[chidambaram27]

The service already honours REDIS_TLS and REDIS_USE_ALTERNATIVE_DNS_LOOKUP in every Redis client (queue, file-server, tool-call-server, egress-ledger), but the chart can only set them on api and service-worker via extraEnv. file-server, tool-call-server and egress-gateway have no way to receive them, so an external Redis that requires TLS (e.g. AWS ElastiCache with in-transit encryption, which is also a prerequisite for AUTH there) can't be used.

This adds redis.external.tls and redis.external.useAlternativeDnsLookup (both default false) and renders the matching env vars on all five control-plane containers through one helper. The sandbox-runner is untouched and still refuses REDIS_*. The default render is unchanged.

Changes

• values.yaml: real redis.external block (host, port, password, tls, useAlternativeDnsLookup). The host/port/password semantics are unchanged.
• _helpers.tpl: new codeapi.redis.tlsEnv helper. It emits nothing when redis.enabled=true and is nil-safe when redis.external is missing from older values files.
• The helper is included after REDIS_PASSWORD in the api, service-worker, file-server, tool-call-server and egress-gateway containers. It uses with … | trim | nindent 12, so an empty result adds no whitespace line and the default render stays byte-identical.
• The wait-for-redis init containers are unchanged (nc -z is a plain TCP check and works with TLS).
• Chart.yaml: 0.3.2 → 0.4.0. This is a minor bump because of the new values, matching the earlier feat bump 0.2.0 → 0.3.0. appVersion is unchanged.
• README.md: documents the redis.external.* values and gives an ElastiCache example. It replaces the old "set REDIS_TLS via extraEnv on each component" note, which wasn't possible for three of the five components.
• tests/redis_tls_env.sh (wired into the CI "Deployment Config Tests" job): checks the TLS path, placement per container, sandbox-runner exclusion, bundled Redis, defaults, and a missing redis.external. It fails against the templates on main.

Verification

(executionManifest.privateKey/publicKey=test are passed throughout; the chart refuses to render without them.)

helm lint helm/codeapi

==> Linting helm/codeapi
[INFO] Chart.yaml: icon is recommended

1 chart(s) linted, 0 chart(s) failed

helm template with default values, diffed against main. The only differences are the helm.sh/chart: codeapi-0.3.2 → codeapi-0.4.0 label lines from the version bump. With that label normalised:

default render: identical to main (ignoring helm.sh/chart label version)
values-local render: identical

helm template --set redis.enabled=false --set redis.external.host=x --set redis.external.tls=true --set redis.external.useAlternativeDnsLookup=true, env vars per container:

api: REDIS_TLS
api: REDIS_USE_ALTERNATIVE_DNS_LOOKUP
egress-gateway: REDIS_TLS
egress-gateway: REDIS_USE_ALTERNATIVE_DNS_LOOKUP
file-server: REDIS_TLS
file-server: REDIS_USE_ALTERNATIVE_DNS_LOOKUP
tool-call-server: REDIS_TLS
tool-call-server: REDIS_USE_ALTERNATIVE_DNS_LOOKUP
service-worker: REDIS_TLS
service-worker: REDIS_USE_ALTERNATIVE_DNS_LOOKUP
sandbox-runner REDIS_* count: 0

helm template --set redis.enabled=true --set redis.external.tls=true:

bundled+tls: 0 REDIS_TLS entries

(The only TLS-related var in that render is the Bitnami subchart's own REDIS_TLS_ENABLED: "no".)

Chart tests:

$ tests/redis_tls_env.sh
PASS: Redis TLS env reaches every control-plane Redis client and never sandbox-runner
$ tests/block_root_package_delivery.sh
block-root package delivery checks passed
$ tests/package_init_runtime_rollout.sh
PASS: package-init refreshes cached latest and preserves offline images
$ tests/sandbox_runner_metrics.sh
Sandbox runner metrics chart regressions passed
$ tests/bridge_pairing_rollout.sh   # exit 0

Follow-up (not in this PR)

The clients use rejectUnauthorized: false, so the Redis server certificate is never verified. Verification would need a service-side option, e.g. REDIS_TLS_REJECT_UNAUTHORIZED (default true for new installs) and an optional CA bundle. That is a service code change, not a chart change.