Azure Cache for Redis
What does zop.dev create for Azure Cache for Redis?
zop.dev provisions azurerm_redis_cache with 2 companions: a Key Vault secret holding the access key and a Kubernetes ExternalName alias. Terraform defaults to the Basic SKU while the application default is Standard C1, and Basic carries no replica and no SLA. The SKU meter runs continuously across 30 cataloged sizes.
| Field | Value |
|---|---|
| Cloud | azure |
Azure Cache for Redis is Microsoft’s managed Redis service. zop.dev provisions the cache with its credentials stored in Key Vault and an in-cluster alias for applications.
Redis cache, a Key Vault secret, and an alias
azurerm_redis_cache, a Key Vault secret for the access key, and a Kubernetes ExternalName service.
SKU, capacity, family, and the non-SSL port
sku_name default Basic (app default Standard C1); redis_cache_capacity 1; redis_cache_family C; non-SSL port flag (enabled in app defaults); 30 SKUs cataloged (Basic/Standard C0-C6, Premium P1-P5, Enterprise E1-E400, Flash F300-F1500).Basic in Terraform, Standard C1 in the API
Terraform default SKU (Basic) differs from the backend-api application default (Standard C1).
Two defaults that disagree
The Terraform module defaults to the Basic SKU; the application-level default is Standard C1. Which one you got depends on which path provisioned the cache, and the difference is not cosmetic. Basic is a single node with no replication and no SLA, while Standard adds a replica and the availability guarantee. Before reasoning about a cache’s resilience, check which default actually applied.
A cache that restarts empty
On Basic, there is no replica to fail over to: maintenance events and node failures come back
with an empty cache. That is fine for a true cache, where the application repopulates from the
source of truth, and quietly catastrophic for anything using Redis as a session store or
queue. The moment Redis holds state you cannot recompute, Standard is the floor, and the
capacity/family settings (redis_cache_capacity 1, family C by default) size what you get.
The non-SSL port flag
App defaults enable the non-SSL port: plaintext Redis on 6379. Inside a private network that is a pragmatic compatibility choice for clients without TLS support, but it means credentials and cached data cross the network unencrypted. For anything production-facing, disabling the non-SSL port and letting clients speak TLS is the cheap hardening step this default leaves on the table.
Tier moves go up, not down
Scaling has a direction. Within and between Basic and Standard you can move up sizes (the catalog spans C0 through C6, Premium P1 to P5, Enterprise E1 to E400 and Flash F300 to F1500), and Standard can move to Premium, but downgrades across tiers are not supported, and Enterprise is a separate track entirely. The SKU bills per hour regardless of traffic, so oversizing “to be safe” is a permanent-feeling cost decision that only a migration walks back.