feat(openhands): PLTF-1247 make Valkey the bundled cache

charts/openhands/templates/troubleshoot/_shared.tpl

@@ -61,7 +61,7 @@
     outcomes:
       - fail:
           when: "== false"
-          message: "No default storage class found - required for PostgreSQL, Redis, and file storage"
+          message: "No default storage class found - required for persistent PostgreSQL, file, and runtime storage"
       - pass:
           message: "Default storage class is available"
 {{- if .Values.externalDatabase.enabled }}

charts/openhands/templates/troubleshoot/support-bundle.yaml

@@ -1005,20 +1005,20 @@ spec:
     {{- end }}
     {{- if and (include "openhands.cache.backend" .) .Values.replicated.enabled .Values.replicated.redisPassword }}
     - redis:
-        checkName: "Redis Cache Health"
+        checkName: "Cache Health"
         collectorName: redis
         outcomes:
           - fail:
               when: "connected == false"
-              message: "Cannot connect to Redis server"
+              message: "Cannot connect to the cache server"
           - fail:
               when: "version == \"\""
-              message: "Redis version could not be determined"
+              message: "Cache server version could not be determined"
           - warn:
               when: "version < 6.0.0"
-              message: "Redis version is older than recommended (6.0.0+)"
+              message: "Cache server version is older than recommended (6.0.0+)"
           - pass:
               when: "connected == true"
-              message: "Redis server is healthy"
+              message: "Cache server is healthy"
     {{- end }}
 {{- end -}}

charts/openhands/tests/notes_test.yaml

@@ -27,7 +27,7 @@ tests:
           pattern: "was not deployed by this release"
   - it: warns when both cache backends are enabled
     set:
-      valkey.enabled: true
+      redis.enabled: true
     asserts:
       - matchRegexRaw:
           pattern: "both cache backends are enabled"
@@ -38,7 +38,7 @@ tests:
   - it: warns about both backends even when the app is not deployed
     set:
       enabled: false
-      valkey.enabled: true
+      redis.enabled: true
     asserts:
       - matchRegexRaw:
           pattern: "both cache backends are enabled"

charts/openhands/tests/valkey_env_test.yaml

@@ -15,28 +15,7 @@ templates:
 release:
   name: openhands
 tests:
-  - it: keeps the cache env on redis at the chart defaults
-    asserts:
-      - template: deployment.yaml
-        contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: REDIS_HOST
-            value: openhands-redis-master
-      - template: deployment.yaml
-        contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: REDIS_PASSWORD
-            valueFrom:
-              secretKeyRef:
-                name: redis
-                key: redis-password
-
-  - it: points the cache env at valkey when only valkey is enabled
-    set:
-      redis.enabled: false
-      valkey.enabled: true
+  - it: points the cache env at valkey at the chart defaults
     asserts:
       - template: deployment.yaml
         contains:
@@ -52,11 +31,8 @@ tests:
             value: "6379"
 
   # If this assertion changes, an install has to create a new secret before it
-  # can enable valkey.
+  # can upgrade.
   - it: reads the password from the same redis secret
-    set:
-      redis.enabled: false
-      valkey.enabled: true
     asserts:
       - template: deployment.yaml
         contains:
@@ -68,16 +44,25 @@ tests:
                 name: redis
                 key: redis-password
 
-  - it: stays on redis when both backends are enabled
+  - it: returns to redis when redis is re-enabled
     set:
-      valkey.enabled: true
+      redis.enabled: true
     asserts:
       - template: deployment.yaml
         contains:
           path: spec.template.spec.containers[0].env
           content:
             name: REDIS_HOST
             value: openhands-redis-master
+      - template: deployment.yaml
+        contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: redis
+                key: redis-password
 
   - it: drops the cache env when neither backend is enabled
     set:
@@ -91,33 +76,10 @@ tests:
             name: REDIS_PORT
             value: "6379"
 
-  - it: analyses redis as a StatefulSet in the support bundle
-    set:
-      replicated.enabled: true
-      replicated.redisPassword: test-password
-    asserts:
-      - template: troubleshoot/secrets.yaml
-        documentIndex: 1
-        matchRegex:
-          path: stringData.support-bundle-spec
-          pattern: "statefulsetStatus:\n\\s+name: openhands-redis-master"
-      - template: troubleshoot/secrets.yaml
-        documentIndex: 1
-        matchRegex:
-          path: stringData.support-bundle-spec
-          pattern: "app.kubernetes.io/name=redis"
-      - template: troubleshoot/secrets.yaml
-        documentIndex: 1
-        notMatchRegex:
-          path: stringData.support-bundle-spec
-          pattern: "openhands-valkey"
-
   # Valkey renders a Deployment, not a StatefulSet. A statefulsetStatus analyzer
   # left pointing at the old workload reports permanently unready.
   - it: analyses valkey as a Deployment in the support bundle
     set:
-      redis.enabled: false
-      valkey.enabled: true
       replicated.enabled: true
       replicated.redisPassword: test-password
     asserts:
@@ -143,8 +105,6 @@ tests:
   # own separate cache and is unaffected.
   - it: leaves no reference to openhands-redis-master
     set:
-      redis.enabled: false
-      valkey.enabled: true
       replicated.enabled: true
       replicated.redisPassword: test-password
     asserts:
@@ -153,3 +113,20 @@ tests:
         notMatchRegex:
           path: stringData.support-bundle-spec
           pattern: "openhands-redis-master"
+
+  - it: analyses redis as a StatefulSet again when re-enabled
+    set:
+      redis.enabled: true
+      replicated.enabled: true
+      replicated.redisPassword: test-password
+    asserts:
+      - template: troubleshoot/secrets.yaml
+        documentIndex: 1
+        matchRegex:
+          path: stringData.support-bundle-spec
+          pattern: "statefulsetStatus:\n\\s+name: openhands-redis-master"
+      - template: troubleshoot/secrets.yaml
+        documentIndex: 1
+        notMatchRegex:
+          path: stringData.support-bundle-spec
+          pattern: "openhands-valkey"

charts/openhands/values.yaml

@@ -877,8 +877,9 @@ externalDatabase:
   sslMode: "prefer"
   existingSecret: postgres-password
 
+# Superseded by the valkey block below. Still selected when enabled.
 redis:
-  enabled: true
+  enabled: false
   image:
     repository: bitnamilegacy/redis
   architecture: standalone
@@ -901,10 +902,10 @@ redis:
   replica:
     replicaCount: 0
 
-# Second bundled cache backend. Redis above wins while both are enabled
+# The bundled cache. Redis above wins while both are enabled
 # (templates/_cache.tpl).
 valkey:
-  enabled: false
+  enabled: true
   image:
     repository: valkey/valkey
     # The subchart defaults to its appVersion (9.1.1, Debian), which has

docs/ARCHITECTURE.md

@@ -18,7 +18,7 @@ OpenHands Cloud is deployed to a Kubernetes cluster using Helm charts, with mini
 
 * [Kubernetes](https://kubernetes.io) (compute for OpenHands UI, agent and runtimes)
 * [PostgreSQL](https://www.postgresql.org) (databases for several of the components)
-* [Redis](https://redis.io) (caching)
+* [Valkey](https://valkey.io) (caching)
 * [Keycloak](https://www.keycloak.org) (authentication)
 * [LiteLLM Proxy](https://docs.litellm.ai/docs/simple_proxy) (handles connections to AI Language models)
 * AI Language Models

docs/assets/fig1.d2

@@ -24,7 +24,7 @@ app-cluster: Kubernetes Cluster {
     shape: cylinder
   }
   litellm: LiteLLM Proxy
-  redis: Redis {
+  valkey: Valkey {
     shape: cylinder
   }
   runtimes: Runtimes {
@@ -51,7 +51,7 @@ lb -> app-cluster.openhands
 lb -> app-cluster.keycloak
 app-cluster.openhands -> app-cluster.runtime-api
 app-cluster.openhands -> app-cluster.keycloak
-app-cluster.openhands -> app-cluster.redis
+app-cluster.openhands -> app-cluster.valkey
 app-cluster.openhands -> convo-bucket
 app-cluster.runtime-api -> app-cluster.runtimes
 app-cluster.openhands -> app-cluster.litellm

local-kind/kind-resources.yaml

@@ -58,19 +58,15 @@ postgresql:
         cpu: "1"
         memory: 1Gi
 
-redis:
+valkey:
   enabled: true
-  networkPolicy:
-    enabled: false
-  master:
-    resourcesPreset: none
-    resources:
-      requests:
-        cpu: 50m
-        memory: 128Mi
-      limits:
-        cpu: 250m
-        memory: 512Mi
+  resources:
+    requests:
+      cpu: 50m
+      memory: 128Mi
+    limits:
+      cpu: 250m
+      memory: 512Mi
 
 minio:
   resources:

replicated/application.yaml

@@ -61,9 +61,9 @@ spec:
     - '{{repl if ConfigOptionEquals "postgres_type" "embedded_postgres"}}openhands/statefulset/openhands-postgresql{{repl end}}'
     - '{{repl if ConfigOptionEquals "postgres_type" "embedded_postgres"}}openhands/service/openhands-postgresql{{repl end}}'
 
-    # redis
-    - openhands/statefulset/openhands-redis-master
-    - openhands/service/openhands-redis-master
+    # valkey
+    - openhands/deployment/openhands-valkey
+    - openhands/service/openhands-valkey
 
     # lite-llm
     - openhands/deployment/openhands-litellm

replicated/openhands.yaml

@@ -518,11 +518,11 @@ spec:
     postgresql:
       enabled: repl{{ ConfigOptionEquals "postgres_type" "embedded_postgres" }}
     redis:
+      enabled: false
+    valkey:
       enabled: true
       image:
-        repository: 'proxy/{{repl LicenseFieldValue "appSlug"}}/docker.io/bitnamilegacy/redis'
-      auth:
-        password: '{{repl ConfigOption "redis_password" | Base64Encode }}'
+        repository: 'proxy/{{repl LicenseFieldValue "appSlug"}}/docker.io/valkey/valkey'
     # Conversation/session files live on the bundled MinIO, which is durable
     # here (persistence below). With no endpoint or credentials configured,
     # the app targets the bundled instance automatically.
@@ -829,9 +829,9 @@ spec:
         postgresql:
           image:
             repository: '{{repl LocalRegistryNamespace }}/postgresql'
-        redis:
+        valkey:
           image:
-            repository: '{{repl LocalRegistryNamespace }}/redis'
+            repository: '{{repl LocalRegistryNamespace }}/valkey'
         minio:
           image:
             repository: '{{repl LocalRegistryHost }}/{{repl LocalRegistryNamespace }}/ohe-minio'
@@ -1459,7 +1459,7 @@ spec:
         tag: 'RELEASE.2023-05-18T16-59-00Z-amd64@sha256:9e46d9ed12fa66361f6482b0081d65c2d68e01cbbdede8b964950f76e5a35701'
     postgresql:
       enabled: true
-    redis:
+    valkey:
       enabled: true
     runtime-api:
       enabled: true

scripts/test_troubleshoot_secrets_template.py

@@ -63,7 +63,7 @@ def test_db_collectors_render_with_credentials() -> None:
     assert "- postgresql:" in manifest
     assert "uri: postgresql://oh:pg-secret@openhands-postgresql" in manifest
     assert "- redis:" in manifest
-    assert "uri: redis://default:redis-secret@openhands-redis-master" in manifest
+    assert "uri: redis://default:redis-secret@openhands-valkey" in manifest
 
 
 def test_replicated_sdk_renders_by_default() -> None: