Redis - Control Plane

Overview

Redis is a high-performance in-memory data store. This template deploys a Redis master-replica cluster with Redis Sentinel for automatic failover and leader election. Both tiers run Redis 8 by default; redis:7.4 remains a supported value if you need to pin the previous line. Setting a single engine knob runs both tiers on Valkey, the BSD-licensed fork of Redis, instead. Leaving it alone changes nothing.

This template does not create a GVC. You must deploy it into an existing GVC.

What Gets Created

Stateful Redis Workload — (RELEASE_NAME-redis): a master-replica cluster running Redis, or Valkey when engine: valkey. Replica 0 starts as the primary; all others replicate from it.
Stateful Sentinel Workload — (RELEASE_NAME-sentinel): monitors the cluster and orchestrates automatic failover when the primary becomes unavailable. Always runs the same engine as the Redis tier.
Secret — An opaque secret containing the Redis server configuration (redis.conf), mounted into each Redis container.
Secret — An opaque secret containing the Sentinel configuration (sentinel.conf), mounted into each Sentinel container.
Secret (optional) — A dictionary secret holding the Redis auth password, created when redis.auth.password.enabled is true.
Secret (optional) — A dictionary secret holding the Sentinel auth password, created when sentinel.auth.password.enabled is true.
Identity & Policy — Separate identities and policies for the Redis and Sentinel workloads, each with reveal access to their respective secrets, and cloud storage access when backup is enabled.
Volume Set (optional) — Persistent storage for Redis data, created when redis.persistence.enabled is true.
Volume Set (optional) — Persistent storage for Sentinel state, created when sentinel.persistence.enabled is true.
Domain (optional) — External domain resources for Redis and/or Sentinel when publicAccess.enabled is true.
Backup Cron Workload (optional) — A scheduled backup job that writes Redis snapshots to AWS S3 or GCS.

Installation

This template has no external prerequisites unless backup or public access is enabled. To install, follow the instructions for your preferred method:

UI

Browse, install, and manage templates visually

CLI

Manage templates from your terminal

Terraform

Declare templates in your Terraform configurations

Pulumi

Declare templates in your Pulumi programs

Configuration

The default values.yaml for this template:

engine: redis                     # redis | valkey
# Used for BOTH tiers when engine is valkey; redis.image / sentinel.image are
# then ignored. Only the Debian-based tags are supported.
valkeyImage: valkey/valkey:8.1.9

redis:
  image: redis:8
  resources:
    maxCpu: 200m
    maxMemory: 256Mi
    minCpu: 80m
    minMemory: 128Mi
  replicas: 3
  timeoutSeconds: 15
  multiZone: false
  replicaDirect: false
  auth:
    fromSecret:
      enabled: false
      name: example-redis-auth-password
      passwordKey: password
    password:
      enabled: false
      value: change-me-redis-password
  serverCommand: redis-server  # correct for both engines — the Valkey image ships a redis-server symlink
  # extraArgs: "--maxclients 20000 --maxmemory 200mb --maxmemory-policy allkeys-lru"
  publicAccess:
    enabled: false
    address: redis-test.example-cpln.com
  firewall:
    internal_inboundAllowType: same-gvc # Options: same-org / same-gvc / workload-list
    # external_inboundAllowCIDR: 0.0.0.0/0
    # inboundAllowWorkload:
    #   - //gvc/GVC_NAME/workload/WORKLOAD_NAME
    # external_outboundAllowCIDR: 0.0.0.0/0
  env: []
  tags: {}
  requestRetryPolicy: {}
  replication:
    backlogSize: 1gb
    timeout: 300
    slaveOutputBufferLimit: "2gb 512mb 300"
  probes:
    readiness:
      failureThreshold: 10
      initialDelaySeconds: 10
      periodSeconds: 5
      timeoutSeconds: 4
    liveness:
      failureThreshold: 5
      initialDelaySeconds: 30
      periodSeconds: 10
      timeoutSeconds: 5
  exporter:
    enabled: false  # adds a redis_exporter sidecar that exposes metrics at :9121/metrics
    image: oliver006/redis_exporter:v1.67.0-alpine
    resources:
      maxCpu: 50m
      maxMemory: 64Mi
      minCpu: 25m
      minMemory: 32Mi
    dropMetrics: []  # e.g., ["redis_command_.*", "redis_keyspace_.*"]
  dataDir: /data
  persistence:
    enabled: false
    volumes:
      data:
        initialCapacity: 10 # In GiB
        performanceClass: general-purpose-ssd # general-purpose-ssd / high-throughput-ssd (Min 1000 GiB)
        fileSystemType: ext4 # ext4 / xfs
        snapshots:
          retentionDuration: 7d
          schedule: "0 0 * * *" # UTC
        autoscaling:
          maxCapacity: 100 # In GiB
          minFreePercentage: 20
          scalingFactor: 1.2
        # customEncryption:
        #   enabled: true
        #   region: aws-us-east-1
        #   keyId: arn:aws:kms:us-east-1:1234567890:key/YOUR_KEY_ID

sentinel:
  image: redis:8
  resources:
    maxCpu: 200m
    maxMemory: 256Mi
    minCpu: 80m
    minMemory: 128Mi
  replicas: 3
  timeoutSeconds: 10
  multiZone: false
  replicaDirect: false
  quorumAutoCalculation: true # Quorum = (replicas / 2) + 1
  quorumOverride: null        # Only used if quorumAutoCalculation is false
  auth:
    fromSecret:
      enabled: false
      name: example-redis-auth-password
      passwordKey: password
    password:
      enabled: false
      value: change-me-sentinel-password
  publicAccess:
    enabled: false
    address: redis-sentinel-test.example-cpln.com
  firewall:
    internal_inboundAllowType: same-gvc # Options: same-org / same-gvc
    # external_inboundAllowCIDR: 0.0.0.0/0
    # inboundAllowWorkload:
    #   - //gvc/GVC_NAME/workload/WORKLOAD_NAME
    # external_outboundAllowCIDR: 0.0.0.0/0
  env: []
  tags: {}
  requestRetryPolicy: {}
  persistence:
    enabled: false
    volumes:
      data:
        initialCapacity: 10 # In GiB
        performanceClass: general-purpose-ssd
        fileSystemType: ext4
        snapshots:
          retentionDuration: 7d
          schedule: "0 0 * * *"
        autoscaling:
          maxCapacity: 50 # In GiB
          minFreePercentage: 20
          scalingFactor: 1.2
        # customEncryption:
        #   enabled: true
        #   region: aws-us-east-1
        #   keyId: arn:aws:kms:us-east-1:1234567890:key/YOUR_KEY_ID

backup:
  enabled: false
  image: ghcr.io/controlplane-com/backup-images/redis-backup:1.0.0
  schedule: "0 2 * * *"   # daily at 2am UTC

  resources:
    cpu: 100m
    memory: 128Mi

  provider: aws # Options: aws or gcp

  aws:
    bucket: my-backup-bucket
    region: us-east-1
    cloudAccountName: my-backup-cloudaccount
    policyName: my-backup-policy
    prefix: redis/backups

  gcp:
    bucket: my-backup-bucket
    cloudAccountName: my-backup-cloudaccount
    prefix: redis/backups

grafana:
  dashboard:
    enabled: false          # K8s clusters only — set to true to provision via Grafana Operator
  folder: Redis             # Grafana folder the dashboard is placed in
  datasource: metrics       # name of the Prometheus datasource in your Grafana instance
  instanceSelector:
    matchLabels:
      dashboards: grafana   # must match the label on your Grafana CR

Redis or Valkey Engine

One knob selects the server both tiers run. engine: redis is the default and changes nothing: with engine left alone, every resource this template creates is identical to the previous version apart from the chart-version tags.

engine: valkey                    # redis | valkey
valkeyImage: valkey/valkey:8.1.9  # used for BOTH tiers when engine is valkey

Valkey is the BSD-3-Clause fork of Redis 7.2, stewarded by the Linux Foundation. There is no paid edition, so nothing — replication, Sentinel, failover, persistence, backups — is feature-gated.

Both tiers move together. engine: valkey puts the Redis and Sentinel workloads on valkeyImage; redis.image and sentinel.image are then ignored. A Redis-Sentinel / Valkey-server hybrid cannot be produced with this knob.
Nothing else in the chart changes. The Valkey image ships redis-server, redis-cli and redis-sentinel compatibility symlinks, so every command, config directive and health probe described on this page is identical on both engines. redis.serverCommand stays redis-server.
Only the Debian-based Valkey tags work. The -alpine tags have no bash, and this chart’s readiness and liveness probes are bash scripts.
Do not set dual-channel-replication-enabled yes through redis.extraArgs on Valkey. A known upstream defect makes Sentinel see duplicate replicas. It defaults to no and the chart never sets it.

To confirm which server a running deployment is on:

cpln workload exec RELEASE_NAME-redis --gvc GVC_NAME \
  --replica RELEASE_NAME-redis-0 --container redis -- redis-cli INFO server

Valkey answers with server_name:valkey and a valkey_version line; Redis has neither.

Version Reporting

Valkey reports redis_version:7.2.4 in INFO for client compatibility, and carries the real version in server_name and valkey_version. The default Redis image reports redis_version:8.10.1, so to a client library a Valkey install looks like a version downgrade. That matters only if your client gates features on redis_version — check it before switching. The marketplace card shows the Redis version for either engine: a chart’s appVersion is a constant and cannot follow a values knob.

The engine is an install-time choice and cannot be switched on a running deployment. With persistence enabled, pointing an existing Redis data directory at Valkey crash-loops the replaced replica — Can't handle RDB format version 15, container exits 1 — because redis:8 writes a data format Valkey does not read. With persistence disabled the node silently starts empty instead. Migrate between engines with dump/restore or replication, never by changing engine.The rollout replaces replicas one at a time and halts on the unhealthy one, so the remaining nodes keep serving; changing engine back recovers the release.

Redis Version

Both the data nodes and Sentinel run redis:8 by default. Redis 8 is the current stable line and adds AGPLv3 as a license option alongside the existing RSALv2/SSPLv1 terms. To stay on the previous line, pin both images:

redis:
  image: redis:7.4
sentinel:
  image: redis:7.4

These image knobs apply to the Redis engine only. Under engine: valkey, both tiers use valkeyImage and redis.image / sentinel.image are ignored.

Upgrading an existing Redis 7.4 deployment to Redis 8 is one-way. Redis 8 loads a 7.4 data file directly, so upgrading with persistence enabled keeps your data — but once a node has written its data file under Redis 8, a 7.4 image can no longer load it. Snapshot the volume set before upgrading if you want a rollback path.

The upgrade rolls the pods one at a time, which replaces the master and triggers a Sentinel failover. Clients must discover the master through Sentinel rather than pinning replica 0 — writing to the old replica 0 after the roll returns READONLY You can't write against a read only replica.

Authentication

Authentication is disabled by default. Both the Redis workload and the Sentinel workload support independent auth configuration. Only one method can be enabled at a time per workload. Option 1 — Inline password (creates a secret automatically):

redis:
  auth:
    password:
      enabled: true
      value: change-me-redis-password

Option 2 — Reference an existing secret:

redis:
  auth:
    fromSecret:
      enabled: true
      name: my-redis-secret   # Name of an existing Control Plane secret
      passwordKey: password   # Key within the secret containing the password

Sentinel can be configured with a separate password for Sentinel-to-Sentinel communication using the same options under sentinel.auth.

Do not rotate the Redis password on a running cluster. Changing redis.auth.password.value (or the referenced secret) stalls the rolling update: the first restarted node cannot replicate from the not-yet-restarted master, logging Unable to AUTH to MASTER: -WRONGPASS invalid username-password pair or user is disabled. — its readiness probe never passes, so the roll never advances. Re-apply the previous password to recover. To change the password, uninstall and reinstall, or accept a planned outage.

Redis Cluster

redis.replicas — Number of Redis replicas. Defaults to 3. Replica 0 is always the initial primary.
redis.resources.maxCpu / redis.resources.maxMemory — Maximum CPU and memory per replica.
redis.resources.minCpu / redis.resources.minMemory — Minimum CPU and memory guaranteed per replica.
redis.multiZone — Spread replicas across availability zones within the location.
redis.extraArgs — Additional Redis server arguments (e.g. --maxmemory 200mb --maxmemory-policy allkeys-lru).

Sentinel

Sentinel monitors the Redis cluster and automatically promotes a replica when the primary fails.

sentinel.replicas — Number of Sentinel replicas. A minimum of 3 is required for a majority quorum.
sentinel.quorumAutoCalculation — When true, the quorum is calculated automatically as (replicas / 2) + 1. Set to false to use sentinel.quorumOverride.
sentinel.quorumOverride — Manual quorum value, used only when quorumAutoCalculation is false.
sentinel.resources.maxCpu / sentinel.resources.maxMemory — Maximum CPU and memory per Sentinel replica.
sentinel.resources.minCpu / sentinel.resources.minMemory — Minimum CPU and memory guaranteed per Sentinel replica.
sentinel.multiZone — Spread Sentinel replicas across availability zones.

Sentinel marks a master down after 5 seconds without a response. In testing on Redis 8, a full failover — detection, election, promotion of a replica, and clients seeing the new master — completed 6.7–8.4 seconds after the master stopped responding, and the old master rejoined as a replica once it recovered. Valkey 8.1.9 measured in the same band: 8.7 seconds end to end, costing a Sentinel-aware client about 6 seconds of writes.

Replication Tuning

The redis.replication block controls low-level replication behavior. The defaults are sized for production workloads and typically do not need adjustment.

replication.backlogSize — Replication backlog size. The default 1gb covers ~5 minutes of disconnect at ~3 MB/s of writes. The Redis default of 1mb will trigger a full RDB resync on any brief disconnect.
replication.timeout — Timeout in seconds for full-resync transfers. The default 300s covers datasets up to ~30 GB. The Redis default of 60s is too low for large datasets.
replication.slaveOutputBufferLimit — Format: <hard> <soft> <seconds>. The default "2gb 512mb 300" sustains full resyncs of large datasets at high write rates. The Redis default "256mb 64mb 60" can cause the master to kill a replica mid-stream.

Health Checks

Probe settings for the Redis workload are configurable under redis.probes. This is most useful when persistence is enabled and large datasets require additional time to load before the replica is ready. The startup probe window is derived from the readiness probe settings:

startup window = initialDelaySeconds + (30 × periodSeconds)

The default (10 + 30×5 = 160s) is sufficient for small datasets. If AOF load takes longer, increase periodSeconds:

redis:
  probes:
    readiness:
      initialDelaySeconds: 35   # clears the AOF load window
      periodSeconds: 20          # startup window = 35 + (30×20) = 635s

Field	Default	Description
`readiness.initialDelaySeconds`	`10`	Seconds to wait before first readiness check
`readiness.periodSeconds`	`5`	How often to run the readiness check; also controls the startup window
`readiness.failureThreshold`	`10`	Number of failures before the replica is marked not ready
`readiness.timeoutSeconds`	`4`	Timeout per probe attempt
`liveness.initialDelaySeconds`	`30`	Seconds before the first liveness check
`liveness.periodSeconds`	`10`	How often to run the liveness check
`liveness.failureThreshold`	`5`	Number of failures before the container is restarted
`liveness.timeoutSeconds`	`5`	Timeout per probe attempt

Metrics

A redis_exporter sidecar can be enabled to expose Prometheus metrics. When enabled, Control Plane scrapes :9121/metrics automatically every 30 seconds and makes the metrics available in the console. The default exporter image is verified against Redis 8 and Valkey 8.1.9, including against a password-protected server.

redis.exporter.enabled — Set to true to add the exporter sidecar to each Redis replica.
redis.exporter.image — Exporter image (default: oliver006/redis_exporter:v1.67.0-alpine).
redis.exporter.resources — CPU and memory limits/requests for the sidecar container.
redis.exporter.dropMetrics — List of regex patterns matched against metric names. Use to filter high-cardinality series before they are stored.

redis:
  exporter:
    enabled: true
    dropMetrics:
      - "redis_commands_latencies_usec_bucket"
      - "redis_latency_percentiles_usec"

Grafana Dashboard

A pre-built Grafana dashboard can be provisioned automatically via the Grafana Operator. This is opt-in and intended for Kubernetes clusters running the Grafana Operator — on Control Plane’s managed platform where no operator is present, leave this disabled.

Enabling the dashboard requires redis.exporter.enabled: true for the Redis-specific panels. CPU and memory panels are always available.

Included panels:

Panel	Requires exporter
CPU Usage	No
Memory Usage	No
Connected Clients	Yes
Redis Memory	Yes
Commands/sec	Yes
Cache Hit Rate	Yes

The dashboard includes template variables for datasource, GVC, workload, and replica so you can filter by deployment without editing the dashboard. Prerequisites:

The Grafana Operator must be installed in your cluster with a Kubernetes secret containing your Grafana service account token:

kubectl create secret generic grafana-admin-credentials \
  --from-literal=GF_SECURITY_ADMIN_USER=admin \
  --from-literal=GF_SECURITY_ADMIN_PASSWORD=<grafana-api-token> \
  -n grafana-operator

A Grafana CR with a label matching grafana.instanceSelector.matchLabels:

apiVersion: grafana.integreatly.org/v1beta1
kind: Grafana
metadata:
  name: grafana
  labels:
    dashboards: grafana
spec:
  external:
    url: https://your-org.grafana.cpln.io
    adminPassword:
      name: grafana-admin-credentials
      key: GF_SECURITY_ADMIN_PASSWORD

Configuration:

grafana.dashboard.enabled — Set to true to provision the GrafanaDashboard CRD.
grafana.folder — Grafana folder the dashboard appears in (default: Redis).
grafana.datasource — Name of the Prometheus datasource configured in your Grafana instance (default: metrics).
grafana.instanceSelector.matchLabels — Label selector that must match the label on your Grafana CR.

Storage

Persistence is disabled by default. When enabled, a Volume Set is created to store data across restarts.

Enable persistence at install time, not on a running release. Turning redis.persistence.enabled or sentinel.persistence.enabled on for a deployment that is already running stalls the rollout indefinitely: every replica sits on Replica N will be restarted shortly, the Volume Set’s volumes stay unbound, and the data directory never leaves the container overlay. A forced redeployment does not clear it — this was measured at 27 minutes with no progress. Uninstall and reinstall with persistence enabled instead. A fresh install with persistence comes up normally, and upgrading a release that already owns its volume rolls fine. This is independent of engine.

Redis persistence:

redis.persistence.enabled — Enable persistent storage for Redis data.
redis.persistence.volumes.data.initialCapacity — Initial volume size in GiB. Minimum 1000 GiB for high-throughput-ssd.
redis.persistence.volumes.data.performanceClass — general-purpose-ssd or high-throughput-ssd.
redis.persistence.volumes.data.fileSystemType — ext4 or xfs.
redis.persistence.volumes.data.snapshots.retentionDuration — How long to retain volume snapshots.
redis.persistence.volumes.data.snapshots.schedule — Cron expression for snapshot frequency.
redis.persistence.volumes.data.autoscaling.maxCapacity — Maximum volume size in GiB.
redis.persistence.volumes.data.autoscaling.minFreePercentage — Trigger scaling when free space drops below this percentage.
redis.persistence.volumes.data.autoscaling.scalingFactor — Multiply current capacity by this factor when scaling up.

Sentinel persistence uses the same options under sentinel.persistence.

Firewall

Both Redis and Sentinel firewall settings are configured independently.

redis.firewall.internal_inboundAllowType / sentinel.firewall.internal_inboundAllowType:

Value	Description
`same-gvc`	Allow access from all workloads in the same GVC (recommended)
`same-org`	Allow access from all workloads in the same organization
`workload-list`	Allow access only from specific workloads

redis.firewall.inboundAllowWorkload — List of specific workload links when using workload-list.
redis.firewall.external_inboundAllowCIDR — Comma-separated CIDR ranges for external inbound access.
redis.firewall.external_outboundAllowCIDR — Comma-separated CIDR ranges for external outbound access.

Public Access

Redis and Sentinel can be exposed over the internet via TCP using Control Plane’s domain resource with per-replica port routing.

Prerequisites

Enable Dedicated Load Balancer on your GVC — This is required for arbitrary TCP port routing. Navigate to your GVC settings in the Control Plane console and enable the Dedicated Load Balancer option.
Add DNS records before deploying — Control Plane verifies domain ownership when the domain resource is first created. If the records are not in place, the deploy will fail with an Unable to apply domain error. Add the following records in your DNS provider for each address you configure, and disable any proxy (TCP must pass through directly):

Type	Name	Value
TXT	`_cpln-<subdomain>`	Your Control Plane org name or org ID
CNAME	`<subdomain>`	`<gvc-alias>.cpln.app`

Your GVC alias is visible under GVC settings in the Control Plane console.

Configuration

Enable public access for Redis and/or Sentinel, set the subdomain address, and open the external firewall:

redis:
  publicAccess:
    enabled: true
    address: redis.your-domain.com
  firewall:
    internal_inboundAllowType: same-gvc
    external_inboundAllowCIDR: "0.0.0.0/0"  # or restrict to specific CIDRs

sentinel:
  publicAccess:
    enabled: true
    address: redis-sentinel.your-domain.com
  firewall:
    internal_inboundAllowType: same-gvc
    external_inboundAllowCIDR: "0.0.0.0/0"

external_inboundAllowCIDR must be set when public access is enabled — without it, inbound traffic from the internet will be blocked even though the domain is configured.

Port Mapping

Each replica is assigned its own external port. Port numbers increment per replica starting at:

Redis: 6380, 6381, 6382, … (replica 0, 1, 2, …)
Sentinel: 26380, 26381, 26382, … (replica 0, 1, 2, …)

Connecting Externally

# Redis replica 0 (append -a <password> if auth is enabled)
redis-cli -h redis.your-domain.com -p 6380 ping

# Redis replica 1
redis-cli -h redis.your-domain.com -p 6381 ping

# Sentinel replica 0
redis-cli -h redis-sentinel.your-domain.com -p 26380 ping

After deploying, verify the domain is resolving correctly:

dig redis.your-domain.com CNAME   # should return <gvc-alias>.cpln.app
dig <gvc-alias>.cpln.app          # should return an IP address

Connecting to Redis

Connect to Redis internally from within the same GVC:

RELEASE_NAME-redis.GVC_NAME.cpln.local:6379

For Sentinel-aware clients, connect through Sentinel to always reach the current primary:

RELEASE_NAME-sentinel.GVC_NAME.cpln.local:26379

The Sentinel master name is mymaster.

Ports

Workload	Port	Description
Redis	`6379`	Internal Redis data port
Sentinel	`26379`	Internal Sentinel discovery port
Redis (public)	`6380`, `6381`, …	One port per replica when public access is enabled
Sentinel (public)	`26380`, `26381`, …	One port per replica when public access is enabled

Backup

Backup is disabled by default. When enabled, a cron workload runs on the configured schedule and uploads a Redis snapshot to AWS S3 or GCS. The backup image is verified against both Redis 7.4 and Redis 8.

backup.enabled — Enable scheduled backups.
backup.schedule — Cron expression for backup frequency (default: daily at 2am UTC). Step expressions such as */5 * * * * are supported.
backup.provider — aws or gcp.
backup.resources.cpu / backup.resources.memory — Resources for the backup cron container.

Switching backup.provider between aws and gcp on an existing release leaves the previous provider’s cloud binding on the workload identity — the rendered manifest is correct, but identity updates are merged rather than replaced. Inspect the identity (cpln identity get RELEASE_NAME-redis-identity --gvc GVC_NAME) after a provider switch and remove the stale binding, or reinstall the release, if least privilege matters to you.

AWS S3

Before enabling backup with provider: aws, complete the following in your AWS account:

Create an S3 bucket. Set backup.aws.bucket to its name and backup.aws.region to its region.
If you do not have a Cloud Account set up, refer to the docs to Create a Cloud Account. Set backup.aws.cloudAccountName to its name.
Create an IAM policy with the following JSON, replacing YOUR_BUCKET_NAME:

Version 3.5.1 narrows AWS backup permissions. This version removes aws::ReadOnlyAccess from the backup identity. That AWS managed policy granted read access to every bucket in your AWS account and contains no write actions at all, so it was never carrying the backup itself — but it was silently supplying any read action your own bucket-scoped policy happened to omit.Update your IAM policy to the full action list below before upgrading. If it already matches, no action is needed. The identity now carries cpln-connector and your bucket-scoped policy only, which is strictly narrower than before. Nothing else changes.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:ListBucket",
                "s3:GetObjectVersion",
                "s3:DeleteObjectVersion",
                "s3:GetBucketLocation",
                "s3:AbortMultipartUpload",
                "s3:ListBucketMultipartUploads",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": [
                "arn:aws:s3:::YOUR_BUCKET_NAME",
                "arn:aws:s3:::YOUR_BUCKET_NAME/*"
            ]
        }
    ]
}

Set backup.aws.policyName to the name of the policy created in step 3.
Set backup.aws.prefix to the folder path where backups will be stored.

GCS

Before enabling backup with provider: gcp, complete the following in your GCP account:

Create a GCS bucket. Set backup.gcp.bucket to its name.
If you do not have a Cloud Account set up, refer to the docs to Create a Cloud Account. Set backup.gcp.cloudAccountName to its name.
Add the Storage Admin role to the GCP service account associated with the Cloud Account.
Set backup.gcp.prefix to the folder path where backups will be stored.

Restoring a Backup

Download the .rdb backup file from your bucket and restore it into a running Redis instance. For GCS, replace aws s3 cp s3://... with gsutil cp gs://....

aws s3 cp s3://BUCKET_NAME/PREFIX/BACKUP_FILE.rdb /tmp/dump.rdb
redis-cli \
  -h RELEASE_NAME-redis.GVC_NAME.cpln.local \
  -p 6379 \
  --rdb /tmp/dump.rdb

Important Notes

The engine is an install-time choice. Switching engine on a running release does not migrate anything — Valkey cannot read a data file written by Redis 8. Migrate with dump/restore or replication.
Persistence is an install-time choice too. Enabling it on a running release stalls the rollout indefinitely. Enable it on the initial install, or uninstall and reinstall.
The Redis 7.4 to 8 upgrade is one-way. Data written under Redis 8 cannot be loaded by a 7.4 image. Snapshot the volume set first if you need a rollback path.
Never rotate the Redis password in place. It deadlocks the rolling update. Re-apply the previous password to recover; uninstall and reinstall to change it.
Always discover the master through Sentinel. The master moves during failovers and rolling upgrades, so a client pinned to replica 0 will hit READONLY errors after either.
Enable sentinel.persistence in production. Persisted Sentinel state lets replicas rejoin the real master after a restart instead of assuming replica 0 is still the master.
Firewall changes can take up to about five minutes to propagate. After tightening internal_inboundAllowType or the allowed workload list, previously-allowed clients may keep connecting for several minutes before the new rule takes effect — 305 seconds was the longest measured. Re-check before concluding a rule does not work.

External References

Redis Documentation

Official Redis documentation

Redis Sentinel Documentation

Redis Sentinel setup and client configuration

Valkey Documentation

Official Valkey documentation

Redis and Valkey Migration

Moving data between Redis and Valkey

Backup Image Source

Source code for the Redis backup container image

Redis Template

View the source files, default values, and chart definition

​Overview

​What Gets Created

​Installation

UI

CLI

Terraform

Pulumi

​Configuration

​Redis or Valkey Engine

​Version Reporting

​Redis Version

​Authentication

​Redis Cluster

​Sentinel

​Replication Tuning

​Health Checks

​Metrics

​Grafana Dashboard

​Storage

​Firewall

​Public Access

​Prerequisites

​Configuration

​Port Mapping

​Connecting Externally

​Connecting to Redis

​Ports

​Backup

​AWS S3

​GCS

​Restoring a Backup

​Important Notes

​External References

Redis Documentation

Redis Sentinel Documentation

Valkey Documentation

Redis and Valkey Migration

Backup Image Source

Redis Template

Overview

What Gets Created

Installation

Configuration

Redis or Valkey Engine

Version Reporting

Redis Version

Authentication

Redis Cluster

Sentinel

Replication Tuning

Health Checks

Metrics

Grafana Dashboard

Storage

Firewall

Public Access

Prerequisites

Configuration

Port Mapping

Connecting Externally

Connecting to Redis

Ports

Backup

AWS S3

GCS

Restoring a Backup

Important Notes

External References