valkey: external access is always plaintext, the chart has no TLS option #4622

Valkey with external: true always exposes a plaintext endpoint outside the cluster. The chart has no TLS option at all, so there is no configuration of it that is safe to expose.

packages/apps/valkey/templates/service.yaml renders a LoadBalancer on 6379 in front of the master when external is set, and nothing in packages/apps/valkey/values.yaml or the templates configures TLS (c983b5c). It runs on the same RedisFailover operator as packages/apps/redis, which gained opt-in TLS through its operator patches.

The redis app is getting an admission rule that refuses external access without TLS. Valkey has no TLS to require, so the same rule would forbid external outright.

Two ways to close it: port the redis TLS support (the operator side is shared, the chart side is certmanager.yaml, _tls.tpl and the tls values block) and then apply the same admission rule, or deprecate external on valkey until that lands.