Redis-Sentinel Sidecar Pattern Hands-on Guide on Kubernetes ①

Sidecar pattern concept

This page covers a tightly coupled two-container (two-process) design in one Pod. For example, you may attach a log collector or security proxy (sidecar) next to a main web-server container (Nginx, Node.js). Use a sidecar when it is subordinate to the main container. If the main container goes down, a surviving sidecar is useless.

The idea is a bit different: Sentinel should run separately from Redis (it monitors Redis, so it must not die with Redis in the same Pod; dedicated Sentinel Pods are the right design). Still, if you must run Redis-Sentinel in only three Pods, you can try this pattern. Fortunately Sentinel uses only about 1–2% of one CPU core (under 5% at peak) and about 10MB of memory, so we will build it as a sidecar.

1. Redis-Sentinel sidecar YAML spec

When deploying the Redis-Sentinel sidecar pattern on Kubernetes, split Config, Service, and StatefulSet into three YAML files.

┌──────────────────────────────────────────────────────────┐ │ 1. redis-sentinel-sidecar-config.yaml (ConfigMap) │ │ : redis.conf, sentinel.conf, users.acl │ └──────────────────┬───────────────────────────────────────┘ │ [Step 1: provide config] ▼ ┌──────────────────────────────────────────────────────────┐ │ 2. redis-sentinel-sidecar-service.yaml (Service) │ │ : redis-sentinel-service, port, sentinel-port │ └──────────────────┬───────────────────────────────────────┘ │ [Step 2: prepare Service] ▼ ┌──────────────────────────────────────────────────────────┐ │ 3. redis-sentinel-sidecar-statefulset.yaml (StatefulSet) │ │ : Config, Service -> redis-sentinel-0~3 (3Pods) │ │ Persistent Volume Claim (PVC) │ └──────────────────────────────────────────────────────────┘ [Step 3: create Redis/Sentinel Pods]

2. File contents in apply order

🟢 [Step 1] Redis-Sentinel sidecar config: redis-sentinel-sidecar-config.yaml

kind: ConfigMap
metadata.name: redis-sentinel-sidecar-config
⚠️ Names may use only lowercase a-z, digits 0-9, and hyphen (`-`) (no uppercase)
This ConfigMap holds the directives used to create redis.conf and sentinel.conf.
The default redis.conf and sentinel.conf from the Redis tarball are not used.
If each Redis instance (Pod) needs different values, inject them dynamically with a command script in the StatefulSet. Example: replica-priority 100, 110, 120

🧑‍💻 Key fields

bind * -::* # Pod IPs are assigned dynamically and change, so bind all addresses.
KISA Cloud Vulnerability Assessment Guide requires setting a specific IP on bind for security. That is correct on VMs and bare metal, but you cannot pin bind to a fixed IP on Kubernetes.
(Explain this clearly to auditors on public-sector and financial projects.)
protected-mode no # Because bind is '*', setting protected-mode yes would block external clients.
It looks like a security exception, but Kubernetes already isolates the network, so this setting is fine.
daemonize no # Do not set this to yes.
requirepass password # 💥 Always set a password. If the host is on the internet, set a password even in development. Redis is not hacked by a person at a keyboard; 💻 programs scan 24 hours a day. Without a password, even a few minutes of a “dev” instance can be taken over.
See: 🔗 Redis Hacking
If you configure users.acl, requirepass is optional.
masterauth password # Always set this.
replica-priority 100 # 📍Redis-0 100, Redis-1 110, Redis-2 120
Injected dynamically from the StatefulSet initContainer command.
replica-announce-ip # 📍redis-0.redis-service...
Injected dynamically from the StatefulSet initContainer command.
echo "replica-announce-ip redis-$INDEX.redis-service.default.svc.cluster.local" >> /data/redis.conf
users.acl: lines 66–67. Set the 64-character password ('#0cbc...') separately.
See: 🔗 ACL

💾 View redis-sentinel-sidecar-config.yaml ▼

📄 redis-sentinel-sidecar-config.yaml

  1	apiVersion: v1
  2	kind: ConfigMap
  3	metadata:
  4	  name: redis-sentinel-sidecar-config
  5	data:
  6	  redis.conf: |
  7	    # Redis-8.8.2 configuration
  8	    # [NETWORK]
  9	    bind * -::*
 10	    protected-mode no
 11	    port 18504
 12	    tcp-keepalive 60
 13	    # [GENERAL]
 14	    daemonize no
 15	    pidfile /data/redis.pid
 16	    # notice / verbose / debug
 17	    loglevel notice
 18	    logfile /data/redis.log
 19	    always-show-logo yes
 20	    # locale-collate "ko_KR.UTF-8" -> Error: Failed to configure LOCALE for invalid locale name.
 21	    # [MEMORY MANAGEMENT]
 22	    maxmemory 700mb
 23	    # [SNAPSHOTTING]
 24	    dbfilename dump.rdb
 25	    rdb-del-sync-files yes
 26	    # [working directory]
 27	    dir /data
 28	    # [SECURITY]
 29	    requirepass redisgate
 30	    masterauth redisgate
 31	    enable-protected-configs yes
 32	    enable-debug-command yes
 33	    # 📍 file must be created  
 34	    aclfile /data/users.acl
 35	    # [REPLICATION]
 36	    # 📍Redis-0 100, Redis-1 110, Redis-2 120
 37	    replica-priority 100                
 38	    repl-backlog-size 128mb
 39	    repl-diskless-sync yes
 40	    repl-diskless-sync-delay 3
 41	    repl-diskless-sync-max-replicas 0
 42	    repl-diskless-load on-empty-db
 43	    # [CLIENTS]
 44	    maxclients 10000
 45	    client-output-buffer-limit normal 0 0 0
 46	    client-output-buffer-limit replica 1gb 1gb 120
 47	    client-output-buffer-limit pubsub 128mb 64mb 60
 48	    # [APPEND ONLY MODE]
 49	    save ""
 50	    appendonly yes
 51	    appendfilename "aof"
 52	    appenddirname "aof"	
 53	    appendfsync everysec
 54	    no-appendfsync-on-rewrite yes
 55	    auto-aof-rewrite-percentage 200
 56	    auto-aof-rewrite-min-size 1gb
 57	    aof-use-rdb-preamble yes
 58	    aof-timestamp-enabled yes
 59	    # [SLOW LOG]
 60	    slowlog-log-slower-than 10000
 61	    slowlog-max-len 1024
 62	    # [LATENCY MONITOR]
 63	    # 10ms, 0 disable
 64	    latency-monitor-threshold 10		
 65	
 66	  users.acl: |
 67	    user default on sanitize-payload #0cbc79ebbac0552443521615124610ef12649d44d4550f16fc9edf5594624305 ~* &* +@all
 68	
 69	  sentinel.conf: |
 70	    bind * -::*
 71	    protected-mode no
 72	    port 28504
 73	    daemonize no
 74	    dir /data
 75	    loglevel notice
 76	    logfile /data/sentinel.log
 77	    pidfile /data/sentinel.pid
 78	    requirepass redisgate
 79	    #aclfile /data/sentinel-users.acl
 80	    sentinel auth-user mymaster default
 81	    sentinel auth-pass mymaster redisgate
 82	    sentinel sentinel-user default
 83	    sentinel sentinel-pass redisgate
 84	    sentinel resolve-hostnames yes
 85	    sentinel announce-hostnames yes
 86	    sentinel monitor mymaster redis-sentinel-0.redis-sentinel-service.default.svc.cluster.local 18504 2
 87	    sentinel down-after-milliseconds mymaster 3000
 88	    sentinel failover-timeout mymaster 60000
 89	    sentinel parallel-syncs mymaster 1

These values are the redis.conf settings redisGate has applied at 90%+ of 100+ production sites. (Tune maxmemory to your data size)

💻 On bare metal or VMs, change the following.

bind 114.x.y.z 127.0.0.1 -::1 -> bind a specific IP
protected-mode yes
port -> default 💥6379 is a prime hacking target. Use another port.
daemonize yes
dir /app/redis -> put pidfile, logfile, etc. in this dir
aclfile /app/redis/users.acl -> per-user ACLs: recommended
#maxmemory <bytes> -> leave commented (default)
① Dedicated Redis server: set 50%–90% of system RAM
② Plenty of RAM: if the host has 16GB and Redis uses 1–2GB, you can skip maxmemory
③ 💥 If Redis consumes all RAM, Linux will kill the Redis process.
# replica-announce-ip -> leave commented (default)

🟢 [Step 2] Service: redis-sentinel-sidecar-service.yaml

kind: Service
metadata.name: redis-sentinel-service
⚠️ Names may use only lowercase a-z, digits 0-9, and hyphen (`-`) (no uppercase)
This is the Service YAML. Even when Pod IPs change, a stable FQDN (Fully Qualified Domain Name) lets clients reach each Redis like a network directory.

🧑‍💻 Key fields

clusterIP: None # 📍 set to None (per-Pod DNS identity)
port: 18504 # Redis port
port: 28504 # Sentinel port

💾 View redis-sentinel-sidecar-service.yaml ▼

📄 redis-sentinel-sidecar-service.yaml

  1	apiVersion: v1
  2	kind: Service
  3	metadata:
  4	  name: redis-sentinel-service
  5	  labels:
  6	    app: redis-sentinel
  7	spec:
  8	  clusterIP: None
  9	  ports:
 10	  - port: 18504
 11	    name: redis-port
 12	  - port: 28504
 13	    name: sentinel-port
 14	  selector:
 15	    app: redis-sentinel

🟢 [Step 3] Redis/Sentinel Pod spec: redis-sentinel-sidecar-statefulset.yaml

StatefulSet spec for Redis Pods (replicas, initContainers, memory, PVC).

kind: StatefulSet
metadata.name: redis-sentinel
⚠️ Names may use only lowercase a-z, digits 0-9, and hyphen (`-`) (no uppercase)
Kubernetes names Pods redis-sentinel-0,1,2 from this name.
Pod name + serviceName form the FQDN:
redis-sentinel-0.redis-sentinel-service.default.svc.cluster.local
Each Redis gets a unique FQDN for Redis-to-Redis, Sentinel-to-Redis, and app traffic. When the IP changes, DNS maps the same FQDN to the new IP.

🧑‍💻 Key fields

configMap: name: redis-sentinel-sidecar-config (links to Step 1 Redis/Sentinel config)
serviceName: redis-sentinel-service (links to Step 2 Service)
replicas: 3
- Pod ① Redis-0 (Master) / Sentinel-0
- Pod ② Redis-1 (Replica-1) / Sentinel-1
- Pod ③ Redis-2 (Replica-2) / Sentinel-2
image: redis:8.8.2 # Redis 8.8.2, released 2026-08-17 (Mon)
imagePullPolicy: IfNotPresent # use local image
command script: copy ConfigMap files and inject dynamic settings
volumeMounts mountPath /data: all Redis files (redis.conf, users.acl, AOF, etc.).

💾 redis-sentinel-sidecar-statefulset.yaml ▼

📄 redis-sentinel-sidecar-statefulset.yaml

  1	apiVersion: apps/v1
  2	kind: StatefulSet
  3	metadata:
  4	  name: redis-sentinel
  5	spec:
  6	  serviceName: "redis-sentinel-service"
  7	  replicas: 3
  8	  selector:
  9	    matchLabels:
 10	      app: redis-sentinel
 11	  template:
 12	    metadata:
 13	      labels:
 14	        app: redis-sentinel
 15	    spec:
 16	      affinity:
 17	        # 1. Why no nodeAffinity: Redis files (redis.conf,
 18	        #   nodes.conf, AOF) live on separate storage, so the Pod can
 19	        #   run on any node.
 20	        # 2. podAntiAffinity: spread Master/Replica
 21	        #   Prefer different nodes for Pods with app=redis-sentinel
 22	        #   (topologyKey kubernetes.io/hostname)
 23	        podAntiAffinity:
 24	          preferredDuringSchedulingIgnoredDuringExecution:
 25	          - weight: 100
 26	            podAffinityTerm:
 27	              labelSelector:
 28	                matchExpressions:
 29	                - key: app
 30	                  operator: In
 31	                  values:
 32	                  - redis-sentinel
 33	              topologyKey: "kubernetes.io/hostname"
 34	      initContainers:
 35	      - name: init-config
 36	        image: redis:8.8.2
 37	        imagePullPolicy: IfNotPresent
 38	        command:
 39	        - /bin/sh
 40	        - -c
 41	        - |
 42	          # 1. Extract Pod index (redis-sentinel-0 -> 0, redis-sentinel-1 -> 1, redis-sentinel-2 -> 2)
 43	          INDEX=$(echo $(hostname) | rev | cut -d'-' -f1 | rev)
 44	
 45	          # 2. If /data/redis.conf is missing (first boot only): copy and inject
 46	          if [ ! -f /data/redis.conf ]; then
 47	            echo "First boot: Copying base redis.conf from ConfigMap..."
 48	            cp /readonly-config/redis.conf /data/redis.conf
 49	
 50	            # If not redis-0, inject initial replicaof
 51	            if [ "$INDEX" -ne "0" ]; then
 52	              echo "replicaof redis-sentinel-0.redis-sentinel-service.default.svc.cluster.local 18504" >> /data/redis.conf
 53	            fi
 54	            echo "replica-announce-ip redis-sentinel-$INDEX.redis-sentinel-service.default.svc.cluster.local" >> /data/redis.conf
 55	            # Update replica-priority from index 
 56	            # redis-0 replica-priority 100, redis-1 110, redis-2 120
 57	            PRIORITY=$((100 + INDEX * 10))
 58	            sed -i '/replica-priority/d' /data/redis.conf
 59	            echo "replica-priority $PRIORITY" >> /data/redis.conf
 60	            # Cloud vulnerability guide recommended mode: rw-------
 61	            chmod 600 /data/redis.conf 
 62	          else
 63	            echo "Pod restarted: Keeping existing /data/redis.conf (Sentinel config preserved)."
 64	          fi
 65	
 66	          # 3. If /data/users.acl is missing (first boot only): copy 
 67	          if [ ! -f /data/users.acl ]; then
 68	            cp /readonly-config/users.acl /data/users.acl
 69	            chmod 600 /data/users.acl
 70	          fi
 71	
 72	          # 4. If /data/sentinel.conf is missing (first boot only): copy 
 73	          if [ ! -f /data/sentinel.conf ]; then
 74	            cp /readonly-config/sentinel.conf /data/sentinel.conf
 75	            # Sentinel announce using this Pod's headless DNS
 76	            POD_DNS="$(hostname).redis-sentinel-service.default.svc.cluster.local"
 77	            echo "sentinel announce-ip $POD_DNS" >> /data/sentinel.conf
 78	            echo "sentinel announce-port 28504" >> /data/sentinel.conf
 79	            chmod 600 /data/sentinel.conf
 80	          fi
 81	        volumeMounts:
 82	        - name: config-volume
 83	          mountPath: /readonly-config
 84	        - name: redis-data
 85	          mountPath: /data
 86	        # Pod memory and CPU
 87	        resources:
 88	          requests:
 89	            memory: "800Mi"      # guaranteed memory (scheduling)
 90	            cpu: "500m"        # guaranteed CPU (0.5 core)
 91	          limits:
 92	            memory: "1Gi"    # memory limit (OOM if exceeded)
 93	            cpu: "1000m"       # CPU limit (1 core)
 94	
 95	      containers:
 96	      # [Container A: main Redis]
 97	      - name: redis
 98	        image: redis:8.8.2
 99	        imagePullPolicy: IfNotPresent
100	        command:
101	        - /bin/sh
102	        - -c
103	        - |
104	          cat << 'EOF' >> /root/.bashrc
105	          alias cls='clear'
106	          alias ll='ls -l --color=auto'
107	          alias ls='ls --color=auto'
108	          EOF
109	          exec redis-server /data/redis.conf
110	        ports:
111	        - containerPort: 18504
112	          name: redis-port
113	        volumeMounts:
114	        - name: redis-data
115	          mountPath: /data
116	        - name: tz-config
117	          mountPath: /etc/localtime
118	          readOnly: true
119	
120	      # [Container B: Sentinel sidecar]
121	      - name: sentinel
122	        image: redis:8.8.2
123	        imagePullPolicy: IfNotPresent
124	        command:
125	        - /bin/sh
126	        - -c
127	        - |
128	          cat << 'EOF' >> /root/.bashrc
129	          alias cls='clear'
130	          alias ll='ls -l --color=auto'
131	          alias ls='ls --color=auto'
132	          EOF
133	          
134	          # Wait until local Redis is up
135	          until redis-cli -p 18504 -a redisgate ping > /dev/null 2>&1; do
136	            echo "Waiting for local redis-server..."
137	            sleep 1
138	          done
139	          
140	          exec redis-sentinel /data/sentinel.conf
141	        ports:
142	        - containerPort: 28504
143	          name: sentinel-port
144	        volumeMounts:
145	        - name: redis-data
146	          mountPath: /data
147	        - name: tz-config
148	          mountPath: /etc/localtime
149	          readOnly: true
150	
151	      volumes:
152	      - name: config-volume
153	        configMap:
154	          name: redis-sentinel-sidecar-config
155	      - name: tz-config
156	        hostPath:
157	          path: /etc/localtime
158	
159	  volumeClaimTemplates:
160	  - metadata:
161	      name: redis-data
162	    spec:
163	      accessModes: [ "ReadWriteOnce" ]
164	      resources:
165	        requests:
166	          storage: 5Gi

🧑‍💻 initContainers command script

Extract the Pod index (redis-sentinel-0 -> 0, redis-sentinel-1 -> 1, redis-sentinel-2 -> 2) and use it for per-Pod dynamic config.

📄 initContainers: command

INDEX=$(echo $(hostname) | rev | cut -d'-' -f1 | rev)
Do not overwrite redis.conf if it already exists (copy and inject only on first boot).
Redis writes redis.conf on important events, so do not copy a fresh file over it on restart.

📄 initContainers: command: redis.conf

if [ ! -f /data/redis.conf ]; then echo "First boot: Copying base redis.conf from ConfigMap..." cp /readonly-config/redis.conf /data/redis.conf # If not redis-0, inject initial replicaof if [ "$INDEX" -ne "0" ]; then echo "replicaof redis-sentinel-0.redis-sentinel-service.default.svc.cluster.local 18504" >> /data/redis.conf fi echo "replica-announce-ip redis-sentinel-$INDEX.redis-sentinel-service.default.svc.cluster.local" >> /data/redis.conf # Update replica-priority from index # redis-0 replica-priority 100, redis-1 110, redis-2 120 PRIORITY=$((100 + INDEX * 10)) sed -i '/replica-priority/d' /data/redis.conf echo "replica-priority $PRIORITY" >> /data/redis.conf # Cloud vulnerability guide recommended mode: rw------- chmod 600 /data/redis.conf fi
Do not overwrite users.acl if it already exists (copy only on first boot).

📄 initContainers: command: users.acl

if [ ! -f /data/users.acl ]; then cp /readonly-config/users.acl /data/users.acl chmod 600 /data/users.acl fi
Do not overwrite sentinel.conf if it already exists (copy and inject only on first boot).

📄 initContainers: command: sentinel.conf

if [ ! -f /data/sentinel.conf ]; then cp /readonly-config/sentinel.conf /data/sentinel.conf # Sentinel announce using this Pod's headless DNS POD_DNS="$(hostname).redis-sentinel-service.default.svc.cluster.local" echo "sentinel announce-ip $POD_DNS" >> /data/sentinel.conf echo "sentinel announce-port 28504" >> /data/sentinel.conf chmod 600 /data/sentinel.conf fi

🧑‍💻 containers command script

Add convenient aliases to .bashrc

📄 containers: command: .bashrc

cat << 'EOF' >> /root/.bashrc alias cls='clear' alias ll='ls -l --color=auto' alias ls='ls --color=auto' EOF
With '--color=auto', filenames are colored as follows:
dir file: redis-sentinel-model
exec file: cluster_create.sh
tar file: file redis-8.8.2.tar
Default time is UTC. Switch to host OS time (Korea).

📄 containers command: use host OS time

# Mount host OS timezone into the container - name: tz-config mountPath: /etc/localtime readOnly: true # Refer to host OS /etc/localtime - name: tz-config hostPath: path: /etc/localtime

➡ YAML is ready. Next we create the Pods.

<< K8s Redis-Sentinel App ②	K8s Sidecar Pattern Setup ② >>

Email 답글이 올라오면 이메일로 알려드리겠습니다.