From bac286ee1bfb6e20d6a42dc09ebf71a8cd8bc5a5 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Sun, 18 Jan 2026 11:10:36 -0600
Subject: [PATCH] feat(k8s): move Valkey to standalone StatefulSet

Previously Valkey ran as a sidecar container in the main deployment,
causing it to restart every time the web app deployed. This resulted
in connection errors and cache loss during deployments.

Changes:
- Created valkey-statefulset.yaml with StatefulSet resource (1 replica)
- Created valkey-service.yaml with headless service
- Removed Valkey sidecar container from deployment.yaml
- Updated REDIS_HOST from 127.0.0.1 to valkey-0.valkey.towerops.svc.cluster.local
- Added new resources to kustomization.yaml

Benefits:
- Valkey persists across web app deployments
- No connection errors during rolling updates
- Cache data preserved
- Independent scaling and resource management
---
 k8s/deployment.yaml         | 45 ++-----------------------
 k8s/kustomization.yaml      |  2 ++
 k8s/valkey-service.yaml     | 14 ++++++++
 k8s/valkey-statefulset.yaml | 65 +++++++++++++++++++++++++++++++++++++
 4 files changed, 83 insertions(+), 43 deletions(-)
 create mode 100644 k8s/valkey-service.yaml
 create mode 100644 k8s/valkey-statefulset.yaml

diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index 95f6e8aa..2c054cb8 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -84,9 +84,9 @@ spec:
                 secretKeyRef:
                   name: towerops-secrets
                   key: SECRET_KEY_BASE
-            # Redis connection to Valkey sidecar container (localhost because same pod)
+            # Redis connection to standalone Valkey StatefulSet
             - name: REDIS_HOST
-              value: "127.0.0.1"
+              value: "valkey-0.valkey.towerops.svc.cluster.local"
             - name: REDIS_PORT
               value: "6379"
           envFrom:
@@ -124,44 +124,3 @@ spec:
             timeoutSeconds: 2
             successThreshold: 1
             failureThreshold: 2
-        - name: valkey
-          image: valkey/valkey:8.0-alpine
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            allowPrivilegeEscalation: false
-            runAsNonRoot: true
-            runAsUser: 999
-            capabilities:
-              drop:
-                - ALL
-            seccompProfile:
-              type: RuntimeDefault
-          ports:
-            - containerPort: 6379
-              name: valkey
-          resources:
-            requests:
-              memory: "128Mi"
-              cpu: "50m"
-            limits:
-              memory: "256Mi"
-              cpu: "200m"
-          livenessProbe:
-            exec:
-              command:
-                - valkey-cli
-                - ping
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 2
-            failureThreshold: 3
-          readinessProbe:
-            exec:
-              command:
-                - valkey-cli
-                - ping
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            timeoutSeconds: 2
-            successThreshold: 1
-            failureThreshold: 2
diff --git a/k8s/kustomization.yaml b/k8s/kustomization.yaml
index 1456b5b8..79abcc76 100644
--- a/k8s/kustomization.yaml
+++ b/k8s/kustomization.yaml
@@ -6,6 +6,8 @@ resources:
   - deployment.yaml
   - service.yaml
   - service-headless.yaml
+  - valkey-statefulset.yaml
+  - valkey-service.yaml
   - certificate.yaml
   - ingressroute.yaml
   - poddisruptionbudget.yaml
diff --git a/k8s/valkey-service.yaml b/k8s/valkey-service.yaml
new file mode 100644
index 00000000..e12f7252
--- /dev/null
+++ b/k8s/valkey-service.yaml
@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: valkey
+  namespace: towerops
+spec:
+  clusterIP: None  # Headless service for StatefulSet
+  selector:
+    app: valkey
+  ports:
+    - port: 6379
+      targetPort: 6379
+      name: valkey
diff --git a/k8s/valkey-statefulset.yaml b/k8s/valkey-statefulset.yaml
new file mode 100644
index 00000000..4d1fcb25
--- /dev/null
+++ b/k8s/valkey-statefulset.yaml
@@ -0,0 +1,65 @@
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: valkey
+  namespace: towerops
+spec:
+  serviceName: valkey
+  replicas: 1
+  selector:
+    matchLabels:
+      app: valkey
+  template:
+    metadata:
+      labels:
+        app: valkey
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 999
+        fsGroup: 999
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: valkey
+          image: valkey/valkey:8.0-alpine
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 999
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          ports:
+            - containerPort: 6379
+              name: valkey
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "50m"
+            limits:
+              memory: "512Mi"
+              cpu: "200m"
+          livenessProbe:
+            exec:
+              command:
+                - valkey-cli
+                - ping
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 2
+            failureThreshold: 3
+          readinessProbe:
+            exec:
+              command:
+                - valkey-cli
+                - ping
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 2
+            successThreshold: 1
+            failureThreshold: 2