StackExchange / StackExchange/StackExchange.Redis
Update docs with required permissions when using restrictive sentinel permissions
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 6.2k
- Forks
- 1.6k
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 43
Description
I'm using restrictive permissions for users when they connect to our sentinel instances to get our primary redis instance.
I set the permissions to what they mentioned in https://redis.io/docs/management/sentinel/#sentinel-access-control-list-authentication
-@all +auth +client|getname +client|id +client|setname +command +hello +ping +role +sentinel|get-master-addr-by-name +sentinel|master +sentinel|myid +sentinel|replicas +sentinel|sentinels
Using only this, one get the error
StackExchange.Redis.RedisConnectionException: Sentinel: The ConnectionMultiplexer is not a Sentinel connection. Detected as: Standalone
The current documentation mentions sort of that required permissions for sentinel is the whole sentinel command namespace, sort of. But I wanted to be able to use the restrictive permissions redis suggests themselves. So I started digging for what permissions you actually require, because the application works fine when the user is not restricted.
After a digging for a while I found the following: https://github.com/StackExchange/StackExchange.Redis/blob/main/src/StackExchange.Redis/ServerEndPoint.cs#L407-L412
I tried adding +sentinel|masters, and now it worked!
Not sure if this is the only sentinel command it requires to detect it as a sentinel server, but it think it will be useful to specify the permissions required to detect a sentinel server in the documentation
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read src/StackExchange.Redis/ServerEndPoint.cs at lines 407-412 to verify the Sentinel commands used for detection, then locate the existing Sentinel ACL documentation. Compare it with the restrictive ACL example and document the permissions needed for detection, including the command reported in the issue; done means the documentation matches the observed behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, redis
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100