# HG changeset patch
# User Balasankar "Balu" C <balasankar@gitlab.com>
# Date 1694768688 -19800
#      Fri Sep 15 14:34:48 2023 +0530
# Node ID b9783d9e34b28c8b46b2bf3047e43271b01d6256
# Parent  37bc7ee8b175455bb9ad94f8e623e2828677fbc5
Add Redis TLS settings for Rails

Changelog: added
Signed-off-by: Balasankar "Balu" C <balasankar@gitlab.com>

diff --git a/files/gitlab-config-template/gitlab.rb.template b/files/gitlab-config-template/gitlab.rb.template
--- a/files/gitlab-config-template/gitlab.rb.template
+++ b/files/gitlab-config-template/gitlab.rb.template
@@ -776,6 +776,10 @@
 # gitlab_rails['redis_password'] = nil
 # gitlab_rails['redis_database'] = 0
 # gitlab_rails['redis_enable_client'] = true
+# gitlab_rails['redis_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/'
+# gitlab_rails['redis_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem'
+# gitlab_rails['redis_tls_client_cert_file'] = nil
+# gitlab_rails['redis_tls_client_key_file'] = nil
 
 #### Redis local UNIX socket (will be disabled if TCP method is used)
 # gitlab_rails['redis_socket'] = "/var/opt/gitlab/redis/redis.socket"
@@ -810,60 +814,100 @@
 # gitlab_rails['redis_cache_username'] = nil
 # gitlab_rails['redis_cache_password'] = nil
 # gitlab_rails['redis_cache_cluster_nodes'] = nil
+# gitlab_rails['redis_cache_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/'
+# gitlab_rails['redis_cache_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem'
+# gitlab_rails['redis_cache_tls_client_cert_file'] = nil
+# gitlab_rails['redis_cache_tls_client_key_file'] = nil
 # gitlab_rails['redis_queues_instance'] = nil
 # gitlab_rails['redis_queues_sentinels'] = nil
 # gitlab_rails['redis_queues_sentinels_password'] = nil
 # gitlab_rails['redis_queues_username'] = nil
 # gitlab_rails['redis_queues_password'] = nil
 # gitlab_rails['redis_queues_cluster_nodes'] = nil
+# gitlab_rails['redis_queues_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/'
+# gitlab_rails['redis_queues_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem'
+# gitlab_rails['redis_queues_tls_client_cert_file'] = nil
+# gitlab_rails['redis_queues_tls_client_key_file'] = nil
 # gitlab_rails['redis_shared_state_instance'] = nil
 # gitlab_rails['redis_shared_state_sentinels'] = nil
 # gitlab_rails['redis_shared_state_sentinels_password'] = nil
 # gitlab_rails['redis_shared_state_username'] = nil
 # gitlab_rails['redis_shared_state_password'] = nil
 # gitlab_rails['redis_shared_state_cluster_nodes'] = nil
+# gitlab_rails['redis_shared_state_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/'
+# gitlab_rails['redis_shared_state_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem'
+# gitlab_rails['redis_shared_state_tls_client_cert_file'] = nil
+# gitlab_rails['redis_shared_state_tls_client_key_file'] = nil
 # gitlab_rails['redis_trace_chunks_instance'] = nil
 # gitlab_rails['redis_trace_chunks_sentinels'] = nil
 # gitlab_rails['redis_trace_chunks_sentinels_password'] = nil
 # gitlab_rails['redis_trace_chunks_username'] = nil
 # gitlab_rails['redis_trace_chunks_password'] = nil
 # gitlab_rails['redis_trace_chunks_cluster_nodes'] = nil
+# gitlab_rails['redis_trace_chunks_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/'
+# gitlab_rails['redis_trace_chunks_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem'
+# gitlab_rails['redis_trace_chunks_tls_client_cert_file'] = nil
+# gitlab_rails['redis_trace_chunks_tls_client_key_file'] = nil
 # gitlab_rails['redis_actioncable_instance'] = nil
 # gitlab_rails['redis_actioncable_sentinels'] = nil
 # gitlab_rails['redis_actioncable_sentinels_password'] = nil
 # gitlab_rails['redis_actioncable_username'] = nil
 # gitlab_rails['redis_actioncable_password'] = nil
 # gitlab_rails['redis_actioncable_cluster_nodes'] = nil
+# gitlab_rails['redis_actioncable_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/'
+# gitlab_rails['redis_actioncable_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem'
+# gitlab_rails['redis_actioncable_tls_client_cert_file'] = nil
+# gitlab_rails['redis_actioncable_tls_client_key_file'] = nil
 # gitlab_rails['redis_rate_limiting_instance'] = nil
 # gitlab_rails['redis_rate_limiting_sentinels'] = nil
 # gitlab_rails['redis_rate_limiting_sentinels_password'] = nil
 # gitlab_rails['redis_rate_limiting_username'] = nil
 # gitlab_rails['redis_rate_limiting_password'] = nil
 # gitlab_rails['redis_rate_limiting_cluster_nodes'] = nil
+# gitlab_rails['redis_rate_limiting_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/'
+# gitlab_rails['redis_rate_limiting_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem'
+# gitlab_rails['redis_rate_limiting_tls_client_cert_file'] = nil
+# gitlab_rails['redis_rate_limiting_tls_client_key_file'] = nil
 # gitlab_rails['redis_sessions_instance'] = nil
 # gitlab_rails['redis_sessions_sentinels'] = nil
 # gitlab_rails['redis_sessions_sentinels_password'] = nil
 # gitlab_rails['redis_sessions_username'] = nil
 # gitlab_rails['redis_sessions_password'] = nil
 # gitlab_rails['redis_sessions_cluster_nodes'] = nil
+# gitlab_rails['redis_sessions_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/'
+# gitlab_rails['redis_sessions_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem'
+# gitlab_rails['redis_sessions_tls_client_cert_file'] = nil
+# gitlab_rails['redis_sessions_tls_client_key_file'] = nil
 # gitlab_rails['redis_cluster_rate_limiting_instance'] = nil
 # gitlab_rails['redis_cluster_rate_limiting_sentinels'] = nil
 # gitlab_rails['redis_cluster_rate_limiting_sentinels_password'] = nil
 # gitlab_rails['redis_cluster_rate_limiting_username'] = nil
 # gitlab_rails['redis_cluster_rate_limiting_password'] = nil
 # gitlab_rails['redis_cluster_rate_limiting_cluster_nodes'] = nil
+# gitlab_rails['redis_cluster_rate_limiting_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/'
+# gitlab_rails['redis_cluster_rate_limiting_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem'
+# gitlab_rails['redis_cluster_rate_limiting_tls_client_cert_file'] = nil
+# gitlab_rails['redis_cluster_rate_limiting_tls_client_key_file'] = nil
 # gitlab_rails['redis_repository_cache_instance'] = nil
 # gitlab_rails['redis_repository_cache_sentinels'] = nil
 # gitlab_rails['redis_repository_cache_sentinels_password'] = nil
 # gitlab_rails['redis_repository_cache_username'] = nil
 # gitlab_rails['redis_repository_cache_password'] = nil
 # gitlab_rails['redis_repository_cache_cluster_nodes'] = nil
+# gitlab_rails['redis_repository_cache_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/'
+# gitlab_rails['redis_repository_cache_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem'
+# gitlab_rails['redis_repository_cache_tls_client_cert_file'] = nil
+# gitlab_rails['redis_repository_cache_tls_client_key_file'] = nil
 # gitlab_rails['redis_workhorse_instance'] = nil
 # gitlab_rails['redis_workhorse_sentinels'] = nil
 # gitlab_rails['redis_workhorse_sentinels_password'] = nil
 # gitlab_rails['redis_workhorse_username'] = nil
 # gitlab_rails['redis_workhorse_password'] = nil
 # gitlab_rails['redis_workhorse_cluster_nodes'] = nil
+# gitlab_rails['redis_workhorse_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/'
+# gitlab_rails['redis_workhorse_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem'
+# gitlab_rails['redis_workhorse_tls_client_cert_file'] = nil
+# gitlab_rails['redis_workhorse_tls_client_key_file'] = nil
 
 # gitlab_rails['redis_workhorse_sentinel_master'] = nil
 
diff --git a/files/gitlab-cookbooks/gitlab/attributes/default.rb b/files/gitlab-cookbooks/gitlab/attributes/default.rb
--- a/files/gitlab-cookbooks/gitlab/attributes/default.rb
+++ b/files/gitlab-cookbooks/gitlab/attributes/default.rb
@@ -438,6 +438,10 @@
 default['gitlab']['gitlab_rails']['redis_host'] = "127.0.0.1"
 default['gitlab']['gitlab_rails']['redis_port'] = nil
 default['gitlab']['gitlab_rails']['redis_ssl'] = false
+default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'] = "#{node['package']['install-dir']}/embedded/ssl/certs/"
+default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'] = "#{node['package']['install-dir']}/embedded/ssl/certs/cacert.pem"
+default['gitlab']['gitlab_rails']['redis_tls_client_cert_file'] = nil
+default['gitlab']['gitlab_rails']['redis_tls_client_key_file'] = nil
 default['gitlab']['gitlab_rails']['redis_password'] = nil
 default['gitlab']['gitlab_rails']['redis_socket'] = "/var/opt/gitlab/redis/redis.socket"
 default['gitlab']['gitlab_rails']['redis_enable_client'] = true
@@ -449,60 +453,110 @@
 default['gitlab']['gitlab_rails']['redis_cache_username'] = nil
 default['gitlab']['gitlab_rails']['redis_cache_password'] = nil
 default['gitlab']['gitlab_rails']['redis_cache_cluster_nodes'] = []
+default['gitlab']['gitlab_rails']['redis_cache_ssl'] = false
+default['gitlab']['gitlab_rails']['redis_cache_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup
+default['gitlab']['gitlab_rails']['redis_cache_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup
+default['gitlab']['gitlab_rails']['redis_cache_tls_client_cert_file'] = nil
+default['gitlab']['gitlab_rails']['redis_cache_tls_client_key_file'] = nil
 default['gitlab']['gitlab_rails']['redis_queues_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_queues_username'] = nil
 default['gitlab']['gitlab_rails']['redis_queues_password'] = nil
 default['gitlab']['gitlab_rails']['redis_queues_sentinels'] = []
 default['gitlab']['gitlab_rails']['redis_queues_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_queues_cluster_nodes'] = []
+default['gitlab']['gitlab_rails']['redis_queues_ssl'] = false
+default['gitlab']['gitlab_rails']['redis_queues_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup
+default['gitlab']['gitlab_rails']['redis_queues_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup
+default['gitlab']['gitlab_rails']['redis_queues_tls_client_cert_file'] = nil
+default['gitlab']['gitlab_rails']['redis_queues_tls_client_key_file'] = nil
 default['gitlab']['gitlab_rails']['redis_shared_state_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_shared_state_sentinels'] = []
 default['gitlab']['gitlab_rails']['redis_shared_state_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_shared_state_username'] = nil
 default['gitlab']['gitlab_rails']['redis_shared_state_password'] = nil
 default['gitlab']['gitlab_rails']['redis_shared_state_cluster_nodes'] = []
+default['gitlab']['gitlab_rails']['redis_shared_state_ssl'] = false
+default['gitlab']['gitlab_rails']['redis_shared_state_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup
+default['gitlab']['gitlab_rails']['redis_shared_state_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup
+default['gitlab']['gitlab_rails']['redis_shared_state_tls_client_cert_file'] = nil
+default['gitlab']['gitlab_rails']['redis_shared_state_tls_client_key_file'] = nil
 default['gitlab']['gitlab_rails']['redis_trace_chunks_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_trace_chunks_sentinels'] = []
 default['gitlab']['gitlab_rails']['redis_trace_chunks_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_trace_chunks_username'] = nil
 default['gitlab']['gitlab_rails']['redis_trace_chunks_password'] = nil
 default['gitlab']['gitlab_rails']['redis_trace_chunks_cluster_nodes'] = []
+default['gitlab']['gitlab_rails']['redis_trace_chunks_ssl'] = false
+default['gitlab']['gitlab_rails']['redis_trace_chunks_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup
+default['gitlab']['gitlab_rails']['redis_trace_chunks_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup
+default['gitlab']['gitlab_rails']['redis_trace_chunks_tls_client_cert_file'] = nil
+default['gitlab']['gitlab_rails']['redis_trace_chunks_tls_client_key_file'] = nil
 default['gitlab']['gitlab_rails']['redis_actioncable_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_actioncable_sentinels'] = []
 default['gitlab']['gitlab_rails']['redis_actioncable_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_actioncable_username'] = nil
 default['gitlab']['gitlab_rails']['redis_actioncable_password'] = nil
 default['gitlab']['gitlab_rails']['redis_actioncable_cluster_nodes'] = []
+default['gitlab']['gitlab_rails']['redis_actioncable_ssl'] = false
+default['gitlab']['gitlab_rails']['redis_actioncable_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup
+default['gitlab']['gitlab_rails']['redis_actioncable_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup
+default['gitlab']['gitlab_rails']['redis_actioncable_tls_client_cert_file'] = nil
+default['gitlab']['gitlab_rails']['redis_actioncable_tls_client_key_file'] = nil
 default['gitlab']['gitlab_rails']['redis_rate_limiting_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_rate_limiting_sentinels'] = []
 default['gitlab']['gitlab_rails']['redis_rate_limiting_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_rate_limiting_username'] = nil
 default['gitlab']['gitlab_rails']['redis_rate_limiting_password'] = nil
 default['gitlab']['gitlab_rails']['redis_rate_limiting_cluster_nodes'] = []
+default['gitlab']['gitlab_rails']['redis_rate_limiting_ssl'] = false
+default['gitlab']['gitlab_rails']['redis_rate_limiting_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup
+default['gitlab']['gitlab_rails']['redis_rate_limiting_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup
+default['gitlab']['gitlab_rails']['redis_rate_limiting_tls_client_cert_file'] = nil
+default['gitlab']['gitlab_rails']['redis_rate_limiting_tls_client_key_file'] = nil
 default['gitlab']['gitlab_rails']['redis_sessions_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_sessions_sentinels'] = []
 default['gitlab']['gitlab_rails']['redis_sessions_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_sessions_username'] = nil
 default['gitlab']['gitlab_rails']['redis_sessions_password'] = nil
 default['gitlab']['gitlab_rails']['redis_sessions_cluster_nodes'] = []
+default['gitlab']['gitlab_rails']['redis_sessions_ssl'] = false
+default['gitlab']['gitlab_rails']['redis_sessions_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup
+default['gitlab']['gitlab_rails']['redis_sessions_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup
+default['gitlab']['gitlab_rails']['redis_sessions_tls_client_cert_file'] = nil
+default['gitlab']['gitlab_rails']['redis_sessions_tls_client_key_file'] = nil
 default['gitlab']['gitlab_rails']['redis_repository_cache_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_repository_cache_sentinels'] = []
 default['gitlab']['gitlab_rails']['redis_repository_cache_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_repository_cache_username'] = nil
 default['gitlab']['gitlab_rails']['redis_repository_cache_password'] = nil
 default['gitlab']['gitlab_rails']['redis_repository_cache_cluster_nodes'] = []
+default['gitlab']['gitlab_rails']['redis_repository_cache_ssl'] = false
+default['gitlab']['gitlab_rails']['redis_repository_cache_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup
+default['gitlab']['gitlab_rails']['redis_repository_cache_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup
+default['gitlab']['gitlab_rails']['redis_repository_cache_tls_client_cert_file'] = nil
+default['gitlab']['gitlab_rails']['redis_repository_cache_tls_client_key_file'] = nil
 default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_sentinels'] = []
 default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_username'] = nil
 default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_password'] = nil
 default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_cluster_nodes'] = []
+default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_ssl'] = false
+default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup
+default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup
+default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_tls_client_cert_file'] = nil
+default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_tls_client_key_file'] = nil
 default['gitlab']['gitlab_rails']['redis_workhorse_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_workhorse_sentinels'] = []
 default['gitlab']['gitlab_rails']['redis_workhorse_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_workhorse_username'] = nil
 default['gitlab']['gitlab_rails']['redis_workhorse_password'] = nil
 default['gitlab']['gitlab_rails']['redis_workhorse_cluster_nodes'] = []
+default['gitlab']['gitlab_rails']['redis_workhorse_ssl'] = false
+default['gitlab']['gitlab_rails']['redis_workhorse_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup
+default['gitlab']['gitlab_rails']['redis_workhorse_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup
+default['gitlab']['gitlab_rails']['redis_workhorse_tls_client_cert_file'] = nil
+default['gitlab']['gitlab_rails']['redis_workhorse_tls_client_key_file'] = nil
 
 # used by workhorse to connect to a separate external redis instead of the omnibus-gitlab redis
 default['gitlab']['gitlab_rails']['redis_workhorse_sentinel_master'] = nil
diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb
--- a/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb
+++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb
@@ -200,6 +200,11 @@
 redis_sentinels = node['gitlab']['gitlab_rails']['redis_sentinels']
 redis_sentinels_password = node['gitlab']['gitlab_rails']['redis_sentinels_password']
 redis_enable_client = node['gitlab']['gitlab_rails']['redis_enable_client']
+redis_ssl = node['gitlab']['gitlab_rails']['redis_ssl']
+redis_tls_ca_cert_dir = node['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir']
+redis_tls_ca_cert_file = node['gitlab']['gitlab_rails']['redis_tls_ca_cert_file']
+redis_tls_client_cert_file = node['gitlab']['gitlab_rails']['redis_tls_client_cert_file']
+redis_tls_client_key_file = node['gitlab']['gitlab_rails']['redis_tls_client_key_file']
 
 templatesymlink "Create a secrets.yml and create a symlink to Rails root" do
   link_from File.join(gitlab_rails_source_dir, "config/secrets.yml")
@@ -227,7 +232,17 @@
   owner "root"
   group "root"
   mode "0644"
-  variables(redis_url: redis_url, redis_sentinels: redis_sentinels, redis_sentinels_password: redis_sentinels_password, redis_enable_client: redis_enable_client)
+  variables(
+    redis_url: redis_url,
+    redis_sentinels: redis_sentinels,
+    redis_sentinels_password: redis_sentinels_password,
+    redis_enable_client: redis_enable_client,
+    redis_ssl: redis_ssl,
+    redis_tls_ca_cert_dir: redis_tls_ca_cert_dir,
+    redis_tls_ca_cert_file: redis_tls_ca_cert_file,
+    redis_tls_client_cert_file: redis_tls_client_cert_file,
+    redis_tls_client_key_file: redis_tls_client_key_file
+  )
   dependent_services.each { |svc| notifies :restart, svc }
   sensitive true
 end
@@ -273,6 +288,11 @@
   clusters = node['gitlab']['gitlab_rails']["redis_#{instance}_cluster_nodes"]
   username = node['gitlab']['gitlab_rails']["redis_#{instance}_username"]
   password = node['gitlab']['gitlab_rails']["redis_#{instance}_password"]
+  redis_ssl = node['gitlab']['gitlab_rails']["redis_#{instance}_ssl"]
+  ca_cert_dir = node['gitlab']['gitlab_rails']["redis_#{instance}_tls_ca_cert_dir"]
+  ca_cert_file = node['gitlab']['gitlab_rails']["redis_#{instance}_tls_ca_cert_file"]
+  certificate_file = node['gitlab']['gitlab_rails']["redis_#{instance}_tls_client_cert_file"]
+  key_file = node['gitlab']['gitlab_rails']["redis_#{instance}_tls_client_key_file"]
   from_filename = File.join(gitlab_rails_source_dir, "config/#{filename}")
   to_filename = File.join(gitlab_rails_etc_dir, filename)
 
@@ -292,7 +312,12 @@
       redis_enable_client: redis_enable_client,
       cluster_nodes: clusters,
       cluster_username: username,
-      cluster_password: password
+      cluster_password: password,
+      redis_ssl: redis_ssl,
+      redis_tls_ca_cert_dir: ca_cert_dir,
+      redis_tls_ca_cert_file: ca_cert_file,
+      redis_tls_client_cert_file: certificate_file,
+      redis_tls_client_key_file: key_file
     )
     dependent_services.each { |svc| notifies :restart, svc }
     action :delete if url.nil? && clusters.empty?
diff --git a/files/gitlab-cookbooks/gitlab/templates/default/resque.yml.erb b/files/gitlab-cookbooks/gitlab/templates/default/resque.yml.erb
--- a/files/gitlab-cookbooks/gitlab/templates/default/resque.yml.erb
+++ b/files/gitlab-cookbooks/gitlab/templates/default/resque.yml.erb
@@ -13,6 +13,13 @@
     <% end %>
   <% else %>
   url: <%= @redis_url %>
+  <%- if @redis_ssl %>
+  ssl_params:
+    <%- if @redis_tls_ca_cert_dir %>ca_path: "<%= @redis_tls_ca_cert_dir %>"<% end %>
+    <%- if @redis_tls_ca_cert_file %>ca_file: "<%= @redis_tls_ca_cert_file %>"<% end %>
+    <%- if @redis_tls_client_cert_file %>cert_file: "<%= @redis_tls_client_cert_file %>"<% end %>
+    <%- if @redis_tls_client_key_file %>key_file: "<%= @redis_tls_client_key_file %>"<% end %>
+  <% end %>
   <% unless @redis_sentinels.empty? %>
   sentinels:
     <% @redis_sentinels.each do |sentinel| %>
diff --git a/spec/chef/cookbooks/gitlab/recipes/gitlab-rails_spec.rb b/spec/chef/cookbooks/gitlab/recipes/gitlab-rails_spec.rb
--- a/spec/chef/cookbooks/gitlab/recipes/gitlab-rails_spec.rb
+++ b/spec/chef/cookbooks/gitlab/recipes/gitlab-rails_spec.rb
@@ -306,6 +306,38 @@
       end
     end
 
+    context 'with TLS settings' do
+      let(:resque_yml_template) { chef_run.template('/var/opt/gitlab/gitlab-rails/etc/resque.yml') }
+      let(:resque_yml_file_content) { ChefSpec::Renderer.new(chef_run, resque_yml_template).content }
+      let(:resque_yml) { YAML.safe_load(resque_yml_file_content, [], [], true, symbolize_names: true) }
+
+      before do
+        stub_gitlab_rb(
+          gitlab_rails: {
+            redis_host: 'redis.example.com',
+            redis_port: 8888,
+            redis_password: 'mypass',
+            redis_ssl: true,
+            redis_tls_ca_cert_dir: '/tmp/certs',
+            redis_tls_ca_cert_file: '/tmp/ca.crt',
+            redis_tls_client_cert_file: '/tmp/self_signed.crt',
+            redis_tls_client_key_file: '/tmp/self_signed.key',
+          }
+        )
+      end
+
+      it 'renders configuration with tls settings' do
+        expected_output = {
+          ca_file: "/tmp/ca.crt",
+          ca_path: "/tmp/certs",
+          cert_file: "/tmp/self_signed.crt",
+          key_file: "/tmp/self_signed.key"
+        }
+
+        expect(resque_yml[:production][:ssl_params]).to eq(expected_output)
+      end
+    end
+
     shared_examples 'instances does not support redis cluster' do |instance|
       context "with disallowed instance: #{instance}" do
         before do
@@ -403,7 +435,12 @@
               redis_enable_client: false,
               cluster_nodes: [{ "host" => instance, "port" => "1234" }, { "host" => instance, "port" => "3456" }],
               cluster_username: instance,
-              cluster_password: "#{instance}_password"
+              cluster_password: "#{instance}_password",
+              redis_ssl: false,
+              redis_tls_ca_cert_dir: "/opt/gitlab/embedded/ssl/certs/",
+              redis_tls_ca_cert_file: "/opt/gitlab/embedded/ssl/certs/cacert.pem",
+              redis_tls_client_cert_file: nil,
+              redis_tls_client_key_file: nil
             )
 
             expect(chef_run).to render_file("/var/opt/gitlab/gitlab-rails/etc/redis.#{instance}.yml").with_content { |content|
@@ -440,7 +477,12 @@
               redis_enable_client: false,
               cluster_nodes: [],
               cluster_username: nil,
-              cluster_password: nil
+              cluster_password: nil,
+              redis_ssl: false,
+              redis_tls_ca_cert_dir: "/opt/gitlab/embedded/ssl/certs/",
+              redis_tls_ca_cert_file: "/opt/gitlab/embedded/ssl/certs/cacert.pem",
+              redis_tls_client_cert_file: nil,
+              redis_tls_client_key_file: nil
             )
 
             expect(chef_run).to render_file("/var/opt/gitlab/gitlab-rails/etc/redis.#{instance}.yml").with_content { |content|
@@ -477,7 +519,12 @@
                 redis_enable_client: false,
                 cluster_nodes: [],
                 cluster_username: nil,
-                cluster_password: nil
+                cluster_password: nil,
+                redis_ssl: false,
+                redis_tls_ca_cert_dir: "/opt/gitlab/embedded/ssl/certs/",
+                redis_tls_ca_cert_file: "/opt/gitlab/embedded/ssl/certs/cacert.pem",
+                redis_tls_client_cert_file: nil,
+                redis_tls_client_key_file: nil
               )
 
               expect(chef_run).to render_file("/var/opt/gitlab/gitlab-rails/etc/redis.#{instance}.yml").with_content { |content|