMAGE_TAG=$(grep 'image: redis' manifests/base/redis/argocd-redis-deployment.yaml | cut -d':' -f3)
+REDIS_IMAGE_TAG=$(grep -A1 "name: redis" manifests/base/redis/argocd-redis-deployment.yaml | grep "image:" | cut -d':' -f3)
 
 if [ "$ARGOCD_REDIS_LOCAL" = 'true' ]; then
     if ! command -v redis-server &>/dev/null; then

manifests/base/application-controller-deployment/argocd-application-controller-deployment.yaml

@@ -20,6 +20,8 @@ spec:
       - args:
         - /usr/local/bin/argocd-application-controller
         env:
+        - name: REDIS_CREDS_FILE_PATH
+          value: "/run/secrets/argocd/redis-auth"
         - name: REDIS_PASSWORD
           valueFrom:
             secretKeyRef:
@@ -287,6 +289,9 @@ spec:
           mountPath: /home/argocd
         - name: argocd-cmd-params-cm
           mountPath: /home/argocd/params
+        - name: redis-creds
+          mountPath: "/run/secrets/argocd/redis-auth"
+          readOnly: true    
       serviceAccountName: argocd-application-controller
       affinity:
         podAntiAffinity:
@@ -324,5 +329,12 @@ spec:
           items:
           - key: controller.profile.enabled
             path: profiler.enabled
+      - name: redis-creds
+        secret:
+          secretName: argocd-redis
+          items:
+            - key: auth
+              path: auth
+          optional: true      
       nodeSelector:
         kubernetes.io/os: linux

manifests/base/application-controller/argocd-application-controller-statefulset.yaml

@@ -21,6 +21,8 @@ spec:
       - args:
         - /usr/local/bin/argocd-application-controller
         env:
+        - name: REDIS_CREDS_FILE_PATH
+          value: "/run/secrets/argocd/redis-auth"
         - name: REDIS_PASSWORD
           valueFrom:
             secretKeyRef:
@@ -306,6 +308,9 @@ spec:
           mountPath: /home/argocd/params
         - name: argocd-application-controller-tmp
           mountPath: /tmp
+        - name: redis-creds
+          mountPath: "/run/secrets/argocd/redis-auth"
+          readOnly: true  
       serviceAccountName: argocd-application-controller
       affinity:
         podAntiAffinity:
@@ -345,5 +350,12 @@ spec:
           items:
             - key: controller.profile.enabled
               path: profiler.enabled
+      - name: redis-creds
+        secret:
+          secretName: argocd-redis
+          items:
+            - key: auth
+              path: auth
+          optional: true            
       nodeSelector:
         kubernetes.io/os: linux

manifests/base/redis/argocd-redis-cm.yaml

@@ -0,0 +1,54 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-redis-cm
+  labels:
+    app.kubernetes.io/name: argocd-redis
+    app.kubernetes.io/part-of: argocd
+    app.kubernetes.io/component: redis
+data:
+  init.sh: |
+    echo "$(date) Start..."
+    REDIS_CONF=/data/conf/redis.conf
+
+    mkdir -p /data/conf
+
+    echo "Copying default redis config.."
+    cp /readonly-config/redis.conf "${REDIS_CONF}"
+
+    # Determine which source to use for the Redis password
+    if [ -n "${REDIS_CREDS_FILE_PATH}" ] && [ -f "${REDIS_CREDS_FILE_PATH}/auth" ]; then
+      file_auth="$(< "${REDIS_CREDS_FILE_PATH}/auth" tr -d '\n\r')"
+      if [ -n "$file_auth" ]; then
+        echo "Retrieved Redis credentials from file."
+        REDIS_PASSWORD="$file_auth"
+      elif [ -n "${REDIS_PASSWORD:-}" ]; then
+        echo "Retrieved Redis password from environment (file was empty)."
+      else
+        echo "ERROR: Redis credential file is empty and no environment variable set."
+        exit 1
+      fi
+
+    elif [ -n "${REDIS_PASSWORD:-}" ]; then
+      # No valid file, but env var is set
+      echo "Retrieved Redis password from environment."
+    else
+      # Neither source provided anything
+      echo "WARNING: Redis password not set via file or environment."
+      exit 1
+    fi
+
+    echo "Setting redis auth values.."
+    ESCAPED_AUTH=$(echo "${REDIS_PASSWORD}" | sed -e 's/[\/&]/\\&/g');
+    sed -i "s/replace-default-auth/${ESCAPED_AUTH}/" "${REDIS_CONF}"
+
+    echo "$(date) Ready..."
+  redis.conf: |
+    # Redis configuration file template
+
+    dir "/data"
+    port 6379
+    bind 0.0.0.0
+    appendonly no
+    save ""
+    requirepass replace-default-auth

manifests/base/redis/argocd-redis-deployment.yaml

@@ -32,6 +32,36 @@ spec:
             runAsNonRoot: true
             seccompProfile:
               type: RuntimeDefault
+        - name: config-init
+          image: redis:7.2.7-alpine
+          command: 
+          - "sh"
+          - "/readonly-config/init.sh"
+          env:
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  key: auth
+                  name: argocd-redis
+            - name: REDIS_CREDS_FILE_PATH
+              value: "/run/secrets/argocd/redis-auth"
+          volumeMounts:
+            - name: config
+              mountPath: /readonly-config
+            - name: data
+              mountPath: /data
+            - name: redis-creds
+              mountPath: "/run/secrets/argocd/redis-auth"
+              readOnly: true
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: false
+            runAsNonRoot: true
+            seccompProfile:
+              type: RuntimeDefault      
       securityContext:
         runAsNonRoot: true
         runAsUser: 999
@@ -43,17 +73,8 @@ spec:
         image: redis:7.2.7-alpine
         imagePullPolicy: Always
         args:
-        - "--save"
-        - ""
-        - "--appendonly"
-        - "no"
-        - --requirepass $(REDIS_PASSWORD)
-        env:
-          - name: REDIS_PASSWORD
-            valueFrom:
-              secretKeyRef:
-                key: auth
-                name: argocd-redis
+        - "redis-server"
+        - "/data/conf/redis.conf"
         ports:
         - containerPort: 6379
         securityContext:
@@ -62,6 +83,22 @@ spec:
           capabilities:
             drop:
             - ALL
+        volumeMounts:
+          - name: data
+            mountPath: /data   
+      volumes:
+        - name: config
+          configMap:
+            name: argocd-redis-cm
+        - name: data
+          emptyDir: {}
+        - name: redis-creds
+          secret:
+            secretName: argocd-redis
+            items:
+              - key: auth
+                path: auth
+            optional: true  
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:

manifests/base/redis/kustomization.yaml

@@ -8,6 +8,7 @@ resources:
   - argocd-redis-network-policy.yaml
   - argocd-redis-role.yaml
   - argocd-redis-rolebinding.yaml
+  - argocd-redis-cm.yaml
 
 images:
   - name: redis

manifests/base/repo-server/argocd-repo-server-deployment.yaml

@@ -24,6 +24,8 @@ spec:
         args:
           - /usr/local/bin/argocd-repo-server
         env:
+          - name: REDIS_CREDS_FILE_PATH
+            value: "/run/secrets/argocd/redis-auth"
           - name: REDIS_PASSWORD
             valueFrom:
               secretKeyRef:
@@ -284,6 +286,9 @@ spec:
           seccompProfile:
             type: RuntimeDefault
         volumeMounts:
+        - name: redis-creds
+          mountPath: "/run/secrets/argocd/redis-auth"
+          readOnly: true
         - name: ssh-known-hosts
           mountPath: /app/config/ssh
         - name: tls-certs
@@ -321,6 +326,13 @@ spec:
         - mountPath: /var/run/argocd
           name: var-files
       volumes:
+        - name: redis-creds
+          secret:
+            secretName: argocd-redis
+            items:
+              - key: auth
+                path: auth
+            optional: true      
         - name: ssh-known-hosts
           configMap:
             name: argocd-ssh-known-hosts-cm

manifests/base/server/argocd-server-deployment.yaml

@@ -23,6 +23,8 @@ spec:
           args:
             - /usr/local/bin/argocd-server
           env:
+            - name: REDIS_CREDS_FILE_PATH
+              value: "/run/secrets/argocd/redis-auth"
             - name: REDIS_PASSWORD
               valueFrom:
                 secretKeyRef:
@@ -311,6 +313,9 @@ spec:
                   key: server.sync.replace.allowed
                   optional: true
           volumeMounts:
+            - name: redis-creds
+              mountPath: "/run/secrets/argocd/redis-auth"
+              readOnly: true
             - name: ssh-known-hosts
               mountPath: /app/config/ssh
             - name: tls-certs
@@ -351,6 +356,13 @@ spec:
             seccompProfile:
               type: RuntimeDefault
       volumes:
+        - name: redis-creds
+          secret:
+            secretName: argocd-redis
+            items:
+              - key: auth
+                path: auth
+            optional: true
         - emptyDir: {}
           name: plugins-home
         - emptyDir: {}