Skip to content

README.md

Latest commit

 

History

History
190 lines (137 loc) · 5.06 KB

README.md

File metadata and controls

190 lines (137 loc) · 5.06 KB
Raw

Valkey Cluster External Service for SAP EIC

Deploy Valkey (Redis-compatible) in Redis Cluster mode (hash slot sharding) with TLS on OpenShift for SAP Edge Integration Cell.

Prerequisites

  • oc CLI logged into your OpenShift cluster
  • helm v3 installed
  • cluster-admin permissions

Directory Structure

external-valkey-cluster/
├── charts/
│   ├── redhat-valkey-imagestreams/
│   │   └── src/                      # ImageStreams helm chart
│   └── redhat-valkey-cluster/
│       └── src/                      # Valkey cluster helm chart
├── deploy_valkey.sh                  # Automated deployment script
├── get_valkey_access.sh              # Get connection details
├── cleanup_valkey.sh                 # Cleanup script
└── README.md

Architecture

This chart deploys Valkey in Redis Cluster mode using a StatefulSet:

  • All pods start as independent Valkey nodes with --cluster-enabled yes
  • After pods are ready, a Helm post-install hook Job forms the cluster via valkey-cli --cluster create
  • Hash slots (0-16383) are distributed evenly across all nodes
  • Each node is a master responsible for a subset of hash slots
  • Minimum 3 nodes required for Redis Cluster

Two services are created:

Service Description
valkey ClusterIP service routing to all pods (use as seed for cluster discovery)
valkey-headless Headless service for StatefulSet DNS resolution and TLS certificate SANs

Quick Start

Automated Deployment

# Deploy Valkey cluster with TLS (password optional, default: testp)
bash deploy_valkey.sh

# Deploy with custom password
bash deploy_valkey.sh --password <your-password>

# Deploy to custom namespace
bash deploy_valkey.sh --namespace my-valkey --password <your-password>

# Dry-run to preview
bash deploy_valkey.sh --dry-run

Get Access Details

bash get_valkey_access.sh

# For custom namespace
bash get_valkey_access.sh --namespace my-valkey

Cleanup

# Interactive cleanup
bash cleanup_valkey.sh

# Force cleanup (no prompts)
bash cleanup_valkey.sh --force

# Dry-run
bash cleanup_valkey.sh --dry-run

Manual Deployment

1. Install ImageStreams Chart

oc new-project sap-eic-external-valkey-cluster

helm install redhat-valkey-imagestreams \
  ./charts/redhat-valkey-imagestreams/src \
  -n sap-eic-external-valkey-cluster

2. Install Valkey Cluster Chart

# TLS is always enabled (required by SAP EIC)
helm install valkey-cluster \
  ./charts/redhat-valkey-cluster/src \
  -n sap-eic-external-valkey-cluster \
  --set valkey_password=<your-password> \
  --timeout 10m

The Helm post-install hook will automatically form the Redis Cluster after all pods are ready.

3. Verify Deployment

# Check all pods are running
oc get pods -l name=valkey -n sap-eic-external-valkey-cluster

# Check services
oc get svc -l template=valkey-cluster-template -n sap-eic-external-valkey-cluster

# Check cluster init job completed
oc get jobs -n sap-eic-external-valkey-cluster

# Check TLS secret (auto-generated by OpenShift Service CA)
oc get secret valkey-tls -n sap-eic-external-valkey-cluster

# Check Service CA ConfigMap
oc get configmap valkey-service-ca -n sap-eic-external-valkey-cluster

# Run helm test (validates cluster_state:ok and all slots assigned)
helm test valkey-cluster -n sap-eic-external-valkey-cluster

Connection Details

Clients use a Redis Cluster client (e.g., Go redis.ClusterClient) that connects to seed nodes, discovers all cluster nodes via CLUSTER SLOTS, and routes commands to the correct node based on key hash slot.

The TLS certificate is generated for the headless service, so CLUSTER SLOTS returns hostnames matching the certificate SANs via --cluster-announce-hostname.

Cluster connection

  • Seed Addresses: valkey-{0,1,2}.valkey-headless.sap-eic-external-valkey-cluster.svc.cluster.local:6380
  • Port: 6380 (TLS)
valkey-cli -h valkey-0.valkey-headless.sap-eic-external-valkey-cluster.svc -p 6380 \
  --tls --cacert /etc/ssl/service-ca/service-ca.crt \
  -a <your-password> -c

Note: Use -c flag for cluster mode in valkey-cli to follow MOVED redirections.

Mount CA Certificate in Application

volumeMounts:
  - name: service-ca
    mountPath: /etc/ssl/service-ca
    readOnly: true
volumes:
  - name: service-ca
    configMap:
      name: valkey-service-ca

No client certificate is required (--tls-auth-clients is set to no).

Upgrade

helm upgrade valkey-cluster \
  ./charts/redhat-valkey-cluster/src \
  -n sap-eic-external-valkey-cluster \
  --timeout 10m

Manual Cleanup

helm uninstall valkey-cluster -n sap-eic-external-valkey-cluster
helm uninstall redhat-valkey-imagestreams -n sap-eic-external-valkey-cluster
oc delete pvc -l template=valkey-cluster-template -n sap-eic-external-valkey-cluster
oc delete namespace sap-eic-external-valkey-cluster