With the addition of ACLs in Redis 6, a Redis admin can create different users with different "permissions." One of the neat enhancements that comes with this is the ability to have a dedicated user for replication. Before ACLs, you could use only the masterauth config option on a replica, which permitted you to specify the password to use for replication. Now with ACLs comes a new config option masteruser, so that you can specify both a username and a password (using both options together) for the replica to use when connecting to the master. This is awesome!
However, no such enhancement was made to Sentinel. I hoped I could just specify both with the auth-pass option, but this did not work:
sentinel auth-pass my_master sentinel_user super_secret_sentinel_password
I believe Sentinel should be enhanced similarly to replication, perhaps with a new auth-user option (below example) or just permitting providing both the user and the password in auth-pass (as above):
sentinel auth-user my_master sentinel_user
sentinel auth-pass my_master super_secret_sentinel_password
Without this feature, systems using ACLs are forced to have a "default" user, which may not be ideal for security purposes.
Comment From: jrm780
Hi @nickwilliams-eventbrite!
This functionality appears to have been added in https://github.com/redis/redis/commit/9321c7871f41364fbe539d6b7711f5ccc7c90bdc.
It may not yet be in the Sentinel documentation, but I do see it described in the default sentinel.conf comments. It also lists the sentinel user's required ACLs:
+client +subscribe +publish +ping +info +multi +slaveof +config +client +exec
which may address https://github.com/redis/redis/issues/6985.
I've verified it to be working with
$ redis-cli -p 26379 INFO | head -6
# Server
redis_version:6.0.6
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:c0f165c655c7ebbc
redis_mode:sentinel
$ redis-cli -p 26379 sentinel set mymaster auth-user sentinel-user
OK
and setting it in sentinel.conf
sentinel auth-user mymaster sentinel-user
Comment From: oranagra
@nickwilliams-eventbrite @jrm780 is there anything else needed here or can we close this one? if you feel that documentation is missing, please state where or better yet, make a PR.
Comment From: oranagra
this was resolved by: 9321c7871f41364fbe539d6b7711f5ccc7c90bdc and FYI some other improvements in this area (for redis 6.2): https://github.com/redis/redis/pull/7888 https://github.com/redis/redis/pull/7952