I can run this against my local and get the expected result (which is just a redis docker image with no TLS)

redis-cli -h localhost -p 6379 ping

From a pod in our k8s cluster, I can run this and get the same result (note the --tls flag this time)

redis-cli --tls -h redis.default.svc.cluster.local -p 6379 ping

My assumption was that I'd use the lucee extension's custom "useSsl" flag to set TLS to false locally (which works fine) and true in the cluster (which just seems to spin trying to connect but only from the app). I don't have access to the logs on the redis cluster yet (it's new and I just don't have permission yet. my only access is redis-cli for a day or two at least) I focused on the connection because until I turn the redis flag on in the app, it works as it always has but, with REDIS_ENABLED set to true, the stdout() message in the code below spits out every few seconds and the pods never become "ready". This is the only block of code driven by REDIS_ENABLED and is in the pseudo constructor of Applicaiton.cfc

// If a redis host was provided by the configuration, use redis
	if( models.libs.Udfs::getEnv( "REDIS_ENABLED", false ) ) {
		models.libs.Udfs::stdout( "Configuring Redis cache for session storage" )

		this["sessionCluster"] = models.libs.Udfs::getEnv( "REDIS_SESSION_CLUSTER", false );

		this["cache"]["sessionCache"] = {
			"class":"lucee.extension.io.cache.redis.simple.RedisCache",
			"custom":{
				"connectionTimeout": models.libs.Udfs::getEnv( "REDIS_CONNECTION_TIMEOUT", 5000 ),
				"host": models.libs.Udfs::getEnv( "REDIS_HOST", "redis.default.svc.cluster.local" ),
				"port": models.libs.Udfs::getEnv( "REDIS_PORT", 6379 ),
				"socketTimeout": models.libs.Udfs::getEnv( "REDIS_SOCKET_TIMEOUT", 5000 ),
				"useSsl": models.libs.Udfs::getEnv( "REDIS_TLS", true )
			},
			"readOnly":"false",
			"storage":"true"
		};

		this["sessionStorage"] = "sessionCache";
	}

I expect the stdout() message spitting out every few seconds would line up with k8s readiness probes

I did try getting a local redis instance running with TLS to better debug and test but it was not working out so I went this route. Ideally, useSsl would just always be true of course.

sooo... the examples I've seen all say use the "useSsl" custom setting on the extension but, after looking closer at the code, it looks like the setting is actually called "ssl". It seems to be working now...