Redis-Standalone Hands-on Guide on Kubernetes ①

YAML spec overview

Redis-Standalone overview

Redis-Standalone runs a single Redis master in one Pod.

1. Redis-Standalone YAML spec

When deploying Redis-Standalone on Kubernetes, split Config, Service, and StatefulSet into three YAML files.

┌─────────────────────────────────────────────────────┐ │ 1. redis-config.yaml (ConfigMap) │ │ : redis.conf, users.acl │ └──────────────────┬──────────────────────────────────┘ │ [Step 1: provide Config] ▼ ┌─────────────────────────────────────────────────────┐ │ 2. redis-service.yaml (Headless Service) │ │ : redis-service, clusterIP: None, port │ └──────────────────┬──────────────────────────────────┘ │ [Step 2: prepare Service] ▼ ┌─────────────────────────────────────────────────────┐ │ 3. redis-statefulset.yaml (StatefulSet) │ │ : Config, Service -> redis-0 (1Pod) │ │ Persistent Volume Claim (PVC) │ └─────────────────────────────────────────────────────┘ [Step 3: create Redis Pod]

2. File contents in apply order

🟢 [Step 1] Redis config: redis-config.yaml

kind: ConfigMap
metadata.name: redis-config
⚠️ Names may use only lowercase a-z, digits 0-9, and hyphen (`-`) (no uppercase)
This ConfigMap holds the directives used to create redis.conf.
The default redis.conf from the Redis tarball is not used.

🧑‍💻 Key fields

bind * -::* # Pod IPs are assigned dynamically and change, so bind all addresses.
KISA Cloud Vulnerability Assessment Guide requires setting a specific IP on bind for security. That is correct on VMs and bare metal, but you cannot pin bind to a fixed IP on Kubernetes.
(Explain this clearly to auditors on public-sector and financial projects.)
protected-mode no # Because bind is '*', setting protected-mode yes would block external clients.
It looks like a security exception, but Kubernetes already isolates the network, so this setting is fine.
daemonize no # Do not set this to yes.
requirepass password # 💥 Always set a password. If the host is on the internet, set a password even in development. Redis is not hacked by a person at a keyboard; 💻 programs scan 24 hours a day. Without a password, even a few minutes of a “dev” instance can be taken over.
See: 🔗 Redis Hacking
If you configure users.acl, requirepass is optional.
masterauth password # Always set this.
users.acl: lines 65–66. Set the 64-character password ('#0cbc...') separately.
See: 🔗 ACL

💾 View redis-config.yaml ▼

📄 redis-config.yaml

  1	apiVersion: v1
  2	kind: ConfigMap
  3	metadata:
  4	  name: redis-config
  5	data:
  6	  redis.conf: |
  7	    # Redis-8.8.2 configuration
  8	    # [NETWORK]
  9	    bind * -::*
 10	    protected-mode no
 11	    port 18504
 12	    tcp-keepalive 60
 13	    # [GENERAL]
 14	    daemonize no
 15	    pidfile /data/redis.pid
 16	    # notice / verbose / debug
 17	    loglevel notice
 18	    logfile /data/redis.log
 19	    always-show-logo yes
 20	    # locale-collate "ko_KR.UTF-8" -> Error: Failed to configure LOCALE for invalid locale name.
 21	    # [MEMORY MANAGEMENT]
 22	    maxmemory 700m 
 23	    # [SNAPSHOTTING]
 24	    dbfilename dump.rdb
 25	    rdb-del-sync-files yes
 26	    # [working directory]
 27	    dir /data
 28	    # [SECURITY]
 29	    requirepass redisgate
 30	    masterauth redisgate
 31	    enable-protected-configs yes
 32	    enable-debug-command yes
 33	    # 📍 file must be created  
 34	    aclfile /data/users.acl
 35	    # [REPLICATION]
 36	    replica-priority 100                
 37	    repl-backlog-size 128mb
 38	    repl-diskless-sync yes
 39	    repl-diskless-sync-delay 3
 40	    repl-diskless-sync-max-replicas 0
 41	    repl-diskless-load on-empty-db
 42	    # [CLIENTS]
 43	    maxclients 10000
 44	    client-output-buffer-limit normal 0 0 0
 45	    client-output-buffer-limit replica 1gb 1gb 120
 46	    client-output-buffer-limit pubsub 128mb 64mb 60
 47	    # [APPEND ONLY MODE]
 48	    save ""
 49	    appendonly yes
 50	    appendfilename "aof"
 51	    appenddirname "aof"	
 52	    appendfsync everysec
 53	    no-appendfsync-on-rewrite yes
 54	    auto-aof-rewrite-percentage 200
 55	    auto-aof-rewrite-min-size 1gb
 56	    aof-use-rdb-preamble yes
 57	    aof-timestamp-enabled yes
 58	    # [SLOW LOG]
 59	    slowlog-log-slower-than 10000
 60	    slowlog-max-len 1024
 61	    # [LATENCY MONITOR]
 62	    # 10ms, 0 disable
 63	    latency-monitor-threshold 10		
 64	
 65	  users.acl: |
 66	    user default on sanitize-payload #0cbc79ebbac0552443521615124610ef12649d44d4550f16fc9edf5594624305 ~* &* +@all

These values are the redis.conf settings redisGate has applied at 90%+ of 100+ production sites. (Tune maxmemory to your data size)

💻 On bare metal or VMs, change the following.

bind 114.x.y.z 127.0.0.1 -::1 -> bind a specific IP
protected-mode yes
port -> default 💥6379 is a prime hacking target. Use another port.
daemonize yes
dir /app/redis -> put pidfile, logfile, etc. in this dir
aclfile /app/redis/users.acl -> per-user ACLs: recommended
#maxmemory <bytes> -> leave commented (default)
① Dedicated Redis server: set 50%–90% of system RAM
② Plenty of RAM: if the host has 16GB and Redis uses 1–2GB, you can skip maxmemory
③ 💥 If Redis consumes all RAM, Linux will kill the Redis process.

🟢 [Step 2] Service: redis-service.yaml

kind: Service
metadata.name: redis-service
⚠️ Names may use only lowercase a-z, digits 0-9, and hyphen (`-`) (no uppercase)
This is the Service YAML. Even when Pod IPs change, a stable FQDN (Fully Qualified Domain Name) lets clients reach each Redis like a network directory.

🧑‍💻 Key fields

clusterIP: None # 📍 set to None (per-Pod DNS identity)
port: 18504 # Redis port

💾 View redis-service.yaml ▼

📄 redis-service.yaml

  1	apiVersion: v1
  2	kind: Service
  3	metadata:
  4	  name: redis-service
  5	  labels:
  6	    app: redis
  7	spec:
  8	  clusterIP: None  # Headless Service (per-Pod DNS identity)
  9	  ports:
 10	  - port: 18504
 11	    name: redis-port
 12	  selector:
 13	    app: redis

🟢 [Step 3] Redis Pod spec: redis-statefulset.yaml

StatefulSet spec for Redis Pods (replicas, initContainers, memory, PVC).

kind: StatefulSet
metadata.name: redis
⚠️ Names may use only lowercase a-z, digits 0-9, and hyphen (`-`) (no uppercase)
Kubernetes names Pods redis-0,1,2 from this name.
Pod name + serviceName form the FQDN:
redis-0.redis-service.default.svc.cluster.local
Each Redis gets a unique FQDN for Redis-to-Redis and Redis-to-app traffic.
When the IP changes, DNS maps the same FQDN to the new IP.

🧑‍💻 Key fields

configMap: name: redis-config (links to Step 1 Redis config)
serviceName: redis-service (links to Step 2 Service)
replicas: 1 # one Redis Pod
image: redis:8.8.2 # Redis 8.8.2, released 2026-08-17 (Mon)
imagePullPolicy: IfNotPresent # use local image
command script: copy ConfigMap files and inject dynamic settings
volumeMounts mountPath /data: all Redis files (redis.conf, users.acl, AOF, etc.).

💾 View redis-statefulset.yaml ▼

📄 redis-statefulset.yaml

  1	apiVersion: apps/v1
  2	kind: StatefulSet
  3	metadata:
  4	  name: redis
  5	spec:
  6	  serviceName: "redis-service"
  7	  replicas: 1
  8	  selector:
  9	    matchLabels:
 10	      app: redis
 11	  template:
 12	    metadata:
 13	      labels:
 14	        app: redis
 15	    spec:
 16	#      affinity:
 17	      initContainers:
 18	      - name: init-redis-config
 19	        image: redis:8.8.2
 20	        imagePullPolicy: IfNotPresent  # never pull from the internet if the image is local
 21	        command:
 22	        - /bin/sh
 23	        - -c
 24	        - |
 25	          # 1. If /data/redis.conf is missing (first boot only)
 26	          if [ ! -f /data/redis.conf ]; then
 27	            echo "First boot: Copying base redis.conf from ConfigMap..."
 28	            cp /readonly-config/redis.conf /data/redis.conf
 29	            chmod 600 /data/redis.conf 
 30	          else
 31	            echo "Pod restarted: Keeping existing /data/redis.conf (config preserved)."
 32	          fi
 33	          # 2. If /data/users.acl is missing (first boot only) 
 34	          if [ ! -f /data/users.acl ]; then
 35	            cp /readonly-config/users.acl /data/users.acl
 36	            chmod 600 /data/users.acl
 37	          fi
 38	        volumeMounts:
 39	        - name: config-volume
 40	          mountPath: /readonly-config
 41	        - name: redis-data
 42	          mountPath: /data
 43	        # 📍 Pod memory and CPU
 44	        resources:
 45	          requests:
 46	            memory: "800Mi"      # guaranteed memory (scheduling)
 47	            cpu: "500m"        # guaranteed CPU (0.5 core)
 48	          limits:
 49	            memory: "1Gi"    # memory limit (OOM if exceeded)
 50	            cpu: "1000m"       # CPU limit (1 core)
 51	
 52	      containers:
 53	      - name: redis
 54	        image: redis:8.8.2
 55	        imagePullPolicy: IfNotPresent  # never pull from the internet if the image is local
 56	        # 🚩 append aliases, then exec redis-server
 57	        command:
 58	        - /bin/sh
 59	        - -c
 60	        - |
 61	          cat << 'EOF' >> /root/.bashrc
 62	          alias cls='clear'
 63	          alias ll='ls -l --color=auto'
 64	          alias ls='ls --color=auto'
 65	          EOF
 66	          exec redis-server /data/redis.conf
 67	        #command: ["redis-server", "/data/redis.conf"]
 68	        ports:
 69	        - containerPort: 18504
 70	          name: redis-port
 71	        volumeMounts:
 72	        - name: redis-data
 73	          mountPath: /data
 74	        # Mount host OS timezone into the container
 75	        - name: tz-config
 76	          mountPath: /etc/localtime
 77	          readOnly: true
 78	      volumes:
 79	      - name: config-volume
 80	        configMap:
 81	          name: redis-sentinel-config
 82	      # Refer to host OS /etc/localtime
 83	      - name: tz-config
 84	        hostPath:
 85	          path: /etc/localtime
 86	  volumeClaimTemplates:
 87	  - metadata:
 88	      name: redis-data
 89	    spec:
 90	      accessModes: [ "ReadWriteOnce" ]
 91	      resources:
 92	        requests:
 93	          storage: 5Gi

🧑‍💻 initContainers command script

① Copy read-only redis.conf from ConfigMap to writable /data

Redis may rewrite the conf via CONFIG REWRITE and also writes it on important events. So redis.conf must live on a read-write directory.
cp /readonly-config/redis.conf /data/redis.conf chmod 600 /data/redis.conf
② Copy users.acl

cp /readonly-config/users.acl /data/users.acl chmod 600 /data/users.acl

🧑‍💻 containers command script

③ Add convenient aliases to .bashrc

cat << 'EOF' >> /root/.bashrc alias cls='clear' alias ll='ls -l --color=auto' alias ls='ls --color=auto' EOF
With '--color=auto', filenames are colored as follows:
dir file: redis-sentinel-model
exec file: cluster_create.sh
tar file: file redis-8.8.2.tar
④ The Redis image defaults to UTC. Switch to host OS time (Korea).

# Mount host OS timezone into the container - name: tz-config mountPath: /etc/localtime readOnly: true # Refer to host OS /etc/localtime - name: tz-config hostPath: path: /etc/localtime

➡ YAML is ready. Next we create the Pods.

<< K8s Sidecar Pattern Test ③	K8s Redis-Standalone ② >>

Email 답글이 올라오면 이메일로 알려드리겠습니다.