[bitnami/redis] Mount volume conflict (Read-only file system) when combining auth.acl.enabled=true and custom configuration

[hxl9654]

Name and Version

bitnami/redis 27.0.12

What steps will reproduce the bug?

1. In this environment: Any standard Kubernetes environment (e.g., Kubernetes 1.36.2).
2. With this config: A values.yaml that simultaneously enables ACL (auth.acl.enabled: true) and defines custom configurations (e.g., using commonConfiguration).
3. Run: helm upgrade --install redis oci://registry-1.docker.io/bitnamicharts/redis --version 27.0.12 -f values.yaml
4. See error

Are you using any custom parameters or values?

architecture: replication

auth:
  enabled: true
  usePasswordFiles: true
  acl:
    enabled: true
    userSecret: redis-acl-secret
    users:
    - channels: '&*'
      commands: +@all
      enabled: "on"
      keys: ~*
      username: admin

commonConfiguration: |
  maxmemory 768mb
  maxmemory-policy allkeys-lru
  appendonly yes
  appendfsync everysec
  auto-aof-rewrite-percentage 100
  auto-aof-rewrite-min-size 128mb
  tcp-backlog 511
  timeout 0
  tcp-keepalive 300
  maxclients 10000
  slowlog-log-slower-than 10000
  slowlog-max-len 1024
  latency-monitor-threshold 100
  repl-disable-tcp-nodelay no

What is the expected behavior?

The Pod should start successfully with both the custom redis.conf and users.acl properly mounted and readable by the Redis process.

What do you see instead?

The Pod creation fails. The Kubelet throws a volume mount error similar to:

The Redis Pod fails to start and remains in StartError state (exitCode 128). 
failed to create containerd task: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error mounting "/var/lib/kubelet/pods/xxxxxxxxxx/volume-subpaths/redis-acl/redis/4" to rootfs at "/opt/bitnami/redis/mounted-etc/users.acl": mount src=/var/lib/kubelet/pods/xxxxxxxxxx/volume-subpaths/redis-acl/redis/4, dst=/opt/bitnami/redis/mounted-etc/users.acl, dstFd=/proc/thread-self/fd/8, flags=MS_RDONLY|MS_BIND|MS_REC: not a directory

Additional information

1. Root Cause Analysis:
   This might be a breaking change/bug introduced in chart version 26.0.0 (maybe 27.0.0 actually?) during the "Consolidated ACL Secret" refactoring.
   In the current template design:
   When custom configuration is provided, the chart mounts the entire ConfigMap to /opt/bitnami/redis/mounted-etc without a subPath. Kubernetes inherently mounts this entire directory as Read-Only.
   When ACL is enabled, the chart generates a Secret for users.acl and attempts to mount it into the same directory using subPath: users.acl (/opt/bitnami/redis/mounted-etc/users.acl).
   Because the parent directory is already rendered read-only by the ConfigMap mount, the Kubelet cannot create the empty placeholder file required for the subPath bind mount, resulting in this error.

2. Suggested Fixes for Maintainers:
   2.1. Best approach: Refactor the chart to use Kubernetes Projected Volumes (projected) when both ConfigMaps and Secrets need to be mounted into the same mounted-etc directory. This natively solves the conflict and supports automatic hot-reloading for both ConfigMap and Secret.
   2.2. Alternative approach: Mount the ACL Secret to a completely separate, non-conflicting directory (e.g., /opt/bitnami/redis/mounted-acl/users.acl) and update the aclfile path in the default Redis config accordingly.

[hxl9654]

BTW, I found that the code here is not the up-to-date version, such as bitnami/redis/templates/configmap.yaml.
Is this repo still under maintenance?

[carrodher]

BTW, I found that the code here is not the up-to-date version, such as bitnami/redis/templates/configmap.yaml. Is this repo still under maintenance?

With the changes announced at #35164, the container images were removed from docker.io/bitnami and moved to docker.io/bitnamilegacy, where they will no longer receive updates. To continue getting new, hardened image versions, a Bitnami Secure Images subscription is required.

Regarding Helm charts, a small subset of Helm charts will be maintained as part of a BSI trial. Here you can view the list of applications included in the trial. Those Helm charts are fully functional and updated from our internal pipeline using secure and hardened images, but as stated in the above GH issue, the Helm charts source code present in this repository is not being updated, just community contributions are accepted. That's why the packaged Helm chart present in DockerHub for those trial applications could differ from the source code present in this opensource repo.

Please take a look at the pinned issue linked above for full details.