Improve teh securty of teh DB

infrastructure/kubernetes/base/components/databases/redis.yaml

@@ -19,6 +19,27 @@ spec:
         app.kubernetes.io/name: redis
         app.kubernetes.io/component: cache
     spec:
+      securityContext:
+        fsGroup: 999  # redis group
+      initContainers:
+      - name: fix-tls-permissions
+        image: busybox:latest
+        securityContext:
+          runAsUser: 0
+        command: ['sh', '-c']
+        args:
+        - |
+          cp /tls-source/* /tls/
+          chmod 600 /tls/redis-key.pem
+          chmod 644 /tls/redis-cert.pem /tls/ca-cert.pem
+          chown 999:999 /tls/*
+          ls -la /tls/
+        volumeMounts:
+        - name: tls-certs-source
+          mountPath: /tls-source
+          readOnly: true
+        - name: tls-certs-writable
+          mountPath: /tls
       containers:
       - name: redis
         image: redis:7.4-alpine
@@ -41,9 +62,23 @@ spec:
         - "512mb"
         - --databases
         - "16"
+        - --tls-port
+        - "6379"
+        - --port
+        - "0"
+        - --tls-cert-file
+        - /tls/redis-cert.pem
+        - --tls-key-file
+        - /tls/redis-key.pem
+        - --tls-ca-cert-file
+        - /tls/ca-cert.pem
+        - --tls-auth-clients
+        - "no"
         volumeMounts:
         - name: redis-data
           mountPath: /data
+        - name: tls-certs-writable
+          mountPath: /tls
         resources:
           requests:
             memory: "256Mi"
@@ -55,6 +90,13 @@ spec:
           exec:
             command:
             - redis-cli
+            - --tls
+            - --cert
+            - /tls/redis-cert.pem
+            - --key
+            - /tls/redis-key.pem
+            - --cacert
+            - /tls/ca-cert.pem
             - -a
             - $(REDIS_PASSWORD)
             - ping
@@ -66,6 +108,13 @@ spec:
           exec:
             command:
             - redis-cli
+            - --tls
+            - --cert
+            - /tls/redis-cert.pem
+            - --key
+            - /tls/redis-key.pem
+            - --cacert
+            - /tls/ca-cert.pem
             - -a
             - $(REDIS_PASSWORD)
             - ping
@@ -77,6 +126,11 @@ spec:
       - name: redis-data
         persistentVolumeClaim:
           claimName: redis-pvc
+      - name: tls-certs-source
+        secret:
+          secretName: redis-tls
+      - name: tls-certs-writable
+        emptyDir: {}
 
 ---
 apiVersion: v1