StackExchange / StackExchange/StackExchange.Redis

Update docs with required permissions when using restrictive sentinel permissions

Open
#2,566 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C#
Stars
6.2k
Forks
1.6k
Avg merge
1d 15h
Merged PRs (30d)
43

Description

I'm using restrictive permissions for users when they connect to our sentinel instances to get our primary redis instance.

I set the permissions to what they mentioned in https://redis.io/docs/management/sentinel/#sentinel-access-control-list-authentication

-@all +auth +client|getname +client|id +client|setname +command +hello +ping +role +sentinel|get-master-addr-by-name +sentinel|master +sentinel|myid +sentinel|replicas +sentinel|sentinels

Using only this, one get the error

StackExchange.Redis.RedisConnectionException: Sentinel: The ConnectionMultiplexer is not a Sentinel connection. Detected as: Standalone

The current documentation mentions sort of that required permissions for sentinel is the whole sentinel command namespace, sort of. But I wanted to be able to use the restrictive permissions redis suggests themselves. So I started digging for what permissions you actually require, because the application works fine when the user is not restricted.

After a digging for a while I found the following: https://github.com/StackExchange/StackExchange.Redis/blob/main/src/StackExchange.Redis/ServerEndPoint.cs#L407-L412
I tried adding +sentinel|masters, and now it worked!

Not sure if this is the only sentinel command it requires to detect it as a sentinel server, but it think it will be useful to specify the permissions required to detect a sentinel server in the documentation

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Read src/StackExchange.Redis/ServerEndPoint.cs at lines 407-412 to verify the Sentinel commands used for detection, then locate the existing Sentinel ACL documentation. Compare it with the restrictive ACL example and document the permissions needed for detection, including the command reported in the issue; done means the documentation matches the observed behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, redis
Domain
documentation
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.