feat: support redis TLS

[Ubisoft-potato]

Summary

Adds TLS support for Redis/Valkey connections across all four services (api, batch, subscriber, web). Bucketeer previously could only connect to Redis in plaintext, which is incompatible with AWS ElastiCache/MemoryDB deployments that have in-transit encryption enabled.

• pkg/redis/v3: new TLSConfig + WithTLS option. Builds a standard tls.Config — CACert (optional, defaults to the system CA pool, sufficient for AWS ElastiCache/MemoryDB), Cert/Key (optional, for mutual TLS against self-managed Redis/Valkey that enforces client certs — not supported by AWS-managed Redis), and InsecureSkipVerify (dev/testing only).
• Every Redis client construction site in api, batch, subscriber, and web gets matching *-tls-enabled/-ca-cert/-cert/-key/-insecure-skip-verify CLI flags (env-var bound via kingpin), independently configurable per Redis block (main/persistent/non-persistent/pubsub) since some deployments mix a TLS-enabled primary Redis with a plaintext pubsub Redis, etc.
• Helm charts: each chart exposes its own local Redis TLS fields; the shared pubsub.redis TLS fields (including a new tlsSecretName) live once at the top level and are referenced by all four charts. When tlsSecretName is set, all four deployment.yamls mount that secret read-only at /usr/local/certs/redis, mirroring the existing Postgres sslSecretName pattern. Leaving it unset (default) renders no volume/mount at all.
• Subscriber's subscribers-configmap.yaml propagates the pubsub Redis TLS settings into subscribers.json, onDemandSubscribers.json, and the segmentUserPersister block of processors.json.

Scope notes

• docker-compose (local dev) is intentionally left untouched — the stock redis:7-alpine image doesn't support TLS termination, and tlsEnabled is more meaningfully exercised against a real TLS endpoint (ElastiCache/MemoryDB or self-hosted). This mirrors the existing Postgres TLS precedent's config surface but not its local end-to-end termination.

Closes #2771

[Copilot]

Pull request overview

Adds Redis/Valkey TLS support across services and Helm deployments.

Changes:

• Adds reusable Redis TLS configuration with CA and mTLS support.
• Exposes service CLI flags and Helm values for Redis TLS.
• Propagates TLS settings to subscriber configurations and mounts certificate secrets.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pkg/redis/v3/redis.go	Implements Redis TLS configuration.
pkg/redis/v3/redis_test.go	Tests TLS configuration handling.
pkg/api/cmd/server.go	Configures API Redis TLS.
pkg/batch/cmd/server/server.go	Configures batch Redis TLS.
pkg/subscriber/subscriber.go	Adds subscriber TLS fields.
pkg/subscriber/cmd/server/server.go	Configures subscriber Redis TLS.
pkg/web/cmd/server/server.go	Configures web Redis TLS.
manifests/bucketeer/values.yaml	Defines shared PubSub TLS values.
manifests/bucketeer/charts/api/values.yaml	Defines API TLS values.
manifests/bucketeer/charts/api/templates/deployment.yaml	Injects API TLS settings and secret.
manifests/bucketeer/charts/batch/values.yaml	Defines batch TLS values.
manifests/bucketeer/charts/batch/templates/deployment.yaml	Injects batch TLS settings and secret.
manifests/bucketeer/charts/subscriber/values.yaml	Defines subscriber TLS values.
manifests/bucketeer/charts/subscriber/templates/deployment.yaml	Injects subscriber TLS settings and secret.
manifests/bucketeer/charts/subscriber/templates/subscribers-configmap.yaml	Propagates PubSub TLS configuration.
manifests/bucketeer/charts/web/values.yaml	Defines web TLS values.
manifests/bucketeer/charts/web/templates/deployment.yaml	Injects web TLS settings and secret.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 21 out of 21 changed files in this pull request and generated 2 comments.