Add Valkey support via new valkey role

CLAUDE.md

@@ -2,7 +2,7 @@
 
 ## Overview
 
-`itential.deployer` is an Ansible collection (namespace: `itential`, version: `3.7.2`) that deploys the full Itential automation platform stack: Itential Platform (IAP), Itential Automation Gateway (IAG), MongoDB, and Redis. It supports online and offline (air-gapped) installations, TLS configuration, and multiple deployment topologies.
+`itential.deployer` is an Ansible collection (namespace: `itential`, version: `3.7.2`) that deploys the full Itential automation platform stack: Itential Platform (IAP), Itential Automation Gateway (IAG), MongoDB, and Redis (or Valkey as a Remi-free alternative, on EL9 or Amazon Linux 2023). It supports online and offline (air-gapped) installations, TLS configuration, and multiple deployment topologies.
 
 ## Collection Metadata
 
@@ -35,6 +35,7 @@ Also requires the `jmespath` Python module on the control node.
 | `gateway.yml` | `itential.deployer.gateway` | Install IAG on `gateway` hosts |
 | `mongodb.yml` | `itential.deployer.mongodb` | Install MongoDB on `mongodb_primary`, `mongodb_replica`, `mongodb_arbiter` hosts |
 | `redis.yml` | `itential.deployer.redis` | Install Redis on `redis_master`/`redis_replica`; Sentinel on `redis_sentinel` hosts |
+| `valkey.yml` | `itential.deployer.valkey` | Install Valkey on `valkey_master`/`valkey_replica`; Sentinel on `valkey_sentinel` hosts (EL9 or Amazon Linux 2023 only) |
 | `os.yml` | `itential.deployer.os` | Install base OS packages on all component hosts |
 | `nginx.yml` | `itential.deployer.nginx` | Install and configure nginx (wraps `nginxinc.nginx` and `nginxinc.nginx_config`) |
 | `nginx_install.yml` | `itential.deployer.nginx_install` | Install nginx only |
@@ -43,10 +44,12 @@ Also requires the `jmespath` Python module on the control node.
 | `patch_gateway.yml` | `itential.deployer.patch_gateway` | Upgrade IAG in-place |
 | `certify.yml` | `itential.deployer.certify` | Run all certification playbooks (Redis + MongoDB + Platform) |
 | `certify_redis.yml` | `itential.deployer.certify_redis` | Generate Redis/Sentinel installation certification reports |
+| `certify_valkey.yml` | `itential.deployer.certify_valkey` | Generate Valkey/Sentinel installation certification reports |
 | `certify_mongodb.yml` | `itential.deployer.certify_mongodb` | Generate MongoDB installation certification reports |
 | `certify_platform.yml` | `itential.deployer.certify_platform` | Generate Platform installation certification reports |
 | `verify.yml` | `itential.deployer.verify` | Pre-install environment verification (OS, HW specs, proxy, required repository connectivity) for all components |
 | `verify_redis.yml` | `itential.deployer.verify_redis` | Pre-install verification for Redis hosts |
+| `verify_valkey.yml` | `itential.deployer.verify_valkey` | Pre-install verification for Valkey hosts |
 | `verify_mongodb.yml` | `itential.deployer.verify_mongodb` | Pre-install verification for MongoDB hosts |
 | `verify_platform.yml` | `itential.deployer.verify_platform` | Pre-install verification for Platform hosts |
 | `verify_gateway.yml` | `itential.deployer.verify_gateway` | Pre-install verification for Gateway hosts |
@@ -57,6 +60,7 @@ Also requires the `jmespath` Python module on the control node.
 | `download_packages_gateway_site.yml` | `itential.deployer.download_packages_gateway_site` | Wraps `download_packages_gateway` with a tag |
 | `download_packages_mongodb.yml` | `itential.deployer.download_packages_mongodb` | Download MongoDB packages for offline install |
 | `download_packages_redis.yml` | `itential.deployer.download_packages_redis` | Download Redis packages for offline install |
+| `download_packages_valkey.yml` | `itential.deployer.download_packages_valkey` | Download Valkey packages for offline install |
 | `download_packages_os.yml` | `itential.deployer.download_packages_os` | Download OS packages for offline install |
 
 ## Inventory Topology Options
@@ -69,6 +73,7 @@ Also requires the `jmespath` Python module on the control node.
 | `asa` | `example_inventories/asa/` | Active/Standby: 5-node MongoDB (4 data + 1 arbiter across 3 DCs), 4-node Redis across 3 DCs. Disaster recovery topology. |
 | `platform` | `example_inventories/platform/` | Platform-only example showing external (managed) Redis/MongoDB via URL. |
 | `redis` | `example_inventories/redis/` | Redis-only examples: install from Remi repo, from system repo, or from source. |
+| `valkey` | `example_inventories/valkey/` | Valkey-only example: install via the native OS package repositories on EL9 or Amazon Linux 2023 (the only supported method). |
 
 ## Roles Summary
 
@@ -81,6 +86,7 @@ Also requires the `jmespath` Python module on the control node.
 | `offline` | Shared utility role for downloading and installing RPMs/wheels/adapters in air-gapped mode. |
 | `mongodb` | Installs and configures MongoDB: users, replica set, auth, TLS, kernel tuning, SELinux, logrotate, NUMA. |
 | `redis` | Installs and configures Redis (from source or repo) and Redis Sentinel: auth, TLS, replication, SELinux. |
+| `valkey` | Installs and configures Valkey (via the native OS package repositories only — EL9 AppStream or Amazon Linux 2023's core repo) and Valkey Sentinel: auth, TLS, replication. No source install, no Remi, no EL8 support, no relocatable install paths, no role-level SELinux step (handled entirely by the base OS policy). |
 | `platform` | Installs and configures Itential Platform: NodeJS, Python, RPM packages, adapters, properties file, TLS certs, Vault, SELinux. |
 | `gateway` | Installs and configures Itential Automation Gateway (IAG): Python venv, Ansible, Nornir, TLS certs, systemd service, SELinux. |
 
@@ -102,12 +108,13 @@ Also requires the `jmespath` Python module on the control node.
 
 ## TLS Overview
 
-TLS is supported at the component level and is **enabled by default** for MongoDB and Platform, and **disabled by default** for Redis.
+TLS is supported at the component level and is **enabled by default** for MongoDB, Platform, and Valkey, and **disabled by default** for Redis.
 
 | Component | Enable Flag | Copy-Certs Flag | PKI Base Dir |
 |-----------|------------|-----------------|--------------|
 | MongoDB | `mongodb_tls_enabled: true` | `mongodb_tls_copy_certs: true` | `/etc/pki/mongodb` |
 | Redis | `redis_tls_enabled: false` | n/a (always copies when TLS enabled) | `/etc/pki/redis` |
+| Valkey | `valkey_tls_enabled: true` | n/a (always copies when TLS enabled) | `/etc/pki/valkey` |
 | Platform (HTTPS) | `platform_webserver_https_enabled: true` | `platform_webserver_https_copy_certs: true` | `/etc/pki/itential-platform/https` |
 | Platform (MongoDB client) | `platform_mongo_tls_enabled: true` | `platform_mongodb_copy_certs: true` | `/etc/pki/itential-platform/mongodb` |
 | Gateway (HTTPS) | `gateway_https_enabled: true` | `gateway_pki_copy_certs: true` | `/etc/pki/automation-gateway` |
@@ -149,6 +156,7 @@ See `docs/offline_install_guide.md` for the full workflow.
 | `docs/itential_gateway_guide.md` | Gateway role variables, feature flags, Ansible/Nornir config |
 | `docs/mongodb_guide.md` | MongoDB role variables, replica set, TLS, user accounts |
 | `docs/redis_guide.md` | Redis role variables, Sentinel, TLS, install methods |
+| `docs/valkey_guide.md` | Valkey role variables, Sentinel, TLS, EL9/Amazon Linux 2023 native package install |
 | `docs/tls_guide.md` | End-to-end TLS configuration guide across all components |
 | `docs/offline_install_guide.md` | Step-by-step offline (air-gapped) install workflow |
 | `docs/patch_itential_platform_guide.md` | How to run `patch_platform.yml` to upgrade Platform |

README.md

@@ -31,8 +31,9 @@
 6. [Component Guides](#component-guides)
     1. [MongoDB](#mongodb)
     2. [Redis](#redis)
-    3. [Itential Platform](#itential-platform)
-    4. [Itential Gateway](#itential-gateway)
+    3. [Valkey](#valkey)
+    4. [Itential Platform](#itential-platform)
+    5. [Itential Gateway](#itential-gateway)
 7. [Patching Itential Platform and IAG](#patching-itential-platform-and-iag)
 8. [Using Internal YUM Repositories](#using-internal-yum-repositories)
 9. [Running the Deployer in Offline Mode](#running-the-deployer-in-offline-mode)
@@ -45,7 +46,7 @@ At its most basic, the following must be installed.
 
 - Itential Platform
 - Itential Automation Gateway (IAG)
-- Redis
+- Redis (or Valkey as a Remi-free alternative, on EL9 or Amazon Linux 2023)
 - MongoDB
 
 Optionally, one can include Hashicorp Vault for secrets management, and Prometheus & Grafana for
@@ -106,7 +107,7 @@ The ideal HA2 environment will have 9 VMs:
 
 - 2 VMs hosting Itential Platform.
 - 3 VMs hosting MongoDB configured as a replica set.
-- 3 VMs hosting Redis configured as a highly available replica set using Redis Sentinel.
+- 3 VMs hosting Redis (or Valkey, on EL9/Amazon Linux 2023 hosts) configured as a highly available replica set using Sentinel.
 - 1 VM hosting IAG.
 
 Itential recommends applying sound security principles to ALL environments. This would include
@@ -138,6 +139,12 @@ members in the primary data center, 2 data-bearing members in the secondary data
 MongoDB, Redis HA requires Redis Sentinel. These must be distributed in 3 data centers to preserve
 a majority of voting members (3) in the event of a data center loss.
 
+Valkey is a protocol-compatible, drop-in alternative to Redis and follows the identical HA mechanics
+described above: same replica/Sentinel topology, same quorum math, same data center distribution.
+It is currently only supported on EL9 and Amazon Linux 2023 hosts, installed via the native OS
+package repositories (no Remi, no source install) — see the [Valkey Guide](docs/valkey_guide.md)
+for details.
+
 Itential recommends applying sound security principles to ALL environments. In the ASA, this would
 include configuring all components to use authentication and use SSL when communicating with
 components on other VMs and across clusters.
@@ -239,6 +246,7 @@ the Deployer will either install the required repository or download the package
 | Redis | <https://dl.fedoraproject.org> | TCP | EPEL YUM RPMs<br>When installing Redis from the Remi repository |
 | Redis | <https://github.com> | TCP | Redis source packages <br>When installing Redis from source |
 | Redis | <https://codeload.github.com> | TCP | Redis source packages<br>When installing Redis from source |
+| Valkey | <https://mirrors.rockylinux.org> | TCP | Rocky/AlmaLinux 9 AppStream mirror for the Valkey RPM. RHEL proper resolves AppStream through its own subscription-manager CDN instead of a fixed public URL; Amazon Linux 2023 ships Valkey in its own preconfigured core repository. Neither of those is checked by the `verify` playbook. |
 
 If internal YUM repositories are used, refer to the
 [Using Internal YUM Repositories](#using-internal-yum-repositories) section.
@@ -257,7 +265,7 @@ ansible-playbook itential.deployer.verify -i <inventory>
 ```
 
 This checks each component's target hosts (`gateway`, `platform*`, `mongodb*`, `redis_master`/
-`redis_replica`) against the rows in the table above. See
+`redis_replica`, `valkey_master`/`valkey_replica`) against the rows in the table above. See
 [Confirm Requirements](#confirm-requirements) for details.
 
 ### Ports and Networking
@@ -275,6 +283,8 @@ network traffic flows need to be allowed.
 | Itential Platform | MongoDB | 27017 | TCP | Itential Platform connections to MongoDB |
 | Itential Platform | Redis | 6379 | TCP | Itential Platform connections to Redis |
 | Itential Platform | Redis | 26379 | TCP | Itential Platform connections to Redis Sentinel |
+| Itential Platform | Valkey | 6379 | TCP | Itential Platform connections to Valkey |
+| Itential Platform | Valkey | 26379 | TCP | Itential Platform connections to Valkey Sentinel |
 | Itential Platform | IAG | 8083 | TCP | Itential Platform connections to IAG over HTTP |
 | Itential Platform | IAG | 8443 | TCP | Itential Platform connections to IAG over HTTPS |
 | Itential Platform | Vault | 8200 | TCP | Itential Platform connections to Hashicorp Vault |
@@ -284,6 +294,8 @@ network traffic flows need to be allowed.
 | MongoDB | MongoDB | 27017 | TCP | MongoDB replication |
 | Redis | Redis | 6379 | TCP | Redis replication |
 | Redis | Redis | 26379 | TCP | Redis Sentinel for HA |
+| Valkey | Valkey | 6379 | TCP | Valkey replication |
+| Valkey | Valkey | 26379 | TCP | Valkey Sentinel for HA |
 
 Notes
 
@@ -303,6 +315,7 @@ can be used and what their purpose is.
 | IAG webserver | Enables HTTPS communications with the IAG webserver. |
 | MongoDB | Enables secure communications with the MongoDB server. Also used for intra-node mongo replication. |
 | Redis | Enables secure communications with the Redis server. Also used for intra-node redis replication. |
+| Valkey | Enables secure communications with the Valkey server. Also used for intra-node valkey replication. |
 | LDAP | Enables secure communications with LDAP server. |
 
 ### Passwords
@@ -330,6 +343,17 @@ these variables just define the variable in the deployer host file.
 | sentineluser | sentineluser | redis_user_sentineluser_password | Has access to the minimum set of commands to perform sentinel monitoring: multi, slaveof, ping, exec, subscribe, config.rewrite, role, publish, info, client.setname, client.kill, script.kill. |
 | monitor | monitor | redis_user_monitor_password | Read-only access to gather metric and cluster data from Redis and Sentinel. Enabled via `redis_monitor_user_enabled`. |
 
+#### Valkey Accounts
+
+| User Account | Default Password | Variable Name | Description |
+| :----------- | :--------------- | :------------ | :---------- |
+| admin | admin | valkey_user_admin_password | Has full root access to the Valkey database, all channels, all keys, all commands. |
+| itential | itential | valkey_user_itential_password | Has full access to the Valkey database, all channels, all keys, EXCEPT the following commands: asking, cluster, readonly, readwrite, bgrewriteaof, bgsave, failover, flushall, flushdb, psync, replconf, replicaof, save, shutdown, sync. |
+| repluser | repluser | valkey_user_repluser_password | Has access to the minimum set of commands to perform replication: psync, replconf, ping. |
+| admin | sentineladmin | valkey_user_sentineladmin_password | Full root access to Valkey Sentinel. |
+| sentineluser | sentineluser | valkey_user_sentineluser_password | Has access to the minimum set of commands to perform sentinel monitoring: multi, slaveof, ping, exec, subscribe, config.rewrite, role, publish, info, client.setname, client.kill, script.kill. |
+| monitor | monitor | valkey_user_monitor_password | Read-only access to gather metric and cluster data from Valkey and Sentinel. Enabled via `valkey_monitor_user_enabled`. |
+
 ### Obtaining the Itential Binaries
 
 #### SaaS
@@ -411,6 +435,9 @@ ansible-playbook -i <path-to-inventory> itential.deployer.verify
 # Verify Redis
 ansible-playbook -i <path-to-inventory> itential.deployer.verify_redis
 
+# Verify Valkey
+ansible-playbook -i <path-to-inventory> itential.deployer.verify_valkey
+
 # Verify MongoDB
 ansible-playbook -i <path-to-inventory> itential.deployer.verify_mongodb
 
@@ -650,6 +677,9 @@ ansible-playbook -i <path-to-inventory> itential.deployer.certify
 # Certify Redis
 ansible-playbook -i <path-to-inventory> itential.deployer.certify_redis
 
+# Certify Valkey
+ansible-playbook -i <path-to-inventory> itential.deployer.certify_valkey
+
 # Certify MongoDB
 ansible-playbook -i <path-to-inventory> itential.deployer.certify_mongodb
 
@@ -723,14 +753,15 @@ $ sudo systemctl status automation-gateway
            └─94844 /opt/automation-gateway/venv/bin/python3 /opt/automation-gateway/venv/bin/automation-gateway --properties-file=/etc/automation-gateway/propert>
 ```
 
-#### MongoDB and Redis
+#### MongoDB, Redis, and Valkey
 
 From the command line of each dependency server, use the `sudo systemctl status <service>` command
 to confirm that the relevant service is running. When executing the command, replace `<service>`
 with one of the following:
 
 - **MongoDB**: `mongod`
 - **Redis**: `redis`
+- **Valkey**: `valkey`
 
 The output should look similar to the following examples.
 
@@ -769,6 +800,24 @@ $ sudo systemctl status redis
              └─15723 "/usr/bin/redis-server 127.0.0.1:6379"
 ```
 
+</br>
+
+#### Example Output: Valkey Status
+
+```bash
+$ sudo systemctl status valkey
+● valkey.service - Valkey persistent key-value database
+     Loaded: loaded (/usr/lib/systemd/system/valkey.service; enabled; preset: disabled)
+     Active: active (running) since Thu 2026-09-11 09:15:00 UTC; 20h ago
+   Main PID: 15723 (valkey-server)
+     Status: "Ready to accept connections"
+      Tasks: 5 (limit: 22862)
+     Memory: 9.7M
+        CPU: 13.409s
+     CGroup: /system.slice/valkey.service
+             └─15723 "/usr/bin/valkey-server 127.0.0.1:6379"
+```
+
 ## Component Guides
 
 In addition to the `itential.deployer.site` playbook, there are playbooks for each component.
@@ -785,6 +834,10 @@ corresponding variables are detailed in the following guides.
 
 [Redis Guide](docs/redis_guide.md)
 
+### Valkey
+
+[Valkey Guide](docs/valkey_guide.md)
+
 ### Itential Platform
 
 [Itential Platform Guide](docs/itential_platform_guide.md)
@@ -860,3 +913,27 @@ replication process.
 - Redis Sentinel will be included to monitor the Redis cluster and will be colocated with Redis.
 - Redis Sentinel will have an admin user able to perform a Sentinel task.
 - Redis nodes maintain a low latency connection between nodes to avoid replication failures.
+
+### Highly Available Valkey
+
+Valkey is a protocol-compatible fork of Redis and its clustering model is identical: a
+primary/secondary replication topology monitored by Sentinel, with the same failure-detection and
+promotion mechanics described above for Redis. Itential's preferred Valkey cluster assumes the same
+requirements as the preferred Redis cluster:
+
+- Authentication between the replica members is done with users defined in the Valkey config file.
+- Valkey will have an admin user able to perform any operation.
+- Valkey will have an "itential" user that is granted the least amount of privileges required by the
+application.
+- Valkey will have a replication user that is granted the least amount of privileges required by the
+replication process.
+- Initial passwords are intended to be changed.
+- Valkey Sentinel will be included to monitor the Valkey cluster and will be colocated with Valkey.
+- Valkey Sentinel will have an admin user able to perform a Sentinel task.
+- Valkey nodes maintain a low latency connection between nodes to avoid replication failures.
+
+Unlike Redis, Valkey is currently only supported on EL9 and Amazon Linux 2023 hosts, installed
+exclusively via the native OS package repositories — there is no Remi option and no
+source-install fallback for EL8. Valkey's install paths also cannot be customized: the package
+is not relocatable, so customers requiring non-standard install locations must use `roles/redis`
+(source install) instead.