Migration path for redis to valkey container with requirepass

[raldone01]

My current redis setup:

  my-redis:
    image: redis:6.2-alpine
    healthcheck:
      test: redis-cli ping || exit 1
    command: [
        "ash",
        "-c",
        '
        docker-entrypoint.sh
        --requirepass "$$(cat /run/secrets/redis_pw)"
        ',
      ]
    volumes:
      - ${CONTAINER_SSD}/my_redis:/data
    secrets:
      - redis_pw
    networks:
      - redis-net

My migration attempt:

  my-redis:
    image: docker.io/valkey/valkey
    healthcheck:
      test: redis-cli ping || exit 1
    command: [
        "bash",
        "-c",
        '
        valkey-server
        --requirepass "$$(cat /run/secrets/redis_pw)"
        ',
      ]
    volumes:
      - ${CONTAINER_SSD}/my_redis:/data
    secrets:
      - redis_pw
    networks:
      - redis-net

However it seems like valkey-server does not support requirepass.
What is the proper migration route for this?

[parimoh]

So when trying out the latter setup locally everything seems to work. This is the docker-compose file we used:

version: '3.8'

services:
  my-redis:
    image: docker.io/valkey/valkey
    healthcheck:
      test: ["CMD", "sh", "-c", "redis-cli ping | grep -q PONG || (echo 'Health check failed, exiting...' && kill 1)"]
    command: [
        "bash",
        "-c",
        "docker-entrypoint.sh --requirepass $$(cat /run/secrets/redis_pass)"
      ]
    volumes:
      - ${CONTAINER_SSD}/my_redis:/data
    secrets:
      - redis_pass
    networks:
      - redis-net

secrets:
  redis_pass:
    file: ./redis_pass

networks:
  redis-net:
    driver: bridge

Here's a screenshot of the server blocking us when we do not enter the password after running docker exec -it docker-my-redis-1 valkey-cli:

We had to make sure to define the network and secrets ourselves, but otherwise we didn't have to change anything for it to work. Can you share the error message you're getting?

[DerRockWolf]

Afaik when doing bash -c, valkey isn't PID 1 anymore, so it won't get any signals (e.g., SIGTERM).

My current setup (in Kubernetes) looks like this and uses the VALKEY_EXTRA_FLAGS environment variable as supported by the container image:

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: valkey-master
  namespace: paperless-ngx
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: master
      app.kubernetes.io/instance: valkey
      app.kubernetes.io/name: valkey
  template:
    metadata:
      labels:
        app.kubernetes.io/component: master
        app.kubernetes.io/instance: valkey
        app.kubernetes.io/name: valkey
    spec:
      containers:
        - name: valkey
          image: docker.io/valkey/valkey:8.1.3-alpine
          imagePullPolicy: IfNotPresent
          env:
            # order is important here
            - name: VALKEY_PASSWORD # not used directly by the container image
              valueFrom:
                secretKeyRef:
                  name: paperless-credentials
                  key: valkey-password
            - name: VALKEY_EXTRA_FLAGS
              value: '--appendonly yes --save "" --requirepass $(VALKEY_PASSWORD)'
          ports:
            - containerPort: 6379
              name: valkey
          volumeMounts:
            - mountPath: /data
              name: valkey-data
  volumeClaimTemplates:
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: valkey-data
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 1Gi

variable substitution like $(VALKEY_PASSWORD) probably also works in docker-compose somehow 🙂

Edit: note that passing credentials via command arguments is separable to being stolen as /proc/PID/cmdline is world readable. Valkey, from what I can tell, always replaces the passed arguments (argv) to just contain *:6379 (so the value of bind + : + port), but there is still a small time where the originally passed arguments are present in cmdline.
So ideally valkey itself should provide support for configuring some settings via environment variables, or the container images entrypoint could dynamically create a valkey.conf based on passed environment variables.

[TheRealBecks]

Until now I never used Redis or Valkey so I also have no idea if I need to use a user-defined valkey.conf for my container. That being said I wanted to use an username and password as it seems like a good idea to me. But there seems to be no simple way to use the old or new (ACL) way to configure a user and password via e.g. environment variables directly in a (Docker/Podman) compose file? The documentation on dockerhub only points to the official Valkey documentation, but that looks like overkill to me.

Is there an easy way for (new) users to get user authentication working with a Valkey container?

Edit: I also found out that some services can only access the old (non-ACL) way of authentication

[filipcoja3108]

For anyone using K8s:

I just went with some init container before running the valkey image:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: valkey-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: valkey
  template:
    metadata:
      labels:
        app: valkey
    spec:
      volumes:
        - name: valkey-config
          emptyDir: {}
        - name: valkey-configmap
          configMap:
            name: valkey-config
        - name: valkey-data
          emptyDir: {}

      initContainers:
        - name: init-valkey-config
          image: busybox:1.37-musl
          command:
            - sh
            - -c
            - |
              set -euo pipefail
              cp /configmap/valkey.conf /config/valkey.conf
              echo "requirepass ${VALKEY_AUTH}" >> /config/valkey.conf
          envFrom:
            - secretRef:
                name: ponton-valkey-secret
          volumeMounts:
            - name: valkey-config
              mountPath: /config
            - name: valkey-configmap
              mountPath: /configmap

      containers:
        - name: valkey
          image: valkey/valkey:8.1.4-alpine3.22
          imagePullPolicy: IfNotPresent
          command: ["valkey-server", "/usr/local/etc/valkey/valkey.conf"]
          ports:
            - containerPort: 6379
          volumeMounts:
            - name: valkey-config
              mountPath: /usr/local/etc/valkey
            - name: valkey-data
              mountPath: /data

[ypid-work]

Afaik when doing bash -c, valkey isn't PID 1 anymore, so it won't get any signals (e.g., SIGTERM).

@DerRockWolf Easy to check with ls -l /proc/*/exe. Turns out, (da)sh and bash will exec into valkey-server if no Shell feature is required anymore. But as it can be difficult to tell, I consider it best practice to write the exec explicitly otherwise you never know and valkey might be SIGKILLed because it never received any SIGTERM just because someone not aware of shell signal passing added something to the inline shell script.