feat: switch to dandydeveloper/redis-ha chart

Signed-off-by: Jan Larwig <[email protected]>

Author: tuunit

.github/workflows/release.yaml

@@ -24,7 +24,7 @@ jobs:
 
       - name: Add Helm repositories
         run: |
-          helm repo add bitnami https://charts.bitnami.com/bitnami
+          helm repo add dandydev https://dandydeveloper.github.io/charts
 
       - name: Run chart-releaser
         uses: helm/[email protected]

ct.yaml

@@ -5,4 +5,4 @@ chart-dirs:
 target-branch: main
 # helm-extra-args: --timeout 600s
 chart-repos:
-  - bitnami=https://charts.bitnami.com/bitnami
+  - dandydev=https://dandydeveloper.github.io/charts

helm/oauth2-proxy/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
-- name: redis
-  repository: https://charts.bitnami.com/bitnami
-  version: 22.0.1
-digest: sha256:7e8f393290629839ef212fb63e9ab4c5170ccba3da30c06c464a554987fcbb45
-generated: "2025-08-11T14:45:37.460990457Z"
+- name: redis-ha
+  repository: https://dandydeveloper.github.io/charts
+  version: 4.33.8
+digest: sha256:99abe093ebc97b930cad234e3bce566bb55e11ed0b2324e195d9783aaf5d1ace
+generated: "2025-08-13T08:08:37.645426006+02:00"

helm/oauth2-proxy/Chart.yaml

@@ -1,5 +1,5 @@
 name: oauth2-proxy
-version: 7.18.0
+version: 8.0.0
 apiVersion: v2
 appVersion: 7.11.0
 home: https://oauth2-proxy.github.io/oauth2-proxy/
@@ -13,9 +13,9 @@ keywords:
   - github
   - redis
 dependencies:
-  - name: redis
-    version: 22.0.1
-    repository: https://charts.bitnami.com/bitnami
+  - name: redis-ha
+    version: 4.33.8
+    repository: https://dandydeveloper.github.io/charts
     alias: redis
     condition: redis.enabled
 sources:
@@ -31,10 +31,8 @@ maintainers:
 kubeVersion: ">=1.16.0-0"
 annotations:
   artifacthub.io/changes: |
-    - kind: added
-      description: Added support for PodDisruptionBudget unhealthyPodEvictionPolicy
+    - kind: changed
+      description: Replace Redis chart by bitnami with dandydeveloper/redis-ha chart
       links:
         - name: Github PR
-          url: https://github.com/oauth2-proxy/manifests/pull/336
-        - name: Kubernetes documentation
-          url: https://kubernetes.io/docs/tasks/run-application/configure-pdb/#unhealthy-pod-eviction-policy
+          url: https://github.com/oauth2-proxy/manifests/pull/335

helm/oauth2-proxy/ci/redis-sentinel-array-values.yaml

@@ -8,17 +8,16 @@ sessionStorage:
       connectionUrls:
         - "redis://oauth2-proxy-redis:26379"
         - "redis://oauth2-proxy-redis:26379"
+
+# provision an instance of the redis-ha sub-chart
 redis:
-  # provision an instance of the redis sub-chart
   enabled: true
   fullnameOverride: oauth2-proxy-redis
-  architecture: replication
-  sentinel:
-    enabled: true
-    masterSet: mymaster
-  global:
-    redis:
-      password: "foo"
+  replicas: 3
+  redisPassword: "foo"
+  redis:
+    masterGroupName: mymaster
+
 initContainers:
   waitForRedis:
     enabled: true

helm/oauth2-proxy/ci/redis-sentinel-comma-values.yaml

@@ -6,17 +6,16 @@ sessionStorage:
       password: "foo"
       masterName: "mymaster"
       connectionUrls: "redis://oauth2-proxy-redis:26379,redis://oauth2-proxy-redis:26379"
+
+# provision an instance of the redis-ha sub-chart
 redis:
-  # provision an instance of the redis sub-chart
   enabled: true
   fullnameOverride: oauth2-proxy-redis
-  architecture: replication
-  sentinel:
-    enabled: true
-    masterSet: mymaster
-  global:
-    redis:
-      password: "foo"
+  replicas: 3
+  redisPassword: "foo"
+  redis:
+    masterGroupName: mymaster
+
 initContainers:
   waitForRedis:
     enabled: true

helm/oauth2-proxy/ci/redis-standalone-values.yaml

@@ -3,13 +3,14 @@ sessionStorage:
   redis:
     clientType: "standalone"
     password: "foo"
+
+# provision an instance of the redis-ha sub-chart
 redis:
-  # provision an instance of the redis sub-chart
   enabled: true
-  architecture: standalone
-  global:
-    redis:
-      password: "foo"
+  fullnameOverride: oauth2-proxy-redis
+  replicas: 1
+  redisPassword: "foo"
+
 initContainers:
   waitForRedis:
     enabled: true

helm/oauth2-proxy/templates/_helpers.tpl

@@ -94,7 +94,7 @@ Redis subcharts fullname
 */}}
 {{- define "oauth2-proxy.redis.fullname" -}}
 {{- if .Values.redis.enabled -}}
-{{- include "common.names.fullname" (dict "Chart" (dict "Name" "redis") "Release" .Release "Values" .Values.redis) -}}
+{{- include "redis-ha.fullname" (dict "Chart" (dict "Name" "redis-ha") "Release" .Release "Values" .Values.redis) -}}
 {{- else -}}
 {{ fail "attempting to use redis subcharts fullname, even though the subchart is not enabled. This will lead to misconfiguration" }}
 {{- end -}}
@@ -107,7 +107,7 @@ Compute the redis url if not set explicitly.
 {{- if .Values.sessionStorage.redis.standalone.connectionUrl -}}
 {{ .Values.sessionStorage.redis.standalone.connectionUrl }}
 {{- else if .Values.redis.enabled -}}
-{{- printf "redis://%s-master:%.0f" (include "oauth2-proxy.redis.fullname" .) .Values.redis.master.service.ports.redis -}}
+{{- printf "redis://%s-master:%.0f" (include "oauth2-proxy.redis.fullname" .) .Values.redis.redis.port -}}
 {{- else -}}
 {{ fail "please set sessionStorage.redis.standalone.connectionUrl or enable the redis subchart via redis.enabled" }}
 {{- end -}}

helm/oauth2-proxy/templates/deployment.yaml

@@ -199,7 +199,7 @@ spec:
         {{- if eq (default "cookie" .Values.sessionStorage.type) "redis" }}
         - name: OAUTH2_PROXY_SESSION_STORE_TYPE
           value: "redis"
-         {{- if or .Values.sessionStorage.redis.existingSecret .Values.sessionStorage.redis.password (and .Values.redis.enabled (.Values.redis.auth).enabled )}}
+         {{- if or .Values.sessionStorage.redis.existingSecret .Values.sessionStorage.redis.password (and .Values.redis.enabled (.Values.redis.auth))}}
         - name: OAUTH2_PROXY_REDIS_PASSWORD
           valueFrom:
             secretKeyRef:

helm/oauth2-proxy/values.yaml

@@ -31,7 +31,8 @@ config:
   # The name of the cookie that oauth2-proxy will create
   # If left empty, it will default to the release name
   cookieName: ""
-  google: {}
+  google:
+    {}
     # adminEmail: xxxx
     # useApplicationDefaultCredentials: true
     # targetPrincipal: xxxx
@@ -83,7 +84,8 @@ image:
 # Optionally specify an array of imagePullSecrets.
 # Secrets must be manually created in the namespace.
 # ref: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
-imagePullSecrets: []
+imagePullSecrets:
+  []
   # - name: myRegistryKeySecretName
 
 # Set a custom containerPort if required.
@@ -183,7 +185,7 @@ ingress:
   pathType: ImplementationSpecific
   # Used to create an Ingress record.
   # hosts:
-    # - chart-example.local
+  # - chart-example.local
   # Extra paths to prepend to every host configuration. This is useful when working with annotation based services.
   # Warning! The configuration is dependant on your current k8s API version capabilities (networking.k8s.io/v1)
   # extraPaths:
@@ -199,35 +201,40 @@ ingress:
   #   kubernetes.io/ingress.class: nginx
   #   kubernetes.io/tls-acme: "true"
   # tls:
-    # Secrets must be manually created in the namespace.
-    # - secretName: chart-example-tls
-    #   hosts:
-    #     - chart-example.local
+  # Secrets must be manually created in the namespace.
+  # - secretName: chart-example-tls
+  #   hosts:
+  #     - chart-example.local
 
-resources: {}
+resources:
+  {}
   # limits:
   #   cpu: 100m
   #   memory: 300Mi
   # requests:
   #   cpu: 100m
   #   memory: 300Mi
 
-extraVolumes: []
+extraVolumes:
+  []
   # - name: ca-bundle-cert
   #   secret:
   #     secretName: <secret-name>
 
-extraVolumeMounts: []
+extraVolumeMounts:
+  []
   # - mountPath: /etc/ssl/certs/
   #   name: ca-bundle-cert
 
 # Additional containers to be added to the pod.
-extraContainers: []
+extraContainers:
+  []
   #  - name: my-sidecar
   #    image: nginx:latest
 
 # Additional Init containers to be added to the pod.
-extraInitContainers: []
+extraInitContainers:
+  []
   #  - name: wait-for-idp
   #    image: my-idp-wait:latest
   #    command:
@@ -288,7 +295,7 @@ securityContext:
   allowPrivilegeEscalation: false
   capabilities:
     drop:
-    - ALL
+      - ALL
   readOnlyRootFilesystem: true
   runAsNonRoot: true
   runAsUser: 2000
@@ -327,7 +334,8 @@ autoscaling:
   annotations: {}
   # Configure HPA behavior policies for scaling if needed
   # Ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#configuring-scaling-behavior
-  behavior: {}
+  behavior:
+    {}
     # scaleDown:
     #   stabilizationWindowSeconds: 300
     #   policies:
@@ -380,7 +388,8 @@ initContainers:
       seccompProfile:
         type: RuntimeDefault
     timeout: 180
-    resources: {}
+    resources:
+      {}
       # limits:
       #   cpu: 100m
       #   memory: 300Mi
@@ -435,19 +444,25 @@ sessionStorage:
       # - "redis://127.0.0.1:8000"
       # - "redis://127.0.0.1:8001"
 
-# Enables and configure the automatic deployment of the redis subchart
+# Enables and configure the automatic deployment of the redis-ha subchart
 redis:
-  # provision an instance of the redis sub-chart
+  # provision an instance of the redis-ha sub-chart
   enabled: false
   # Redis specific helm chart settings, please see:
-  # https://github.com/bitnami/charts/tree/master/bitnami/redis#parameters
-  # global:
-  #   redis:
-  #     password: yourpassword
+  # https://artifacthub.io/packages/helm/dandydev-charts/redis-ha#general-parameters
+  #
+  # Recommended:
+  #
+  # redisPassword: xxxxx
+  # replicas: 1
+  # persistentVolume:
+  #   enabled: false
+  #
   # If you install Redis using this sub chart, make sure that the password of the sub chart matches the password
   # you set in sessionStorage.redis.password (see above).
-  # redisPort: 6379
-  # architecture: standalone
+  #
+  # If you want to use redis in sentinel mode see:
+  # https://artifacthub.io/packages/helm/dandydev-charts/redis-ha#redis-sentinel-parameters
 
 # Enables apiVersion deprecation checks
 checkDeprecation: true
@@ -515,7 +530,8 @@ metrics:
     #   action: replace
 
 # Extra K8s manifests to deploy
-extraObjects: []
+extraObjects:
+  []
   # - apiVersion: secrets-store.csi.x-k8s.io/v1
   #   kind: SecretProviderClass
   #   metadata: