fix(helm): derive redis master host from subchart fullname + tests

Address CodeRabbit review on appsmith.redisMasterHost (PR #41874):
the host was hardcoded as "{release}-redis-master", which is wrong
whenever the Bitnami subchart names its master Service differently
(release name contains "redis", or nameOverride/fullnameOverride set).
Derive it from common.names.fullname evaluated in the redis subchart
context (.Subcharts.redis) so it always matches the rendered Service.

- Tighten the helper comment (name common.names.fullname; note the
  nameOverride/fullnameOverride edge cases).
- Add redis_auth_test cases: redis.auth.password guard (reject/accept),
  self-managed path skips bootstrap hook, init container skips
  REDISCLI_AUTH on operator URL, and a regression case asserting the
  master host follows the subchart fullname for a "redis"-named release.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: sebastianiv21

deploy/helm/templates/_helpers.tpl

@@ -260,12 +260,15 @@ every `helm template`/install/upgrade.
 
 {{/*
 Redis: master service hostname (FQDN inside the cluster).
-Derived from the release name to stay uniform with the chart's other components.
-Assumes the release name does not contain "redis" (otherwise the Bitnami subchart
-collapses its fullname to just the release name and this host would not match).
+Reuses the bundled `common.names.fullname` helper (the one the subchart's master
+Service uses), evaluated in the redis subchart's context (.Subcharts.redis), so the
+host always matches the Service it renders — including the edge cases where the
+release name contains "redis" (the subchart collapses its fullname to just the
+release name) or redis.nameOverride / redis.fullnameOverride is set.
+Only valid when redis.enabled (the subchart context exists); all callers gate on it.
 */}}
 {{- define "appsmith.redisMasterHost" -}}
-{{- printf "%s-redis-master.%s.svc.cluster.local" .Release.Name (include "appsmith.namespace" .) -}}
+{{- printf "%s-master.%s.svc.cluster.local" (include "common.names.fullname" .Subcharts.redis) (include "appsmith.namespace" .) -}}
 {{- end -}}
 
 {{/*

deploy/helm/tests/redis_auth_test.yaml

@@ -197,9 +197,86 @@ tests:
           path: data.APPSMITH_REDIS_URL
           value: redis://RELEASE-NAME-redis-master.NAMESPACE.svc.cluster.local:6379
 
+  # Regression: the host must track the subchart's fullname, not a naive
+  # "{release}-redis-master". When the release name contains "redis" the subchart
+  # collapses its fullname to just the release name, so the master Service is
+  # "{release}-master" (no doubled -redis-). See appsmith.redisMasterHost.
+  - name: host follows subchart fullname when release name contains "redis"
+    release:
+      name: myredis
+    set:
+      redis.auth.enabled: false
+    asserts:
+      - equal:
+          path: data.APPSMITH_REDIS_URL
+          value: redis://myredis-master.NAMESPACE.svc.cluster.local:6379
+
   - name: no bundled redis URL when the subchart is disabled
     set:
       redis.enabled: false
     asserts:
       - notExists:
           path: data.APPSMITH_REDIS_URL
+
+---
+# Guard: redis.auth.password is only allowed on the fully self-managed path
+# (existingSecret: "" + a matching applicationConfig.APPSMITH_REDIS_URL).
+# Validation lives in appsmith.validateRedisAuth, invoked from configMap.yaml.
+suite: Redis auth - password guard (validateRedisAuth)
+templates:
+  - configMap.yaml
+tests:
+  - name: rejects password with the default bootstrap secret still set
+    set:
+      redis.auth.password: hunter2
+    asserts:
+      - failedTemplate:
+          errorMessage: ""
+
+  - name: rejects password when no APPSMITH_REDIS_URL is supplied
+    set:
+      redis.auth.password: hunter2
+      redis.auth.existingSecret: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: ""
+
+  - name: accepts the self-managed path (password + empty existingSecret + URL)
+    set:
+      redis.auth.password: hunter2
+      redis.auth.existingSecret: ""
+      applicationConfig.APPSMITH_REDIS_URL: redis://:hunter2@RELEASE-NAME-redis-master:6379
+    asserts:
+      - notFailedTemplate: {}
+
+---
+suite: Redis auth - self-managed path skips chart bootstrap
+templates:
+  - hooks/redis.yaml
+tests:
+  - name: no bootstrap hook when redis.auth.password is set (self-managed)
+    set:
+      redis.auth.password: hunter2
+      redis.auth.existingSecret: ""
+      applicationConfig.APPSMITH_REDIS_URL: redis://:hunter2@RELEASE-NAME-redis-master:6379
+    asserts:
+      - hasDocuments:
+          count: 0
+
+---
+suite: Redis auth - init container skips REDISCLI_AUTH on self-managed URL
+templates:
+  - deployment.yaml
+tests:
+  - name: no REDISCLI_AUTH when the operator supplies APPSMITH_REDIS_URL
+    set:
+      applicationConfig.APPSMITH_REDIS_URL: redis://custom.example:6379
+    asserts:
+      - notContains:
+          path: spec.template.spec.initContainers[0].env
+          content:
+            name: REDISCLI_AUTH
+            valueFrom:
+              secretKeyRef:
+                name: appsmith-redis-secret
+                key: redis-password