search string side menu

BRIX On-Premises > Prepare infrastructure > Databases > High availability infrastructure / Redis cluster

Redis cluster

For the correct operation of the system, Redis version 5 or 6.2 is required. The article describes the installation of Redis 6.2.12 for Ubuntu Linux 20.04 and 22.04. You can also refer to the guide in the official Redis documentation.

Installation consists of five steps:

  1. Prepare nodes (servers).
  2. Install Redis and Sentinel.
  3. Configure Redis.
  4. Configure Sentinel.
  5. Connect to Redis.

Step 1: Prepare nodes (servers)

начало внимание

The minimum number of servers to organize a cluster is three.

конец внимание

  1. Create three nodes (servers) with sequentially numbered host names:
  • redis-server1.your_domain.
  • redis-server2.your_domain.
  • redis-server3.your_domain.
  1. Create the necessary host name mappings in DNS. If this is not possible, add the required entries to /etc/hosts.

Step 2: Install Redis and Sentinel

  1. Install the necessary packages:

sudo apt install lsb-release curl gpg

  1. Import the necessary keys and add the Redis repository:

curl -fsSL https://packages.redis.io/gpg | sudo gpg --dearmor -o /usr/share/keyrings/redis-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/redis.list

  1. Update the package cache:

sudo apt-get update

  1. Install  Redis:

sudo apt-get -y install redis=6:6.2.12-1rl1~$(lsb_release -cs)1 redis-server=6:6.2.12-1rl1~$(lsb_release -cs)1 redis-tools=6:6.2.12-1rl1~$(lsb_release -cs)1 redis-sentinel=6:6.2.12-1rl1~$(lsb_release -cs)1

Step 3: Configure Redis

Начало примечание

Note

For the password, the following characters are allowed:

  • Uppercase Latin letters: A to Z
  • Lowercase Latin letters: a to z
  • Digits: 0 to 9
  • Symbols: -_

Reserved (invalid) symbols:

! * ' ( ) ; : @ & = + $ , / ? % # [ ]

конец примечание

To configure, edit the /etc/redis/redis.conf file on each server:

sudo nano /etc/redis/redis.conf

  1. Make the servers accessible from all IP addresses of this server. This makes the Redis service accessible from all external addresses:

bind 0.0.0.0 

  1. Increase the maximum number of clients by changing the value of the parameter maxclients to 20000. Uncomment the line by removing the hash sign #:

maxclients 20000

  1. Set the key eviction policy by changing the value of the maxmemory-policy parameter to allkeys-lfu. Uncomment the line by removing the hash sign #:

maxmemory-policy allkeys-lfu

  1. Disable snapshot creation by changing the value of the save parameter to "". Uncomment the line by removing the hash sign #:

save ""

  1. Disable AOF (Redis database saving to file). To do this, replace the value of the appendonly parameter with no. Uncomment the line by removing the hash sign #:

appendonly no

  1. Specify the password to the Master:

masterauth SecretPassword

  1. Specify the domain (FQDN) to represent the node in the cluster:
  • on the node redis-server1.your_domain:

replica-announce-ip redis-server1.your_domain

  • on the node redis-server2.your_domain:

replica-announce-ip redis-server2.your_domain

  • on the node redis-server3.your_domain:

replica-announce-ip redis-server3.your_domain

  1. Specify the password for access:

requirepass SecretPassword

  1. On nodes redis-server2.your_domain and redis-server3.your_domain, specify the domain (FQDN) and port to connect to the Master node (redis-server1.your_domain):

replicaof redis-server1.your_domain 6379

  1. Restart all servers (primary first, then subordinates):

sudo systemctl restart redis-server
sudo systemctl enable redis-server

  1. Check the replication status on the node redis-server1.your_domain:

sudo redis-cli -a SecretPassword info replication

Enabling TLS/SSL in Redis

 
To enable TLS/SSL support in Redis, you need to edit the configuration file redis.conf:

  1. Disable unsecured connections by setting 0 in the parameter port.
  2. Set the port for TLS connections, uncomment the parameter tls-port.
  3. In the parameter tls-cert-file, specify the path to the server certificate file.
  4. In the parameter tls-key-file, specify the path to the private key file.
  5. In the parameter tls-ca-cert-file, specify the path to the root CA file.

port 0
tls-port 6379
tls-cert-file /path/to/redis.crt
tls-key-file /path/to/redis.key
tls-ca-cert-file /path/to/ca.crt

  1. Restart all servers (primary first, then subordinates):

sudo systemctl restart redis-server
sudo systemctl enable redis-server

  1. Check the replication status on the node redis-server1.your_domain:

sudo redis-cli -p 6379 -h redis-server1.your_domain --tls --cacert /path/to/ca.crt --cert /path/to/redis.crt --key /path/to/redis.key -a SecretPassword info replication

 
For more details on configuring TLS/SSL in Redis, refer to the official Redis documentation.
 

Step 4: Configure Sentinel

To configure Sentinel, edit the file /etc/redis/sentinel.conf on each server.

Начало внимание 

To work correctly, observe the specified order of entries in the file /etc/redis/sentinel.conf.

Конец внимание

  1. Make the servers accessible from all IP addresses of this server. In this case, it makes the Sentinel service accessible from all external addresses:

bind 0.0.0.0 

  1. Specify the domain (FQDN) to represent Sentinel nodes:
  • on the node redis-server1.your_domain:

sentinel announce-ip redis-server1.your_domain

  • on the node redis-server2.your_domain:

sentinel announce-ip redis-server2.your_domain

  • on the node redis-server3.your_domain:

sentinel announce-ip redis-server3.your_domain

  1. Specify the domain (FQDN) and port of the Master, as well as the value to achieve the quorum:

sentinel monitor mymaster redis-server1.your_domain 6379 2

  1. Specify the password for access to the Master:

sentinel auth-pass mymaster SecretPassword

  1. Specify the time after which the Master will be considered down:

sentinel down-after-milliseconds mymaster 3000

  1. Specify the waiting time after the Subordinate switches roles to Master in case the Master goes down:

sentinel failover-timeout mymaster 6000

  1. Enable support for resolving hostnames:

sentinel resolve-hostnames yes
sentinel announce-hostnames yes

  1. To increase security, configure the default user to access Sentinel by password only:

user default on >SecretPassword sanitize-payload ~* &* +@all

  1. After that, restart all servers:

sudo systemctl restart redis-sentinel
sudo systemctl enable redis-sentinel

  1. Check the Sentinel status and the quorum state on the node redis-server1.your_domain using different commands depending on the TLS/SSL usage and Sentinel configuration:
  • Without TLS/SSL if password access to Sentinel is not enabled:

sudo redis-cli -p 26379 info sentinel
sudo redis-cli -p 26379 sentinel ckquorum mymaster

  • Without TLS/SSL if password-only access to Sentinel is set up:

sudo redis-cli -p 26379 -a SecretPassword info sentinel
sudo redis-cli -p 26379 -a SecretPassword sentinel ckquorum mymaster

  • With TLS/SSL if password access to Sentinel is not enabled:

sudo redis-cli -p 26379 -h redis-server1.your_domain --tls --cacert /path/to/ca.crt --cert /path/to/redis.crt --key /path/to/redis.key info sentinel
sudo redis-cli -p 26379 -h redis-server1.your_domain --tls --cacert /path/to/ca.crt --cert /path/to/redis.crt --key /path/to/redis.key sentinel ckquorum mymaster

  • With TLS/SSL if password-only access to Sentinel is set up:

sudo redis-cli -p 26379 -a SecretPassword -h redis-server1.your_domain --tls --cacert /path/to/ca.crt --cert /path/to/redis.crt --key /path/to/redis.key info sentinel
sudo redis-cli -p 26379 -a SecretPassword -h redis-server1.your_domain --tls --cacert /path/to/ca.crt --cert /path/to/redis.crt --key /path/to/redis.key sentinel ckquorum mymaster

Enabling TLS/SSL in Sentinel

 
To enable TLS/SSL support in Sentinel, edit the configuration file sentinel.conf:

  1. Disable unsecured connections by setting 0 in the parameter port.
  2. Set the port for TLS connections, add the parameter tls-port.
  3. Add the parameter tls-cert-file specifying the path to the server certificate file.
  4. Add the parameter tls-key-file specifying the path to the private key file.
  5. Add the parameter tls-ca-cert-file specifying the path to the root CA file.
  6. Add the parameter tls-replication enabling TLS support, specifying the value yes.

port 0
tls-port 26379
tls-cert-file /path/to/redis.crt
tls-key-file /path/to/redis.key
tls-ca-cert-file /path/to/ca.crt
tls-replication yes

  1. After that, restart all servers:

sudo systemctl restart redis-sentinel
sudo systemctl enable redis-sentinel

  1. Check the Sentinel status and the quorum state on the node redis-server1.your_domain:

sudo redis-cli -p 26379 -h redis-server1.your_domain --tls --cacert /path/to/ca.crt --cert /path/to/redis.crt --key /path/to/redis.key info sentinel
sudo redis-cli -p 26379 -h redis-server1.your_domain --tls --cacert /path/to/ca.crt --cert /path/to/redis.crt --key /path/to/redis.key sentinel ckquorum mymaster

 
For more details on configuring TLS/SSL in Sentinel, refer to the official Redis documentation.
 

Step 5: Connect to Redis

Connect to Redis. The connection string depends on the use of TLS/SSL and Sentinel configuration:

  • Without TLS/SSL if password access to Sentinel is not enabled:

redis://:SecretPassword@redis-server1.your_domain:26379,redis-server2.your_domain:26379,redis-server3.your_domain:26379/0?masterName=mymaster

  • Without TLS/SSL if password-only access to Sentinel is set up:

redis://:SecretPassword@redis-server1.your_domain:26379,redis-server2.your_domain:26379,redis-server3.your_domain:26379/0?masterName=mymaster&sentinelUsername=default&sentinelPassword=SecretPassword

  • With TLS/SSL if password access to Sentinel is not enabled:

redis://:SecretPassword@redis-server1.your_domain:26379,redis-server2.your_domain:26379,redis-server3.your_domain:26379/0?masterName=mymaster

  • With TLS/SSL if password-only access to Sentinel is set up:

rediss://:SecretPassword@redis-server1.your_domain:26379,redis-server2.your_domain:26379,redis-server3.your_domain:26379/0?masterName=mymaster&sentinelUsername=default&sentinelPassword=SecretPassword

configure-mongodb.html configure-rabbitmq.html