fix(helm): deliver bundled REDIS_URL via ConfigMap so an operator value always wins

Injecting REDIS_URL as an inline container env made it beat every envFrom
source, so a REDIS_URL held in a pre-created Secret or synced by External
Secrets was silently shadowed and traffic moved to a fresh in-cluster Redis.

Kubernetes resolves duplicate envFrom keys by letting the last source win, so
the bundled URL now ships as a ConfigMap listed before the app Secret. Any
operator-supplied value overrides it without the chart needing to read it,
which also removes the redis.provideUrl flag the previous attempt required.

Author: waleedlatif1

apps/docs/content/docs/en/platform/self-hosting/redis.mdx

@@ -58,12 +58,9 @@ app:
     REDIS_URL: "rediss://:<password>@my-cache.internal:6380"
 ```
 
-`app.env.REDIS_URL` takes over whenever it is set, and the chart skips the bundled instance so you do not get a stray pod.
+`app.env.REDIS_URL` takes over whenever it is set, and the chart skips the bundled Deployment so you do not get a stray pod.
 
-If the URL lives in a secret store rather than in values:
-
-- **External Secrets** — map `externalSecrets.remoteRefs.app.REDIS_URL`. The chart detects the mapping and steps aside automatically.
-- **Pre-created Secret** (`app.secrets.existingSecret`) — set `redis.provideUrl: false`. The chart cannot read your Secret, so without this it would inject a computed `REDIS_URL` that takes precedence over `envFrom` and shadows your value.
+If the URL lives in a secret store instead — a pre-created Secret or one synced by External Secrets — it also wins, and there is nothing extra to configure. The bundled URL is delivered as a ConfigMap listed before the app Secret in `envFrom`, and Kubernetes lets the last source win for duplicate keys, so your value overrides it without the chart ever reading it.
 
 The bundled Redis is deliberately non-persistent (`--save ""`, `--appendonly no`) with a 512 MB cap: Sim stores coordination state and short-lived keys in it, so a restart costs in-flight live updates rather than committed data.
 

helm/sim/README.md

@@ -473,17 +473,11 @@ Two changes alter behavior on an existing release. Neither requires action, but
 
 * **Free-tier plan limits are no longer preset.** `app.envDefaults` previously shipped `RATE_LIMIT_FREE_SYNC`, `RATE_LIMIT_FREE_ASYNC`, `EXECUTION_TIMEOUT_FREE`, `EXECUTION_TIMEOUT_ASYNC_FREE`, `FREE_TABLES_LIMIT: 3`, and `FREE_TABLE_ROWS_LIMIT: 1000`. With billing disabled the application treats these as **opt-in** — unset means unlimited — so presetting them imposed hosted-plan caps on self-hosted deployments and diverged from Docker Compose, which presets nothing. They are now commented out. **On upgrade, these limits stop being enforced.** To keep them, set the keys explicitly under `app.env`. An explicitly set value has always taken precedence and is unaffected.
 
-* **Redis is now bundled** (`redis.enabled: true`), matching the Docker Compose stack. Redis backs pub/sub and the Socket.IO adapter, and multi-replica deployments silently drop cross-pod events without it. The chart steps aside whenever it can tell you are supplying `REDIS_URL` yourself, so no upgrade reroutes an existing instance:
+* **Redis is now bundled** (`redis.enabled: true`), matching the Docker Compose stack. Redis backs pub/sub and the Socket.IO adapter, and multi-replica deployments silently drop cross-pod events without it.
 
-  | Your configuration | Bundled Redis | `REDIS_URL` |
-  |---|---|---|
-  | Default install | Deployed | Points at the bundled instance |
-  | `app.env.REDIS_URL` set | Not deployed | Your value |
-  | `externalSecrets.remoteRefs.app.REDIS_URL` mapped | Not deployed | Synced by ESO — detected automatically |
-  | `redis.provideUrl: false` | Not deployed | Whatever your pre-created Secret contains |
-  | `redis.enabled: false` | Not deployed | Unset unless you provide it |
+  **An existing `REDIS_URL` always wins, wherever it comes from — no action needed on upgrade.** The bundled URL ships as a ConfigMap listed *before* the app Secret in `envFrom`. Kubernetes resolves duplicate keys by letting the last source win, so a `REDIS_URL` in your chart-managed Secret, a pre-created `existingSecret`, or one synced by External Secrets overrides the bundled value — the chart never has to read it. The bundled Redis simply fills the gap when nothing else provides a URL.
 
-  **If you use `app.secrets.existingSecret` and that Secret already contains `REDIS_URL`, set `redis.provideUrl: false`.** The chart cannot read a pre-created Secret, so it would otherwise inject a computed `REDIS_URL` as a container `env` entry, which takes precedence over `envFrom` and would shadow your value. External Secrets needs no such flag — mapping `remoteRefs.app.REDIS_URL` is detected on its own.
+  Set `app.env.REDIS_URL` to skip the bundled Deployment entirely (no unused pod), or `redis.enabled: false` to opt out.
 
 ## Upgrading to 1.2.0
 

helm/sim/examples/values-existing-secret.yaml

@@ -70,6 +70,5 @@ postgresql:
 #   --namespace sim \
 #   --from-literal=POSTGRES_PASSWORD="$(openssl rand -base64 16 | tr -d '/+=')"
 
-# Redis: the chart bundles one by default and wires REDIS_URL to it. If the
-# Secret referenced above already contains REDIS_URL, set redis.provideUrl=false
-# so the chart does not shadow it.
+# Redis: bundled by default. If the Secret above already contains REDIS_URL,
+# it overrides the bundled value automatically — nothing to configure.

helm/sim/examples/values-external-secrets.yaml

@@ -125,6 +125,5 @@ postgresql:
 #           mountPath: "kubernetes"
 #           role: "external-secrets"
 
-# Redis: the chart bundles one by default and wires REDIS_URL to it. To use a
-# managed Redis instead, map externalSecrets.remoteRefs.app.REDIS_URL — the
-# chart detects that and steps aside.
+# Redis: bundled by default. Map externalSecrets.remoteRefs.app.REDIS_URL to
+# use a managed instance instead; the synced value overrides the bundled one.

helm/sim/templates/_helpers.tpl

@@ -465,54 +465,21 @@ PII (Presidio) service URL
 {{- end }}
 
 {{/*
-Whether the operator is supplying REDIS_URL themselves.
-
-Three detectable signals:
-  - app.env.REDIS_URL set explicitly
-  - externalSecrets.remoteRefs.app.REDIS_URL mapped (ESO syncs it into the Secret)
-  - redis.provideUrl=false, the opt-out for a pre-created Secret that already
-    contains REDIS_URL, which the chart cannot read at render time
-
-When any holds, the chart neither deploys Redis nor emits a computed REDIS_URL —
-a container `env` entry beats `envFrom`, so emitting one would silently shadow
-the operator's value and reroute a managed Redis to an empty in-cluster instance.
-*/}}
-{{- define "sim.redisUrlSuppliedByOperator" -}}
-{{- $esoRef := "" -}}
-{{- if .Values.externalSecrets.enabled -}}
-{{- $esoRef = dig "remoteRefs" "app" "REDIS_URL" "" .Values.externalSecrets -}}
-{{- end -}}
-{{- if or (.Values.app.env.REDIS_URL | default "") $esoRef (not .Values.redis.provideUrl) -}}
-true
-{{- end -}}
-{{- end }}
+Whether the chart owns Redis for this release.
 
-{{/*
-Whether the chart owns Redis for this release: enabled, and the operator is not
-supplying a URL themselves. Secret-manager modes alone do NOT suppress it —
-doing so left those deployments with no Redis at all, since REDIS_URL is optional
-and the shipped examples omit it.
+False only when the operator points app.env.REDIS_URL at their own instance —
+then deploying a bundled one would leave an unused pod. Secret-manager modes do
+NOT suppress it: the bundled URL ships as a ConfigMap listed before the app
+Secret in envFrom, so any operator-supplied REDIS_URL (chart Secret, pre-created
+Secret, or ESO-synced) overrides it without the chart needing to see the value.
+See templates/configmap-redis.yaml.
 */}}
 {{- define "sim.chartManagesRedis" -}}
-{{- if and .Values.redis.enabled (not (include "sim.redisUrlSuppliedByOperator" .)) -}}
+{{- if and .Values.redis.enabled (not (.Values.app.env.REDIS_URL | default "")) -}}
 true
 {{- end -}}
 {{- end }}
 
-{{/*
-Redis URL emitted as a chart-computed container env. Only set when the chart owns
-Redis, or when app.env.REDIS_URL is given explicitly. Empty otherwise, so a
-Secret- or ESO-supplied value flows through envFrom untouched.
-*/}}
-{{- define "sim.redisUrl" -}}
-{{- $external := .Values.app.env.REDIS_URL | default "" -}}
-{{- if $external -}}
-{{- $external -}}
-{{- else if (include "sim.chartManagesRedis" .) -}}
-{{- printf "redis://%s-redis:6379" (include "sim.fullname" .) -}}
-{{- end -}}
-{{- end }}
-
 {{/*
 Socket Server URL (internal)
 */}}

helm/sim/templates/configmap-redis.yaml

@@ -0,0 +1,32 @@
+{{- if include "sim.chartManagesRedis" . }}
+{{- /*
+  REDIS_URL for the bundled Redis, delivered as a ConfigMap rather than an
+  inline container `env` entry.
+
+  This is deliberate. Kubernetes resolves duplicate keys by letting the LAST
+  envFrom source win, while an inline `env` entry beats every envFrom source.
+  The app and realtime Deployments list this ConfigMap FIRST, before the app
+  Secret, so:
+
+    - an operator-supplied REDIS_URL (chart Secret, pre-created Secret, or one
+      synced by External Secrets) always wins, because it is listed later
+    - the bundled URL applies only when nothing else provides one
+
+  An inline `env` entry would invert that and silently shadow a managed Redis
+  the chart cannot see, which is why REDIS_URL is not chart-computed like
+  DATABASE_URL and SOCKET_SERVER_URL are.
+
+  The value is a plain in-cluster service address with no credentials, so a
+  ConfigMap is the right resource here.
+*/}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "sim.fullname" . }}-redis
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "sim.labels" . | nindent 4 }}
+    app.kubernetes.io/component: redis
+data:
+  REDIS_URL: {{ printf "redis://%s-redis:6379" (include "sim.fullname" .) | quote }}
+{{- end }}

helm/sim/templates/deployment-app.yaml

@@ -91,10 +91,6 @@ spec:
               value: {{ include "sim.ollamaUrl" . | quote }}
             - name: PII_URL
               value: {{ include "sim.piiUrl" . | quote }}
-            {{- with (include "sim.redisUrl" .) }}
-            - name: REDIS_URL
-              value: {{ . | quote }}
-            {{- end }}
             {{- /*
               Skip envDefaults keys that the user has explicitly overridden in app.env
               with a non-empty value. K8s `env` takes precedence over `envFrom`, so an
@@ -123,7 +119,7 @@ spec:
               and in inline mode (values flow through the chart-managed Secret).
             */}}
             {{- if and .Values.app.secrets.existingSecret.enabled (not .Values.externalSecrets.enabled) }}
-            {{- $chartComputed := list "DATABASE_URL" "SOCKET_SERVER_URL" "OLLAMA_URL" "PII_URL" "REDIS_URL" }}
+            {{- $chartComputed := list "DATABASE_URL" "SOCKET_SERVER_URL" "OLLAMA_URL" "PII_URL" }}
             {{- range $key, $value := $appEnv }}
             {{- if and (ne (toString $value) "") (ne (toString $value) "<nil>") (not (has $key $chartComputed)) }}
             - name: {{ $key }}
@@ -147,6 +143,12 @@ spec:
             {{- toYaml . | nindent 12 }}
             {{- end }}
           envFrom:
+            # Bundled Redis URL. Listed FIRST so any operator-supplied REDIS_URL
+            # in a later source overrides it — see templates/configmap-redis.yaml.
+            {{- if include "sim.chartManagesRedis" . }}
+            - configMapRef:
+                name: {{ include "sim.fullname" . }}-redis
+            {{- end }}
             # App secrets (authentication, encryption keys)
             - secretRef:
                 name: {{ include "sim.appSecretName" . }}

helm/sim/templates/deployment-realtime.yaml

@@ -62,10 +62,6 @@ spec:
           env:
             - name: DATABASE_URL
               value: {{ include "sim.databaseUrl" . | quote }}
-            {{- with (include "sim.redisUrl" .) }}
-            - name: REDIS_URL
-              value: {{ . | quote }}
-            {{- end }}
             {{- if .Values.telemetry.enabled }}
             {{- $nodeEnv := default (default "production" (index (.Values.realtime.envDefaults | default dict) "NODE_ENV")) (index (.Values.realtime.env | default dict) "NODE_ENV") }}
             # OpenTelemetry configuration
@@ -116,7 +112,7 @@ spec:
               deployment.
             */}}
             {{- if and .Values.app.secrets.existingSecret.enabled (not .Values.externalSecrets.enabled) }}
-            {{- $chartComputed := list "DATABASE_URL" "SOCKET_SERVER_URL" "OLLAMA_URL" "PII_URL" "REDIS_URL" }}
+            {{- $chartComputed := list "DATABASE_URL" "SOCKET_SERVER_URL" "OLLAMA_URL" "PII_URL" }}
             {{- /*
               Build the effective realtime env from app.env as the base, then
               overlay non-empty realtime.env values. Sprig's `merge` keeps the
@@ -141,6 +137,12 @@ spec:
             {{- toYaml . | nindent 12 }}
             {{- end }}
           envFrom:
+            # Bundled Redis URL. Listed FIRST so any operator-supplied REDIS_URL
+            # in a later source overrides it — see templates/configmap-redis.yaml.
+            {{- if include "sim.chartManagesRedis" . }}
+            - configMapRef:
+                name: {{ include "sim.fullname" . }}-redis
+            {{- end }}
             # App secrets (authentication keys shared with main app)
             - secretRef:
                 name: {{ include "sim.appSecretName" . }}