Configure Multiple Sentinels, Monitored Primary, Replicas, Authentication, and Networking

Learning outcomes

By the end of this lesson, you should be able to:

1. Practical problem: a correct failover algorithm still fails with wrong addresses or credentials

Sentinel can agree perfectly that a master is down and still fail operationally if it cannot authenticate to replicas, if replicas advertise unroutable addresses, or if the application receives a primary address it cannot reach. Chapter 20 therefore treats authentication and networking as part of the failover mechanism—not deployment decoration.

2. Authentication has three independent relationships

The lab uses separate principals because “one password everywhere” hides real permission boundaries. replica-user authenticates replication PSYNC/REPLCONF/PING; sentinel-user lets Sentinels inspect and reconfigure Redis data nodes and limits Pub/Sub to reserved __sentinel__:hello; atlasmart-app reads/writes AtlasMart keys. Sentinel instances themselves additionally expose sentinel-admin and restricted sentinel-client users.

3. Create the lab files

Create a disposable directory named redis-ch20-lab with a conf subdirectory. The whole disposable conf directory is bind-mounted read/write. Sentinel must rewrite its own configuration, and Redis data-node configuration is also writable so Sentinel-issued role changes can be persisted with CONFIG REWRITE. Each process has a distinct config filename; the shared ACL file is still a lab-only artifact and should not be edited during the exercise.

services:  primary:    image: redis:8.10.1    container_name: atlasmart-redis-ch20-primary    hostname: atlasmart-redis-ch20-primary    command: ["redis-server", "/usr/local/etc/redis/primary.conf"]    ports: ["127.0.0.1:6411:6379"]    volumes:      - ./conf:/usr/local/etc/redis      - ch20-primary-data:/data    networks: [ch20net]  replica-a:    image: redis:8.10.1    container_name: atlasmart-redis-ch20-replica-a    hostname: atlasmart-redis-ch20-replica-a    command: ["redis-server", "/usr/local/etc/redis/replica-a.conf"]    ports: ["127.0.0.1:6412:6379"]    volumes:      - ./conf:/usr/local/etc/redis      - ch20-replica-a-data:/data    networks: [ch20net]  replica-b:    image: redis:8.10.1    container_name: atlasmart-redis-ch20-replica-b    hostname: atlasmart-redis-ch20-replica-b    command: ["redis-server", "/usr/local/etc/redis/replica-b.conf"]    ports: ["127.0.0.1:6413:6379"]    volumes:      - ./conf:/usr/local/etc/redis      - ch20-replica-b-data:/data    networks: [ch20net]  sentinel-1:    image: redis:8.10.1    container_name: atlasmart-redis-ch20-sentinel-1    hostname: atlasmart-redis-ch20-sentinel-1    command: ["redis-server", "/data/conf/sentinel-1.conf", "--sentinel"]    ports: ["127.0.0.1:26401:26379"]    volumes: ["./conf:/data/conf"]    networks: [ch20net]  sentinel-2:    image: redis:8.10.1    container_name: atlasmart-redis-ch20-sentinel-2    hostname: atlasmart-redis-ch20-sentinel-2    command: ["redis-server", "/data/conf/sentinel-2.conf", "--sentinel"]    ports: ["127.0.0.1:26402:26379"]    volumes: ["./conf:/data/conf"]    networks: [ch20net]  sentinel-3:    image: redis:8.10.1    container_name: atlasmart-redis-ch20-sentinel-3    hostname: atlasmart-redis-ch20-sentinel-3    command: ["redis-server", "/data/conf/sentinel-3.conf", "--sentinel"]    ports: ["127.0.0.1:26403:26379"]    volumes: ["./conf:/data/conf"]    networks: [ch20net]networks:  ch20net:    name: atlasmart-redis-ch20-netvolumes:  ch20-primary-data:  ch20-replica-a-data:  ch20-replica-b-data:

user default offuser academy-admin on >AtlasMart-Ch20-Admin-Lab-Only-2026 ~* &* +@alluser replica-user on >AtlasMart-Ch20-Replica-Lab-Only-2026 +psync +replconf +pinguser sentinel-user on >AtlasMart-Ch20-SentinelSvc-Lab-Only-2026 resetchannels &__sentinel__:hello +multi +slaveof +ping +exec +subscribe +config|rewrite +role +publish +info +client|setname +client|kill +script|killuser atlasmart-app on >AtlasMart-Ch20-App-Lab-Only-2026 ~atlasmart:ch20:* resetchannels +@read +@write +@connection -@dangerous

bind 0.0.0.0protected-mode yesport 6379dir /dataappendonly yesappendfsync everysecaclfile /usr/local/etc/redis/users.aclmasteruser replica-usermasterauth AtlasMart-Ch20-Replica-Lab-Only-2026replica-priority 100loglevel notice

bind 0.0.0.0protected-mode yesport 6379dir /dataappendonly yesappendfsync everysecaclfile /usr/local/etc/redis/users.aclmasteruser replica-usermasterauth AtlasMart-Ch20-Replica-Lab-Only-2026replicaof atlasmart-redis-ch20-primary 6379replica-announce-ip REPLICA_HOSTNAMEreplica-announce-port 6379replica-priority REPLICA_PRIORITYloglevel notice

port 26379dir /dataprotected-mode yesresolve-hostnames yesannounce-hostnames yessentinel monitor atlasmart-primary atlasmart-redis-ch20-primary 6379 2sentinel down-after-milliseconds atlasmart-primary 3000sentinel failover-timeout atlasmart-primary 15000sentinel parallel-syncs atlasmart-primary 1sentinel auth-user atlasmart-primary sentinel-usersentinel auth-pass atlasmart-primary AtlasMart-Ch20-SentinelSvc-Lab-Only-2026sentinel announce-ip SENTINEL_HOSTNAMEsentinel announce-port 26379user default offuser sentinel-admin on >AtlasMart-Ch20-SentinelAdmin-Lab-Only-2026 allchannels +@alluser sentinel-client on >AtlasMart-Ch20-SentinelClient-Lab-Only-2026 -@all +auth +client|getname +client|id +client|setname +command +hello +ping +role +sentinel|get-master-addr-by-name +sentinel|master +sentinel|myid +sentinel|replicas +sentinel|sentinels +sentinel|masterssentinel sentinel-user sentinel-adminsentinel sentinel-pass AtlasMart-Ch20-SentinelAdmin-Lab-Only-2026

4. Materialize per-node files without changing their semantic contract

For replica-a.conf, replace REPLICA_HOSTNAME with atlasmart-redis-ch20-replica-a and REPLICA_PRIORITY with 50. For replica B use hostname atlasmart-redis-ch20-replica-b and priority 100. Lower nonzero priority is preferred, so the game day should normally select replica A if freshness is otherwise acceptable.

Create sentinel-1.conf, sentinel-2.conf, and sentinel-3.conf from the template, replacing SENTINEL_HOSTNAME with the matching container hostname. Do not share one writable Sentinel config file among three processes.

5. Start and verify before injecting any failure

Start the topology only after all files exist. The verification sequence checks role, replication health, Sentinel peer discovery, and quorum. A green startup is a precondition for later failure drills—not evidence that failover has been tested.

docker compose -f ch20-compose.yaml up -ddocker compose -f ch20-compose.yaml psexport REDISCLI_AUTH=AtlasMart-Ch20-Admin-Lab-Only-2026redis-cli -h 127.0.0.1 -p 6411 --user academy-admin ROLEredis-cli -h 127.0.0.1 -p 6412 --user academy-admin INFO replicationredis-cli -h 127.0.0.1 -p 6413 --user academy-admin INFO replicationunset REDISCLI_AUTHexport REDISCLI_AUTH=AtlasMart-Ch20-SentinelClient-Lab-Only-2026redis-cli -h 127.0.0.1 -p 26401 --user sentinel-client SENTINEL MASTER atlasmart-primaryredis-cli -h 127.0.0.1 -p 26401 --user sentinel-client SENTINEL REPLICAS atlasmart-primaryredis-cli -h 127.0.0.1 -p 26401 --user sentinel-client SENTINEL SENTINELS atlasmart-primaryunset REDISCLI_AUTH

6. Docker/NAT boundary: why the client runs on the private network

Docker port remapping can break Sentinel discovery because Sentinels and replicas announce addresses/ports that differ from the host-facing mapping. This lab avoids pretending that 6411/6412/6413 are the internal Redis ports. Sentinels and Redis nodes communicate with stable Docker hostnames and port 6379; Sentinel-aware application code is run on that network and can therefore resolve the returned hostnames.

For production NAT environments, use a deliberately supported address plan. Redis Sentinel provides sentinel announce-ip/announce-port; replicas provide replica-announce-ip/replica-announce-port. Hostname support is optional and version/client dependent; if announce-hostnames is enabled, verify every Sentinel client accepts names rather than assuming IP-only replies.

7. Deliberately wrong configuration: announce an unreachable port

Do not sabotage the active three-Sentinel topology yet. Instead reason from the config: if Sentinel 1 advertised host port 26401 while peers tried to reach that value inside the Docker network, they would contact the wrong port because Sentinel itself listens on 26379. Port remapping is a client-network concern, not an excuse to publish a non-routable control-plane address.

The repair is a single consistent routing model: internal Docker names and native ports for the mandatory local topology; explicit announce settings only when the advertised address is actually reachable from every intended peer/client.

8. Production judgment

Credentials must be rotated and scoped independently; TLS must protect real network paths; Sentinel and Redis ports should be network-restricted; and the reserved __sentinel__:hello channel should not be broadly writable because Sentinel discovery trusts those messages. Managed services may hide or replace these controls, so do not transfer self-managed Sentinel commands blindly to a provider control plane.

9. Verification checklist

Confirm all six containers are healthy/running, each Sentinel sees two replicas and two other Sentinels, CKQUORUM succeeds, replica links are up, and no credential appears outside this disposable lab. Leave the topology running.

Summary and next step

Configure Multiple Sentinels, Monitored Primary, Replicas, Authentication, and Networking is now connected to observable Redis behavior, bounded failure cases, and production tradeoffs. Keep the evidence and cleanup state from this lesson; next, continue with Leader Election, Failover State Machine, Replica Promotion, and Reconfiguration.

Authoritative references

• Redis Sentinel — High availability for non-clustered Redis
• Redis Sentinel client specification
• Redis replication
• Redis ACL
• Redis security
• Redis 8.10 release notes
• redis-py Sentinel client
• redis-py package
• INFO command
• ROLE command
• SENTINEL command
• WAIT command