[4krajesh]

What

• Was: kustomize installs could only give services one Redis URL.
• Now: a new opt-in components/redis-sentinel copies the Sentinel settings from overlay-secret-vars into the app, live and silo Secrets, and flux and mcp-server's where present. No overlay includes it, so existing overlays render as before.
• This lets self-hosted customers who bring their own Sentinel deploy with it. Plane doesn't provide or certify Sentinel.
• Keys are first declared as "", then filled, because a replacement that creates a key renders "" as null and "false" as a boolean, which a Secret rejects.

Where to look

1. 🔴 kustomize/components/redis-sentinel/kustomization.yaml — which Secrets get which keys
2. 🟡 kustomize/overlays/{default,managed,phoenix}/ — commented include and example block
3. ⚪ kustomize/README.md, kustomize/components/redis/kustomization.yaml, kustomize/components/flux/secret.yaml — docs and comments

Watch out for:

• The component must be listed after flux and mcp-server, or it misses their Secrets.
• custom-ca doesn't set SSL_CERT_FILE, so Python services should fail verification against a private CA. Whether to add it here is an open decision.

Blast Radius

• Existing overlays — render identically
• Sentinel enabled — app, live, silo, flux and mcp-server Secrets get the keys as strings; pi's Secret is untouched
• Private CA with verification on — expected to fail on Python services until SSL_CERT_FILE is added

Proof

Important

Confidence: Low — render-checked only; it hasn't run on a cluster, and the private CA gap is open.

• Ran: kubectl kustomize (v5.8.1) on all three overlays: identical to main when off; with it on, all keys render as strings, plane-pi-api-secrets is untouched and no plane-redis StatefulSet renders.
• Try it: remove components/redis, enable redis-sentinel, set the example block with REDIS_URL: "", then run kubectl kustomize.
• Not verified: a kustomize install on a cluster, with or without Sentinel; a private CA.

Rollout

• Opt-in; nothing changes until the component is enabled. Needs images from makeplane/plane-ee#10916 and [INFRA-1336] feat(storage): Redis Sentinel support for the OAuth token store plane-mcp-server#273; older images ignore the keys.
• Phase 0 decisions await owner sign-off. Rollback: remove the component.

Media

N/A

Links

• Work item: INFRA-1336 (report page)
• Design / plan: docs/redis-sentinel.md in makeplane/plane-ee#10916
• Stack / follow-ups: related: makeplane/plane-ee#10916, [INFRA-1336] feat(plane-enterprise): Redis Sentinel support (3.13.0) helm-charts#371, makeplane/docs#649, [INFRA-1336] feat(storage): Redis Sentinel support for the OAuth token store plane-mcp-server#273
• DRI / session: Rajesh K

[makeplane]

Linked to Plane Work Item(s)

• (INFRA-1336) [HRT] Support Redis Sentinel for HA Redis/Valkey

This comment was auto-generated by Plane