fix(auth): stop writing the redis password into the ConfigMap

[binhnguyenduc]

What

Stops embedding masterauth/requirepass in plaintext in the redis ConfigMap. The password is now handed to redis-server via --requirepass/--masterauth command-line args sourced from the existing REDIS_PASSWORD env (a SecretKeyRef).

Why

ConfigMaps are not encrypted at rest and are broadly readable, so writing the redis password into the redis ConfigMap (generator.go) leaked it to anyone with configmap read access.

How

• getRedisCommand: when spec.auth.secretPath is set (and no custom command), launch redis via sh -c 'exec redis-server /redis/redis.conf --requirepass "$REDIS_PASSWORD" --masterauth "$REDIS_PASSWORD"'.
  • The shell expands the env var; exec keeps redis as PID 1 so SIGTERM still triggers a graceful shutdown.
  • The literal $REDIS_PASSWORD is what's stored in the pod spec, so the password appears in no cluster object (ConfigMap or pod spec).
  • redis applies the config file then the args before accepting connections, so there is no auth-less startup window.
• generateRedisConfigMap / EnsureRedisConfigMap: drop the password embed and the now-unused password fetch/param.

Scope / compatibility

• No-auth clusters and custom spec.redis.command are unchanged.
• The sentinel ConfigMap never embedded the password (auth-pass is applied at runtime) — unaffected.
• Upgrade is seamless: the ConfigMap updates, and under the OnDelete STS strategy running pods keep working; restarted pods pick up the args-based auth with the same password. No re-key needed.
• Residual: inside the container ps shows the expanded password (same trust boundary that already holds the env). This is the standard trade-off and a strict improvement over cluster-readable plaintext.

Upstream references

• Auth from ConfigMap spotahome/redis-operator#684 (auth from ConfigMap — exclude masterauth/requirepass)

Test

New tests: the redis ConfigMap contains no requirepass/masterauth; with auth the redis command is the env-based wrapper. go build ./..., go test ./..., gofmt clean.