feat(helm): Use Valkey #13408

kiblik · 2025-10-13T08:07:33Z

#13331 was replaced only in docker-compose. This PR replaces it in the HELM chart as well.
Official Valkey HELM charts would require too many customisations; we needed something more developed. https://artifacthub.io/packages/helm/cloudpirates-valkey/valkey supported many fields that are compatible with the previous Bitnami stack.

There are multiple places that are mentioned in release notes.

github-actions · 2025-10-23T11:41:11Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

Maffooch · 2025-10-27T18:55:05Z

Hi @kiblik the valkey migration is slated for release in the upcoming minor release on November 3rd. The docker compose PR looks ready to roll after your feedback was incorporated. Is there anything left to be implemented in this PR for the helm chart?

kiblik · 2025-11-03T15:05:56Z

So, my original idea was to replace Bitnami Redis with the official Valkey Helm chart. Unfortunately, this is not fully possible because authN issue.
The official Valkey Helm chart does not support the approach: "This is a password which I generated/prepared for you. Use it". Valkey needs the users.acl file with the full definition of users.
This issue is partially solved in the open PR, but still not fully support "This is a prepared password. Use it."
So we might

use Valkey chart from Bitnami. But charts and/or Docker images would have to be mirrored (not a good and maintainable solution)
use CloudPirates chart (comes from the original Bitnami definition, but they keep it nicely maintained)
use deployment without authN (we might depend on network isolation using NetworkPolicy)
???

kiblik · 2025-11-03T15:07:01Z

I hope migration will be easier, and I did not have enough time to come back to it until now.

github-actions · 2025-11-03T19:59:51Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

github-actions · 2025-11-04T18:18:18Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

kiblik · 2025-11-13T16:19:21Z

This PR is fully ready for review.

fernandezcuesta

@kiblik added some logic and yet another parameter to better isolate the 2 options (external Redis vs Valkey). Rather than that LGTM

helm/defectdojo/README.md

fernandezcuesta · 2025-11-13T23:06:35Z

helm/defectdojo/templates/_helpers.tpl

 {{- /*
  Determine the protocol to use for Redis.
 */}}
 {{- define "redis.scheme" -}}
-{{- if eq .Values.celery.broker "redis" -}}
-{{- if .Values.redis.tls.enabled -}}
+{{- if .Values.valkey.tls.enabled -}}
 {{- printf "rediss" -}}
-{{- else if .Values.redis.sentinel.enabled -}}
+{{- else if .Values.valkey.sentinel.enabled -}}
 {{- printf "sentinel" -}}
 {{- else -}}
 {{- printf "redis" -}}
 {{- end -}}
 {{- end -}}


Suggested change

{{- /*

Determine the protocol to use for Redis.

*/}}

{{- define "redis.scheme" -}}

{{- if eq .Values.celery.broker "redis" -}}

{{- if .Values.redis.tls.enabled -}}

{{- if .Values.valkey.tls.enabled -}}

{{- printf "rediss" -}}

{{- else if .Values.redis.sentinel.enabled -}}

{{- else if .Values.valkey.sentinel.enabled -}}

{{- printf "sentinel" -}}

{{- else -}}

{{- printf "redis" -}}

{{- end -}}

{{- end -}}

{{- /*

Determine the default params to use for Redis.

*/}}

{{- define "redis.params" -}}

{{- $redisScheme := template "redis.scheme" . -}}

{{- $defaultBrokerParams := ternary "ssl_cert_reqs=optional" "" (eq "rediss" $redisScheme -}}

{{- if .Values.valkey.enabled -}}

{{- default $defaultBrokerParams .Values.valkeyParams -}}

{{- else -}}

{{- default $defaultBrokerParams .Values.redisParams -}}

{{- end -}}

{{- /*

Determine the protocol to use for Redis.

*/}}

{{- define "redis.scheme" -}}

{{- if .Values.valkey.enabled -}}

{{- if .Values.valkey.tls.enabled -}}

rediss

{{- else if .Values.valkey.sentinel.enabled -}}

sentinel

{{- else -}}

redis

{{- end -}}

{{- else -}}

{{- .Values.redisScheme -}}

{{- end -}}

{{- end -}}

fernandezcuesta · 2025-11-13T23:09:29Z

helm/defectdojo/templates/configmap.yaml

@@ -1,5 +1,5 @@
 {{- $fullName := include "defectdojo.fullname" . -}}
-{{- $defaultBrokerParams := ternary "ssl_cert_reqs=optional" "" .Values.redis.tls.enabled -}}
+{{- $defaultBrokerParams := ternary "ssl_cert_reqs=optional" "" .Values.valkey.tls.enabled -}}


Suggested change

{{- $defaultBrokerParams := ternary "ssl_cert_reqs=optional" "" .Values.valkey.tls.enabled -}}

{{- $redisScheme := template "redis.scheme" . -}}

{{- $defaultBrokerParams := ternary "ssl_cert_reqs=optional" "" (eq "rediss" $redisScheme -}}

fernandezcuesta · 2025-11-13T23:10:32Z

helm/defectdojo/values.yaml


 #
 # External database support.
 #
 # @schema type:[string, null]
 # -- To use an external Redis instance, set `redis.enabled` to false and set the address here:
 redisServer: ~
-# -- Parameters attached to the redis connection string, defaults to "ssl_cert_reqs=optional" if `redis.tls.enabled`
+# -- Parameters attached to the redis connection string, defaults to "ssl_cert_reqs=optional" if `valkey.tls.enabled`
 redisParams: ""


Suggested change

redisParams: ""

# -- Parameters attached to the valkey connection string, defaults to "ssl_cert_reqs=optional" if `valkey.tls.enabled`

valkeyParams: ""

#

# External database support.

#

# @schema type:[string, null]

# -- To use an external Redis instance, set `redis.enabled` to false and set the address here:

redisServer: ~

# -- Parameters attached to the redis connection string, defaults to "ssl_cert_reqs=optional" if `redisScheme` is `rediss`

redisParams: ""

# -- Define the protocol to use with the external Redis instance

redisScheme: redis

Ideally the scheme and params should be isolated when using an external redis or when opting in for Valkey.

⚠️ didn't tested myself though, but hope the logic is clear

I like this approach. As it hasn't been tested, I will need more time to do that. I will check it next week.

github-actions · 2025-11-15T14:00:58Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

sgissi · 2025-11-20T03:24:59Z

So, my original idea was to replace Bitnami Redis with the official Valkey Helm chart. Unfortunately, this is not fully possible because authN issue. The official Valkey Helm chart does not support the approach: "This is a password which I generated/prepared for you. Use it". Valkey needs the users.acl file with the full definition of users. This issue is partially solved in the open PR, but still not fully support "This is a prepared password. Use it." So we might

Hi, I'm one of the Valkey Helm chart maintainers. We have implemented both inline and secret-based passwords in the chart. Note that it currently only supports standalone deployments with replicas coming soon.

github-actions · 2025-11-20T15:58:19Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

dryrunsecurity · 2025-11-20T16:08:43Z

This pull request introduces several security concerns: documentation encourages Helm-generated Valkey secrets without warning, the Valkey Helm chart is sourced from an unverified OCI repo (supply-chain risk), TLS defaults disable proper certificate validation for Celery (ssl_cert_reqs=optional), and the chart generates a relatively weak 10-character alphanumeric Valkey password (~59.5 bits entropy).

Insecure Documentation Examples in helm/defectdojo/README.md.gotmpl

Vulnerability	Insecure Documentation Examples
Description	The documentation examples in `README.md.gotmpl` consistently use `--set createValkeySecret=true` in `helm install` commands. This flag instructs Helm to generate and manage the Valkey secret, which can be less secure for production environments compared to using external secret managers or pre-existing, securely provisioned secrets. The documentation does not provide warnings about the implications of using Helm-generated secrets in production, nor does it guide users towards more secure alternatives that the chart itself supports (e.g., `valkey.auth.existingSecret`).

django-DefectDojo/helm/defectdojo/README.md.gotmpl

Lines 94 to 100 in 1e709eb

    
             --set django.ingress.enabled=${DJANGO_INGRESS_ENABLED} \ 
        
             --set django.ingress.activateTLS=${DJANGO_INGRESS_ACTIVATE_TLS} \ 
        
             --set createSecret=true \ 
        
             --set createValkeySecret=true \ 
        
             --set createPostgresqlSecret=true 
        
           ```

Supply Chain Risk from Unverified Helm Chart in helm/defectdojo/Chart.yaml

Vulnerability	Supply Chain Risk from Unverified Helm Chart
Description	The Helm chart for 'valkey' is sourced from an unverified repository ('oci://registry-1.docker.io/cloudpirates'). There is no evidence to suggest that 'cloudpirates' is a reputable or official publisher for Valkey Helm charts, nor is it associated with the official Valkey project or trusted vendors like Bitnami. This introduces a significant supply chain risk, as the integrity and security of the deployed chart cannot be assured.

django-DefectDojo/helm/defectdojo/Chart.yaml

Lines 18 to 21 in 1e709eb

    
               repository: "oci://registry-1.docker.io/cloudpirates" 
        
               condition: valkey.enabled 
        
           # For correct syntax, check https://artifacthub.io/docs/topics/annotations/helm/ 
        
           # This is example for "artifacthub.io/changes"

Insecure Default TLS Configuration in helm/defectdojo/templates/configmap.yaml

Vulnerability	Insecure Default TLS Configuration
Description	The Helm chart's default configuration for the Celery broker connection to Valkey sets `ssl_cert_reqs=optional` when TLS is enabled (`rediss` scheme). This setting disables proper server certificate validation, allowing Man-in-the-Middle (MitM) attacks where an attacker can intercept and potentially tamper with communications without detection. While the chart provides `valkeyParams` to override this, the default is insecure.

django-DefectDojo/helm/defectdojo/templates/configmap.yaml

Lines 3 to 6 in 1e709eb

    
           {{- $defaultBrokerParams := ternary "ssl_cert_reqs=optional" "" (eq "rediss" $redisScheme) -}} 
        
           apiVersion: v1 
        
           kind: ConfigMap 
        
           metadata:

Weak Password Generation in helm/defectdojo/templates/secret-valkey.yaml

Vulnerability	Weak Password Generation
Description	The Helm chart generates a 10-character alphanumeric password for Valkey using `randAlphaNum 10`. This results in approximately 59.54 bits of entropy. While there isn't a single universally agreed-upon minimum entropy for all machine-generated secrets, security best practices often recommend higher entropy for long-lived secrets. For instance, OWASP suggests 64 bits of entropy for session IDs, and cryptographic key recommendations can go as high as 112 bits for long-term security. A password with ~59.54 bits of entropy is below these common recommendations, making it potentially vulnerable to offline brute-force attacks if the secret hash is compromised, especially in high-security environments.

django-DefectDojo/helm/defectdojo/templates/secret-valkey.yaml

Lines 33 to 36 in 1e709eb

    
             {{ .Values.valkey.auth.existingSecretPasswordKey }}: {{ randAlphaNum 10 | b64enc | quote }} 
        
           {{- end }} 
        
           {{- end }}

All finding details can be found in the DryRun Security Dashboard.

github-actions · 2025-11-20T22:11:54Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

github-actions · 2025-11-20T22:11:54Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

Signed-off-by: kiblik <5609770+kiblik@users.noreply.github.com>

github-actions · 2025-11-24T18:38:33Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

Signed-off-by: kiblik <5609770+kiblik@users.noreply.github.com>

github-actions bot added the helm label Oct 13, 2025

mtesauro added the conflicts-detected label Oct 15, 2025

kiblik force-pushed the helm_valkey branch from 5f0942a to e62474b Compare October 23, 2025 11:40

github-actions bot removed the conflicts-detected label Oct 23, 2025

kiblik force-pushed the helm_valkey branch from e62474b to e64c513 Compare October 27, 2025 13:55

github-actions bot added the conflicts-detected label Nov 3, 2025

kiblik force-pushed the helm_valkey branch 5 times, most recently from 5bf0d34 to 854c188 Compare November 4, 2025 18:13

github-actions bot removed the conflicts-detected label Nov 4, 2025

kiblik force-pushed the helm_valkey branch 12 times, most recently from bf3a0d5 to 196988a Compare November 5, 2025 10:27

kiblik force-pushed the helm_valkey branch 2 times, most recently from eb207b8 to 52ea586 Compare November 13, 2025 13:59

github-actions bot added the docs label Nov 13, 2025

kiblik force-pushed the helm_valkey branch 5 times, most recently from 3ecc8f5 to 639528c Compare November 13, 2025 16:18

fernandezcuesta reviewed Nov 13, 2025

View reviewed changes

github-actions bot added the conflicts-detected label Nov 15, 2025

kiblik force-pushed the helm_valkey branch from 639528c to 62622ab Compare November 20, 2025 15:58

github-actions bot removed the conflicts-detected label Nov 20, 2025

kiblik force-pushed the helm_valkey branch from 62622ab to e5fc3d1 Compare November 20, 2025 16:05

github-actions bot added conflicts-detected labels Nov 20, 2025

feat(helm): Use Valkey

d02ce03

Signed-off-by: kiblik <5609770+kiblik@users.noreply.github.com>

kiblik force-pushed the helm_valkey branch from e5fc3d1 to d02ce03 Compare November 24, 2025 18:38

github-actions bot removed the conflicts-detected label Nov 24, 2025

kiblik force-pushed the helm_valkey branch 2 times, most recently from d65f11d to eaee0fe Compare November 24, 2025 21:16

apply changes from @fernandezcuesta

1e709eb

Signed-off-by: kiblik <5609770+kiblik@users.noreply.github.com>

kiblik force-pushed the helm_valkey branch from eaee0fe to 1e709eb Compare November 24, 2025 21:21

	{{- $defaultBrokerParams := ternary "ssl_cert_reqs=optional" "" .Values.valkey.tls.enabled -}}
	{{- $redisScheme := template "redis.scheme" . -}}
	{{- $defaultBrokerParams := ternary "ssl_cert_reqs=optional" "" (eq "rediss" $redisScheme -}}

feat(helm): Use Valkey #13408

Are you sure you want to change the base?

feat(helm): Use Valkey #13408

Conversation

kiblik commented Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Oct 23, 2025

Uh oh!

Maffooch commented Oct 27, 2025

Uh oh!

kiblik commented Nov 3, 2025

Uh oh!

kiblik commented Nov 3, 2025

Uh oh!

github-actions bot commented Nov 3, 2025

Uh oh!

github-actions bot commented Nov 4, 2025

Uh oh!

kiblik commented Nov 13, 2025

Uh oh!

fernandezcuesta left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

fernandezcuesta Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fernandezcuesta Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

fernandezcuesta Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fernandezcuesta Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kiblik Nov 14, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Nov 15, 2025

Uh oh!

sgissi commented Nov 20, 2025

Uh oh!

github-actions bot commented Nov 20, 2025

Uh oh!

dryrunsecurity bot commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 20, 2025

Uh oh!

github-actions bot commented Nov 20, 2025

Uh oh!

github-actions bot commented Nov 24, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

kiblik commented Oct 13, 2025 •

edited

Loading

fernandezcuesta left a comment •

edited

Loading

fernandezcuesta Nov 13, 2025 •

edited

Loading

fernandezcuesta Nov 13, 2025 •

edited

Loading

fernandezcuesta Nov 13, 2025 •

edited

Loading

dryrunsecurity bot commented Nov 20, 2025 •

edited

Loading