Setup valkey cluster with enabled TLS

[jakubno]

Note

Adds a GCP Memorystore Valkey cluster with TLS, outputs its secure URL and CA via Secret Manager, and wires these through modules; bumps google provider to 6.50.0.

• Redis/Memorystore (GCP):
  • Enable memorystore.googleapis.com and add PSC policy for Valkey (google_network_connectivity_service_connection_policy.valkey).
  • Provision google_memorystore_instance.valkey_cluster (VALKEY_8_0, CLUSTER, multi-zone, AOF, server-auth TLS).
  • Derive connection endpoint and CA from the instance and publish to secrets.
• Secrets Manager:
  • New secrets: redis-tls-ca-base64, redis-secure-cluster-url with initial versions and ignore_changes for placeholder data.
  • Create secret versions populated from Valkey instance: secure URL and base64 CA.
• Modules/Wiring:
  • Export new secret versions from init and pass to redis module; add variables (shard_count, replica_count, secret version inputs).
• Provider:
  • Bump hashicorp/google from 6.49.3 to 6.50.0.

^{Written by Cursor Bugbot for commit 2cbfe62. This will update automatically on new commits. Configure here.}

[linear]

ENG-3286 Migrate to Redis cluster with TLS enabled

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sitole]

LGTM!