Redis-Sentinel on Kubernetes Prep ①

Manifest (YAML) overview

Redis-Sentinel overview

Redis-Sentinel stores (and manages) data on one Redis Pod (the master) and keeps two backup (replica) Pods. Three Sentinel Pods monitor the Redis master and, if the master goes down, promote one of the replicas to master.
🔗 See here for a full Redis-Sentinel overview.

1. Redis-Sentinel manifests (YAML)

When you deploy Redis-Sentinel on Kubernetes, split the work across four YAML files: config (Config), Service, Redis Pod creation, and Sentinel Pod creation (two StatefulSets).

┌─────────────────────────────────────────────────────────────────┐ │ 1. redis-sentinel-config.yaml (ConfigMap) │ │ : redis.conf, sentinel.conf, users.acl │ └──────────────────┬──────────────────────────────────────────────┘ │ [Step 1: provide Config values] ▼ ┌─────────────────────────────────────────────────────────────────┐ │ 2. redis-sentinel-service.yaml (Headless Service) │ │ : redis-service, sentinel-service, clusterIP: None │ └──────────────────┬──────────────────────────────────────────────┘ │ [Step 2: prepare Services] ▼ ┌─────────────────────────────────────────────────────────────────┐ │ 3. redis-statefulset.yaml (StatefulSet) redis-0~2 (3Pods) │ │ 4. sentinel-statefulset.yaml (StatefulSet) sentinel-0~2 (3Pods) │ └─────────────────────────────────────────────────────────────────┘ [Step 3: create Redis/Sentinel Pods]

2. File contents in deploy order

🟢 [Step 1] Redis-Sentinel config: redis-sentinel-config.yaml

Kind: ConfigMap
Name (metadata:name): redis-sentinel-config
⚠️ Names are strictly limited to lowercase (a-z), digits (0-9), and hyphens (`-`) (uppercase is not allowed)
This is the ConfigMap. Directives here are used to build redis.conf and sentinel.conf.
The default redis.conf and sentinel.conf that come with the tarball are not used.
If each Redis instance (Pod) needs a different value, you can set it dynamically with a command script in the StatefulSet. Example) replica-priority 100, 110, 120

🧑‍💻 Key values

bind * -::* # IPs are assigned dynamically and change, so accept all IPs.
KISA (Korea Internet & Security Agency) [Cloud Vulnerability Assessment Guide] insists on setting a specific IP on bind for security. That is correct on VMs/physical servers, but you cannot do that in Kubernetes.
(You need to explain this clearly to auditors on public-sector/finance projects.)
protected-mode no # Because we set 'bind *', 'yes' would block external connections.
It looks like a security violation, but Kubernetes has its own isolation, so this setting is fine.
daemonize no # Do not set this to 'yes'.
requirepass password # 💥Always set a password. Even in a lab, if the server or PC is on the Internet, set a password. Redis is not hacked by 🕵️people; 💻programs scan 24 hours a day. Without a password, even a few minutes of a "dev only" instance can be compromised immediately.
See here for details. 🔗 Redis Hacking
If you configure users.acl, you do not need to set 'requirepass'.
masterauth password # Always set this.
replica-priority 100 # 📍Redis-0 100, Redis-1 110, Redis-2 120
Injected dynamically from redis-statefulset.yaml initContainer:command.
replica-announce-ip # 📍redis-0.redis-service...
Injected dynamically from redis-statefulset.yaml initContainer:command.
echo "replica-announce-ip redis-$INDEX.redis-service.default.svc.cluster.local" >> /data/redis.conf
users.acl: lines 66–67. The password ('#0cbc...' 64 chars) must be set separately.
See here for details. 🔗 ACL

💾 View redis-sentinel-config.yaml ▼

📄 redis-sentinel-config.yaml

  1	apiVersion: v1
  2	kind: ConfigMap
  3	metadata:
  4	  name: redis-sentinel-config
  5	data:
  6	  redis.conf: |
  7	    # Redis-8.8.2 configuration
  8	    # [NETWORK]
  9	    bind * -::*
 10	    protected-mode no
 11	    port 18504
 12	    tcp-keepalive 60
 13	    # [GENERAL]
 14	    daemonize no
 15	    pidfile /data/redis.pid
 16	    # notice / verbose / debug
 17	    loglevel notice
 18	    logfile /data/redis.log
 19	    always-show-logo yes
 20	    # locale-collate "ko_KR.UTF-8" 
 21	    # [MEMORY MANAGEMENT] limit: Statefulset limits: memory: "1Gi"
 22	    maxmemory 950m 
 23	    # [SNAPSHOTTING]
 24	    dbfilename dump.rdb
 25	    rdb-del-sync-files yes
 26	    # [working directory]
 27	    dir /data
 28	    # [SECURITY]
 29	    requirepass redisgate
 30	    masterauth redisgate
 31	    enable-protected-configs yes
 32	    enable-debug-command yes
 33	    # 📍 file must be created
 34	    aclfile /data/users.acl
 35	    # [REPLICATION]
 36	    # 📍Redis-0 100, Redis-1 110, Redis-2 120
 37	    replica-priority 100                
 38	    repl-backlog-size 128mb
 39	    repl-diskless-sync yes
 40	    repl-diskless-sync-delay 3
 41	    repl-diskless-sync-max-replicas 0
 42	    repl-diskless-load on-empty-db
 43	    # [CLIENTS]
 44	    maxclients 10000
 45	    client-output-buffer-limit normal 0 0 0
 46	    client-output-buffer-limit replica 1gb 1gb 120
 47	    client-output-buffer-limit pubsub 128mb 64mb 60
 48	    # [APPEND ONLY MODE]
 49	    save ""
 50	    appendonly yes
 51	    appendfilename "aof"
 52	    appenddirname "aof"	
 53	    appendfsync everysec
 54	    no-appendfsync-on-rewrite yes
 55	    auto-aof-rewrite-percentage 200
 56	    auto-aof-rewrite-min-size 1gb
 57	    aof-use-rdb-preamble yes
 58	    aof-timestamp-enabled yes
 59	    # [SLOW LOG]
 60	    slowlog-log-slower-than 10000
 61	    slowlog-max-len 1024
 62	    # [LATENCY MONITOR]
 63	    # 10ms, 0 disable
 64	    latency-monitor-threshold 10		
 65	
 66	  users.acl: |
 67	    user default on sanitize-payload #0cbc79ebbac0552443521615124610ef12649d44d4550f16fc9edf5594624305 ~* &* +@all
 68	
 69	  sentinel.conf: |
 70	    bind * -::*
 71	    protected-mode no
 72	    port 28504
 73	    daemonize no
 74	    dir /data
 75	    loglevel notice
 76	    logfile /data/sentinel.log
 77	    pidfile /data/sentinel.pid
 78	    requirepass redisgate
 79	    #aclfile /data/sentinel-users.acl
 80	    sentinel auth-user mymaster default
 81	    sentinel auth-pass mymaster redisgate
 82	    sentinel sentinel-user default
 83	    sentinel sentinel-pass redisgate
 84	    sentinel resolve-hostnames yes
 85	    sentinel announce-hostnames yes
 86	    sentinel monitor mymaster redis-0.redis-service.default.svc.cluster.local 18504 2
 87	    sentinel down-after-milliseconds mymaster 3000
 88	    sentinel failover-timeout mymaster 60000
 89	    sentinel parallel-syncs mymaster 1

The values shown here are redis.conf settings that redisGate has applied at 90%+ of more than 100 sites we installed and operate. (Adjust maxmemory to match your data size)

💻 On physical servers/VMs, change the following values.

bind 114.x.y.z 127.0.0.1 -::1 -> bind a specific IP
protected-mode yes
port -> default 💥port 6379 is a primary hacking target. Always use a different port.
daemonize yes
dir /app/redis -> pidfile, logfile, etc. also live under this dir
aclfile /app/redis/users.acl -> per-user privileges: recommended
#maxmemory <bytes> -> commented (default)
① On a Redis-dedicated server, set 50%–90% of system memory
② If you have plenty of RAM: e.g. 16GB system memory and Redis using 1–2GB, you do not really need to set it
③ 💥 If Redis consumes all system memory, the OS (Linux) will kill the Redis process.
# replica-announce-ip -> commented (default)

🟢 [Step 2] Service config: redis-sentinel-service.yaml

Kind: Service
Name (metadata:name): redis-service / sentinel-service
⚠️ Names are strictly limited to lowercase (a-z), digits (0-9), and hyphens (`-`) (uppercase is not allowed)
This is the Service spec. It prepares a network "directory" so you can reach each Redis by a stable domain name (FQDN: Fully Qualified Domain Name) even when Pod IPs change.

🧑‍💻 Key values

clusterIP: None # 📍Set to 'None' (to identify each Pod by DNS)
port: 18504 # Redis port
port: 28504 # Sentinel port

💾 View redis-sentinel-service.yaml ▼

📄 redis-sentinel-service.yaml

  1	apiVersion: v1
  2	kind: Service
  3	metadata:
  4	  name: redis-service
  5	  labels:
  6	    app: redis
  7	spec:
  8	  clusterIP: None  # Keep Headless Service (identify each Pod by DNS)
  9	  ports:
 10	  - port: 18504
 11	    name: redis-port
 12	  selector:
 13	    app: redis
 14	---
 15	apiVersion: v1
 16	kind: Service
 17	metadata:
 18	  name: sentinel-service
 19	  labels:
 20	    app: sentinel
 21	spec:
 22	  clusterIP: None  # Keep Headless Service (identify each Pod by DNS)
 23	  ports:
 24	  - port: 28504
 25	    name: sentinel-port
 26	  selector:
 27	    app: sentinel

🟢 [Step 3-1] Redis Pod manifest: redis-statefulset.yaml

Manifest for Redis Pods (replicas, initContainers, memory, pvc(disk volume)).

Kind: StatefulSet
Name: metadata: name: redis
⚠️ Names are limited to lowercase (a-z), digits (0-9), and hyphens (`-`) (uppercase is not allowed)
This name is used to name Pods with a suffix: redis-0,1,2.
Pod name plus serviceName form an FQDN (Fully Qualified Domain Name) as follows.
redis-0.redis-service.default.svc.cluster.local
Each Redis has a unique FQDN for Redis-to-Redis, Sentinel-to-Redis, and Redis/Sentinel-to-App communication. When the IP changes, the new IP is bound to that FQDN.

🧑‍💻 Key values

configMap: name: redis-sentinel-config (linked to Step 1 Redis/Sentinel config)
serviceName: redis-service (linked to Step 2 Service)
replicas: 3 # Master: 1, Replica: 2 -> replicaof set dynamically
image: redis:8.8.2 # version 8.8.2 released Monday, August 17, 2026
imagePullPolicy: IfNotPresent # use the local image
command script: copy ConfigMap files from Step 1 and apply dynamic settings
volumeMounts: mountPath: /data: stores all files Redis uses/manages (redis.conf, users.acl, aof files, etc.).

💾 redis-statefulset.yaml ▼

📄 redis-statefulset.yaml

  1	apiVersion: apps/v1
  2	kind: StatefulSet
  3	metadata:
  4	  name: redis
  5	spec:
  6	  serviceName: "redis-service"
  7	  replicas: 3
  8	  selector:
  9	    matchLabels:
 10	      app: redis
 11	  template:
 12	    metadata:
 13	      labels:
 14	        app: redis
 15	    spec:
 16	#      affinity:
 17	        # 1. Why we do not set 'nodeAffinity': Redis files (redis.conf,
 18	        #   AOF files) are stored safely on separate storage, so it is fine
 19	        #   whichever node the Redis Pod runs on.
 20	        # 2. podAntiAffinity: spread Master/Replica across nodes
 21	        #   Prefer scheduling Pods with the same app=redis label on
 22	        #   different nodes (by kubernetes.io/hostname)
 23	#        podAntiAffinity:
 24	#          preferredDuringSchedulingIgnoredDuringExecution:
 25	#          - weight: 100
 26	#            podAffinityTerm:
 27	#              labelSelector:
 28	#                matchExpressions:
 29	#                - key: app
 30	#                  operator: In
 31	#                  values:
 32	#                  - redis
 33	#              topologyKey: "kubernetes.io/hostname"
 34	      initContainers:
 35	      - name: init-redis-config
 36	        image: redis:8.8.2
 37	        imagePullPolicy: IfNotPresent  # if the image exists locally, never pull from the Internet
 38	        command:
 39	        - /bin/sh
 40	        - -c
 41	        - |
 42	          # 1. Extract Pod index (redis-0 -> 0, redis-1 -> 1, redis-2 -> 2)
 43	          INDEX=$(echo $(hostname) | rev | cut -d'-' -f1 | rev)
 44	          
 45	          # 2. Check whether /data/redis.conf exists (initial setup only on first boot)
 46	          if [ ! -f /data/redis.conf ]; then
 47	            echo "First boot: Copying base redis.conf from ConfigMap..."
 48	            cp /readonly-config/redis.conf /data/redis.conf
 49	            
 50	            # If not redis-0, inject initial replica setting (replicaof)
 51	            if [ "$INDEX" -ne "0" ]; then
 52	              echo "replicaof redis-0.redis-service.default.svc.cluster.local 18504" >> /data/redis.conf
 53	            fi
 54	            echo "replica-announce-ip redis-$INDEX.redis-service.default.svc.cluster.local" >> /data/redis.conf
 55	            # Update replica-priority from index (always applied dynamically)
 56	            PRIORITY=$((100 + INDEX * 10))
 57	            sed -i '/replica-priority/d' /data/redis.conf
 58	            echo "replica-priority $PRIORITY" >> /data/redis.conf
 59	            chmod 600 /data/redis.conf 
 60	          else
 61	            echo "Pod restarted: Keeping existing /data/redis.conf (config preserved)."
 62	          fi
 63	
 64	          # 3. Check whether /data/users.acl exists (copy only on first boot)
 65	          if [ ! -f /data/users.acl ]; then
 66	            cp /readonly-config/users.acl /data/users.acl
 67	            chmod 600 /data/users.acl
 68	          fi
 69	        volumeMounts:
 70	        - name: config-volume
 71	          mountPath: /readonly-config
 72	        - name: redis-data
 73	          mountPath: /data
 74	        # 📍 Pod memory and CPU resources
 75	        resources:
 76	          requests:
 77	            memory: "800Mi"      # guaranteed minimum memory (node scheduling)
 78	            cpu: "500m"        # guaranteed minimum CPU (0.5 core)
 79	          limits:
 80	            memory: "1Gi"    # max memory (OOM if exceeded)
 81	            cpu: "1000m"       # max CPU (1 core)
 82	
 83	      containers:
 84	      - name: redis
 85	        image: redis:8.8.2
 86	        imagePullPolicy: IfNotPresent  # if the image exists locally, never pull from the Internet
 87	        # 🚩 Before starting Redis, copy /data/.bashrc to /root/ then start the Redis server
 88	        command:
 89	        - /bin/sh
 90	        - -c
 91	        - |
 92	          cat << 'EOF' >> /root/.bashrc
 93	          alias cls='clear'
 94	          alias ll='ls -l --color=auto'
 95	          alias ls='ls --color=auto'
 96	          EOF
 97	          exec redis-server /data/redis.conf
 98	        #command: ["redis-server", "/data/redis.conf"]
 99	        ports:
100	        - containerPort: 18504
101	          name: redis-port
102	        volumeMounts:
103	        - name: redis-data
104	          mountPath: /data
105	        # Mount Host OS timezone inside the container
106	        - name: tz-config
107	          mountPath: /etc/localtime
108	          readOnly: true
109	      volumes:
110	      - name: config-volume
111	        configMap:
112	          name: redis-sentinel-config
113	      # Reference Host OS /etc/localtime
114	      - name: tz-config
115	        hostPath:
116	          path: /etc/localtime
117	  volumeClaimTemplates:
118	  - metadata:
119	      name: redis-data
120	    spec:
121	      accessModes: [ "ReadWriteOnce" ]
122	      resources:
123	        requests:
124	          storage: 5Gi

🧑‍💻 initContainers: command: script

Extract the Pod index (redis-0 -> 0, redis-1 -> 1, redis-2 -> 2) and use it for per-Pod dynamic settings.
INDEX=$(echo $(hostname) | rev | cut -d'-' -f1 | rev)
Do not copy redis.conf if it already exists. (copy only on first boot)
Redis writes to redis.conf on important events, so on Pod restart you must not overwrite the generated file.
if [ ! -f /data/redis.conf ]; then echo "First boot: Copying base redis.conf from ConfigMap..." cp /readonly-config/redis.conf /data/redis.conf # If not redis-0, inject initial replica setting (replicaof) if [ "$INDEX" -ne "0" ]; then echo "replicaof redis-0.redis-service.default.svc.cluster.local 18504" >> /data/redis.conf fi echo "replica-announce-ip redis-$INDEX.redis-service.default.svc.cluster.local" >> /data/redis.conf # Update replica-priority from index PRIORITY=$((100 + INDEX * 10)) sed -i '/replica-priority/d' /data/redis.conf echo "replica-priority $PRIORITY" >> /data/redis.conf # 📍[Cloud Vulnerability Assessment Guide] recommended: rw------- chmod 600 /data/redis.conf else echo "Pod restarted: Keeping existing /data/redis.conf (config preserved)." fi

🧑‍💻 containers: command: script

Add a few convenient aliases to .bashrc
cat << 'EOF' >> /root/.bashrc alias cls='clear' alias ll='ls -l --color=auto' alias ls='ls --color=auto' EOF
With '--color=auto', filenames are colored as follows.
dir file: redis-sentinel-model
exec file: cluster_create.sh
tar file: file redis-8.8.2.tar
The redis.tar timestamps are UTC (UK). Switch to host OS time (Korea time in this lab).
# Mount Host OS timezone inside the container - name: tz-config mountPath: /etc/localtime readOnly: true # Reference Host OS /etc/localtime - name: tz-config hostPath: path: /etc/localtime

🟢 [Step 3-2] Sentinel Pod manifest: sentinel-statefulset.yaml

Manifest for Sentinel Pods (replicas, initContainers, memory, pvc(disk volume)).

Kind: StatefulSet
Name: metadata: name: sentinel
⚠️ Names are limited to lowercase (a-z), digits (0-9), and hyphens (`-`) (uppercase is not allowed)
This name is used to name Pods with a suffix: sentinel-0,1,2.
Pod name plus serviceName form an FQDN (Fully Qualified Domain Name) as follows.
sentinel-0.sentinel-service.default.svc.cluster.local
Each Sentinel has a unique FQDN for Sentinel-to-Sentinel or Sentinel-to-App communication.
When the IP changes, the new IP is bound to that FQDN.

💾 sentinel-statefulset.yaml ▼

📄 sentinel-statefulset.yaml

  1	apiVersion: apps/v1
  2	kind: StatefulSet
  3	metadata:
  4	  name: sentinel
  5	spec:
  6	  serviceName: "sentinel-service"
  7	  replicas: 3
  8	  selector:
  9	    matchLabels:
 10	      app: sentinel
 11	  template:
 12	    metadata:
 13	      labels:
 14	        app: sentinel
 15	    spec:
 16	#      affinity:
 17	        # 1. podAntiAffinity: spread across nodes
 18	        #   Prefer scheduling Pods with the same app=sentinel label on
 19	        #   different nodes (by kubernetes.io/hostname)
 20	#        podAntiAffinity:
 21	#          preferredDuringSchedulingIgnoredDuringExecution:
 22	#          - weight: 100
 23	#            podAffinityTerm:
 24	#              labelSelector:
 25	#                matchExpressions:
 26	#                - key: app
 27	#                  operator: In
 28	#                  values:
 29	#                  - sentinel
 30	#              topologyKey: "kubernetes.io/hostname"
 31	
 32	      initContainers:
 33	      - name: init-sentinel-config
 34	        image: redis:8.8.1
 35	        command:
 36	        - /bin/sh
 37	        - -c
 38	        - |
 39	          echo "Waiting for redis-0.redis-service DNS resolution..."
 40	          until getent hosts redis-0.redis-service.default.svc.cluster.local > /dev/null 2>&1; do
 41	            echo "DNS not ready yet, sleeping 1s..."
 42	            sleep 1
 43	          done
 44	          echo "DNS is ready!"
 45	
 46	          if [ ! -f /data/sentinel.conf ]; then
 47	            echo "First boot: Copying base sentinel.conf from ConfigMap..."
 48	            cp /readonly-config/sentinel.conf /data/sentinel.conf
 49	            # Inject this Pod's Headless DNS name as announce-ip
 50	            POD_DNS="$(hostname).sentinel-service"
 51	            echo "sentinel announce-ip $POD_DNS" >> /data/sentinel.conf
 52	            chmod 600 /data/sentinel.conf
 53	          else
 54	            echo "Pod restarted: Keeping existing /data/sentinel.conf (Sentinel dynamic state preserved)."
 55	          fi
 56	
 57	          # Aliases for a convenient CLI
 58	          cat << 'EOF' > /root/.bashrc
 59	          alias cls='clear'
 60	          alias ll='ls -l --color=auto'
 61	          alias ls='ls --color=auto'
 62	          EOF
 63	          
 64	        volumeMounts:
 65	        - name: config-volume
 66	          mountPath: /readonly-config
 67	        - name: sentinel-data
 68	          mountPath: /data
 69	        # 📍 Pod memory and CPU resources
 70	        resources:
 71	          requests:
 72	            memory: "100Mi"      # guaranteed minimum memory (node scheduling)
 73	            cpu: "500m"        # guaranteed minimum CPU (0.5 core)
 74	          limits:
 75	            memory: "1Gi"    # max memory (OOM if exceeded)
 76	            cpu: "1000m"       # max CPU (1 core)
 77	
 78	      containers:
 79	      - name: sentinel
 80	        image: redis:8.8.1
 81	        command: ["redis-sentinel", "/data/sentinel.conf"]
 82	        ports:
 83	        - containerPort: 28504
 84	          name: sentinel-port
 85	        volumeMounts:
 86	        - name: sentinel-data
 87	          mountPath: /data
 88	        # 📍 Mount Host OS timezone inside the container
 89	        - name: tz-config
 90	          mountPath: /etc/localtime
 91	          readOnly: true
 92	      volumes:
 93	      - name: config-volume
 94	        configMap:
 95	          name: redis-sentinel-config
 96	      # 📍 Reference Host OS /etc/localtime
 97	      - name: tz-config
 98	        hostPath:
 99	          path: /etc/localtime
100	  volumeClaimTemplates:
101	  - metadata:
102	      name: sentinel-data
103	    spec:
104	      accessModes: [ "ReadWriteOnce" ]
105	      resources:
106	        requests:
107	          storage: 1Gi # 1Gi for Sentinel logs/config

➡ Prep is done. Next we create the Pods.

<< K8s Redis-Cluster App ②	K8s Redis-Sentinel Setup ② >>

Email 답글이 올라오면 이메일로 알려드리겠습니다.