# Valkey cluster

> [HTML Version](valkey-cluster.html)

Valkey is a high-performance NoSQL database management system designed based on Redis for modern cloud and distributed systems.

This article describes how to install Valkey 8.1.1 on Ubuntu Linux 22.04 and 24.04. You can obtain Valkey installation files for your OS from:

- [The official Valkey repository](https://github.com/valkey-io/valkey/releases).

- [The Repology service website](https://repology.org/project/valkey/versions).

Additional information about Valkey can also be found in the following sources:

- [System requirements for BRIX On-Premises](elma365-enterprise-on-premises.md#valkey). This article contains information about supported Valkey versions for correct system operation.

- [Migrate from a Redis to Valkey cluster](cluster-redis-to-valkey.md). This article contains information on how to replace a Redis cluster with a Valkey cluster.

- [Official Valkey documentation](https://valkey.io/topics/quickstart/). It describes more about working with DBMS.

Valkey cluster deployment steps:

1. [Node (server) preparation](#nodes).

2. [Valkey installation](#install).

3. [Valkey configuration](#configure).

4. [Sentinel configuration](#sentinel).

5. [Connection to Valkey](#connect).

## Step 1: Node (server) preparation

````
начало внимание

````
The minimum number of servers required to set up a cluster is three.

````
конец внимание

1. ````
Create three nodes (servers) with sequentially numbered host names:

	- **valkey-server1.your\_domain**

	- **valkey-server2.your\_domain**

	- **valkey-server3.your\_domain**

2. Configure hostname mappings in DNS. If DNS configuration is not available, add the corresponding entries to the \[OBJECT\] directory.

## Step 2: Valkey installation

1. Install the packages:

````
sudo apt install -y apt-transport-https ca-certificates curl

2. ````
Import the keys:

````
sudo curl -fsSL https://repo.brix365.com/deb/brix365-keyring.gpg | gpg --dearmor > /etc/apt/trusted.gpg.d/brix365-keyring.gpg

3. ````
Add the repository:

````
echo "deb \[arch=amd64\] https://repo.brix365.com/deb \$(lsb\_release -cs) stable" | sudo tee /etc/apt/sources.list.d/brix365.list  
sudo apt update

4. ````
Install Valkey:

````
sudo apt install brix365-valkey-server

## ````
Step 3: Valkey configuration

````
начало примечание

````
**Note**

The password can contain the following characters:

- Uppercase Latin letters: A to Z

- Lowercase Latin letters: a to z

- Digits: 0 to 9

- Symbols: -\_

Reserved (invalid) characters:

\! \* ' ( ) ; : @ \& = + \$ , / ? % # \[ \]

````
конец примечание

````
Configure the database management system installed:

1. Edit the \[OBJECT\] file on each server:

````
sudo nano /etc/valkey/valkey.conf

2. ````
To allow Valkey connections from all server network interfaces, specify:

````
bind 0.0.0.0 

3. ````
Increase the maximum number of clients by setting the \[OBJECT\] parameter to \[OBJECT\]. Uncomment the line by removing the \[OBJECT\] sign:

````
maxclients 20000

4. ````
Set the key eviction policy by setting the \[OBJECT\] parameter to \[OBJECT\]. Uncomment the line by removing the \[OBJECT\] sign:

````
maxmemory-policy allkeys-lfu

5. ````
Disable creation of **snapshots** by setting the \[OBJECT\] parameter to null. Uncomment the line by removing the \[OBJECT\] sign:

````
save ""

6. ````
Disable the **AOF** (**Append Only File)** to prevent saving of Valkey data in a file. To do it, set the \[OBJECT\] parameter to \[OBJECT\]. Uncomment the line by removing the \[OBJECT\] sign:

````
appendonly no

7. ````
Enter the password to the primary node:

````
masterauth SecretPassword

8. ````
Set the domain (FQDN) for nodes in the cluster:

- On the **valkey-server1.your\_domain** node:

````
replica-announce-ip valkey-server1.your\_domain

- ````
On the **valkey-server2.your\_domain** node:

````
replica-announce-ip valkey-server2.your\_domain

- ````
On the **valkey-server3.your\_domain** node:

````
replica-announce-ip valkey-server3.your\_domain

9. ````
Specify the access password:

````
requirepass SecretPassword

10. ````
Disable the protected mode if the \[OBJECT\] parameter is used or the \[OBJECT\]** option **is not set:

````
protected-mode no

11. ````
On the **valkey-server2.your\_domain** and **valkey-server3.your\_domain** nodes, specify the domain (FQDN) and connection port for the **valkey-server1.your\_domain** primary node:

````
replicaof valkey-server1.your\_domain 6379

12. ````
Restart all servers. Begin with the primary node, and then proceed to the subordinate nodes:

````
sudo systemctl restart valkey-server  
sudo systemctl enable valkey-server

13. ````
Check the replication status on the **valkey-server1.your\_domain **node:

````
sudo valkey-cli -a SecretPassword info replication

````
Enable TLS/SSL in Valkey 

  
To enable the TLS/SSL in Valkey, in the \[OBJECT\]** **configuration file:

1. Disable unprotected connections by setting the \[OBJECT\] parameter** **to \[OBJECT\].

2. Set the port for TLS connections and uncomment the \[OBJECT\] parameter.

3. In the \[OBJECT\] parameter, specify the path to the server certificate file.

4. In the \[OBJECT\] parameter, specify the path to the private key file.

5. In the \[OBJECT\] parameter, specify the path to the root CA file.

````
port 0  
tls-port 6379  
tls-cert-file /path/to/valkey.crt  
tls-key-file /path/to/valkey.key  
tls-ca-cert-file /path/to/ca.crt

6. ````
Restart all servers. Begin with the primary node, and then proceed to the subordinate nodes:

````
sudo systemctl restart valkey-server  
sudo systemctl enable valkey-server

7. ````
Check the replication status on the ** valkey-server1.your\_domain** node:

````
sudo valkey-cli -p 6379 -h valkey-server1.your\_domain --tls --cacert /path/to/ca.crt --cert /path/to/valkey.crt --key /path/to/valkey.key -a SecretPassword info replication

````
  
Learn more about TLS/SSL inValkey in the [official Valkey documentation](https://valkey.io/topics/encryption/).

## Step 4: Sentinel settings

To configure Sentinel, edit the \[OBJECT\] file on each server.

````
начало внимание

````
To work correctly, observe the specified order of entries in the \[OBJECT\]** **file.

````
конец внимание

1. ````
Specify the domain (FQDN) to represent the Sentinel nodes:

- On the **valkey-server1.your\_domain **node:

````
sentinel announce-ip valkey-server1.your\_domain

- ````
On the **valkey-server2.your\_domain **node:

````
sentinel announce-ip valkey-server2.your\_domain

- ````
On the **valkey-server3.your\_domain **node:

````
sentinel announce-ip valkey-server3.your\_domain

2. ````
Set the domain (FQDN) and the port of the primary node, as well as the value to achieve the quorum:

````
sentinel monitor mymaster valkey-server1.your\_domain 6379 2

3. ````
Enter the password to access the primary node:

````
sentinel auth-pass mymaster SecretPassword

4. ````
Set the time after which the primary node will be considered down:

````
sentinel down-after-milliseconds mymaster 3000

5. ````
Specify the timeout after the subordinate node switches to the primary node if the primary node goes down:

````
sentinel failover-timeout mymaster 6000

6. ````
Enable use of the host names:

````
sentinel resolve-hostnames yes  
sentinel announce-hostnames yes

7. ````
Optional: enable access only by password for the \[OBJECT\] user:

````
user default on >SecretPassword sanitize-payload ~\* \&\* +@all

8. ````
Then restart all servers:

````
sudo systemctl restart valkey-sentinel  
sudo systemctl enable valkey-sentinel

9. ````
Check the Sentinel status and the quorum status on the **valkey-server1.your\_domain** node:

- Connection without TLS/SSL:

````
sudo valkey-cli -p 26379 info sentinel  
sudo valkey-cli -p 26379 sentinel ckquorum mymaster

- ````
Connection without TLS/SSL in case of access by password only:

````
sudo valkey-cli -p 26379 -a SecretPassword info sentinel  
sudo valkey-cli -p 26379 -a SecretPassword sentinel ckquorum mymaster

- ````
Connection with TLS/SSL:

````
sudo valkey-cli -p 26379 -h valkey-server1.your\_domain --tls --cacert /path/to/ca.crt --cert /path/to/valkey.crt --key /path/to/valkey.key info sentinel  
sudo valkey-cli -p 26379 -h valkey-server1.your\_domain --tls --cacert /path/to/ca.crt --cert /path/to/valkey.crt --key /path/to/valkey.key sentinel ckquorum mymaster

- ````
Connection with TLS/SSL in case of access by password only:

````
sudo valkey-cli -p 26379 -a SecretPassword -h valkey-server1.your\_domain --tls --cacert /path/to/ca.crt --cert /path/to/valkey.crt --key /path/to/valkey.key info sentinel  
sudo valkey-cli -p 26379 -a SecretPassword -h valkey-server1.your\_domain --tls --cacert /path/to/ca.crt --cert /path/to/valkey.crt --key /path/to/valkey.key sentinel ckquorum mymaster

````
Enable TLS/SSL in Sentinel

  
To enable TLS/SSL in Sentinel, in the \[OBJECT\] configuration file:

1. Disable unprotected connections by setting the \[OBJECT\] parameter to \[OBJECT\].

2. Set the port for TLS connections by adding the \[OBJECT\]** **parameter.

3. Add the \[OBJECT\] parameter to specify the path to the server certificate file.

4. Add the \[OBJECT\] parameter to specify the path to the private key file.

5. Add the \[OBJECT\] parameter to specify the path to the root CA file.

6. Add the \[OBJECT\] parameter and set it to the \[OBJECT\] value to enable TLS.

````
port 0  
tls-port 26379  
tls-cert-file /path/to/valkey.crt  
tls-key-file /path/to/valkey.key  
tls-ca-cert-file /path/to/ca.crt  
tls-replication yes

````
  
Learn more about TLS/SSL in the [official Valkey documentation](https://valkey.io/topics/sentinel-clients/).

## Step 5: Connection to Valkey

Connection string for Valkey:

````
redis://:SecretPassword@valkey-server1.your\_domain:26379,valkey-server2.your\_domain:26379,valkey-server3.your\_domain:26379/0?masterName=mymaster

````
Connection string for Valkey in case of access by password only:

````
redis://:SecretPassword@valkey-server1.your\_domain:26379,valkey-server2.your\_domain:26379,valkey-server3.your\_domain:26379/0?masterName=mymaster\&sentinelUsername=default\&sentinelPassword=SecretPassword

````
Connection string for Valkey with TLS/SSL:

````
rediss://:SecretPassword@valkey-server1.your\_domain:26379,valkey-server2.your\_domain:26379,valkey-server3.your\_domain:26379/0?\&masterName=mymaster

````
Connection string for Valkey with TLS/SSL in case of access by password only:

````
rediss://:SecretPassword@valkey-server1.your\_domain:26379,valkey-server2.your\_domain:26379,valkey-server3.your\_domain:26379/0?masterName=mymaster\&sentinelUsername=default\&sentinelPassword=SecretPassword
````